October 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:1315-1: moderate: update for getmail
by opensuse-security＠opensuse.org 22 Oct '14

22 Oct '14

openSUSE Security Update: update for getmail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1315-1 Rating: moderate References: #900217 Cross-References: CVE-2014-7273 CVE-2014-7274 CVE-2014-7275 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: - getmail 4.46.0 [bnc#900217] This release fixes several similar vulnerabilities that could allow a man-in-the-middle attacker to read encrypted traffic due to pack of certificate verification against the hostname. * fix --idle checking Python version incorrectly, resulting in incorrect warning about running with Python < 2.5 * add missing support for SSL certificate checking in POP3 which broke POP retrieval in v4.45.0 [CVE-2014-7275] - includes changes from 4.45.0: * perform hostname-vs-certificate matching of SSL certificate if validating the certifcate [CVE-2014-7274] * fix missing plaintext versions of documentation - includes changes from 4.44.0: * add extended SSL options for IMAP retrievers, allowing certificate verification and other features [CVE-2014-7273] * fix missing plaintext versions of documentation * fix "Header instance has no attribute 'strip'" error which cropped up in some configurations Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-598 - openSUSE 12.3: zypper in -t patch openSUSE-2014-598 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): getmail-4.46.0-2.4.1 getmail-doc-4.46.0-2.4.1 - openSUSE 12.3 (noarch): getmail-4.46.0-2.4.1 getmail-doc-4.46.0-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-7273.html http://support.novell.com/security/cve/CVE-2014-7274.html http://support.novell.com/security/cve/CVE-2014-7275.html https://bugzilla.suse.com/show_bug.cgi?id=900217

1 0

openSUSE-SU-2014:1314-1: moderate: update for wpa_supplicant
by opensuse-security＠opensuse.org 22 Oct '14

22 Oct '14

openSUSE Security Update: update for wpa_supplicant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1314-1 Rating: moderate References: #900611 Cross-References: CVE-2014-3686 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - add 0001-Add-os_exec-helper-to-run-external-programs.patch - add 0002-wpa_cli-Use-os_exec-for-action-script-execution.patch - fixing CVE-2014-3686 (bnc#900611) trying to abuse the action scripts in wpa_cli Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-599 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): wpa_supplicant-2.0-3.8.1 wpa_supplicant-debuginfo-2.0-3.8.1 wpa_supplicant-debugsource-2.0-3.8.1 wpa_supplicant-gui-2.0-3.8.1 wpa_supplicant-gui-debuginfo-2.0-3.8.1 References: http://support.novell.com/security/cve/CVE-2014-3686.html https://bugzilla.suse.com/show_bug.cgi?id=900611

1 0

openSUSE-SU-2014:1313-1: moderate: update for wpa_supplicant
by opensuse-security＠opensuse.org 22 Oct '14

22 Oct '14

openSUSE Security Update: update for wpa_supplicant ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1313-1 Rating: moderate References: #900611 Cross-References: CVE-2014-3686 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - add 0001-Add-os_exec-helper-to-run-external-programs.patch - add 0002-wpa_cli-Use-os_exec-for-action-script-execution.patch - fixing CVE-2014-3686 (bnc#900611) trying to abuse the action scripts in wpa_cli Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-600 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): wpa_supplicant-1.1-2.4.1 wpa_supplicant-debuginfo-1.1-2.4.1 wpa_supplicant-debugsource-1.1-2.4.1 wpa_supplicant-gui-1.1-2.4.1 wpa_supplicant-gui-debuginfo-1.1-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-3686.html https://bugzilla.suse.com/show_bug.cgi?id=900611

1 0

openSUSE-RU-2014:1312-1: apache2-mod_evasive: Fixes loading module.
by maintenance＠opensuse.org 21 Oct '14

21 Oct '14

openSUSE Recommended Update: apache2-mod_evasive: Fixes loading module. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1312-1 Rating: low References: #865567 #867984 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with apache2-mod_evasive: - boo#867984/boo#865567: Fixes mixture of evasive20 and evasive24 symbols. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-597 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-mod_evasive-1.10.1-5.4.1 apache2-mod_evasive-debuginfo-1.10.1-5.4.1 apache2-mod_evasive-debugsource-1.10.1-5.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=865567 https://bugzilla.suse.com/show_bug.cgi?id=867984

