November 2011 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2011:1288-1: moderate: puppet
by opensuse-security＠opensuse.org 29 Nov '11

29 Nov '11

openSUSE Security Update: puppet ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1288-1 Rating: moderate References: #721139 #726372 #727024 #727025 Cross-References: CVE-2011-3848 CVE-2011-3869 CVE-2011-3870 CVE-2011-3871 CVE-2011-3872 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks (CVE-2011-3872). Note: If you've set the 'certdnsnames' option in your master's puppet.conf file merely installing the updated packages is not sufficient to fix this problem. You need to either pick a new DNS name for the master and reconfigure all agents to use it or re-new certificates on all agents. Please refer to the documentation in /usr/share/doc/packages/puppet/puppetlabs-cve20113872-0.0.5 for detailed instructions and scripts. Puppetlabs' site also provides more information: http://puppetlabs.com/security/cve/cve-2011-3872/faq/ http://puppetlabs.com/blog/important-security-announcement-a ltnames-vulnerability/ -- Directory traversal vulnerability in puppet allowed unauthenticated remote attackers to upload x.509 certificate signing requests to arbitrary locations (CVE-2011-3848) Puppet was prone to several symlink attacks (CVE-2011-3870, CVE-2011-3869, CVE-2011-3871) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch puppet-5403 - openSUSE 11.3: zypper in -t patch puppet-5403 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): puppet-2.6.4-4.11.1 puppet-server-2.6.4-4.11.1 - openSUSE 11.3 (i586 x86_64): puppet-0.25.4-4.7.1 puppet-server-0.25.4-4.7.1 References: http://support.novell.com/security/cve/CVE-2011-3848.html http://support.novell.com/security/cve/CVE-2011-3869.html http://support.novell.com/security/cve/CVE-2011-3870.html http://support.novell.com/security/cve/CVE-2011-3871.html http://support.novell.com/security/cve/CVE-2011-3872.html https://bugzilla.novell.com/721139 https://bugzilla.novell.com/726372 https://bugzilla.novell.com/727024 https://bugzilla.novell.com/727025

1 0

openSUSE-SU-2011:1278-1: moderate: perl: decode_xs heap-based buffer overflow
by opensuse-security＠opensuse.org 23 Nov '11

23 Nov '11

openSUSE Security Update: perl: decode_xs heap-based buffer overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1278-1 Rating: moderate References: #728662 Cross-References: CVE-2011-2939 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of Perl fixes a heap based buffer overflow in the decode_xs() function (CVE-2011-2939, bnc#728662). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch perl-5471 - openSUSE 11.3: zypper in -t patch perl-5471 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): perl-5.12.3-11.18.1 perl-base-5.12.3-11.18.1 - openSUSE 11.4 (x86_64): perl-32bit-5.12.3-11.18.1 perl-base-32bit-5.12.3-11.18.1 - openSUSE 11.4 (noarch): perl-doc-5.12.3-11.18.1 - openSUSE 11.3 (i586 x86_64): perl-5.12.1-2.7.1 perl-base-5.12.1-2.7.1 - openSUSE 11.3 (x86_64): perl-32bit-5.12.1-2.7.1 perl-base-32bit-5.12.1-2.7.1 - openSUSE 11.3 (noarch): perl-doc-5.12.1-2.7.1 References: http://support.novell.com/security/cve/CVE-2011-2939.html https://bugzilla.novell.com/728662

1 0

openSUSE-SU-2011:1273-1: moderate: NetworkManager
by opensuse-security＠opensuse.org 22 Nov '11

