September 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1433-1: moderate: libzypp: security fixes in RPM GPG key import parsing
by opensuse-security＠opensuse.org 12 Sep '13

12 Sep '13

openSUSE Security Update: libzypp: security fixes in RPM GPG key import parsing ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1433-1 Rating: moderate References: #828672 Cross-References: CVE-2013-3704 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libzypp was adjusted to enhance the RPM GPG key import/handling to avoid a problem with multiple key blobs. Attackers able to supplying a repository could let the packagemanager show another keys fingerprint while a second one was actually used to sign the repository (CVE-2013-3704). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-693 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libzypp-11.13.0-2.29.1 libzypp-debuginfo-11.13.0-2.29.1 libzypp-debugsource-11.13.0-2.29.1 libzypp-devel-11.13.0-2.29.1 References: http://support.novell.com/security/cve/CVE-2013-3704.html https://bugzilla.novell.com/828672

1 0

openSUSE-SU-2013:1432-1: moderate: libzypp: security fixes in RPM GPG key import parsing
by opensuse-security＠opensuse.org 12 Sep '13

12 Sep '13

openSUSE Security Update: libzypp: security fixes in RPM GPG key import parsing ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1432-1 Rating: moderate References: #828672 Cross-References: CVE-2013-3704 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libzypp was adjusted to enhance the RPM GPG key import/handling to avoid a problem with multiple key blobs. Attackers able to supplying a repository could let the packagemanager show another keys fingerprint while a second one was actually used to sign the repository (CVE-2013-3704). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-692 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libzypp-12.15.0-1.17.1 libzypp-debuginfo-12.15.0-1.17.1 libzypp-debugsource-12.15.0-1.17.1 libzypp-devel-12.15.0-1.17.1 References: http://support.novell.com/security/cve/CVE-2013-3704.html https://bugzilla.novell.com/828672

1 0

openSUSE-RU-2013:1428-1: moderate: xorg-x11-Xvnc: Do not send local-link ipv6 addresses over xdmcp
by maintenance＠opensuse.org 11 Sep '13

11 Sep '13

openSUSE Recommended Update: xorg-x11-Xvnc: Do not send local-link ipv6 addresses over xdmcp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1428-1 Rating: moderate References: #808490 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with xorg-x11-Xvnc: - bnc#808490: Do not send local-link ipv6 addresses over xdmcp. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-690 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): xorg-x11-Xvnc-7.6_1.0.1-3.16.3 xorg-x11-Xvnc-debuginfo-7.6_1.0.1-3.16.3 xorg-x11-Xvnc-debugsource-7.6_1.0.1-3.16.3 References: https://bugzilla.novell.com/808490

1 0

openSUSE-RU-2013:1422-1: moderate: xtrabackup: Update to version 2.0.8
by maintenance＠opensuse.org 09 Sep '13

09 Sep '13

openSUSE Recommended Update: xtrabackup: Update to version 2.0.8 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1422-1 Rating: moderate References: #838543 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with xtrabackup: - bnc#838543: version 2.0.8 * Percona XtraBackup would assume the table has been dropped if the tablespace was renamed after it was scanned by Percona XtraBackup on startup and before Percona XtraBackup attempted to copy it. * Orphaned xtrabackup_pid file left inside tmpdir could cause SST to fail. * During the backup process loading tablespaces was started before the log copying, this could lead to a race between the datafiles state in the resulting backup and xtrabackup_logfile. Tablespace created at a sensitive time would be missing in both the backup itself and as the corresponding log record in xtrabackup_logfile, so it would not be created on innobackupex --apply-log either. * innobackupex automatic version detection did not work correctly for latest Percona Server and MySQL 5.1 releases which could cause innobackupex to fail. * Difference in behavior between InnoDB 5.5 and 5.6 codebases in cases when a newly created tablespace has uninitialized first page at the time when Percona XtraBackup opens it while creating a list of tablespaces to backup would cause assertion error. * Percona XtraBackup would stop in case log block numbers had to wrap around, which only happens once per 1 GB of log writes, and the wrap-around point was between the last checkpoint and the current log tail at the time the backup starts. * Under some circumstances Percona XtraBackup could fail on a backup prepare with innodb_flush_method=O_DIRECT when XFS filesystem was being used. * Percona XtraBackup didn’t recognize checkpoint #0 as a valid checkpoint on xtrabackup --prepare which would cause an error. * xtrabackup --stats option would not work with server datadir if the server isn’t running and logs were in a separate directory. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-688 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): xtrabackup-2.0.8-2.16.1 xtrabackup-debuginfo-2.0.8-2.16.1 xtrabackup-debugsource-2.0.8-2.16.1 References: https://bugzilla.novell.com/838543

