May 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:0594-1: moderate: update for nrpe
by opensuse-security＠opensuse.org 02 May '14

02 May '14

openSUSE Security Update: update for nrpe ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0594-1 Rating: moderate References: #874743 Cross-References: CVE-2014-2913 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This nrpe update fixes the following security documentation problem. - bnc#874743: Documented a possible command injection when command arguments are enabled (CVE-2014-2913). More details can be found inside the documentation of this package. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-335 - openSUSE 12.3: zypper in -t patch openSUSE-2014-335 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): nagios-plugins-nrpe-2.15-4.1 nagios-plugins-nrpe-debuginfo-2.15-4.1 nrpe-2.15-4.1 nrpe-debuginfo-2.15-4.1 nrpe-debugsource-2.15-4.1 nrpe-doc-2.15-4.1 - openSUSE 12.3 (i586 x86_64): nagios-plugins-nrpe-2.14-3.4.1 nagios-plugins-nrpe-debuginfo-2.14-3.4.1 nrpe-2.14-3.4.1 nrpe-debuginfo-2.14-3.4.1 nrpe-debugsource-2.14-3.4.1 nrpe-doc-2.14-3.4.1 References: http://support.novell.com/security/cve/CVE-2014-2913.html https://bugzilla.novell.com/874743

1 0

openSUSE-SU-2014:0593-1: moderate: libvirt
by opensuse-security＠opensuse.org 02 May '14

02 May '14

openSUSE Security Update: libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0593-1 Rating: moderate References: #852005 #857490 #868943 #871154 #873103 Cross-References: CVE-2013-6456 CVE-2013-7336 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: libvirt was updated to fix various bugs and security issues: CVE-2013-7336: libvirt: unprivileged user can crash libvirtd during spice migration CVE-2013-6456: unsafe usage of paths under /proc/$PID/root Bugfixes for libvirt client killed on reboot shutdown. (bnc#852005) Also notify systemd when we are ready to accept connections. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-328 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libvirt-1.1.2-2.26.1 libvirt-client-1.1.2-2.26.1 libvirt-client-debuginfo-1.1.2-2.26.1 libvirt-daemon-1.1.2-2.26.1 libvirt-daemon-config-network-1.1.2-2.26.1 libvirt-daemon-config-nwfilter-1.1.2-2.26.1 libvirt-daemon-debuginfo-1.1.2-2.26.1 libvirt-daemon-driver-interface-1.1.2-2.26.1 libvirt-daemon-driver-interface-debuginfo-1.1.2-2.26.1 libvirt-daemon-driver-lxc-1.1.2-2.26.1 libvirt-daemon-driver-lxc-debuginfo-1.1.2-2.26.1 libvirt-daemon-driver-network-1.1.2-2.26.1 libvirt-daemon-driver-network-debuginfo-1.1.2-2.26.1 libvirt-daemon-driver-nodedev-1.1.2-2.26.1 libvirt-daemon-driver-nodedev-debuginfo-1.1.2-2.26.1 libvirt-daemon-driver-nwfilter-1.1.2-2.26.1 libvirt-daemon-driver-nwfilter-debuginfo-1.1.2-2.26.1 libvirt-daemon-driver-qemu-1.1.2-2.26.1 libvirt-daemon-driver-qemu-debuginfo-1.1.2-2.26.1 libvirt-daemon-driver-secret-1.1.2-2.26.1 libvirt-daemon-driver-secret-debuginfo-1.1.2-2.26.1 libvirt-daemon-driver-storage-1.1.2-2.26.1 libvirt-daemon-driver-storage-debuginfo-1.1.2-2.26.1 libvirt-daemon-driver-uml-1.1.2-2.26.1 libvirt-daemon-driver-uml-debuginfo-1.1.2-2.26.1 libvirt-daemon-driver-vbox-1.1.2-2.26.1 libvirt-daemon-driver-vbox-debuginfo-1.1.2-2.26.1 libvirt-daemon-lxc-1.1.2-2.26.1 libvirt-daemon-qemu-1.1.2-2.26.1 libvirt-daemon-uml-1.1.2-2.26.1 libvirt-daemon-vbox-1.1.2-2.26.1 libvirt-debugsource-1.1.2-2.26.1 libvirt-devel-1.1.2-2.26.1 libvirt-doc-1.1.2-2.26.1 libvirt-lock-sanlock-1.1.2-2.26.1 libvirt-lock-sanlock-debuginfo-1.1.2-2.26.1 libvirt-login-shell-1.1.2-2.26.1 libvirt-login-shell-debuginfo-1.1.2-2.26.1 libvirt-python-1.1.2-2.26.1 libvirt-python-debuginfo-1.1.2-2.26.1 - openSUSE 13.1 (x86_64): libvirt-client-32bit-1.1.2-2.26.1 libvirt-client-debuginfo-32bit-1.1.2-2.26.1 libvirt-daemon-driver-libxl-1.1.2-2.26.1 libvirt-daemon-driver-libxl-debuginfo-1.1.2-2.26.1 libvirt-daemon-driver-xen-1.1.2-2.26.1 libvirt-daemon-driver-xen-debuginfo-1.1.2-2.26.1 libvirt-daemon-xen-1.1.2-2.26.1 libvirt-devel-32bit-1.1.2-2.26.1 References: http://support.novell.com/security/cve/CVE-2013-6456.html http://support.novell.com/security/cve/CVE-2013-7336.html https://bugzilla.novell.com/852005 https://bugzilla.novell.com/857490 https://bugzilla.novell.com/868943 https://bugzilla.novell.com/871154 https://bugzilla.novell.com/873103

