February 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:0203-1: critical: update flash-player to 11.2.202.336
by opensuse-security＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Security Update: update flash-player to 11.2.202.336 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0203-1 Rating: critical References: #862288 Cross-References: CVE-2014-0497 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Flash Player received an out of band critical security update to fix an integer underflow vulnerability that could be exploited to execute arbitrary code on the affected system (CVE-2014-0497). More information can be found on: http://helpx.adobe.com/security/products/flash-player/apsb14 -04.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-13 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.336-91.1 flash-player-gnome-11.2.202.336-91.1 flash-player-kde4-11.2.202.336-91.1 References: http://support.novell.com/security/cve/CVE-2014-0497.html https://bugzilla.novell.com/862288

1 0

openSUSE-SU-2014:0202-1: moderate: update for bind
by opensuse-security＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Security Update: update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0202-1 Rating: moderate References: #858639 Cross-References: CVE-2014-0591 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Update to version 9.9.4P2 * Fixes named crash when handling malformed NSEC3-signed zones (CVE-2014-0591, bnc#858639) * Obsoletes workaround-compile-problem.diff - Replace rpz2+rl-9.9.3-P1.patch by rpz2-9.9.4.patch, rl is now supported upstream (--enable-rrl). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-14 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): bind-9.9.4P2-63.1 bind-chrootenv-9.9.4P2-63.1 bind-debuginfo-9.9.4P2-63.1 bind-debugsource-9.9.4P2-63.1 bind-devel-9.9.4P2-63.1 bind-libs-9.9.4P2-63.1 bind-libs-debuginfo-9.9.4P2-63.1 bind-lwresd-9.9.4P2-63.1 bind-lwresd-debuginfo-9.9.4P2-63.1 bind-utils-9.9.4P2-63.1 bind-utils-debuginfo-9.9.4P2-63.1 - openSUSE 11.4 (x86_64): bind-libs-32bit-9.9.4P2-63.1 bind-libs-debuginfo-32bit-9.9.4P2-63.1 - openSUSE 11.4 (noarch): bind-doc-9.9.4P2-63.1 - openSUSE 11.4 (ia64): bind-libs-debuginfo-x86-9.9.4P2-63.1 bind-libs-x86-9.9.4P2-63.1 References: http://support.novell.com/security/cve/CVE-2014-0591.html https://bugzilla.novell.com/858639

1 0

openSUSE-SU-2014:0201-1: moderate: update for gnumeric
by opensuse-security＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Security Update: update for gnumeric ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0201-1 Rating: moderate References: #856254 Cross-References: CVE-2013-6836 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Add gnumeric-CVE-2013-6836.patch: fix Heap-buffer-overflow in ms_escher_get_data on a fuzzed xls file (bnc#856254, bgo#712772, CVE-2013-6836). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-15 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gnumeric-1.10.12-7.1 gnumeric-debuginfo-1.10.12-7.1 gnumeric-debugsource-1.10.12-7.1 gnumeric-devel-1.10.12-7.1 - openSUSE 11.4 (noarch): gnumeric-lang-1.10.12-7.1 References: http://support.novell.com/security/cve/CVE-2013-6836.html https://bugzilla.novell.com/856254

1 0

openSUSE-SU-2014:0200-1: QEMU accumulated security and maintenance updates
by opensuse-security＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Security Update: QEMU accumulated security and maintenance updates ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0200-1 Rating: low References: #779727 #840607 #842006 #849587 Cross-References: CVE-2013-4344 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: Running QEMU in a configuration with more than 256 emulated SCSI devices attached could have caused a buffer overflow when the guest issues a REPORT LUNS command. Fix this as part of upgrading to the latest stable version on 13.1. Also fix unintentional building against gtk2 rather than gtk3 on 13.1, and fix serial retry logic on 12.3. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-111 - openSUSE 12.3: zypper in -t patch openSUSE-2014-111 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): qemu-1.6.2-4.5.1 qemu-debuginfo-1.6.2-4.5.1 qemu-debugsource-1.6.2-4.5.1 qemu-guest-agent-1.6.2-4.5.1 qemu-guest-agent-debuginfo-1.6.2-4.5.1 qemu-lang-1.6.2-4.5.1 qemu-linux-user-1.6.2-4.5.1 qemu-linux-user-debuginfo-1.6.2-4.5.1 qemu-linux-user-debugsource-1.6.2-4.5.1 qemu-tools-1.6.2-4.5.1 qemu-tools-debuginfo-1.6.2-4.5.1 - openSUSE 13.1 (noarch): qemu-ipxe-1.0.0-4.5.1 qemu-seabios-1.7.2.2-4.5.1 qemu-sgabios-8-4.5.1 qemu-vgabios-0.6c-4.5.1 - openSUSE 12.3 (i586 x86_64): qemu-1.3.1-3.8.1 qemu-debuginfo-1.3.1-3.8.1 qemu-debugsource-1.3.1-3.8.1 qemu-guest-agent-1.3.1-3.8.1 qemu-guest-agent-debuginfo-1.3.1-3.8.1 qemu-linux-user-1.3.1-3.8.1 qemu-linux-user-debuginfo-1.3.1-3.8.1 qemu-tools-1.3.1-3.8.1 qemu-tools-debuginfo-1.3.1-3.8.1 References: http://support.novell.com/security/cve/CVE-2013-4344.html https://bugzilla.novell.com/779727 https://bugzilla.novell.com/840607 https://bugzilla.novell.com/842006 https://bugzilla.novell.com/849587

