July 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1154-1: moderate: update for python-bugzilla
by opensuse-security＠opensuse.org 06 Jul '13

06 Jul '13

openSUSE Security Update: update for python-bugzilla ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1154-1 Rating: moderate References: #825876 Cross-References: CVE-2013-2191 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python-bugzilla update fixes a SSL verification issue. - CVE-2013-2191 (bnc#825876) - validate SSL certificates and hostnames Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-562 - openSUSE 12.2: zypper in -t patch openSUSE-2013-562 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): python-bugzilla-0.6.2-8.4.1 - openSUSE 12.2 (noarch): python-bugzilla-0.6.2-6.4.1 References: http://support.novell.com/security/cve/CVE-2013-2191.html https://bugzilla.novell.com/825876

1 0

openSUSE-RU-2013:1149-1: icecream to fix crash after boot
by maintenance＠opensuse.org 05 Jul '13

05 Jul '13

openSUSE Recommended Update: icecream to fix crash after boot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1149-1 Rating: low References: #827118 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with icecream: - bnc#827118: fixed crash the first time after boot Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-561 - openSUSE 12.2: zypper in -t patch openSUSE-2013-561 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): icecream-1.0.0-12.8.1 icecream-clang-wrappers-1.0.0-12.8.1 icecream-debuginfo-1.0.0-12.8.1 icecream-debugsource-1.0.0-12.8.1 libicecream-devel-1.0.0-12.8.1 - openSUSE 12.2 (i586 x86_64): icecream-1.0.0-7.8.1 icecream-clang-wrappers-1.0.0-7.8.1 icecream-debuginfo-1.0.0-7.8.1 icecream-debugsource-1.0.0-7.8.1 libicecream-devel-1.0.0-7.8.1 References: https://bugzilla.novell.com/827118

1 0

openSUSE-SU-2013:1148-1: moderate: update for xorg-x11-server
by opensuse-security＠opensuse.org 05 Jul '13

05 Jul '13

openSUSE Security Update: update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1148-1 Rating: moderate References: #815583 #823410 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This xorg-x11-server update fixes a DoS vulnerability and adds randr support. - U_os-Reset-input-buffer-s-ignoreBytes-field.patch * If a client sends a request larger than maxBigRequestSize, the server is supposed to ignore it. Before commit cf88363d, the server would simply disconnect the client. After that commit, it attempts to gracefully ignore the request by remembering how long the client specified the request to be, and ignoring that many bytes. However, if a client sends a BigReq header with a large size and disconnects before actually sending the rest of the specified request, the server will reuse the ConnectionInput buffer without resetting the ignoreBytes field. This makes the server ignore new X clients' requests. This fixes that behavior by resetting the ignoreBytes field when putting the ConnectionInput buffer back on the FreeInputs list. (bnc#815583) - u_xserver_xvfb-randr.patch * Add randr support to Xvfb (bnc#823410) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-558 - openSUSE 12.2: zypper in -t patch openSUSE-2013-558 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): xorg-x11-server-7.6_1.13.2-1.9.1 xorg-x11-server-debuginfo-7.6_1.13.2-1.9.1 xorg-x11-server-debugsource-7.6_1.13.2-1.9.1 xorg-x11-server-extra-7.6_1.13.2-1.9.1 xorg-x11-server-extra-debuginfo-7.6_1.13.2-1.9.1 xorg-x11-server-sdk-7.6_1.13.2-1.9.1 - openSUSE 12.2 (i586 x86_64): xorg-x11-Xvnc-7.6_1.12.3-1.33.1 xorg-x11-Xvnc-debuginfo-7.6_1.12.3-1.33.1 xorg-x11-server-7.6_1.12.3-1.33.1 xorg-x11-server-debuginfo-7.6_1.12.3-1.33.1 xorg-x11-server-debugsource-7.6_1.12.3-1.33.1 xorg-x11-server-extra-7.6_1.12.3-1.33.1 xorg-x11-server-extra-debuginfo-7.6_1.12.3-1.33.1 xorg-x11-server-sdk-7.6_1.12.3-1.33.1 References: https://bugzilla.novell.com/815583 https://bugzilla.novell.com/823410

1 0

openSUSE-RU-2013:1147-1: moderate: xf86-video-modesetting: Update to 0.8.0 and several fixes
by maintenance＠opensuse.org 05 Jul '13