22 Nov '11

openSUSE Security Update: NetworkManager ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1273-1 Rating: moderate References: #574266 #702016 Cross-References: CVE-2006-7246 CVE-2011-2176 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network (CVE-2006-7246). Please note that existing WPA2 Enterprise connections need to be deleted and re-created to take advantage of the new security checks. NetworkManager did not honor the PolicyKit auth_admin setting when creating Ad-Hoc wireless networks (CVE-2011-2176) Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch NetworkManager-5373 - openSUSE 11.3: zypper in -t patch NetworkManager-5373 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): NetworkManager-0.8.2-15.28.1 NetworkManager-devel-0.8.2-15.28.1 NetworkManager-doc-0.8.2-15.28.1 NetworkManager-glib-0.8.2-15.28.1 NetworkManager-gnome-0.8.2-9.12.1 wpa_supplicant-0.7.3-3.4.1 wpa_supplicant-gui-0.7.3-3.4.1 - openSUSE 11.4 (noarch): NetworkManager-gnome-lang-0.8.2-9.12.1 NetworkManager-lang-0.8.2-15.28.1 - openSUSE 11.3 (i586 x86_64): NetworkManager-0.8-8.13.1 NetworkManager-devel-0.8-8.13.1 NetworkManager-doc-0.8-8.13.1 NetworkManager-glib-0.8-8.13.1 NetworkManager-gnome-0.8-6.3.2 wpa_supplicant-0.7.1-5.3.1 wpa_supplicant-gui-0.7.1-5.3.1 References: http://support.novell.com/security/cve/CVE-2006-7246.html http://support.novell.com/security/cve/CVE-2011-2176.html https://bugzilla.novell.com/574266 https://bugzilla.novell.com/702016

1 0

openSUSE-SU-2011:1272-1: important: bind
by opensuse-security＠opensuse.org 22 Nov '11

22 Nov '11

openSUSE Security Update: bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1272-1 Rating: important References: #730995 Cross-References: CVE-2011-4313 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: specially crafted DNS queries could crash the bind name server (CVE-2011-4313). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch bind-5441 - openSUSE 11.3: zypper in -t patch bind-5441 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 9.7.4P1]: bind-9.7.4P1-0.2.1 bind-chrootenv-9.7.4P1-0.2.1 bind-devel-9.7.4P1-0.2.1 bind-libs-9.7.4P1-0.2.1 bind-utils-9.7.4P1-0.2.1 - openSUSE 11.4 (x86_64) [New Version: 9.7.4P1]: bind-libs-32bit-9.7.4P1-0.2.1 - openSUSE 11.4 (noarch) [New Version: 9.7.4P1]: bind-doc-9.7.4P1-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 9.7.4P1]: bind-9.7.4P1-0.2.1 bind-chrootenv-9.7.4P1-0.2.1 bind-devel-9.7.4P1-0.2.1 bind-libs-9.7.4P1-0.2.1 bind-utils-9.7.4P1-0.2.1 - openSUSE 11.3 (x86_64) [New Version: 9.7.4P1]: bind-libs-32bit-9.7.4P1-0.2.1 - openSUSE 11.3 (noarch) [New Version: 9.7.4P1]: bind-doc-9.7.4P1-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-4313.html https://bugzilla.novell.com/730995

1 0

openSUSE-SU-2011:1263-1: important: VUL-1: wireshark: new updates fix two DoS issues
by opensuse-security＠opensuse.org 18 Nov '11

18 Nov '11

openSUSE Security Update: VUL-1: wireshark: new updates fix two DoS issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1263-1 Rating: important References: #706728 Cross-References: CVE-2011-2597 CVE-2011-3266 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: Wireshark version upgrade to 1.4.10 to fix various security flaws and other non-security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch wireshark-5431 - openSUSE 11.3: zypper in -t patch wireshark-5431 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.4.10]: wireshark-1.4.10-0.8.1 wireshark-devel-1.4.10-0.8.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.4.10]: wireshark-1.4.10-0.7.1 wireshark-devel-1.4.10-0.7.1 References: http://support.novell.com/security/cve/CVE-2011-2597.html http://support.novell.com/security/cve/CVE-2011-3266.html https://bugzilla.novell.com/706728

