July 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2013:1224-1: xorg-x11-server: fix Xephyr incorrect commandline arguments parsing
by maintenance＠opensuse.org 22 Jul '13

22 Jul '13

openSUSE Recommended Update: xorg-x11-server: fix Xephyr incorrect commandline arguments parsing ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1224-1 Rating: low References: #828364 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with xorg-x11-server: - bnc#828364: fix Xephyr incorrect commandline arguments parsing Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-595 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): xorg-x11-server-7.6_1.13.2-1.13.1 xorg-x11-server-debuginfo-7.6_1.13.2-1.13.1 xorg-x11-server-debugsource-7.6_1.13.2-1.13.1 xorg-x11-server-extra-7.6_1.13.2-1.13.1 xorg-x11-server-extra-debuginfo-7.6_1.13.2-1.13.1 xorg-x11-server-sdk-7.6_1.13.2-1.13.1 References: https://bugzilla.novell.com/828364

1 0

openSUSE-RU-2013:1222-1: Softwarestack update 06/13
by maintenance＠opensuse.org 19 Jul '13

19 Jul '13

openSUSE Recommended Update: Softwarestack update 06/13 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1222-1 Rating: low References: #803316 #820444 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues for the softwarestack: zypper: - Set default zypper.log mode to 0640 (bnc#825490) - fate#314994: Add -E, --show-enabled-only option to list repos/services command - updated transaltions libzypp: - Fix file probing via tftp:// (bnc#803316) - bnc#803316: added tftp-support - New zypp.conf option 'download.transfer_timeout = 180' Maximum time in seconds that you allow a transfer operation to take. libsolv: - bnc#820444: fix multiversion updating that was broken when the installed package was no longer available in a repository Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-593 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libqdialogsolver1-1.3.0-14.19.4 libqdialogsolver1-debuginfo-1.3.0-14.19.4 libqdialogsolver1-debugsource-1.3.0-14.19.4 libqdialogsolver1-devel-1.3.0-14.19.4 libsolv-debugsource-0.1.2-4.20.1 libsolv-demo-0.1.2-4.20.1 libsolv-demo-debuginfo-0.1.2-4.20.1 libsolv-devel-0.1.2-4.20.1 libsolv-devel-debuginfo-0.1.2-4.20.1 libsolv-tools-0.1.2-4.20.1 libsolv-tools-debuginfo-0.1.2-4.20.1 libzypp-11.11.1-2.23.2 libzypp-bindings-debugsource-0.5.13-2.15.1 libzypp-debuginfo-11.11.1-2.23.2 libzypp-debugsource-11.11.1-2.23.2 libzypp-devel-11.11.1-2.23.2 libzypp-testsuite-tools-4.2.11-14.23.1 perl-solv-0.1.2-4.20.1 perl-solv-debuginfo-0.1.2-4.20.1 perl-zypp-0.5.13-2.15.1 perl-zypp-debuginfo-0.5.13-2.15.1 python-solv-0.1.2-4.20.1 python-solv-debuginfo-0.1.2-4.20.1 python-zypp-0.5.13-2.15.1 python-zypp-debuginfo-0.5.13-2.15.1 ruby-solv-0.1.2-4.20.1 ruby-solv-debuginfo-0.1.2-4.20.1 ruby-zypp-0.5.13-2.15.1 ruby-zypp-debuginfo-0.5.13-2.15.1 zypp-plugin-python-0.3-5.16.1 zypper-1.7.14-1.24.1 zypper-debuginfo-1.7.14-1.24.1 zypper-debugsource-1.7.14-1.24.1 - openSUSE 12.2 (noarch): libzypp-testsuite-tools-data-4.2.11-14.23.1 zypper-aptitude-1.7.14-1.24.1 zypper-log-1.7.14-1.24.1 References: https://bugzilla.novell.com/803316 https://bugzilla.novell.com/820444

1 0

openSUSE-SU-2013:1221-1: moderate: libxml2 to fix out of bounds reads
by opensuse-security＠opensuse.org 19 Jul '13

