June 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2013:0882-1: important: libchewing: ambiguous data package name causes missing dependency
by maintenance＠opensuse.org 10 Jun '13

10 Jun '13

openSUSE Recommended Update: libchewing: ambiguous data package name causes missing dependency ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0882-1 Rating: important References: #808338 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This udpate fixes the following issue with libchewing: - bnc#808338: + retrack updstream sources + remove ambiguous libchewing package + enable ncurses wide-char and thread-safe (w6) + enable python + new sub-packages: chewing-data, python-chewing Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-466 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): chewing-data-0.3.4.git20130424-2.4.1 libchewing-debugsource-0.3.4.git20130424-2.4.1 libchewing-devel-0.3.4.git20130424-2.4.1 libchewing3-0.3.4.git20130424-2.4.1 libchewing3-debuginfo-0.3.4.git20130424-2.4.1 python-chewing-0.3.4.git20130424-2.4.1 - openSUSE 12.3 (x86_64): libchewing3-32bit-0.3.4.git20130424-2.4.1 libchewing3-debuginfo-32bit-0.3.4.git20130424-2.4.1 References: https://bugzilla.novell.com/808338

1 0

openSUSE-SU-2013:0881-1: moderate: Update for clamav to version 0.97.8.
by opensuse-security＠opensuse.org 10 Jun '13

10 Jun '13

openSUSE Security Update: Update for clamav to version 0.97.8. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0881-1 Rating: moderate References: #816865 Cross-References: CVE-2013-2020 CVE-2013-2021 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: New clamav version 0.97.8 (bnc#816865): * CVE-2013-2020: Fix heap corruption * CVE-2013-2021: Fix overflow due to PDF key length computation. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-430 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): clamav-0.97.8-5.8.1 clamav-debuginfo-0.97.8-5.8.1 clamav-debugsource-0.97.8-5.8.1 References: http://support.novell.com/security/cve/CVE-2013-2020.html http://support.novell.com/security/cve/CVE-2013-2021.html https://bugzilla.novell.com/816865

1 0

openSUSE-SU-2013:0880-1: moderate: update for gpg2
by opensuse-security＠opensuse.org 10 Jun '13

10 Jun '13

openSUSE Security Update: update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0880-1 Rating: moderate References: #780943 #798465 Cross-References: CVE-2012-6085 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of gpg2 fixes two security issues: * fix for CVE-2012-6085 (bnc#798465) added gpg2-CVE-2012-6085.patch * fix for bnc#780943 added gpg2-set_umask_before_open_outfile.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-455 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): gpg2-2.0.19-5.4.1 gpg2-debuginfo-2.0.19-5.4.1 gpg2-debugsource-2.0.19-5.4.1 - openSUSE 12.3 (noarch): gpg2-lang-2.0.19-5.4.1 References: http://support.novell.com/security/cve/CVE-2012-6085.html https://bugzilla.novell.com/780943 https://bugzilla.novell.com/798465

1 0

openSUSE-SU-2013:0879-1: moderate: curl
by opensuse-security＠opensuse.org 10 Jun '13

10 Jun '13

openSUSE Security Update: curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0879-1 Rating: moderate References: #814655 Cross-References: CVE-2013-1944 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-71 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): curl-7.21.2-29.1 curl-debuginfo-7.21.2-29.1 libcurl-devel-7.21.2-29.1 libcurl4-7.21.2-29.1 - openSUSE 11.4 (x86_64): libcurl4-32bit-7.21.2-29.1 libcurl4-debuginfo-32bit-7.21.2-29.1 - openSUSE 11.4 (ia64): libcurl4-debuginfo-x86-7.21.2-29.1 libcurl4-x86-7.21.2-29.1 - openSUSE 11.4 (i586): libcurl4-debuginfo-7.21.2-29.1 References: http://support.novell.com/security/cve/CVE-2013-1944.html https://bugzilla.novell.com/814655

1 0

openSUSE-SU-2013:0878-1: moderate: update for xorg-x11-server
by opensuse-security＠opensuse.org 10 Jun '13

10 Jun '13

openSUSE Security Update: update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0878-1 Rating: moderate References: #814653 Cross-References: CVE-2013-1940 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: xorg-x11-server was updated fixing following security issue: In some cases, input events are sent to X servers not currently the VT owner,allowing a user to capture passwords. This is a fix for CVE-2013-1940. (bnc#814653) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-75 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): xorg-x11-Xvnc-7.6_1.9.3-15.36.1 xorg-x11-Xvnc-debuginfo-7.6_1.9.3-15.36.1 xorg-x11-server-7.6_1.9.3-15.36.1 xorg-x11-server-debuginfo-7.6_1.9.3-15.36.1 xorg-x11-server-debugsource-7.6_1.9.3-15.36.1 xorg-x11-server-extra-7.6_1.9.3-15.36.1 xorg-x11-server-extra-debuginfo-7.6_1.9.3-15.36.1 xorg-x11-server-sdk-7.6_1.9.3-15.36.1 References: http://support.novell.com/security/cve/CVE-2013-1940.html https://bugzilla.novell.com/814653