1 0

openSUSE-SU-2014:0199-1: moderate: update for bind
by opensuse-security＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Security Update: update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0199-1 Rating: moderate References: #858639 Cross-References: CVE-2014-0591 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Update to version 9.9.4P2 * Fixes named crash when handling malformed NSEC3-signed zones (CVE-2014-0591, bnc#858639) * Obsoletes workaround-compile-problem.diff - Replace rpz2+rl-9.9.3-P1.patch by rpz2-9.9.4.patch, rl is now supported upstream (--enable-rrl). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-110 - openSUSE 12.3: zypper in -t patch openSUSE-2014-110 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): bind-9.9.4P2-2.4.1 bind-chrootenv-9.9.4P2-2.4.1 bind-debuginfo-9.9.4P2-2.4.1 bind-debugsource-9.9.4P2-2.4.1 bind-devel-9.9.4P2-2.4.1 bind-libs-9.9.4P2-2.4.1 bind-libs-debuginfo-9.9.4P2-2.4.1 bind-lwresd-9.9.4P2-2.4.1 bind-lwresd-debuginfo-9.9.4P2-2.4.1 bind-utils-9.9.4P2-2.4.1 bind-utils-debuginfo-9.9.4P2-2.4.1 - openSUSE 13.1 (x86_64): bind-libs-32bit-9.9.4P2-2.4.1 bind-libs-debuginfo-32bit-9.9.4P2-2.4.1 - openSUSE 13.1 (noarch): bind-doc-9.9.4P2-2.4.1 - openSUSE 12.3 (i586 x86_64): bind-9.9.4P2-2.11.1 bind-chrootenv-9.9.4P2-2.11.1 bind-debuginfo-9.9.4P2-2.11.1 bind-debugsource-9.9.4P2-2.11.1 bind-devel-9.9.4P2-2.11.1 bind-libs-9.9.4P2-2.11.1 bind-libs-debuginfo-9.9.4P2-2.11.1 bind-lwresd-9.9.4P2-2.11.1 bind-lwresd-debuginfo-9.9.4P2-2.11.1 bind-utils-9.9.4P2-2.11.1 bind-utils-debuginfo-9.9.4P2-2.11.1 - openSUSE 12.3 (x86_64): bind-libs-32bit-9.9.4P2-2.11.1 bind-libs-debuginfo-32bit-9.9.4P2-2.11.1 - openSUSE 12.3 (noarch): bind-doc-9.9.4P2-2.11.1 References: http://support.novell.com/security/cve/CVE-2014-0591.html https://bugzilla.novell.com/858639

1 0

openSUSE-SU-2014:0198-1: moderate: update for python-apache-libcloud
by opensuse-security＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Security Update: update for python-apache-libcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0198-1 Rating: moderate References: #857209 Cross-References: CVE-2013-6480 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Updated to 0.13.3 (bnc#857209, CVE-2013-6480) + Security fix release, for destroying nodes on digitalOcean 'data_scrub' method is always invoked - Require python-setuptools instead of distribute (upstreams merged) - Updated to 0.13.2 - General: - Don't sent Content-Length: 0 header with POST and PUT request if "raw" mode is used. This fixes a regression which could cause broken behavior in some storage driver when uploading a file from disk. - Compute: - Added Ubuntu Linux 12.04 image to ElasticHost driver image list. (LIBCLOUD-364) - Update ElasticHosts driver to store drive UUID in the node 'extra' field. (LIBCLOUD-357) - Storage: - Store last_modified timestamp in the Object extra dictionary in the S3 driver. (LIBCLOUD-373) - Load Balancer: - Expose CloudStack driver directly through the Provider.CLOUDSTACK constant. - DNS: - Modify Zerigo driver to include record TTL in the record 'extra' attribute if a record has a TTL set. - Modify values in the Record 'extra' dictionary attribute in the Zerigo DNS driver to be set to None instead of an empty string ('') if a value for the provided key is not set. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-112 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): python-apache-libcloud-0.13.3-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-6480.html https://bugzilla.novell.com/857209