1 0

openSUSE-SU-2014:1310-1: moderate: update for bash
by opensuse-security＠opensuse.org 20 Oct '14

20 Oct '14

openSUSE Security Update: update for bash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1310-1 Rating: moderate References: #898812 #898884 Cross-References: CVE-2014-6271 CVE-2014-6277 CVE-2014-6278 CVE-2014-7169 CVE-2014-7187 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: - Replace patches bash-4.2-heredoc-eof-delim.patch and bash-4.2-parse-exportfunc.patch with the official upstream patch levels bash42-052 and bash42-053 - Replace patch bash-4.2-CVE-2014-7187.patch with upstream patch level bash42-051 - Add patches bash-4.2-heredoc-eof-delim.patch for bsc#898812, CVE-2014-6277: more troubles with functions bash-4.2-parse-exportfunc.patch for bsc#898884, CVE-2014-6278: code execution after original 6271 fix - Make bash-4.2-extra-import-func.patch an optional patch due instruction - Remove and replace patches bash-4.2-CVE-2014-6271.patch bash-4.2-BSC898604.patch bash-4.2-CVE-2014-7169.patch with bash upstream patch 48, patch 49, and patch 50 - Add patch bash-4.2-extra-import-func.patch which is based on the BSD patch of Christos. As further enhancements the option import-functions is mentioned in the manual page and a shopt switch is added to enable and disable import-functions on the fly Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-595 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): bash-4.2-68.12.1 bash-debuginfo-4.2-68.12.1 bash-debugsource-4.2-68.12.1 bash-devel-4.2-68.12.1 bash-loadables-4.2-68.12.1 bash-loadables-debuginfo-4.2-68.12.1 libreadline6-6.2-68.12.1 libreadline6-debuginfo-6.2-68.12.1 readline-devel-6.2-68.12.1 - openSUSE 13.1 (x86_64): bash-debuginfo-32bit-4.2-68.12.1 libreadline6-32bit-6.2-68.12.1 libreadline6-debuginfo-32bit-6.2-68.12.1 readline-devel-32bit-6.2-68.12.1 - openSUSE 13.1 (noarch): bash-doc-4.2-68.12.1 bash-lang-4.2-68.12.1 readline-doc-6.2-68.12.1 References: http://support.novell.com/security/cve/CVE-2014-6271.html http://support.novell.com/security/cve/CVE-2014-6277.html http://support.novell.com/security/cve/CVE-2014-6278.html http://support.novell.com/security/cve/CVE-2014-7169.html http://support.novell.com/security/cve/CVE-2014-7187.html https://bugzilla.suse.com/show_bug.cgi?id=898812 https://bugzilla.suse.com/show_bug.cgi?id=898884

1 0

openSUSE-RU-2014:1309-1: apache2: Fixes issue with PROPFIND walker and enables mod_imagemap
by maintenance＠opensuse.org 20 Oct '14

20 Oct '14

openSUSE Recommended Update: apache2: Fixes issue with PROPFIND walker and enables mod_imagemap ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1309-1 Rating: low References: #866366 #900198 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with apache2: - bnc#866366: enable mod_imagemap - bnc#900198: Fix PR 56480: PROPFIND walker doesn't encode hrefs properly Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-596 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-2.4.6-6.33.1 apache2-debuginfo-2.4.6-6.33.1 apache2-debugsource-2.4.6-6.33.1 apache2-devel-2.4.6-6.33.1 apache2-event-2.4.6-6.33.1 apache2-event-debuginfo-2.4.6-6.33.1 apache2-example-pages-2.4.6-6.33.1 apache2-prefork-2.4.6-6.33.1 apache2-prefork-debuginfo-2.4.6-6.33.1 apache2-utils-2.4.6-6.33.1 apache2-utils-debuginfo-2.4.6-6.33.1 apache2-worker-2.4.6-6.33.1 apache2-worker-debuginfo-2.4.6-6.33.1 - openSUSE 13.1 (noarch): apache2-doc-2.4.6-6.33.1 References: https://bugzilla.suse.com/show_bug.cgi?id=866366 https://bugzilla.suse.com/show_bug.cgi?id=900198

1 0

openSUSE-SU-2014:1308-1: moderate: update for bash
by opensuse-security＠opensuse.org 20 Oct '14

