August 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1393-1: moderate: ruby: configure https usage for rubygems.org
by opensuse-security＠opensuse.org 30 Aug '13

30 Aug '13

openSUSE Security Update: ruby: configure https usage for rubygems.org ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1393-1 Rating: moderate References: Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The ruby gemrc configured the gem installation source as http source, allowing man in the middle attacks (if someone could provide a different address for rubygems.org). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-668 - openSUSE 12.2: zypper in -t patch openSUSE-2013-668 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): ruby-1.9.3-15.6.1 ruby-devel-1.9.3-15.6.1 - openSUSE 12.2 (i586 x86_64): ruby-1.9.3-2.8.1 ruby-common-1.9.3-2.8.1 ruby-devel-1.9.3-2.8.1 References:

1 0

openSUSE-SU-2013:1392-1: moderate: xen: security and bugfix update to 4.1.5
by opensuse-security＠opensuse.org 30 Aug '13

30 Aug '13

openSUSE Security Update: xen: security and bugfix update to 4.1.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1392-1 Rating: moderate References: #801663 #803712 #809662 #813673 #813675 #813677 #814709 #816156 #816159 #816163 #819416 #820917 #820919 #820920 #823011 #823608 #823786 #824676 #826882 Cross-References: CVE-2013-1432 CVE-2013-1917 CVE-2013-1918 CVE-2013-1919 CVE-2013-1920 CVE-2013-1952 CVE-2013-1964 CVE-2013-2072 CVE-2013-2076 CVE-2013-2077 CVE-2013-2078 CVE-2013-2211 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has 7 fixes is now available. Description: XEN was updated to 4.1.5 release. It fixes various bugs and security issues. Issues fixed seperately from the 4.1.5 release: - bnc#824676 - Failed to setup devices for vm instance when start multiple vms simultaneously - bnc#XXXXXX - xen: CVE-2013-XXXX: XSA-61: suppress device assignment to HVM guest when there is no IOMMU - Various upstream patches from Jan were integrated. - bnc#823786 - migrate.py support of short options dropped by PTF - bnc#803712 - after live migration rcu_sched_state detected stalls add new option xm migrate --min_remaing <num> - CVE-2013-1432 / bnc#826882 - xen: XSA-58: x86: fix page refcount handling in page table pin error path - CVE-2013-2211 / bnc#823608 - xen: XSA-57: libxl allows guest write access to sensitive console related xenstore keys - bnc#823011 - xen: XSA-55: Multiple vulnerabilities in libelf PV kernel handling - bnc#801663 - performance of mirror lvm unsuitable for production - CVE-2013-1918/ bnc#816159 - xen: CVE-2013-1918: XSA-45: Several long latency operations are not preemptible - CVE-2013-1952 / bnc#816163 - xen: CVE-2013-1952: XSA-49: VT-d interrupt remapping source validation flaw for bridges - CVE-2013-2076 / bnc#820917 - CVE-2013-2076: xen: Information leak on XSAVE/XRSTOR capable AMD CPUs (XSA-52) - CVE-2013-2077 / bnc#820919 - CVE-2013-2077: xen: Hypervisor crash due to missing exception recovery on XRSTOR (XSA-53) - CVE-2013-2078 / bnc#820920 - CVE-2013-2078: xen: Hypervisor crash due to missing exception recovery on XSETBV (XSA-54) - CVE-2013-2072 / bnc#819416 - xen: CVE-2013-2072: XSA-56: Buffer overflow in xencontrol Python bindings affecting xend - Update to Xen 4.1.5 c/s 23509 There were many xen.spec file patches dropped as now being included in the 4.1.5 tarball. - CVE-2013-1918 / bnc#816159 - xen: XSA-45: Several long latency operations are not preemptible - CVE-2013-1952 / bnc#816163 - xen: XSA-49: VT-d interrupt remapping source validation flaw for bridges - bnc#809662 - can't use pv-grub to start domU (pygrub does work) - CVE-2013-1917 / bnc#813673 - xen: Xen PV DoS vulnerability with SYSENTER - CVE-2013-1919 / bnc#813675 - xen: Several access permission issues with IRQs for unprivileged guests - CVE-2013-1920 / bnc#813677 - xen: Potential use of freed memory in event channel operations - bnc#814709 - Unable to create XEN virtual machines in SLED 11 SP2 on Kyoto Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-669 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): xen-debugsource-4.1.5_04-5.29.1 xen-devel-4.1.5_04-5.29.1 xen-kmp-default-4.1.5_04_k3.4.47_2.38-5.29.1 xen-kmp-default-debuginfo-4.1.5_04_k3.4.47_2.38-5.29.1 xen-kmp-desktop-4.1.5_04_k3.4.47_2.38-5.29.1 xen-kmp-desktop-debuginfo-4.1.5_04_k3.4.47_2.38-5.29.1 xen-libs-4.1.5_04-5.29.1 xen-libs-debuginfo-4.1.5_04-5.29.1 xen-tools-domU-4.1.5_04-5.29.1 xen-tools-domU-debuginfo-4.1.5_04-5.29.1 - openSUSE 12.2 (x86_64): xen-4.1.5_04-5.29.1 xen-doc-html-4.1.5_04-5.29.1 xen-doc-pdf-4.1.5_04-5.29.1 xen-libs-32bit-4.1.5_04-5.29.1 xen-libs-debuginfo-32bit-4.1.5_04-5.29.1 xen-tools-4.1.5_04-5.29.1 xen-tools-debuginfo-4.1.5_04-5.29.1 - openSUSE 12.2 (i586): xen-kmp-pae-4.1.5_04_k3.4.47_2.38-5.29.1 xen-kmp-pae-debuginfo-4.1.5_04_k3.4.47_2.38-5.29.1 References: http://support.novell.com/security/cve/CVE-2013-1432.html http://support.novell.com/security/cve/CVE-2013-1917.html http://support.novell.com/security/cve/CVE-2013-1918.html http://support.novell.com/security/cve/CVE-2013-1919.html http://support.novell.com/security/cve/CVE-2013-1920.html http://support.novell.com/security/cve/CVE-2013-1952.html http://support.novell.com/security/cve/CVE-2013-1964.html http://support.novell.com/security/cve/CVE-2013-2072.html http://support.novell.com/security/cve/CVE-2013-2076.html http://support.novell.com/security/cve/CVE-2013-2077.html http://support.novell.com/security/cve/CVE-2013-2078.html http://support.novell.com/security/cve/CVE-2013-2211.html https://bugzilla.novell.com/801663 https://bugzilla.novell.com/803712 https://bugzilla.novell.com/809662 https://bugzilla.novell.com/813673 https://bugzilla.novell.com/813675 https://bugzilla.novell.com/813677 https://bugzilla.novell.com/814709 https://bugzilla.novell.com/816156 https://bugzilla.novell.com/816159 https://bugzilla.novell.com/816163 https://bugzilla.novell.com/819416 https://bugzilla.novell.com/820917 https://bugzilla.novell.com/820919 https://bugzilla.novell.com/820920 https://bugzilla.novell.com/823011 https://bugzilla.novell.com/823608 https://bugzilla.novell.com/823786 https://bugzilla.novell.com/824676 https://bugzilla.novell.com/826882