19 Jul '13

openSUSE Security Update: libxml2 to fix out of bounds reads ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1221-1 Rating: moderate References: #829077 Cross-References: CVE-2013-2877 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Libxml2 was updated to fix buffer overread problems which could lead to crashes (out of bounds read). (CVE-2013-2877) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-592 - openSUSE 12.2: zypper in -t patch openSUSE-2013-592 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libxml2-2-2.9.0-2.17.1 libxml2-2-debuginfo-2.9.0-2.17.1 libxml2-debugsource-2.9.0-2.17.1 libxml2-devel-2.9.0-2.17.1 libxml2-tools-2.9.0-2.17.1 libxml2-tools-debuginfo-2.9.0-2.17.1 python-libxml2-2.9.0-2.17.1 python-libxml2-debuginfo-2.9.0-2.17.1 python-libxml2-debugsource-2.9.0-2.17.1 - openSUSE 12.3 (x86_64): libxml2-2-32bit-2.9.0-2.17.1 libxml2-2-debuginfo-32bit-2.9.0-2.17.1 libxml2-devel-32bit-2.9.0-2.17.1 - openSUSE 12.3 (noarch): libxml2-doc-2.9.0-2.17.1 - openSUSE 12.2 (i586 x86_64): libxml2-2-2.7.8+git20120223-8.30.1 libxml2-2-debuginfo-2.7.8+git20120223-8.30.1 libxml2-debugsource-2.7.8+git20120223-8.30.1 libxml2-devel-2.7.8+git20120223-8.30.1 libxml2-tools-2.7.8+git20120223-8.30.1 libxml2-tools-debuginfo-2.7.8+git20120223-8.30.1 python-libxml2-2.7.8+git20120223-8.30.1 python-libxml2-debuginfo-2.7.8+git20120223-8.30.1 python-libxml2-debugsource-2.7.8+git20120223-8.30.1 - openSUSE 12.2 (x86_64): libxml2-2-32bit-2.7.8+git20120223-8.30.1 libxml2-2-debuginfo-32bit-2.7.8+git20120223-8.30.1 libxml2-devel-32bit-2.7.8+git20120223-8.30.1 - openSUSE 12.2 (noarch): libxml2-doc-2.7.8+git20120223-8.30.1 References: http://support.novell.com/security/cve/CVE-2013-2877.html https://bugzilla.novell.com/829077

1 0

openSUSE-SU-2013:1208-1: moderate: python-suds: fixed insecure temp directory usage
by opensuse-security＠opensuse.org 17 Jul '13

17 Jul '13

openSUSE Security Update: python-suds: fixed insecure temp directory usage ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1208-1 Rating: moderate References: #827568 Cross-References: CVE-2013-2217 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Python SUDS was updated to create a create random cache tempdir to avoid other local user access (bnc#827568) (CVE-2013-2217) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-590 - openSUSE 12.2: zypper in -t patch openSUSE-2013-590 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): python-suds-0.4-5.4.1 - openSUSE 12.2 (i586 x86_64): python-suds-0.4-2.8.1 References: http://support.novell.com/security/cve/CVE-2013-2217.html https://bugzilla.novell.com/827568

1 0

openSUSE-SU-2013:1207-1: moderate: cgit to fix directory traversal
by opensuse-security＠opensuse.org 17 Jul '13

17 Jul '13

openSUSE Security Update: cgit to fix directory traversal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1207-1 Rating: moderate References: #822166 Cross-References: CVE-2013-2117 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A directory traversal in cgit could be used by remote attackers to read files on the local filesystem. (CVE-2013-2117) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-591 - openSUSE 12.2: zypper in -t patch openSUSE-2013-591 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): cgit-0.9.1-8.5.1 cgit-debuginfo-0.9.1-8.5.1 cgit-debugsource-0.9.1-8.5.1 - openSUSE 12.2 (i586 x86_64): cgit-0.9.0.2-14.14.1 cgit-debuginfo-0.9.0.2-14.14.1 cgit-debugsource-0.9.0.2-14.14.1 References: http://support.novell.com/security/cve/CVE-2013-2117.html https://bugzilla.novell.com/822166

1 0

openSUSE-RU-2013:1205-1: coreutils: preserve timestamps of symlinks with -al
by maintenance＠opensuse.org 16 Jul '13

16 Jul '13

openSUSE Recommended Update: coreutils: preserve timestamps of symlinks with -al ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1205-1 Rating: low References: #696389 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: - re-add coreutils-cp-al-symlink-timestamp.patch, see bnc#696389, the patch was accidentally reverted in openSUSE:11.4:Update/coreutils rev. 13 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-112 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): coreutils-8.9-27.1 coreutils-debuginfo-8.9-27.1 coreutils-debugsource-8.9-27.1 - openSUSE 11.4 (noarch): coreutils-lang-8.9-27.1 - openSUSE 11.4 (ia64): coreutils-debuginfo-x86-8.9-27.1 coreutils-x86-8.9-27.1 References: https://bugzilla.novell.com/696389

1 0

openSUSE-RU-2013:1204-1: moderate: timezone: July 2013 update
by maintenance＠opensuse.org 16 Jul '13

16 Jul '13

openSUSE Recommended Update: timezone: July 2013 update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1204-1 Rating: moderate References: #828372 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The timezone data was updated to 2013d, containing updates for Morocco, Israel, Australia. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-111 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): timezone-2013d-22.1 timezone-debuginfo-2013d-22.1 timezone-debugsource-2013d-22.1 - openSUSE 11.4 (noarch): timezone-java-2013d-22.1 References: https://bugzilla.novell.com/828372

