May 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2012:0657-1: moderate: update for wireshark
by opensuse-security＠opensuse.org 29 May '12

29 May '12

openSUSE Security Update: update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0657-1 Rating: moderate References: #763634 Cross-References: CVE-2012-2392 CVE-2012-2393 CVE-2012-2394 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update is a maintenance release of Wireshark. It fixes some vulererabilities when dissecting certain protocols. As packages for these protocols may be received over the network, an attacker may trigger infinite or large loops or crashes of the dissector. Wireshark release notes and advisories: - http://www.wireshark.org/docs/relnotes/wireshark-1.4.13.html - http://www.wireshark.org/security/wnpa-sec-2012-08.html * CVE-2012-2392 - http://www.wireshark.org/security/wnpa-sec-2012-09.html * CVE-2012-2393 - http://www.wireshark.org/security/wnpa-sec-2012-10.html * CVE-2012-2394 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-297 - openSUSE 11.4: zypper in -t patch openSUSE-2012-297 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): wireshark-1.4.13-3.12.1 wireshark-debuginfo-1.4.13-3.12.1 wireshark-debugsource-1.4.13-3.12.1 wireshark-devel-1.4.13-3.12.1 - openSUSE 11.4 (i586 x86_64): wireshark-1.4.13-0.14.1 wireshark-debuginfo-1.4.13-0.14.1 wireshark-debugsource-1.4.13-0.14.1 wireshark-devel-1.4.13-0.14.1 References: http://support.novell.com/security/cve/CVE-2012-2392.html http://support.novell.com/security/cve/CVE-2012-2393.html http://support.novell.com/security/cve/CVE-2012-2394.html https://bugzilla.novell.com/763634

1 0

openSUSE-SU-2012:0656-1: important: update for chromium, v8
by opensuse-security＠opensuse.org 29 May '12

29 May '12

openSUSE Security Update: update for chromium, v8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0656-1 Rating: important References: #762481 Cross-References: CVE-2011-3083 CVE-2011-3084 CVE-2011-3085 CVE-2011-3086 CVE-2011-3087 CVE-2011-3088 CVE-2011-3089 CVE-2011-3090 CVE-2011-3091 CVE-2011-3092 CVE-2011-3093 CVE-2011-3094 CVE-2011-3095 CVE-2011-3096 CVE-2011-3098 CVE-2011-3100 CVE-2011-3101 CVE-2011-3102 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: Chromium update to 21.0.1145 * Fixed several issues around audio not playing with videos * Crash Fixes * Improvements to trackpad on Cr-48 * Security Fixes (bnc#762481) - CVE-2011-3083: Browser crash with video + FTP - CVE-2011-3084: Load links from internal pages in their own process. - CVE-2011-3085: UI corruption with long autofilled values - CVE-2011-3086: Use-after-free with style element. - CVE-2011-3087: Incorrect window navigation - CVE-2011-3088: Out-of-bounds read in hairline drawing - CVE-2011-3089: Use-after-free in table handling. - CVE-2011-3090: Race condition with workers. - CVE-2011-3091: Use-after-free with indexed DB - CVE-2011-3092: Invalid write in v8 regex - CVE-2011-3093: Out-of-bounds read in glyph handling - CVE-2011-3094: Out-of-bounds read in Tibetan handling - CVE-2011-3095: Out-of-bounds write in OGG container. - CVE-2011-3096: Use-after-free in GTK omnibox handling. - CVE-2011-3098: Bad search path for Windows Media Player plug-in - CVE-2011-3100: Out-of-bounds read drawing dash paths. - CVE-2011-3101: Work around Linux Nvidia driver bug - CVE-2011-3102: Off-by-one out-of-bounds write in libxml. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-295 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): chromium-21.0.1145.0-1.23.1 chromium-debuginfo-21.0.1145.0-1.23.1 chromium-debugsource-21.0.1145.0-1.23.1 chromium-desktop-gnome-21.0.1145.0-1.23.1 chromium-desktop-kde-21.0.1145.0-1.23.1 chromium-suid-helper-21.0.1145.0-1.23.1 chromium-suid-helper-debuginfo-21.0.1145.0-1.23.1 libv8-3-3.11.3.0-1.27.1 libv8-3-debuginfo-3.11.3.0-1.27.1 v8-debugsource-3.11.3.0-1.27.1 v8-devel-3.11.3.0-1.27.1 v8-private-headers-devel-3.11.3.0-1.27.1 References: http://support.novell.com/security/cve/CVE-2011-3083.html http://support.novell.com/security/cve/CVE-2011-3084.html http://support.novell.com/security/cve/CVE-2011-3085.html http://support.novell.com/security/cve/CVE-2011-3086.html http://support.novell.com/security/cve/CVE-2011-3087.html http://support.novell.com/security/cve/CVE-2011-3088.html http://support.novell.com/security/cve/CVE-2011-3089.html http://support.novell.com/security/cve/CVE-2011-3090.html http://support.novell.com/security/cve/CVE-2011-3091.html http://support.novell.com/security/cve/CVE-2011-3092.html http://support.novell.com/security/cve/CVE-2011-3093.html http://support.novell.com/security/cve/CVE-2011-3094.html http://support.novell.com/security/cve/CVE-2011-3095.html http://support.novell.com/security/cve/CVE-2011-3096.html http://support.novell.com/security/cve/CVE-2011-3098.html http://support.novell.com/security/cve/CVE-2011-3100.html http://support.novell.com/security/cve/CVE-2011-3101.html http://support.novell.com/security/cve/CVE-2011-3102.html https://bugzilla.novell.com/762481