1 0

openSUSE-SU-2013:1421-1: moderate: pixman for a stack based buffer overflow
by opensuse-security＠opensuse.org 09 Sep '13

09 Sep '13

openSUSE Security Update: pixman for a stack based buffer overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1421-1 Rating: moderate References: #815064 Cross-References: CVE-2013-1519 CVE-2013-1591 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: libpixman was updated to fix a stack based buffer overflow (CVE-2013-1591). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-686 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libpixman-1-0-0.24.4-4.4.1 libpixman-1-0-debuginfo-0.24.4-4.4.1 libpixman-1-0-devel-0.24.4-4.4.1 pixman-debugsource-0.24.4-4.4.1 - openSUSE 12.2 (x86_64): libpixman-1-0-32bit-0.24.4-4.4.1 libpixman-1-0-debuginfo-32bit-0.24.4-4.4.1 References: http://support.novell.com/security/cve/CVE-2013-1519.html http://support.novell.com/security/cve/CVE-2013-1591.html https://bugzilla.novell.com/815064

1 0

openSUSE-SU-2013:1420-1: moderate: roundcubemail: version update to 0.9.3
by opensuse-security＠opensuse.org 09 Sep '13

09 Sep '13

openSUSE Security Update: roundcubemail: version update to 0.9.3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1420-1 Rating: moderate References: #803091 #837436 Cross-References: CVE-2012-6121 CVE-2013-5645 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: roundcubemail was updated to version 0.9.3 (bnc#837436) (CVE-2013-5645) * Optimized UI behavior for touch devices * Fix setting refresh_interval to "Never" in Preferences * Fix purge action in folder manager * Fix base URL resolving on attribute values with no quotes * Fix wrong handling of links with '|' character * Fix colorspace issue on image conversion using ImageMagick? * Fix XSS vulnerability when saving HTML signatures * Fix XSS vulnerability when editing a message "as new" or draft * Fix rewrite rule in .htaccess * Fix detecting Turkish language in ISO-8859-9 encoding * Fix identity-selection using Return-Path headers * Fix parsing of links with ... in URL * Fix compose priority selector when opening in new window * Fix bug where signature wasn't changed on identity selection when editing a draft * Fix IMAP SETMETADATA parameters quoting * Fix "could not load message" error on valid empty message body * Fix handling of message/rfc822 attachments on message forward and edit * Fix parsing of square bracket characters in IMAP response strings * Don't clear References and in-Reply-To when a message is "edited as new" * Fix messages list sorting with THREAD=REFS * Remove deprecated (in PHP 5.5) PREG /e modifier usage * Fix empty messages list when register_globals is enabled * Fix so valid and set date.timezone is not required by installer checks * Canonize boolean ini_get() results * Fix so install do not fail when one of DB driver checks fails but other drivers exist * Fix so exported vCard specifies encoding in v3-compatible format - Update to version 0.9.2 * Fix image thumbnails display in print mode * Fix height of message headers block * Fix timeout issue on drag&drop uploads * Fix default sorting of threaded list when THREAD=REFS isn't supported * Fix list mode switch to 'List' after saving list settings in Larry skin * Fix error when there's no writeable addressbook source * Fix zipdownload plugin issue with filenames charset * Fix so non-inline images aren't skipped on forward * Fix "null" instead of empty string on messages list in IE10 * Fix legacy options handling * Fix so bounces addresses in Sender headers are skipped on Reply-All * Fix bug where serialized strings were truncated in PDO::quote() * Fix displaying messages with invalid self-closing HTML tags * Fix PHP warning when responding to a message with many Return-Path headers * Fix unintentional compose window resize * Fix performance regression in text wrapping function * Fix connection to posgtres db using unix socket * Fix handling of comma when adding contact from contacts widget * Fix bug where a message was opened in both preview pane and new window on double-click * Fix fatal error when xdebug.max_nesting_level was exceeded in rcube_washtml * Fix PHP warning in html_table::set_row_attribs() in PHP 5.4 * Fix invalid option selected in default_font selector when font is unset * Fix displaying contact with ID divisible by 100 in sql addressbook * Fix browser warnings on PDF plugin detection * Fix fatal error when parsing UUencoded messages - Update to version 0.9.1 * a lot of bugfixes and smaller improvements (http://trac.roundcube.net/wiki/Changelog) - Update to version 0.9.0 * Improved rendering of forwarded and attached messages * Optionally display and compose email messages a new windows * Unified UI for message view and composition * Show sender photos from contacts in email view * Render thumbnails for image attachments * Download all attachments as zip archive (using the zipdownload plugin) * Forward multiple emails as attachments * CSV import for contacts Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-687 - openSUSE 12.2: zypper in -t patch openSUSE-2013-687 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): roundcubemail-0.9.3-1.8.1 - openSUSE 12.2 (noarch): roundcubemail-0.9.3-3.16.1 References: http://support.novell.com/security/cve/CVE-2012-6121.html http://support.novell.com/security/cve/CVE-2013-5645.html https://bugzilla.novell.com/803091 https://bugzilla.novell.com/837436