20 Oct '14

openSUSE Security Update: update for bash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1308-1 Rating: moderate References: #896776 #898346 Cross-References: CVE-2014-6271 CVE-2014-7169 CVE-2014-7187 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: - Replace patches bash-4.2-heredoc-eof-delim.patch and bash-4.2-parse-exportfunc.patch with the official upstream patch levels bash42-052 and bash42-053 - Replace patch bash-4.2-CVE-2014-7187.patch with upstream patch level bash42-051 - Make bash-4.2-extra-import-func.patch an optional patch due instruction - Remove and replace patches bash-4.2-CVE-2014-6271.patch bash-4.2-BSC898604.patch bash-4.2-CVE-2014-7169.patch with bash upstream patch 48, patch 49, and patch 50 - Add patch bash-4.2-extra-import-func.patch which is based on the BSD patch of Christos. As further enhancements the option import-functions is mentioned in the manual page and a shopt switch is added to enable and disable import-functions on the fly Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-594 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): bash-4.2-61.19.1 bash-debuginfo-4.2-61.19.1 bash-debugsource-4.2-61.19.1 bash-devel-4.2-61.19.1 bash-loadables-4.2-61.19.1 bash-loadables-debuginfo-4.2-61.19.1 libreadline6-6.2-61.19.1 libreadline6-debuginfo-6.2-61.19.1 readline-devel-6.2-61.19.1 - openSUSE 12.3 (x86_64): bash-debuginfo-32bit-4.2-61.19.1 libreadline6-32bit-6.2-61.19.1 libreadline6-debuginfo-32bit-6.2-61.19.1 readline-devel-32bit-6.2-61.19.1 - openSUSE 12.3 (noarch): bash-doc-4.2-61.19.1 bash-lang-4.2-61.19.1 readline-doc-6.2-61.19.1 References: http://support.novell.com/security/cve/CVE-2014-6271.html http://support.novell.com/security/cve/CVE-2014-7169.html http://support.novell.com/security/cve/CVE-2014-7187.html https://bugzilla.suse.com/show_bug.cgi?id=896776 https://bugzilla.suse.com/show_bug.cgi?id=898346

1 0

openSUSE-RU-2014:1307-1: More critical improvements in the tool so submitting to update channel.
by maintenance＠opensuse.org 20 Oct '14

20 Oct '14

openSUSE Recommended Update: More critical improvements in the tool so submitting to update channel. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1307-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: More critical improvements in the tool so submitting to update channel. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-593 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): spec-cleaner-0.6.3-6.16.1 References:

1 0

openSUSE-SU-2014:1298-1: moderate: update for rsyslog
by opensuse-security＠opensuse.org 15 Oct '14

15 Oct '14

openSUSE Security Update: update for rsyslog ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1298-1 Rating: moderate References: #890228 #897262 #899756 Cross-References: CVE-2014-3634 CVE-2014-3683 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: - Fixed remote PRI DoS vulnerability patch (CVE-2014-3683,bnc#899756) [* rsyslog-7.2.7-remote-PRI-DoS-fix-backport_CVE-2014-3634.patch] - Removed broken, unsupported and dropped by upstream zpipe utility from rsyslog-diag-tools package (bnc#890228) - Remote syslog PRI DoS vulnerability fix (CVE-2014-3634,bnc#897262) [+ rsyslog-7.2.7-remote-PRI-DoS-fix-backport_CVE-2014-3634.patch] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-591 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): rsyslog-7.2.7-2.13.1 rsyslog-debuginfo-7.2.7-2.13.1 rsyslog-debugsource-7.2.7-2.13.1 rsyslog-diag-tools-7.2.7-2.13.1 rsyslog-diag-tools-debuginfo-7.2.7-2.13.1 rsyslog-doc-7.2.7-2.13.1 rsyslog-module-dbi-7.2.7-2.13.1 rsyslog-module-dbi-debuginfo-7.2.7-2.13.1 rsyslog-module-elasticsearch-7.2.7-2.13.1 rsyslog-module-elasticsearch-debuginfo-7.2.7-2.13.1 rsyslog-module-gssapi-7.2.7-2.13.1 rsyslog-module-gssapi-debuginfo-7.2.7-2.13.1 rsyslog-module-gtls-7.2.7-2.13.1 rsyslog-module-gtls-debuginfo-7.2.7-2.13.1 rsyslog-module-mmnormalize-7.2.7-2.13.1 rsyslog-module-mmnormalize-debuginfo-7.2.7-2.13.1 rsyslog-module-mysql-7.2.7-2.13.1 rsyslog-module-mysql-debuginfo-7.2.7-2.13.1 rsyslog-module-pgsql-7.2.7-2.13.1 rsyslog-module-pgsql-debuginfo-7.2.7-2.13.1 rsyslog-module-relp-7.2.7-2.13.1 rsyslog-module-relp-debuginfo-7.2.7-2.13.1 rsyslog-module-snmp-7.2.7-2.13.1 rsyslog-module-snmp-debuginfo-7.2.7-2.13.1 rsyslog-module-udpspoof-7.2.7-2.13.1 rsyslog-module-udpspoof-debuginfo-7.2.7-2.13.1 References: http://support.novell.com/security/cve/CVE-2014-3634.html http://support.novell.com/security/cve/CVE-2014-3683.html https://bugzilla.suse.com/show_bug.cgi?id=890228 https://bugzilla.suse.com/show_bug.cgi?id=897262 https://bugzilla.suse.com/show_bug.cgi?id=899756