1 0

openSUSE-RU-2013:0877-1: moderate: systemd: various bugfixes
by maintenance＠opensuse.org 10 Jun '13

10 Jun '13

openSUSE Recommended Update: systemd: various bugfixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0877-1 Rating: moderate References: #746595 #789589 #801878 #808319 #809646 #809695 #809820 #812874 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has 8 recommended fixes can now be installed. Description: systemd received lots of bugfixes: - Set ACL on (binary driver) nvidia devices (bnc#808319), avoiding the need to have the local user in the 'video' group. - Improved readahead performance on spinning media with ext4. - Fixed vacuum logic in journal (bnc#789589). - Ensure LSB provides are correctly handled if also referenced as dependencies (bnc#809646). - Ensure udevd is started (and therefore static devices are created) before mounting (bnc#809820). - Update systemd-sysv-convert to search services files in new location (bnc#809695). - Do not turn off services if fsck fails (bnc#812874) - Wait for processes killed by SIGTERM before killing them with SIGKILL. - Update systemctl-options.patch to only apply SYSTEMCTL_OPTIONS to systemctl command (bnc#801878). - Fixed disabling CapsLock and enabling NumLock (bnc#746595) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-384 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libgudev-1_0-0-195-13.25.1 libgudev-1_0-0-debuginfo-195-13.25.1 libgudev-1_0-devel-195-13.25.1 libudev-devel-195-13.25.1 libudev-mini-devel-195-13.25.1 libudev-mini1-195-13.25.1 libudev-mini1-debuginfo-195-13.25.1 libudev1-195-13.25.1 libudev1-debuginfo-195-13.25.1 systemd-195-13.25.1 systemd-analyze-195-13.25.1 systemd-debuginfo-195-13.25.1 systemd-debugsource-195-13.25.1 systemd-devel-195-13.25.1 systemd-logger-195-13.25.1 systemd-mini-195-13.25.1 systemd-mini-analyze-195-13.25.1 systemd-mini-debuginfo-195-13.25.1 systemd-mini-debugsource-195-13.25.1 systemd-mini-devel-195-13.25.1 systemd-mini-sysvinit-195-13.25.1 systemd-sysvinit-195-13.25.1 typelib-1_0-GUdev-1_0-195-13.25.1 udev-195-13.25.1 udev-debuginfo-195-13.25.1 udev-mini-195-13.25.1 udev-mini-debuginfo-195-13.25.1 - openSUSE 12.3 (x86_64): libgudev-1_0-0-32bit-195-13.25.1 libgudev-1_0-0-debuginfo-32bit-195-13.25.1 libudev1-32bit-195-13.25.1 libudev1-debuginfo-32bit-195-13.25.1 systemd-32bit-195-13.25.1 systemd-debuginfo-32bit-195-13.25.1 References: https://bugzilla.novell.com/746595 https://bugzilla.novell.com/789589 https://bugzilla.novell.com/801878 https://bugzilla.novell.com/808319 https://bugzilla.novell.com/809646 https://bugzilla.novell.com/809695 https://bugzilla.novell.com/809820 https://bugzilla.novell.com/812874

1 0

openSUSE-SU-2013:0876-1: moderate: curl: fixed cookie tail matching problem
by opensuse-security＠opensuse.org 10 Jun '13

10 Jun '13

openSUSE Security Update: curl: fixed cookie tail matching problem ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0876-1 Rating: moderate References: #814655 Cross-References: CVE-2013-1944 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libcurl was updated to fix a cookie tail matching flaw which could lead to attackers gaining cookie access depending on domain names. (CVE-2013-1944,bnc#814655) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-369 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): curl-7.28.1-4.13.1 curl-debuginfo-7.28.1-4.13.1 curl-debugsource-7.28.1-4.13.1 libcurl-devel-7.28.1-4.13.1 libcurl4-7.28.1-4.13.1 libcurl4-debuginfo-7.28.1-4.13.1 - openSUSE 12.3 (x86_64): libcurl4-32bit-7.28.1-4.13.1 libcurl4-debuginfo-32bit-7.28.1-4.13.1 References: http://support.novell.com/security/cve/CVE-2013-1944.html https://bugzilla.novell.com/814655