1 0

openSUSE-SU-2013:1203-1: moderate: python-django to 1.4.5
by opensuse-security＠opensuse.org 16 Jul '13

16 Jul '13

openSUSE Security Update: python-django to 1.4.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1203-1 Rating: moderate References: #787521 #807175 Cross-References: CVE-2012-4520 CVE-2013-0305 CVE-2013-0306 CVE-2013-1665 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: python-django was updated to 1.4.5 to fix various security issues and bugs. Update to 1.4.5: - Security release. - Fix bnc#807175 / bnc#787521 / CVE-2012-4520 / CVE-2013-0305 / CVE-2013-0306 and CVE-2013-1665. - Update to 1.4.3: - Security release: - Host header poisoning - Redirect poisoning - Please check release notes for details: https://www.djangoproject.com/weblog/2012/dec/10/security - Add a symlink from /usr/bin/django-admin.py to /usr/bin/django-admin - Update to 1.4.2: - Security release: - Host header poisoning - Please check release notes for details: https://www.djangoproject.com/weblog/2012/oct/17/security - Update to 1.4.1: - Security release: - Cross-site scripting in authentication views - Denial-of-service in image validation - Denial-of-service via get_image_dimensions() - Please check release notes for details: https://www.djangoproject.com/weblog/2012/jul/30/security-re leases-issued - Add patch to support CSRF_COOKIE_HTTPONLY config Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-589 - openSUSE 12.2: zypper in -t patch openSUSE-2013-589 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): python-django-1.4.5-2.4.1 - openSUSE 12.2 (noarch): python-django-1.4.5-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-4520.html http://support.novell.com/security/cve/CVE-2013-0305.html http://support.novell.com/security/cve/CVE-2013-0306.html http://support.novell.com/security/cve/CVE-2013-1665.html https://bugzilla.novell.com/787521 https://bugzilla.novell.com/807175

1 0

openSUSE-SU-2013:1202-1: moderate: qemu
by opensuse-security＠opensuse.org 15 Jul '13

15 Jul '13

openSUSE Security Update: qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1202-1 Rating: moderate References: #818181 Cross-References: CVE-2013-2007 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The qemu guest agent creates a bunch of files with insecure permissions when started in daemon mode. For now mask all file mode bits for "group" and "others" in become_daemon(). Temporarily, for compatibility reasons, stick with the 0666 file-mode in case of files newly created by the "guest-file-open" QMP call. Do so without changing the umask temporarily. QEMU was updated to 1.1.2 on openSUSE 12.2, and 1.3.1 on openSUSE 12.3. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-588 - openSUSE 12.2: zypper in -t patch openSUSE-2013-588 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): qemu-1.3.1-3.4.1 qemu-debuginfo-1.3.1-3.4.1 qemu-debugsource-1.3.1-3.4.1 qemu-guest-agent-1.3.1-3.4.1 qemu-guest-agent-debuginfo-1.3.1-3.4.1 qemu-linux-user-1.3.1-3.4.1 qemu-linux-user-debuginfo-1.3.1-3.4.1 qemu-tools-1.3.1-3.4.1 qemu-tools-debuginfo-1.3.1-3.4.1 - openSUSE 12.2 (i586 x86_64): qemu-1.1.2-3.13.1 qemu-debuginfo-1.1.2-3.13.1 qemu-debugsource-1.1.2-3.13.1 qemu-guest-agent-1.1.2-3.13.1 qemu-guest-agent-debuginfo-1.1.2-3.13.1 qemu-linux-user-1.1.2-3.13.1 qemu-tools-1.1.2-3.13.1 qemu-tools-debuginfo-1.1.2-3.13.1 References: http://support.novell.com/security/cve/CVE-2013-2007.html https://bugzilla.novell.com/818181

1 0

openSUSE-SU-2013:1201-1: moderate: tinyproxy: security fixes
by opensuse-security＠opensuse.org 15 Jul '13

15 Jul '13

openSUSE Security Update: tinyproxy: security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1201-1 Rating: moderate References: #776506 Cross-References: CVE-2012-3505 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Tinyproxy allowed remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably. bucket. This update fixes this by limiting headers and improving the hash keying. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-587 - openSUSE 12.2: zypper in -t patch openSUSE-2013-587 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): tinyproxy-1.8.3-4.4.1 tinyproxy-debuginfo-1.8.3-4.4.1 tinyproxy-debugsource-1.8.3-4.4.1 - openSUSE 12.2 (i586 x86_64): tinyproxy-1.8.3-2.4.1 tinyproxy-debuginfo-1.8.3-2.4.1 tinyproxy-debugsource-1.8.3-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-3505.html https://bugzilla.novell.com/776506

1 0