1 0

openSUSE-RU-2013:1391-1: moderate: release-notes-openSUSE: added note on sysvinit
by maintenance＠opensuse.org 30 Aug '13

30 Aug '13

openSUSE Recommended Update: release-notes-openSUSE: added note on sysvinit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1391-1 Rating: moderate References: #830979 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Releases Notes were updated to mention: * New entries: Sysvinit Support No Longer Available (bnc#830979). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-667 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): release-notes-openSUSE-12.3.11-1.26.1 References: https://bugzilla.novell.com/830979

1 0

openSUSE-RU-2013:1388-1: permission: fixed PERMISSION_FSCAPS typo
by maintenance＠opensuse.org 29 Aug '13

29 Aug '13

openSUSE Recommended Update: permission: fixed PERMISSION_FSCAPS typo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1388-1 Rating: low References: #834790 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The /etc/sysconfig/security uses "PERMISSION_FSCAPS" as variable, while chkstat queried PERMISSIONS_FSCAPS... The chkstat binary was adjusted the correct PERMISSION_FSCAPS name. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-666 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): permissions-2013.01.29.1841-1.5.1 permissions-debuginfo-2013.01.29.1841-1.5.1 permissions-debugsource-2013.01.29.1841-1.5.1 References: https://bugzilla.novell.com/834790