05 Jul '13

openSUSE Recommended Update: xf86-video-modesetting: Update to 0.8.0 and several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1147-1 Rating: moderate References: #809361 #810333 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with xf86-video-modesetting: - Update to version 0.8.0: + modesetting: fix adjust frame crash + support 32 bpp pixmaps when 24 bpp fb is used. + modesetting: probe only succeeds if connectors are detected + bnc#809361: fixes x11 failsafe mode, i.e. fallback to fbdev/vesa X driver, if KMS has been disabled - Update to xf86-video-modesetting 0.7.0 + modesetting: match PCI class 3, any subclass + Add missing GTF modes + autogen.sh: Implement GNOME Build API + modesetting: provide dummy hooks for shadow + modesetting: clean up leaks + modesetting: return null for get_modes if output could not be retrieved - bnc#810333: introduce hardware supplements conditional on xorg-x11-server package Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-560 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): xf86-video-modesetting-0.8.0-2.4.1 xf86-video-modesetting-debuginfo-0.8.0-2.4.1 xf86-video-modesetting-debugsource-0.8.0-2.4.1 References: https://bugzilla.novell.com/809361 https://bugzilla.novell.com/810333

1 0

openSUSE-SU-2013:1146-1: moderate: update for openstack-swift
by opensuse-security＠opensuse.org 05 Jul '13

05 Jul '13

openSUSE Security Update: update for openstack-swift ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1146-1 Rating: moderate References: #824286 Cross-References: CVE-2013-2161 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of openstack-swift fixes a security vulnerability. - Add CVE-2013-2161.patch: fix unchecked user input in Swift XML responses (CVE-2013-2161, bnc#824286). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-557 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): openstack-swift-1.7.4.1+git.1359529903.0ce3e1d-2.8.1 openstack-swift-account-1.7.4.1+git.1359529903.0ce3e1d-2.8.1 openstack-swift-container-1.7.4.1+git.1359529903.0ce3e1d-2.8.1 openstack-swift-doc-1.7.4.1+git.1359529903.0ce3e1d-2.8.1 openstack-swift-object-1.7.4.1+git.1359529903.0ce3e1d-2.8.1 openstack-swift-proxy-1.7.4.1+git.1359529903.0ce3e1d-2.8.1 openstack-swift-test-1.7.4.1+git.1359529903.0ce3e1d-2.8.1 python-swift-1.7.4.1+git.1359529903.0ce3e1d-2.8.1 References: http://support.novell.com/security/cve/CVE-2013-2161.html https://bugzilla.novell.com/824286

1 0

openSUSE-RU-2013:1145-1: fcitx-chewing: Update to bugfix-release 0.2.1
by maintenance＠opensuse.org 05 Jul '13

05 Jul '13

openSUSE Recommended Update: fcitx-chewing: Update to bugfix-release 0.2.1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1145-1 Rating: low References: Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues with fcitx-chewing: - update to version 0.2.1 + Fix space selection + Fix layout configuration + Automatically commit existing buffer when losing focus. + Add support of change selection key + Add new chewing icon. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-559 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): fcitx-chewing-0.2.1-1.4.1 References:

1 0

openSUSE-SU-2013:1143-1: important: xulrunner: 17.0.7esr
by opensuse-security＠opensuse.org 04 Jul '13