1 0

openSUSE-SU-2013:0875-1: moderate: seamonkey: 2.17 update
by opensuse-security＠opensuse.org 10 Jun '13

10 Jun '13

openSUSE Security Update: seamonkey: 2.17 update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0875-1 Rating: moderate References: #813026 #814101 Cross-References: CVE-2013-0788 CVE-2013-0789 CVE-2013-0792 CVE-2013-0793 CVE-2013-0794 CVE-2013-0795 CVE-2013-0796 CVE-2013-0800 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: Seamonkey was updated to the 2.17 release, fixing bugs and security issues: - update to SeaMonkey 2.17 (bnc#813026) * requires NSPR 4.9.5 and NSS 3.14.3 * mozilla-webrtc-ppc.patch included upstream * MFSA 2013-30/CVE-2013-0788/CVE-2013-0789 Miscellaneous memory safety hazards * MFSA 2013-31/CVE-2013-0800 (bmo#825721) Out-of-bounds write in Cairo library * MFSA 2013-35/CVE-2013-0796 (bmo#827106) WebGL crash with Mesa graphics driver on Linux * MFSA 2013-36/CVE-2013-0795 (bmo#825697) Bypass of SOW protections allows cloning of protected nodes * MFSA 2013-37/CVE-2013-0794 (bmo#626775) Bypass of tab-modal dialog origin disclosure * MFSA 2013-38/CVE-2013-0793 (bmo#803870) Cross-site scripting (XSS) using timed history navigations * MFSA 2013-39/CVE-2013-0792 (bmo#722831) Memory corruption while rendering grayscale PNG images - use GStreamer 1.0 starting with 12.3 (mozilla-gstreamer-1.patch) - revert to use GStreamer 0.10 on 12.3 (bnc#814101) (remove mozilla-gstreamer-1.patch) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-400 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): seamonkey-2.17-1.8.4 seamonkey-debuginfo-2.17-1.8.4 seamonkey-debugsource-2.17-1.8.4 seamonkey-dom-inspector-2.17-1.8.4 seamonkey-irc-2.17-1.8.4 seamonkey-translations-common-2.17-1.8.4 seamonkey-translations-other-2.17-1.8.4 seamonkey-venkman-2.17-1.8.4 References: http://support.novell.com/security/cve/CVE-2013-0788.html http://support.novell.com/security/cve/CVE-2013-0789.html http://support.novell.com/security/cve/CVE-2013-0792.html http://support.novell.com/security/cve/CVE-2013-0793.html http://support.novell.com/security/cve/CVE-2013-0794.html http://support.novell.com/security/cve/CVE-2013-0795.html http://support.novell.com/security/cve/CVE-2013-0796.html http://support.novell.com/security/cve/CVE-2013-0800.html https://bugzilla.novell.com/813026 https://bugzilla.novell.com/814101

1 0

openSUSE-RU-2013:0874-1: collectl to fix memory information collection
by maintenance＠opensuse.org 10 Jun '13

10 Jun '13

openSUSE Recommended Update: collectl to fix memory information collection ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0874-1 Rating: low References: #812989 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update resolves an issue where collectl does not collect memory information -- all counters are 0. (bnc#812989) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-478 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): collectl-3.4.3-12.18.1 References: https://bugzilla.novell.com/812989

1 0

openSUSE-SU-2013:0873-1: moderate: update for strongswan
by opensuse-security＠opensuse.org 10 Jun '13

10 Jun '13

openSUSE Security Update: update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0873-1 Rating: moderate References: #815236 Cross-References: CVE-2013-2944 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Applied upstream patch for security vulnerability discovered by Kevin Wojtysiak in ECDSA signature verification of the strongswan openssl plugin (bnc#815236, CVE-2013-2944) [0003-Check-return-value-of-ECDSA_Verify-correctly.patch] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-412 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): strongswan-5.0.1-4.4.1 strongswan-debugsource-5.0.1-4.4.1 strongswan-ipsec-5.0.1-4.4.1 strongswan-ipsec-debuginfo-5.0.1-4.4.1 strongswan-libs0-5.0.1-4.4.1 strongswan-libs0-debuginfo-5.0.1-4.4.1 strongswan-mysql-5.0.1-4.4.1 strongswan-mysql-debuginfo-5.0.1-4.4.1 strongswan-nm-5.0.1-4.4.1 strongswan-nm-debuginfo-5.0.1-4.4.1 strongswan-sqlite-5.0.1-4.4.1 strongswan-sqlite-debuginfo-5.0.1-4.4.1 - openSUSE 12.3 (noarch): strongswan-doc-5.0.1-4.4.1 References: http://support.novell.com/security/cve/CVE-2013-2944.html https://bugzilla.novell.com/815236

1 0