1 0

openSUSE-SU-2014:0197-1: critical: flash-player to 11.2.202.336
by opensuse-security＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Security Update: flash-player to 11.2.202.336 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0197-1 Rating: critical References: #862288 Cross-References: CVE-2014-0497 Affected Products: openSUSE 13.1:NonFree openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Flash Player received an out of band critical security update to fix an integer underflow vulnerability that could be exploited to execute arbitrary code on the affected system (CVE-2014-0497). More information can be found on: http://helpx.adobe.com/security/products/flash-player/apsb14 -04.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2014-109 - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2014-109 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.336-30.1 flash-player-gnome-11.2.202.336-30.1 flash-player-kde4-11.2.202.336-30.1 - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.336-2.56.1 flash-player-gnome-11.2.202.336-2.56.1 flash-player-kde4-11.2.202.336-2.56.1 References: http://support.novell.com/security/cve/CVE-2014-0497.html https://bugzilla.novell.com/862288

1 0

openSUSE-RU-2014:0196-1: gtk3: Update to version 3.6.5
by maintenance＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Recommended Update: gtk3: Update to version 3.6.5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0196-1 Rating: low References: #860690 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with gtk3: - bnc#860690: Update to version 3.6.5 + Bugs fixed: * bgo#669808: fullscreen/unscreen was broken for Quartz on OS X * bgo#672271: File chooser seems over-enthusiastic about using subdirectories * bgo#687066: gtk 3.6.1 fails to build for win32 * bgo#688534: gdk 3.6.2 does not build with mesa 9.0.1 * bgo#691426: get_current_desktop does not interpret property data correctly * bgo#691515: Insufficient checks for EWMH support * bgo#691572: Touch: strengthen synthesized touch crossing events machinery against programmatic crossings * bgo#694742: Fix possible memory leak when GlobalAlloc() fails * bgo#694755: When clicking Activities, sometimes gnome-shell crashes * bgo#695278: Avoid passing a NULL title to setTitle * bgo#695312: Initial 'text' set in the non-numeric-only GtkSpinButton automatically overwritten to '0.0' * bgo#696171: GtkAssistant highlighted font unreadable * bgo#696202: Add GtkSpinner animation back to Win32 theme + Updated translations. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-90 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): gtk3-debugsource-3.6.5-2.14.1 gtk3-devel-3.6.5-2.14.1 gtk3-devel-debuginfo-3.6.5-2.14.1 gtk3-immodule-amharic-3.6.5-2.14.1 gtk3-immodule-amharic-debuginfo-3.6.5-2.14.1 gtk3-immodule-inuktitut-3.6.5-2.14.1 gtk3-immodule-inuktitut-debuginfo-3.6.5-2.14.1 gtk3-immodule-multipress-3.6.5-2.14.1 gtk3-immodule-multipress-debuginfo-3.6.5-2.14.1 gtk3-immodule-thai-3.6.5-2.14.1 gtk3-immodule-thai-debuginfo-3.6.5-2.14.1 gtk3-immodule-vietnamese-3.6.5-2.14.1 gtk3-immodule-vietnamese-debuginfo-3.6.5-2.14.1 gtk3-immodule-xim-3.6.5-2.14.1 gtk3-immodule-xim-debuginfo-3.6.5-2.14.1 gtk3-immodules-tigrigna-3.6.5-2.14.1 gtk3-immodules-tigrigna-debuginfo-3.6.5-2.14.1 gtk3-tools-3.6.5-2.14.1 gtk3-tools-debuginfo-3.6.5-2.14.1 libgtk-3-0-3.6.5-2.14.1 libgtk-3-0-debuginfo-3.6.5-2.14.1 typelib-1_0-Gtk-3_0-3.6.5-2.14.1 - openSUSE 12.3 (x86_64): gtk3-devel-32bit-3.6.5-2.14.1 gtk3-devel-debuginfo-32bit-3.6.5-2.14.1 gtk3-immodule-amharic-32bit-3.6.5-2.14.1 gtk3-immodule-amharic-debuginfo-32bit-3.6.5-2.14.1 gtk3-immodule-inuktitut-32bit-3.6.5-2.14.1 gtk3-immodule-inuktitut-debuginfo-32bit-3.6.5-2.14.1 gtk3-immodule-multipress-32bit-3.6.5-2.14.1 gtk3-immodule-multipress-debuginfo-32bit-3.6.5-2.14.1 gtk3-immodule-thai-32bit-3.6.5-2.14.1 gtk3-immodule-thai-debuginfo-32bit-3.6.5-2.14.1 gtk3-immodule-vietnamese-32bit-3.6.5-2.14.1 gtk3-immodule-vietnamese-debuginfo-32bit-3.6.5-2.14.1 gtk3-immodule-xim-32bit-3.6.5-2.14.1 gtk3-immodule-xim-debuginfo-32bit-3.6.5-2.14.1 gtk3-immodules-tigrigna-32bit-3.6.5-2.14.1 gtk3-immodules-tigrigna-debuginfo-32bit-3.6.5-2.14.1 gtk3-tools-32bit-3.6.5-2.14.1 gtk3-tools-debuginfo-32bit-3.6.5-2.14.1 libgtk-3-0-32bit-3.6.5-2.14.1 libgtk-3-0-debuginfo-32bit-3.6.5-2.14.1 - openSUSE 12.3 (noarch): gtk3-branding-SLED-12.3-2.4.1 gtk3-branding-openSUSE-12.3-2.4.1 gtk3-branding-upstream-3.6.5-2.14.1 gtk3-data-3.6.5-2.14.1 gtk3-lang-3.6.5-2.14.1 References: https://bugzilla.novell.com/860690