1 0

openSUSE-SU-2014:0592-1: moderate: OpenSSL: Fixed a use-after-free race condition in OpenSSL's read buffer.
by opensuse-security＠opensuse.org 02 May '14

02 May '14

openSUSE Security Update: OpenSSL: Fixed a use-after-free race condition in OpenSSL's read buffer. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0592-1 Rating: moderate References: #873351 Cross-References: CVE-2010-5298 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A use-after-free race condition in OpenSSL's read buffer was fixed that could cause connections to drop (CVE-2010-5298). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-325 - openSUSE 12.3: zypper in -t patch openSUSE-2014-325 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1g-11.40.1 libopenssl1_0_0-1.0.1g-11.40.1 libopenssl1_0_0-debuginfo-1.0.1g-11.40.1 openssl-1.0.1g-11.40.1 openssl-debuginfo-1.0.1g-11.40.1 openssl-debugsource-1.0.1g-11.40.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1g-11.40.1 libopenssl1_0_0-32bit-1.0.1g-11.40.1 libopenssl1_0_0-debuginfo-32bit-1.0.1g-11.40.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1g-11.40.1 - openSUSE 12.3 (i586 x86_64): libopenssl-devel-1.0.1g-1.52.1 libopenssl1_0_0-1.0.1g-1.52.1 libopenssl1_0_0-debuginfo-1.0.1g-1.52.1 openssl-1.0.1g-1.52.1 openssl-debuginfo-1.0.1g-1.52.1 openssl-debugsource-1.0.1g-1.52.1 - openSUSE 12.3 (x86_64): libopenssl-devel-32bit-1.0.1g-1.52.1 libopenssl1_0_0-32bit-1.0.1g-1.52.1 libopenssl1_0_0-debuginfo-32bit-1.0.1g-1.52.1 - openSUSE 12.3 (noarch): openssl-doc-1.0.1g-1.52.1 References: http://support.novell.com/security/cve/CVE-2010-5298.html https://bugzilla.novell.com/873351

1 0

openSUSE-SU-2014:0591-1: python-imaging: Fix for temporary file race condition
by opensuse-security＠opensuse.org 02 May '14

02 May '14

openSUSE Security Update: python-imaging: Fix for temporary file race condition ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0591-1 Rating: low References: #863541 Cross-References: CVE-2014-1932 CVE-2014-1933 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: A temporary file race condition has been fixed in python-imaging when converting images (CVE-2014-1932, CVE-2014-1933). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-326 - openSUSE 12.3: zypper in -t patch openSUSE-2014-326 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): python-imaging-1.1.7-18.4.1 python-imaging-debuginfo-1.1.7-18.4.1 python-imaging-debugsource-1.1.7-18.4.1 python-imaging-sane-1.1.7-18.4.1 python-imaging-sane-debuginfo-1.1.7-18.4.1 - openSUSE 12.3 (i586 x86_64): python-imaging-1.1.7-15.4.1 python-imaging-debuginfo-1.1.7-15.4.1 python-imaging-debugsource-1.1.7-15.4.1 python-imaging-sane-1.1.7-15.4.1 python-imaging-sane-debuginfo-1.1.7-15.4.1 References: http://support.novell.com/security/cve/CVE-2014-1932.html http://support.novell.com/security/cve/CVE-2014-1933.html https://bugzilla.novell.com/863541

1 0

openSUSE-SU-2014:0590-1: moderate: update for libmms
by opensuse-security＠opensuse.org 02 May '14

02 May '14

openSUSE Security Update: update for libmms ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0590-1 Rating: moderate References: #874723 Cross-References: CVE-2014-2892 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This libmss update fixes the following security issue. - bnc#874723: Fixed a possible heap memory overrun (CVE-2014-2892). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-327 - openSUSE 12.3: zypper in -t patch openSUSE-2014-327 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libmms-debugsource-0.6.2-13.4.1 libmms-devel-0.6.2-13.4.1 libmms0-0.6.2-13.4.1 libmms0-debuginfo-0.6.2-13.4.1 - openSUSE 13.1 (x86_64): libmms0-32bit-0.6.2-13.4.1 libmms0-debuginfo-32bit-0.6.2-13.4.1 - openSUSE 12.3 (i586 x86_64): libmms-debugsource-0.6.2-10.4.1 libmms-devel-0.6.2-10.4.1 libmms0-0.6.2-10.4.1 libmms0-debuginfo-0.6.2-10.4.1 - openSUSE 12.3 (x86_64): libmms0-32bit-0.6.2-10.4.1 libmms0-debuginfo-32bit-0.6.2-10.4.1 References: http://support.novell.com/security/cve/CVE-2014-2892.html https://bugzilla.novell.com/874723

1 0

openSUSE-SU-2014:0589-1: critical: update for flash-player
by opensuse-security＠opensuse.org 01 May '14

01 May '14

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0589-1 Rating: critical References: #875577 Cross-References: CVE-2014-0515 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This flash-player update fixes a critical buffer overflow vulnerability that leads to arbitrary code execution. The flash-player package was updated to version 11.2.202.356. * bnc#875577, APSB14-13, CVE-2014-0515 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-48 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.356-107.1 flash-player-gnome-11.2.202.356-107.1 flash-player-kde4-11.2.202.356-107.1 References: http://support.novell.com/security/cve/CVE-2014-0515.html https://bugzilla.novell.com/875577

1 0