1 0

openSUSE-SU-2014:1297-1: moderate: update for rsyslog
by opensuse-security＠opensuse.org 15 Oct '14

15 Oct '14

openSUSE Security Update: update for rsyslog ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1297-1 Rating: moderate References: #890228 #897262 #899756 Cross-References: CVE-2014-3634 CVE-2014-3683 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: - Fixed PRI DoS vulnerability patch (CVE-2014-3683,bnc#899756) [* rsyslog-7.4.7-remote-PRI-DoS-fix-backport_CVE-2014-3634.patch] - Removed broken, unsupported and dropped by upstream zpipe utility from rsyslog-diag-tools package (bnc#890228) - Remote syslog PRI DoS vulnerability fix (CVE-2014-3634,bnc#897262) [+ rsyslog-7.4.7-remote-PRI-DoS-fix-backport_CVE-2014-3634.patch] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-592 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): rsyslog-7.4.7-2.20.1 rsyslog-debuginfo-7.4.7-2.20.1 rsyslog-debugsource-7.4.7-2.20.1 rsyslog-diag-tools-7.4.7-2.20.1 rsyslog-diag-tools-debuginfo-7.4.7-2.20.1 rsyslog-doc-7.4.7-2.20.1 rsyslog-module-dbi-7.4.7-2.20.1 rsyslog-module-dbi-debuginfo-7.4.7-2.20.1 rsyslog-module-elasticsearch-7.4.7-2.20.1 rsyslog-module-elasticsearch-debuginfo-7.4.7-2.20.1 rsyslog-module-gcrypt-7.4.7-2.20.1 rsyslog-module-gcrypt-debuginfo-7.4.7-2.20.1 rsyslog-module-gssapi-7.4.7-2.20.1 rsyslog-module-gssapi-debuginfo-7.4.7-2.20.1 rsyslog-module-gtls-7.4.7-2.20.1 rsyslog-module-gtls-debuginfo-7.4.7-2.20.1 rsyslog-module-guardtime-7.4.7-2.20.1 rsyslog-module-guardtime-debuginfo-7.4.7-2.20.1 rsyslog-module-mmnormalize-7.4.7-2.20.1 rsyslog-module-mmnormalize-debuginfo-7.4.7-2.20.1 rsyslog-module-mysql-7.4.7-2.20.1 rsyslog-module-mysql-debuginfo-7.4.7-2.20.1 rsyslog-module-pgsql-7.4.7-2.20.1 rsyslog-module-pgsql-debuginfo-7.4.7-2.20.1 rsyslog-module-relp-7.4.7-2.20.1 rsyslog-module-relp-debuginfo-7.4.7-2.20.1 rsyslog-module-snmp-7.4.7-2.20.1 rsyslog-module-snmp-debuginfo-7.4.7-2.20.1 rsyslog-module-udpspoof-7.4.7-2.20.1 rsyslog-module-udpspoof-debuginfo-7.4.7-2.20.1 References: http://support.novell.com/security/cve/CVE-2014-3634.html http://support.novell.com/security/cve/CVE-2014-3683.html https://bugzilla.suse.com/show_bug.cgi?id=890228 https://bugzilla.suse.com/show_bug.cgi?id=897262 https://bugzilla.suse.com/show_bug.cgi?id=899756

1 0