1 0

openSUSE-RU-2013:1419-1: kdebase4-runtime: fixed mousewheel volume step for Kmix applet in systemtray
by maintenance＠opensuse.org 09 Sep '13

09 Sep '13

openSUSE Recommended Update: kdebase4-runtime: fixed mousewheel volume step for Kmix applet in systemtray ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1419-1 Rating: low References: #835309 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with kdebase4-runtime: - bnc#835309, kde#316546: fixed mousewheel volume step for kmix applet in systemtray. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-681 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): kdebase4-runtime-4.10.5-1.104.5 kdebase4-runtime-branding-upstream-4.10.5-1.104.5 kdebase4-runtime-debuginfo-4.10.5-1.104.5 kdebase4-runtime-debugsource-4.10.5-1.104.5 kdebase4-runtime-devel-4.10.5-1.104.5 plasma-theme-oxygen-4.10.5-1.104.5 References: https://bugzilla.novell.com/835309

1 0

openSUSE-RU-2013:1418-1: moderate: kdelibs4: Added krb-devel krb5-devel BuildRequires, for enabling kio kttp negotiation support
by maintenance＠opensuse.org 09 Sep '13

09 Sep '13

openSUSE Recommended Update: kdelibs4: Added krb-devel krb5-devel BuildRequires, for enabling kio kttp negotiation support ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1418-1 Rating: moderate References: #809859 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with kdelibs4: - bnc#809859: Added krb-devel krb5-devel BuildRequires, for enabling kio kttp negotiation support. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-679 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): kdelibs4-4.8.5-2.32.1 kdelibs4-branding-upstream-4.8.5-2.32.1 kdelibs4-core-4.8.5-2.32.1 kdelibs4-core-debuginfo-4.8.5-2.32.1 kdelibs4-debuginfo-4.8.5-2.32.1 kdelibs4-debugsource-4.8.5-2.32.1 kdelibs4-doc-4.8.5-2.32.1 kdelibs4-doc-debuginfo-4.8.5-2.32.1 libkde4-4.8.5-2.32.1 libkde4-debuginfo-4.8.5-2.32.1 libkde4-devel-4.8.5-2.32.1 libkdecore4-4.8.5-2.32.1 libkdecore4-debuginfo-4.8.5-2.32.1 libkdecore4-devel-4.8.5-2.32.1 libkdecore4-devel-debuginfo-4.8.5-2.32.1 libksuseinstall-devel-4.8.5-2.32.1 libksuseinstall1-4.8.5-2.32.1 libksuseinstall1-debuginfo-4.8.5-2.32.1 - openSUSE 12.2 (x86_64): libkde4-32bit-4.8.5-2.32.1 libkde4-debuginfo-32bit-4.8.5-2.32.1 libkdecore4-32bit-4.8.5-2.32.1 libkdecore4-debuginfo-32bit-4.8.5-2.32.1 libksuseinstall1-32bit-4.8.5-2.32.1 libksuseinstall1-debuginfo-32bit-4.8.5-2.32.1 - openSUSE 12.2 (noarch): kdelibs4-apidocs-4.8.5-2.32.1 References: https://bugzilla.novell.com/809859

1 0

openSUSE-RU-2013:1417-1: systemd: Several fixes
by maintenance＠opensuse.org 09 Sep '13