1 0

openSUSE-RU-2014:0195-1: armadillo: Update to 3.930.4
by maintenance＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Recommended Update: armadillo: Update to 3.930.4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0195-1 Rating: low References: #860900 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This updates armadillo to version 3.930.4 (bnc#860900) For all changes please see http://arma.sourceforge.net Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-108 - openSUSE 12.3: zypper in -t patch openSUSE-2014-108 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): armadillo-devel-3.930.4-2.4.1 libarmadillo3-3.930.4-2.4.1 libarmadillo3-debuginfo-3.930.4-2.4.1 - openSUSE 13.1 (x86_64): armadillo-devel-32bit-3.930.4-2.4.1 libarmadillo3-32bit-3.930.4-2.4.1 libarmadillo3-debuginfo-32bit-3.930.4-2.4.1 - openSUSE 13.1 (noarch): armadillo-doc-3.930.4-2.4.1 - openSUSE 12.3 (i586 x86_64): armadillo-devel-3.930.4-2.4.1 libarmadillo3-3.930.4-2.4.1 libarmadillo3-debuginfo-3.930.4-2.4.1 - openSUSE 12.3 (x86_64): armadillo-devel-32bit-3.930.4-2.4.1 libarmadillo3-32bit-3.930.4-2.4.1 libarmadillo3-debuginfo-32bit-3.930.4-2.4.1 References: https://bugzilla.novell.com/860900

1 0

openSUSE-RU-2014:0194-1: sysstat: rename nfsiostat to avoid a name collision with nfs-utils
by maintenance＠opensuse.org 05 Feb '14

05 Feb '14

openSUSE Recommended Update: sysstat: rename nfsiostat to avoid a name collision with nfs-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0194-1 Rating: low References: #814447 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with sysstat: bnc#814447: Rename nfsiostat to avoid a name collision with nfs-utils. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-107 - openSUSE 12.3: zypper in -t patch openSUSE-2014-107 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): sysstat-10.0.5-8.6.1 sysstat-debuginfo-10.0.5-8.6.1 sysstat-debugsource-10.0.5-8.6.1 sysstat-isag-10.0.5-8.6.1 - openSUSE 12.3 (i586 x86_64): sysstat-10.0.5-6.6.1 sysstat-debuginfo-10.0.5-6.6.1 sysstat-debugsource-10.0.5-6.6.1 sysstat-isag-10.0.5-6.6.1 References: https://bugzilla.novell.com/814447

1 0