04 Jul '13

openSUSE Security Update: xulrunner: 17.0.7esr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1143-1 Rating: important References: #825935 Cross-References: CVE-2013-1682 CVE-2013-1684 CVE-2013-1685 CVE-2013-1686 CVE-2013-1687 CVE-2013-1690 CVE-2013-1692 CVE-2013-1693 CVE-2013-1694 CVE-2013-1697 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: Mozilla xulrunner was update to 17.0.7esr (bnc#825935) Security issues fixed: * MFSA 2013-49/CVE-2013-1682 Miscellaneous memory safety hazards * MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer * MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL * MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event * MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks * MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure * MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior * MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-555 - openSUSE 12.2: zypper in -t patch openSUSE-2013-555 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): mozilla-js-17.0.7-1.20.1 mozilla-js-debuginfo-17.0.7-1.20.1 xulrunner-17.0.7-1.20.1 xulrunner-buildsymbols-17.0.7-1.20.1 xulrunner-debuginfo-17.0.7-1.20.1 xulrunner-debugsource-17.0.7-1.20.1 xulrunner-devel-17.0.7-1.20.1 xulrunner-devel-debuginfo-17.0.7-1.20.1 - openSUSE 12.3 (x86_64): mozilla-js-32bit-17.0.7-1.20.1 mozilla-js-debuginfo-32bit-17.0.7-1.20.1 xulrunner-32bit-17.0.7-1.20.1 xulrunner-debuginfo-32bit-17.0.7-1.20.1 - openSUSE 12.2 (i586 x86_64): mozilla-js-17.0.7-2.46.1 mozilla-js-debuginfo-17.0.7-2.46.1 xulrunner-17.0.7-2.46.1 xulrunner-buildsymbols-17.0.7-2.46.1 xulrunner-debuginfo-17.0.7-2.46.1 xulrunner-debugsource-17.0.7-2.46.1 xulrunner-devel-17.0.7-2.46.1 xulrunner-devel-debuginfo-17.0.7-2.46.1 - openSUSE 12.2 (x86_64): mozilla-js-32bit-17.0.7-2.46.1 mozilla-js-debuginfo-32bit-17.0.7-2.46.1 xulrunner-32bit-17.0.7-2.46.1 xulrunner-debuginfo-32bit-17.0.7-2.46.1 References: http://support.novell.com/security/cve/CVE-2013-1682.html http://support.novell.com/security/cve/CVE-2013-1684.html http://support.novell.com/security/cve/CVE-2013-1685.html http://support.novell.com/security/cve/CVE-2013-1686.html http://support.novell.com/security/cve/CVE-2013-1687.html http://support.novell.com/security/cve/CVE-2013-1690.html http://support.novell.com/security/cve/CVE-2013-1692.html http://support.novell.com/security/cve/CVE-2013-1693.html http://support.novell.com/security/cve/CVE-2013-1694.html http://support.novell.com/security/cve/CVE-2013-1697.html https://bugzilla.novell.com/825935

1 0

openSUSE-SU-2013:1142-1: important: MozillaFirefox: Update to Firefox 22.0 release
by opensuse-security＠opensuse.org 04 Jul '13

04 Jul '13

openSUSE Security Update: MozillaFirefox: Update to Firefox 22.0 release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1142-1 Rating: important References: #825935 Cross-References: CVE-2013-1682 CVE-2013-1683 CVE-2013-1684 CVE-2013-1685 CVE-2013-1686 CVE-2013-1687 CVE-2013-1688 CVE-2013-1690 CVE-2013-1692 CVE-2013-1693 CVE-2013-1694 CVE-2013-1695 CVE-2013-1696 CVE-2013-1697 CVE-2013-1698 CVE-2013-1699 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: MozillaFirefox was updated to Firefox 22.0 (bnc#825935) Following security issues were fixed: * MFSA 2013-49/CVE-2013-1682/CVE-2013-1683 Miscellaneous memory safety hazards * MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer * MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL * MFSA 2013-52/CVE-2013-1688 (bmo#873966) Arbitrary code execution within Profiler * MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event * MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks * MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure * MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior * MFSA 2013-57/CVE-2013-1695 (bmo#849791) Sandbox restrictions not applied to nested frame elements * MFSA 2013-58/CVE-2013-1696 (bmo#761667) X-Frame-Options ignored when using server push with multi-part responses * MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context * MFSA 2013-60/CVE-2013-1698 (bmo#876044) getUserMedia permission dialog incorrectly displays location * MFSA 2013-61/CVE-2013-1699 (bmo#840882) Homograph domain spoofing in .com, .net and .name Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-556 - openSUSE 12.2: zypper in -t patch openSUSE-2013-556 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): MozillaFirefox-22.0-1.25.1 MozillaFirefox-branding-upstream-22.0-1.25.1 MozillaFirefox-buildsymbols-22.0-1.25.1 MozillaFirefox-debuginfo-22.0-1.25.1 MozillaFirefox-debugsource-22.0-1.25.1 MozillaFirefox-devel-22.0-1.25.1 MozillaFirefox-translations-common-22.0-1.25.1 MozillaFirefox-translations-other-22.0-1.25.1 mozilla-nspr-4.9.6-1.10.1 mozilla-nspr-debuginfo-4.9.6-1.10.1 mozilla-nspr-debugsource-4.9.6-1.10.1 mozilla-nspr-devel-4.9.6-1.10.1 - openSUSE 12.3 (x86_64): mozilla-nspr-32bit-4.9.6-1.10.1 mozilla-nspr-debuginfo-32bit-4.9.6-1.10.1 - openSUSE 12.2 (i586 x86_64): MozillaFirefox-22.0-2.51.1 MozillaFirefox-branding-upstream-22.0-2.51.1 MozillaFirefox-buildsymbols-22.0-2.51.1 MozillaFirefox-debuginfo-22.0-2.51.1 MozillaFirefox-debugsource-22.0-2.51.1 MozillaFirefox-devel-22.0-2.51.1 MozillaFirefox-translations-common-22.0-2.51.1 MozillaFirefox-translations-other-22.0-2.51.1 References: http://support.novell.com/security/cve/CVE-2013-1682.html http://support.novell.com/security/cve/CVE-2013-1683.html http://support.novell.com/security/cve/CVE-2013-1684.html http://support.novell.com/security/cve/CVE-2013-1685.html http://support.novell.com/security/cve/CVE-2013-1686.html http://support.novell.com/security/cve/CVE-2013-1687.html http://support.novell.com/security/cve/CVE-2013-1688.html http://support.novell.com/security/cve/CVE-2013-1690.html http://support.novell.com/security/cve/CVE-2013-1692.html http://support.novell.com/security/cve/CVE-2013-1693.html http://support.novell.com/security/cve/CVE-2013-1694.html http://support.novell.com/security/cve/CVE-2013-1695.html http://support.novell.com/security/cve/CVE-2013-1696.html http://support.novell.com/security/cve/CVE-2013-1697.html http://support.novell.com/security/cve/CVE-2013-1698.html http://support.novell.com/security/cve/CVE-2013-1699.html https://bugzilla.novell.com/825935