09 Sep '13

openSUSE Recommended Update: systemd: Several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1417-1 Rating: low References: #805059 #828905 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with systemd: - Add fix-alien-child-as-alive.patch: ensure alien child death is properly propagated. - bnc#828905: Add support-ncp.patch: ensure ncp is recognized as network file system. - bnc#805059: + Add udev MSFT compability rules + Add sg3_utils requires, need it by 61-msft.rules Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-685 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libgudev-1_0-0-195-13.40.1 libgudev-1_0-0-debuginfo-195-13.40.1 libgudev-1_0-devel-195-13.40.1 libudev-devel-195-13.40.1 libudev-mini-devel-195-13.40.1 libudev-mini1-195-13.40.1 libudev-mini1-debuginfo-195-13.40.1 libudev1-195-13.40.1 libudev1-debuginfo-195-13.40.1 systemd-195-13.40.1 systemd-analyze-195-13.40.1 systemd-debuginfo-195-13.40.1 systemd-debugsource-195-13.40.1 systemd-devel-195-13.40.1 systemd-logger-195-13.40.1 systemd-mini-195-13.40.1 systemd-mini-analyze-195-13.40.1 systemd-mini-debuginfo-195-13.40.1 systemd-mini-debugsource-195-13.40.1 systemd-mini-devel-195-13.40.1 systemd-mini-sysvinit-195-13.40.1 systemd-sysvinit-195-13.40.1 typelib-1_0-GUdev-1_0-195-13.40.1 udev-195-13.40.1 udev-debuginfo-195-13.40.1 udev-mini-195-13.40.1 udev-mini-debuginfo-195-13.40.1 - openSUSE 12.3 (x86_64): libgudev-1_0-0-32bit-195-13.40.1 libgudev-1_0-0-debuginfo-32bit-195-13.40.1 libudev1-32bit-195-13.40.1 libudev1-debuginfo-32bit-195-13.40.1 systemd-32bit-195-13.40.1 systemd-debuginfo-32bit-195-13.40.1 References: https://bugzilla.novell.com/805059 https://bugzilla.novell.com/828905

1 0

openSUSE-RU-2013:1416-1: moderate: mkinitrd: several bugfixes and enhancements
by maintenance＠opensuse.org 09 Sep '13

09 Sep '13

openSUSE Recommended Update: mkinitrd: several bugfixes and enhancements ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1416-1 Rating: moderate References: #755642 #775268 #784613 #787075 #801984 #804398 #805059 #809742 #809812 #814540 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has 10 recommended fixes can now be installed. Description: This update fixes the following issues with mkinitrd: - Add support for zImage on ARM - Ask for system root password before starting shell - Find modalias for mmc driver - Fix boolean typo that is assume local time as default in warpclock. - Fix typo in man lsinitrd. - Handle both rootfsopts and rootflags when looking for mount options - Preserve existing /etc/nsswitch.conf in boot-network.sh - Remove usage of absolute path to readlink - add support for aarch64 - bnc#755642: + Handle moving ibft interface between interfaces and subnets + Skip static interfaces when configuring dhcp interfaces - bnc#775268: Include /etc/e2fsck.conf to get broken_system_clock=1 - bnc#784613: Fix boot from mdraid on top of multipath devices - bnc#787075: fix wrong target dependency (local_fs -> local-fs) - bnc#801984: Do not tell the user to refresh the bootloader when generating the kdump initrd. Also, fix the wording of the message - bnc#804398: Do not refresh the bootloader if no kernels are installed - bnc#805059: Package 61-msft.rules and sg_inq to support Windows Server 2012R2 - bnc#809742: Use the default gzip compression level - bnc#809812: Switch plymouth and/or splash off before escaping to emergency shell - bnc#814540: s390x: add support for scm devices - fate#314862: Include hyperv_fb if running in hyper-v guest - include mmc drivers in monster initrd - setup-storage: Support /dev/md/ subdir Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-684 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): mkinitrd-2.7.2-3.5.1 mkinitrd-debuginfo-2.7.2-3.5.1 mkinitrd-debugsource-2.7.2-3.5.1 References: https://bugzilla.novell.com/755642 https://bugzilla.novell.com/775268 https://bugzilla.novell.com/784613 https://bugzilla.novell.com/787075 https://bugzilla.novell.com/801984 https://bugzilla.novell.com/804398 https://bugzilla.novell.com/805059 https://bugzilla.novell.com/809742 https://bugzilla.novell.com/809812 https://bugzilla.novell.com/814540

1 0