1 0

openSUSE-SU-2013:1377-1: moderate: cacti: security and bugfix update to 0.8.8b
by opensuse-security＠opensuse.org 23 Aug '13

23 Aug '13

openSUSE Security Update: cacti: security and bugfix update to 0.8.8b ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1377-1 Rating: moderate References: #834464 Cross-References: CVE-2013-1434 CVE-2013-1435 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: cacti was updated to version 0.8.8b to fix security issues and bugs. - Fixes CVE-2013-1434 CVE-2013-1435 - security: SQL injection and shell escaping issues - bug: Fixed issue with custom data source information being lost when saved from edit - bug: Repopulate the poller cache on new installations - bug: Fix issue with poller not escaping the script query path correctly - bug: Allow snmpv3 priv proto none - bug: Fix issue where host activate may flush the entire poller item cache Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-664 - openSUSE 12.2: zypper in -t patch openSUSE-2013-664 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): cacti-0.8.8b-5.4.1 - openSUSE 12.2 (noarch): cacti-0.8.8b-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1434.html http://support.novell.com/security/cve/CVE-2013-1435.html https://bugzilla.novell.com/834464

1 0

openSUSE-RU-2013:1376-1: moderate: mariadb, mysql-community-server: bugfix update
by maintenance＠opensuse.org 23 Aug '13