1 0

openSUSE-SU-2012:0655-1: important: update for cobbler
by opensuse-security＠opensuse.org 29 May '12

29 May '12

openSUSE Security Update: update for cobbler ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0655-1 Rating: important References: #763610 Cross-References: CVE-2012-2395 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The xmlrpc interface of cobbler was prone to command injectoin Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-296 - openSUSE 11.4: zypper in -t patch openSUSE-2012-296 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): cobbler-2.2.1-7.13.1 cobbler-web-2.2.1-7.13.1 koan-2.2.1-7.13.1 - openSUSE 11.4 (i586 x86_64): cobbler-2.2.1-45.1 cobbler-web-2.2.1-45.1 koan-2.2.1-45.1 References: http://support.novell.com/security/cve/CVE-2012-2395.html https://bugzilla.novell.com/763610

1 0

openSUSE-SU-2012:0654-1: moderate: update for jakarta-poi
by opensuse-security＠opensuse.org 29 May '12

29 May '12

openSUSE Security Update: update for jakarta-poi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0654-1 Rating: moderate References: #750164 Cross-References: CVE-2012-0213 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted CDF/CFBF files could trigger an out of memory condition Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-292 - openSUSE 11.4: zypper in -t patch openSUSE-2012-292 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (noarch): jakarta-poi-2.5.1-12.4.1 jakarta-poi-javadoc-2.5.1-12.4.1 jakarta-poi-manual-2.5.1-12.4.1 - openSUSE 11.4 (noarch): jakarta-poi-2.5.1-12.1 jakarta-poi-javadoc-2.5.1-12.1 jakarta-poi-manual-2.5.1-12.1 References: http://support.novell.com/security/cve/CVE-2012-0213.html https://bugzilla.novell.com/750164

1 0

openSUSE-SU-2012:0653-1: moderate: update for python-django
by opensuse-security＠opensuse.org 29 May '12

29 May '12

openSUSE Security Update: update for python-django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0653-1 Rating: moderate References: #718045 Cross-References: CVE-2011-4136 CVE-2011-4137 CVE-2011-4138 CVE-2011-4139 CVE-2011-4140 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: python-django update version to 1.2.7 fixes several security issues including denial of service, CSRF and information leaks: https://www.djangoproject.com/weblog/2011/sep/10/127/ Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-294 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): python-django-1.2.7-6.1 References: http://support.novell.com/security/cve/CVE-2011-4136.html http://support.novell.com/security/cve/CVE-2011-4137.html http://support.novell.com/security/cve/CVE-2011-4138.html http://support.novell.com/security/cve/CVE-2011-4139.html http://support.novell.com/security/cve/CVE-2011-4140.html https://bugzilla.novell.com/718045