1 0

openSUSE-SU-2013:1141-1: important: MozillaThunderbird: 17.0.7
by opensuse-security＠opensuse.org 04 Jul '13

04 Jul '13

openSUSE Security Update: MozillaThunderbird: 17.0.7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1141-1 Rating: important References: #825935 Cross-References: CVE-2013-1682 CVE-2013-1684 CVE-2013-1685 CVE-2013-1686 CVE-2013-1687 CVE-2013-1690 CVE-2013-1692 CVE-2013-1693 CVE-2013-1694 CVE-2013-1697 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaThunderbird was updated to Thunderbird 17.0.7 (bnc#825935) Security issues fixed: * MFSA 2013-49/CVE-2013-1682 Miscellaneous memory safety hazards * MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer * MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL * MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event * MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks * MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure * MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior * MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-554 - openSUSE 12.2: zypper in -t patch openSUSE-2013-554 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): MozillaThunderbird-17.0.7-61.17.1 MozillaThunderbird-buildsymbols-17.0.7-61.17.1 MozillaThunderbird-debuginfo-17.0.7-61.17.1 MozillaThunderbird-debugsource-17.0.7-61.17.1 MozillaThunderbird-devel-17.0.7-61.17.1 MozillaThunderbird-devel-debuginfo-17.0.7-61.17.1 MozillaThunderbird-translations-common-17.0.7-61.17.1 MozillaThunderbird-translations-other-17.0.7-61.17.1 enigmail-1.5.1+17.0.7-61.17.1 enigmail-debuginfo-1.5.1+17.0.7-61.17.1 - openSUSE 12.2 (i586 x86_64): MozillaThunderbird-17.0.7-49.47.1 MozillaThunderbird-buildsymbols-17.0.7-49.47.1 MozillaThunderbird-debuginfo-17.0.7-49.47.1 MozillaThunderbird-debugsource-17.0.7-49.47.1 MozillaThunderbird-devel-17.0.7-49.47.1 MozillaThunderbird-devel-debuginfo-17.0.7-49.47.1 MozillaThunderbird-translations-common-17.0.7-49.47.1 MozillaThunderbird-translations-other-17.0.7-49.47.1 enigmail-1.5.1+17.0.7-49.47.1 enigmail-debuginfo-1.5.1+17.0.7-49.47.1 References: http://support.novell.com/security/cve/CVE-2013-1682.html http://support.novell.com/security/cve/CVE-2013-1684.html http://support.novell.com/security/cve/CVE-2013-1685.html http://support.novell.com/security/cve/CVE-2013-1686.html http://support.novell.com/security/cve/CVE-2013-1687.html http://support.novell.com/security/cve/CVE-2013-1690.html http://support.novell.com/security/cve/CVE-2013-1692.html http://support.novell.com/security/cve/CVE-2013-1693.html http://support.novell.com/security/cve/CVE-2013-1694.html http://support.novell.com/security/cve/CVE-2013-1697.html https://bugzilla.novell.com/825935