23 Aug '13

openSUSE Recommended Update: mariadb, mysql-community-server: bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1376-1 Rating: moderate References: #734436 #834028 #834967 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: mysql-community-server and mariadb received several bugfixes. - fix hardcoded plugin paths (bnc#834028) - fix includedir (bnc#734436) - use chown --no-dereference to improve security (bnc#834967) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-665 - openSUSE 12.2: zypper in -t patch openSUSE-2013-665 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libmysql55client18-5.5.32-1.8.1 libmysql55client18-debuginfo-5.5.32-1.8.1 libmysql55client_r18-5.5.32-1.8.1 libmysqlclient-devel-5.5.32-1.8.1 libmysqlclient18-5.5.32-1.8.1 libmysqlclient18-debuginfo-5.5.32-1.8.1 libmysqlclient_r18-5.5.32-1.8.1 libmysqld-devel-5.5.32-1.8.1 libmysqld18-5.5.32-1.8.1 libmysqld18-debuginfo-5.5.32-1.8.1 mariadb-5.5.32-1.8.1 mariadb-bench-5.5.32-1.8.1 mariadb-bench-debuginfo-5.5.32-1.8.1 mariadb-client-5.5.32-1.8.1 mariadb-client-debuginfo-5.5.32-1.8.1 mariadb-debug-version-5.5.32-1.8.1 mariadb-debug-version-debuginfo-5.5.32-1.8.1 mariadb-debuginfo-5.5.32-1.8.1 mariadb-debugsource-5.5.32-1.8.1 mariadb-errormessages-5.5.32-1.8.1 mariadb-test-5.5.32-1.8.1 mariadb-test-debuginfo-5.5.32-1.8.1 mariadb-tools-5.5.32-1.8.1 mariadb-tools-debuginfo-5.5.32-1.8.1 mysql-community-server-5.5.32-1.8.1 mysql-community-server-bench-5.5.32-1.8.1 mysql-community-server-bench-debuginfo-5.5.32-1.8.1 mysql-community-server-client-5.5.32-1.8.1 mysql-community-server-client-debuginfo-5.5.32-1.8.1 mysql-community-server-debug-version-5.5.32-1.8.1 mysql-community-server-debug-version-debuginfo-5.5.32-1.8.1 mysql-community-server-debuginfo-5.5.32-1.8.1 mysql-community-server-debugsource-5.5.32-1.8.1 mysql-community-server-errormessages-5.5.32-1.8.1 mysql-community-server-test-5.5.32-1.8.1 mysql-community-server-test-debuginfo-5.5.32-1.8.1 mysql-community-server-tools-5.5.32-1.8.1 mysql-community-server-tools-debuginfo-5.5.32-1.8.1 - openSUSE 12.3 (x86_64): libmysql55client18-32bit-5.5.32-1.8.1 libmysql55client18-debuginfo-32bit-5.5.32-1.8.1 libmysql55client_r18-32bit-5.5.32-1.8.1 libmysqlclient18-32bit-5.5.32-1.8.1 libmysqlclient18-debuginfo-32bit-5.5.32-1.8.1 libmysqlclient_r18-32bit-5.5.32-1.8.1 - openSUSE 12.2 (i586 x86_64): libmariadbclient18-5.5.32-1.12.1 libmariadbclient18-debuginfo-5.5.32-1.12.1 libmariadbclient_r18-5.5.32-1.12.1 libmysqlclient-devel-5.5.32-1.12.1 libmysqlclient18-5.5.32-1.12.1 libmysqlclient18-debuginfo-5.5.32-1.12.1 libmysqlclient_r18-5.5.32-1.12.1 libmysqld-devel-5.5.32-1.12.1 libmysqld18-5.5.32-1.12.1 libmysqld18-debuginfo-5.5.32-1.12.1 mariadb-5.5.32-1.12.1 mariadb-bench-5.5.32-1.12.1 mariadb-bench-debuginfo-5.5.32-1.12.1 mariadb-client-5.5.32-1.12.1 mariadb-client-debuginfo-5.5.32-1.12.1 mariadb-debug-version-5.5.32-1.12.1 mariadb-debug-version-debuginfo-5.5.32-1.12.1 mariadb-debuginfo-5.5.32-1.12.1 mariadb-debugsource-5.5.32-1.12.1 mariadb-errormessages-5.5.32-1.12.1 mariadb-test-5.5.32-1.12.1 mariadb-test-debuginfo-5.5.32-1.12.1 mariadb-tools-5.5.32-1.12.1 mariadb-tools-debuginfo-5.5.32-1.12.1 mysql-community-server-5.5.32-1.12.1 mysql-community-server-bench-5.5.32-1.12.1 mysql-community-server-bench-debuginfo-5.5.32-1.12.1 mysql-community-server-client-5.5.32-1.12.1 mysql-community-server-client-debuginfo-5.5.32-1.12.1 mysql-community-server-debug-version-5.5.32-1.12.1 mysql-community-server-debug-version-debuginfo-5.5.32-1.12.1 mysql-community-server-debuginfo-5.5.32-1.12.1 mysql-community-server-debugsource-5.5.32-1.12.1 mysql-community-server-errormessages-5.5.32-1.12.1 mysql-community-server-test-5.5.32-1.12.1 mysql-community-server-test-debuginfo-5.5.32-1.12.1 mysql-community-server-tools-5.5.32-1.12.1 mysql-community-server-tools-debuginfo-5.5.32-1.12.1 - openSUSE 12.2 (x86_64): libmariadbclient18-32bit-5.5.32-1.12.1 libmariadbclient18-debuginfo-32bit-5.5.32-1.12.1 libmariadbclient_r18-32bit-5.5.32-1.12.1 libmysqlclient18-32bit-5.5.32-1.12.1 libmysqlclient18-debuginfo-32bit-5.5.32-1.12.1 libmysqlclient_r18-32bit-5.5.32-1.12.1 References: https://bugzilla.novell.com/734436 https://bugzilla.novell.com/834028 https://bugzilla.novell.com/834967

1 0

openSUSE-RU-2013:1375-1: moderate: ecryptfs-utils: fixed pam-config usage during update
by maintenance＠opensuse.org 23 Aug '13

23 Aug '13

openSUSE Recommended Update: ecryptfs-utils: fixed pam-config usage during update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1375-1 Rating: moderate References: #814098 #834993 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: ecryptfs-utils was updated so that package updating does not remove the PAM snippets. - fix %postun to not run pam-config on update (bnc#814098, bnc#834993) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-663 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): ecryptfs-utils-103-7.9.1 ecryptfs-utils-debuginfo-103-7.9.1 ecryptfs-utils-debugsource-103-7.9.1 - openSUSE 12.3 (x86_64): ecryptfs-utils-32bit-103-7.9.1 ecryptfs-utils-debuginfo-32bit-103-7.9.1 References: https://bugzilla.novell.com/814098 https://bugzilla.novell.com/834993