1 0

openSUSE-SU-2011:1259-1: libcap
by opensuse-security＠opensuse.org 18 Nov '11

18 Nov '11

openSUSE Security Update: libcap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1259-1 Rating: low References: #727715 Cross-References: CVE-2011-4099 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: capsh did not chdir("/") after callling chroot(). Programs could therefore access the current directory outside of the chroot (CVE-2011-4099). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libcap-5369 - openSUSE 11.3: zypper in -t patch libcap-5369 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libcap-devel-2.19-9.10.1 libcap-progs-2.19-9.10.1 libcap2-2.19-9.10.1 - openSUSE 11.4 (x86_64): libcap2-32bit-2.19-9.10.1 - openSUSE 11.3 (i586 x86_64): libcap-devel-2.16-10.3.1 libcap-progs-2.16-10.3.1 libcap2-2.16-10.3.1 - openSUSE 11.3 (x86_64): libcap2-32bit-2.16-10.3.1 References: http://support.novell.com/security/cve/CVE-2011-4099.html https://bugzilla.novell.com/727715

1 0

openSUSE-SU-2011:1257-1: moderate: empathy
by opensuse-security＠opensuse.org 18 Nov '11

18 Nov '11

openSUSE Security Update: empathy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1257-1 Rating: moderate References: #727003 Cross-References: CVE-2011-3635 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Insufficient quoting of nick names allowed attackers to inject arbitrary html (CVE-2011-3635) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch empathy-5376 - openSUSE 11.3: zypper in -t patch empathy-5376 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): empathy-2.32.2-7.10.1 nautilus-sendto-plugin-empathy-2.32.2-7.10.1 - openSUSE 11.4 (noarch): empathy-lang-2.32.2-7.10.1 - openSUSE 11.3 (i586 x86_64): empathy-2.30.1-3.5.1 nautilus-sendto-plugin-empathy-2.30.1-3.5.1 - openSUSE 11.3 (noarch): empathy-lang-2.30.1-3.5.1 References: http://support.novell.com/security/cve/CVE-2011-3635.html https://bugzilla.novell.com/727003

1 0

openSUSE-SU-2011:1240-2: critical: VUL-0: flash-player: sec. update to version 11.1.102.55
by opensuse-security＠opensuse.org 16 Nov '11

16 Nov '11

openSUSE Security Update: VUL-0: flash-player: sec. update to version 11.1.102.55 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1240-2 Rating: critical References: #729797 Cross-References: CVE-2011-2445 CVE-2011-2450 CVE-2011-2451 CVE-2011-2452 CVE-2011-2453 CVE-2011-2454 CVE-2011-2455 CVE-2011-2456 CVE-2011-2457 CVE-2011-2458 CVE-2011-2459 CVE-2011-2460 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. It includes one version update. Description: flash-player update to version 11.1.102.55 to fix the following critical security issues: CVE-2011-2445, CVE-2011-2450, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2456, CVE-2011-2457, CVE-2011-2458, CVE-2011-2459, CVE-2011-2460 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch flash-player-5436 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 11.1.102.55]: flash-player-11.1.102.55-0.6.1 References: http://support.novell.com/security/cve/CVE-2011-2445.html http://support.novell.com/security/cve/CVE-2011-2450.html http://support.novell.com/security/cve/CVE-2011-2451.html http://support.novell.com/security/cve/CVE-2011-2452.html http://support.novell.com/security/cve/CVE-2011-2453.html http://support.novell.com/security/cve/CVE-2011-2454.html http://support.novell.com/security/cve/CVE-2011-2455.html http://support.novell.com/security/cve/CVE-2011-2456.html http://support.novell.com/security/cve/CVE-2011-2457.html http://support.novell.com/security/cve/CVE-2011-2458.html http://support.novell.com/security/cve/CVE-2011-2459.html http://support.novell.com/security/cve/CVE-2011-2460.html https://bugzilla.novell.com/729797

1 0

openSUSE-SU-2011:1251-1: moderate: VUL-0: CVE-2011-2939: icedtea-web: second-level domain subdomains and suffix domain SOP bypass
by opensuse-security＠opensuse.org 16 Nov '11