1 0

openSUSE-SU-2013:1140-1: important: regular updates for Mozilla applications (FF/TB)
by opensuse-security＠opensuse.org 04 Jul '13

04 Jul '13

openSUSE Security Update: regular updates for Mozilla applications (FF/TB) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1140-1 Rating: important References: #825935 Cross-References: CVE-2013-1682 CVE-2013-1683 CVE-2013-1684 CVE-2013-1685 CVE-2013-1686 CVE-2013-1687 CVE-2013-1688 CVE-2013-1690 CVE-2013-1692 CVE-2013-1693 CVE-2013-1694 CVE-2013-1695 CVE-2013-1696 CVE-2013-1697 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: update to Firefox 22.0 and Thunderbird 17.0.7 including the following security fixes * MFSA 2013-49 Miscellaneous memory safety hazards * MFSA 2013-50 Memory corruption found using Address Sanitizer * MFSA 2013-51 Privileged content access and execution via XBL * MFSA 2013-52 Arbitrary code execution within Profiler * MFSA 2013-53 Execution of unmapped memory through onreadystatechange event * MFSA 2013-54 Data in the body of XHR HEAD requests leads to CSRF attacks * MFSA 2013-55 SVG filters can lead to information disclosure * MFSA 2013-56 PreserveWrapper has inconsistent behavior * MFSA 2013-57 Sandbox restrictions not applied to nested frame elements * MFSA 2013-58 X-Frame-Options ignored when using server push with multi-part responses * MFSA 2013-59 XrayWrappers can be bypassed to run user defined methods in a privileged context Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-101 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-22.0-79.1 MozillaFirefox-branding-upstream-22.0-79.1 MozillaFirefox-buildsymbols-22.0-79.1 MozillaFirefox-debuginfo-22.0-79.1 MozillaFirefox-debugsource-22.0-79.1 MozillaFirefox-devel-22.0-79.1 MozillaFirefox-translations-common-22.0-79.1 MozillaFirefox-translations-other-22.0-79.1 MozillaThunderbird-17.0.7-65.1 MozillaThunderbird-buildsymbols-17.0.7-65.1 MozillaThunderbird-debuginfo-17.0.7-65.1 MozillaThunderbird-debugsource-17.0.7-65.1 MozillaThunderbird-devel-17.0.7-65.1 MozillaThunderbird-devel-debuginfo-17.0.7-65.1 MozillaThunderbird-translations-common-17.0.7-65.1 MozillaThunderbird-translations-other-17.0.7-65.1 enigmail-1.5.1+17.0.7-65.1 enigmail-debuginfo-1.5.1+17.0.7-65.1 References: http://support.novell.com/security/cve/CVE-2013-1682.html http://support.novell.com/security/cve/CVE-2013-1683.html http://support.novell.com/security/cve/CVE-2013-1684.html http://support.novell.com/security/cve/CVE-2013-1685.html http://support.novell.com/security/cve/CVE-2013-1686.html http://support.novell.com/security/cve/CVE-2013-1687.html http://support.novell.com/security/cve/CVE-2013-1688.html http://support.novell.com/security/cve/CVE-2013-1690.html http://support.novell.com/security/cve/CVE-2013-1692.html http://support.novell.com/security/cve/CVE-2013-1693.html http://support.novell.com/security/cve/CVE-2013-1694.html http://support.novell.com/security/cve/CVE-2013-1695.html http://support.novell.com/security/cve/CVE-2013-1696.html http://support.novell.com/security/cve/CVE-2013-1697.html https://bugzilla.novell.com/825935

1 0