1 0

openSUSE-SU-2013:1372-1: moderate: update for strongswan
by opensuse-security＠opensuse.org 22 Aug '13

22 Aug '13

openSUSE Security Update: update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1372-1 Rating: moderate References: #833278 Cross-References: CVE-2013-5018 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of strongswan fixed a denial-of-service vulnerability, that could be triggered by special XAuth usernames and EAP identities. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-128 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): strongswan-4.5.0-6.56.1 strongswan-debugsource-4.5.0-6.56.1 strongswan-doc-4.5.0-6.56.1 strongswan-ikev1-4.5.0-6.56.1 strongswan-ikev1-debuginfo-4.5.0-6.56.1 strongswan-ikev2-4.5.0-6.56.1 strongswan-ikev2-debuginfo-4.5.0-6.56.1 strongswan-ipsec-4.5.0-6.56.1 strongswan-ipsec-debuginfo-4.5.0-6.56.1 strongswan-libs0-4.5.0-6.56.1 strongswan-libs0-debuginfo-4.5.0-6.56.1 strongswan-mysql-4.5.0-6.56.1 strongswan-mysql-debuginfo-4.5.0-6.56.1 strongswan-nm-4.5.0-6.56.1 strongswan-nm-debuginfo-4.5.0-6.56.1 strongswan-sqlite-4.5.0-6.56.1 strongswan-sqlite-debuginfo-4.5.0-6.56.1 References: http://support.novell.com/security/cve/CVE-2013-5018.html https://bugzilla.novell.com/833278

1 0

openSUSE-SU-2013:1371-1: moderate: poppler: fixed terminal escape sequence security issue
by opensuse-security＠opensuse.org 22 Aug '13

22 Aug '13

openSUSE Security Update: poppler: fixed terminal escape sequence security issue ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1371-1 Rating: moderate References: #795582 #834476 Cross-References: CVE-2012-2142 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: poppler was updated to fix a security problem. PDF files could emit messages with terminal escape sequences which could be used to inject shell code if the user ran a PDF viewer from a terminal shell (CVE-2012-2142). Also a bug was fixed to avoid division by zero when using origpagesizes option (bnc#795582) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-662 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libpoppler-cpp0-0.20.0-2.13.1 libpoppler-cpp0-debuginfo-0.20.0-2.13.1 libpoppler-devel-0.20.0-2.13.1 libpoppler-glib-devel-0.20.0-2.13.1 libpoppler-glib8-0.20.0-2.13.1 libpoppler-glib8-debuginfo-0.20.0-2.13.1 libpoppler-qt4-4-0.20.0-2.13.1 libpoppler-qt4-4-debuginfo-0.20.0-2.13.1 libpoppler-qt4-devel-0.20.0-2.13.1 libpoppler25-0.20.0-2.13.1 libpoppler25-debuginfo-0.20.0-2.13.1 poppler-debugsource-0.20.0-2.13.1 poppler-qt-debugsource-0.20.0-2.13.1 poppler-tools-0.20.0-2.13.1 poppler-tools-debuginfo-0.20.0-2.13.1 typelib-1_0-Poppler-0_18-0.20.0-2.13.1 References: http://support.novell.com/security/cve/CVE-2012-2142.html https://bugzilla.novell.com/795582 https://bugzilla.novell.com/834476

1 0

openSUSE-SU-2013:1370-1: critical: puppet: security fix for YAML support
by opensuse-security＠opensuse.org 22 Aug '13

22 Aug '13

openSUSE Security Update: puppet: security fix for YAML support ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1370-1 Rating: critical References: #825878 Cross-References: CVE-2013-3567 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A potential remote code execution via YAML was fixed in puppet. (CVE-2013-3567) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-661 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): puppet-3.0.2-2.9.1 puppet-server-3.0.2-2.9.1 References: http://support.novell.com/security/cve/CVE-2013-3567.html https://bugzilla.novell.com/825878

1 0