16 Nov '11

openSUSE Security Update: VUL-0: CVE-2011-2939: icedtea-web: second-level domain subdomains and suffix domain SOP bypass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1251-1 Rating: moderate References: #729870 Cross-References: CVE-2011-2939 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Update to version 1.1.4 of icedtea-web to fix the following issues: - CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass - PR778: Jar download and server certificate verification deadlock Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch icedtea-web-5422 - openSUSE 11.3: zypper in -t patch icedtea-web-5422 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.1.4]: icedtea-web-1.1.4-0.2.1 - openSUSE 11.4 (noarch) [New Version: 1.1.4]: icedtea-web-javadoc-1.1.4-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.1.4]: icedtea-web-1.1.4-0.2.1 - openSUSE 11.3 (noarch) [New Version: 1.1.4]: icedtea-web-javadoc-1.1.4-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-2939.html https://bugzilla.novell.com/729870

1 0

openSUSE-SU-2011:1250-1: moderate: mysql
by opensuse-security＠opensuse.org 16 Nov '11

16 Nov '11

openSUSE Security Update: mysql ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1250-1 Rating: moderate References: #644864 Cross-References: CVE-2010-3833 CVE-2010-3834 CVE-2010-3835 CVE-2010-3836 CVE-2010-3837 CVE-2010-3838 CVE-2010-3839 CVE-2010-3840 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. It includes one version update. Description: This mysql update fixes the following security issues - CVE-2010-3833: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors (CWE-399) - CVE-2010-3834: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Insufficient Information (CWE-noinfo) - CVE-2010-3835: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Numeric Errors (CWE-189) - CVE-2010-3836: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors (CWE-399) - CVE-2010-3837: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors (CWE-399) - CVE-2010-3838: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other) - CVE-2010-3839: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Design Error (CWE-DesignError) - CVE-2010-3840: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libmysqlclient-devel-4676 - openSUSE 11.3: zypper in -t patch libmysqlclient-devel-4676 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 5.1.57]: libmysqlclient-devel-5.1.57-0.3.1 libmysqlclient16-5.1.57-0.3.1 libmysqlclient_r16-5.1.57-0.3.1 libmysqld-devel-5.1.57-0.3.1 libmysqld0-5.1.57-0.3.1 mysql-community-server-5.1.57-0.3.1 mysql-community-server-bench-5.1.57-0.3.1 mysql-community-server-client-5.1.57-0.3.1 mysql-community-server-debug-5.1.57-0.3.1 mysql-community-server-test-5.1.57-0.3.1 mysql-community-server-tools-5.1.57-0.3.1 - openSUSE 11.4 (x86_64) [New Version: 5.1.57]: libmysqlclient16-32bit-5.1.57-0.3.1 libmysqlclient_r16-32bit-5.1.57-0.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 5.1.57]: libmysqlclient-devel-5.1.57-0.3.1 libmysqlclient16-5.1.57-0.3.1 libmysqlclient_r16-5.1.57-0.3.1 libmysqld-devel-5.1.57-0.3.1 libmysqld0-5.1.57-0.3.1 mysql-community-server-5.1.57-0.3.1 mysql-community-server-bench-5.1.57-0.3.1 mysql-community-server-client-5.1.57-0.3.1 mysql-community-server-debug-5.1.57-0.3.1 mysql-community-server-test-5.1.57-0.3.1 mysql-community-server-tools-5.1.57-0.3.1 - openSUSE 11.3 (x86_64) [New Version: 5.1.57]: libmysqlclient16-32bit-5.1.57-0.3.1 libmysqlclient_r16-32bit-5.1.57-0.3.1 References: http://support.novell.com/security/cve/CVE-2010-3833.html http://support.novell.com/security/cve/CVE-2010-3834.html http://support.novell.com/security/cve/CVE-2010-3835.html http://support.novell.com/security/cve/CVE-2010-3836.html http://support.novell.com/security/cve/CVE-2010-3837.html http://support.novell.com/security/cve/CVE-2010-3838.html http://support.novell.com/security/cve/CVE-2010-3839.html http://support.novell.com/security/cve/CVE-2010-3840.html https://bugzilla.novell.com/644864

1 0