1 0

openSUSE-SU-2012:0652-1: moderate: update for sudo
by opensuse-security＠opensuse.org 29 May '12

29 May '12

openSUSE Security Update: update for sudo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0652-1 Rating: moderate References: #762327 Cross-References: CVE-2012-2337 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: sudo did not always honor the Host_List setting in /etc/sudoers properly Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-293 - openSUSE 11.4: zypper in -t patch openSUSE-2012-293 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): sudo-1.8.2-2.8.1 sudo-debuginfo-1.8.2-2.8.1 sudo-debugsource-1.8.2-2.8.1 sudo-devel-1.8.2-2.8.1 - openSUSE 11.4 (i586 x86_64): sudo-1.7.6p2-0.13.1 sudo-debuginfo-1.7.6p2-0.13.1 sudo-debugsource-1.7.6p2-0.13.1 References: http://support.novell.com/security/cve/CVE-2012-2337.html https://bugzilla.novell.com/762327

1 0

openSUSE-RU-2012:0651-1: ntp: don't use --bind on /var/lib/ntp/proc
by maintenance＠opensuse.org 29 May '12

29 May '12

openSUSE Recommended Update: ntp: don't use --bind on /var/lib/ntp/proc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0651-1 Rating: low References: #656509 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for ntp: -656509: don't use --bind on /var/lib/ntp/proc Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-291 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): ntp-4.2.6p3-6.21.1 ntp-debuginfo-4.2.6p3-6.21.1 ntp-debugsource-4.2.6p3-6.21.1 ntp-doc-4.2.6p3-6.21.1 References: https://bugzilla.novell.com/656509

1 0

openSUSE-RU-2012:0650-1: upower: Adjust the cap on the energy rate
by maintenance＠opensuse.org 29 May '12

29 May '12

openSUSE Recommended Update: upower: Adjust the cap on the energy rate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0650-1 Rating: low References: #753327 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for upower: - 753327: Ignore the abnormal energy rate to evaluate the remaining battery time properly Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-290 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libupower-glib-devel-0.9.14-2.4.1 libupower-glib1-0.9.14-2.4.1 libupower-glib1-debuginfo-0.9.14-2.4.1 upower-0.9.14-2.4.1 upower-debuginfo-0.9.14-2.4.1 upower-debugsource-0.9.14-2.4.1 - openSUSE 12.1 (noarch): upower-lang-0.9.14-2.4.1 References: https://bugzilla.novell.com/753327

1 0

openSUSE-RU-2012:0649-1: important: sysconfig: Collective update
by maintenance＠opensuse.org 29 May '12

29 May '12

openSUSE Recommended Update: sysconfig: Collective update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0649-1 Rating: important References: #724775 #763533 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues for sysconfig: - 763533: Fixed ifrenew-dhcp to use built-in dhcpcd --renew - 724775: added tests to the 77-network.rules file if the /sbin/ifup and /etc/sysconfig/network/scripts/ifup-sysctl exit Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-289 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): sysconfig-0.75.4-2.10.1 sysconfig-debuginfo-0.75.4-2.10.1 sysconfig-debugsource-0.75.4-2.10.1 References: https://bugzilla.novell.com/724775 https://bugzilla.novell.com/763533

1 0

openSUSE-SU-2012:0639-1: moderate: update for cobbler
by opensuse-security＠opensuse.org 25 May '12

25 May '12

openSUSE Security Update: update for cobbler ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0639-1 Rating: moderate References: #757062 #757316 Cross-References: CVE-2011-4952 CVE-2011-4953 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Specially crafted YAML could allow attackers to execute arbitrary code due to the use of yaml.load instead of yaml.safe_load. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-287 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): cobbler-2.2.1-40.1 cobbler-web-2.2.1-40.1 koan-2.2.1-40.1 References: http://support.novell.com/security/cve/CVE-2011-4952.html http://support.novell.com/security/cve/CVE-2011-4953.html https://bugzilla.novell.com/757062 https://bugzilla.novell.com/757316

1 0