December 2011 - openSUSE Security Announce

[security-announce] SUSE-SU-2011:1035-2: important: Security update for Xorg-X11
by opensuse-security＠opensuse.org 06 Dec '11

06 Dec '11

SUSE Security Update: Security update for Xorg-X11 ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1035-2 Rating: important References: #709851 Cross-References: CVE-2011-2895 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The following bug has been fixed: * Specially crafted font files could have caused a buffer overflow in applications that use libXfont to load such files (CVE-2011-2895). Security Issue reference: * CVE-2011-2895 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2895 > Indications: Please install this update. Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): xorg-x11-6.9.0-50.76.4 xorg-x11-Xnest-6.9.0-50.76.4 xorg-x11-Xvfb-6.9.0-50.76.4 xorg-x11-Xvnc-6.9.0-50.76.4 xorg-x11-devel-6.9.0-50.76.4 xorg-x11-doc-6.9.0-50.76.4 xorg-x11-fonts-100dpi-6.9.0-50.76.4 xorg-x11-fonts-75dpi-6.9.0-50.76.4 xorg-x11-fonts-cyrillic-6.9.0-50.76.4 xorg-x11-fonts-scalable-6.9.0-50.76.4 xorg-x11-fonts-syriac-6.9.0-50.76.4 xorg-x11-libs-6.9.0-50.76.4 xorg-x11-man-6.9.0-50.76.4 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc x86_64): xorg-x11-sdk-6.9.0-50.76.4 xorg-x11-server-6.9.0-50.76.4 xorg-x11-server-glx-6.9.0-50.76.4 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): xorg-x11-devel-32bit-6.9.0-50.76.4 xorg-x11-libs-32bit-6.9.0-50.76.4 - SUSE Linux Enterprise Server 10 SP4 (ia64): xorg-x11-libs-x86-6.9.0-50.76.4 - SUSE Linux Enterprise Server 10 SP4 (ppc): xorg-x11-devel-64bit-6.9.0-50.76.4 xorg-x11-libs-64bit-6.9.0-50.76.4 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): xorg-x11-6.9.0-50.76.4 xorg-x11-Xnest-6.9.0-50.76.4 xorg-x11-Xvfb-6.9.0-50.76.4 xorg-x11-Xvnc-6.9.0-50.76.4 xorg-x11-devel-6.9.0-50.76.4 xorg-x11-fonts-100dpi-6.9.0-50.76.4 xorg-x11-fonts-75dpi-6.9.0-50.76.4 xorg-x11-fonts-cyrillic-6.9.0-50.76.4 xorg-x11-fonts-scalable-6.9.0-50.76.4 xorg-x11-fonts-syriac-6.9.0-50.76.4 xorg-x11-libs-6.9.0-50.76.4 xorg-x11-man-6.9.0-50.76.4 xorg-x11-server-6.9.0-50.76.4 xorg-x11-server-glx-6.9.0-50.76.4 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): xorg-x11-devel-32bit-6.9.0-50.76.4 xorg-x11-libs-32bit-6.9.0-50.76.4 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): xorg-x11-Xvfb-6.9.0-50.76.4 xorg-x11-doc-6.9.0-50.76.4 - SLE SDK 10 SP4 (i586 ia64 ppc x86_64): xorg-x11-sdk-6.9.0-50.76.4 References: http://support.novell.com/security/cve/CVE-2011-2895.html https://bugzilla.novell.com/709851 http://download.novell.com/patch/finder/?keywords=1a2ab2f33ca77404c8f69d54b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1300-1: important: Security update for nginx-1.0
by opensuse-security＠opensuse.org 05 Dec '11

05 Dec '11

SUSE Security Update: Security update for nginx-1.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1300-1 Rating: important References: #731084 Cross-References: CVE-2011-4315 Affected Products: WebYaST 1.2 SUSE Studio Standard Edition 1.2 SUSE Studio Onsite 1.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A flaw in the custom DNS resolver of nginx could lead to a heap based buffer overflow which could potentially allow attackers to execute arbitrary code or to cause a Denial of Service (bnc#731084, CVE-2011-4315). Security Issue reference: * CVE-2011-4315 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4315 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - WebYaST 1.2: zypper in -t patch slewyst12-nginx-1.0-5464 - SUSE Studio Standard Edition 1.2: zypper in -t patch sleslms12-nginx-1.0-5464 - SUSE Studio Onsite 1.2: zypper in -t patch slestso12-nginx-1.0-5464 To bring your system up-to-date, use "zypper patch". Package List: - WebYaST 1.2 (i586 ia64 ppc64 s390x x86_64): nginx-1.0-1.0.0-0.11.1 - SUSE Studio Standard Edition 1.2 (x86_64): nginx-1.0-1.0.0-0.11.1 - SUSE Studio Onsite 1.2 (x86_64): nginx-1.0-1.0.0-0.11.1 References: http://support.novell.com/security/cve/CVE-2011-4315.html https://bugzilla.novell.com/731084 http://download.novell.com/patch/finder/?keywords=27ad6bfa3403bc754de85cea4… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:1299-1: important: xorg-x11-libs
by opensuse-security＠opensuse.org 05 Dec '11

05 Dec '11

openSUSE Security Update: xorg-x11-libs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1299-1 Rating: important References: #709851 Cross-References: CVE-2011-2895 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted font files could cause a buffer overflow in applications that use libXfont to load such files (CVE-2011-2895). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libpciaccess0-5102 - openSUSE 11.3: zypper in -t patch libpciaccess0-5102 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libpciaccess0-7.6-17.18.1 libpciaccess0-devel-7.6-17.18.1 xorg-x11-devel-7.6-17.18.1 xorg-x11-libs-7.6-17.18.1 - openSUSE 11.4 (x86_64): libpciaccess0-32bit-7.6-17.18.1 xorg-x11-devel-32bit-7.6-17.18.1 xorg-x11-libs-32bit-7.6-17.18.1 - openSUSE 11.3 (i586 x86_64): libpciaccess0-7.5-4.3.1 libpciaccess0-devel-7.5-4.3.1 xorg-x11-devel-7.5-4.3.1 xorg-x11-libs-7.5-4.3.1 - openSUSE 11.3 (x86_64): libpciaccess0-32bit-7.5-4.3.1 xorg-x11-devel-32bit-7.5-4.3.1 xorg-x11-libs-32bit-7.5-4.3.1 References: http://support.novell.com/security/cve/CVE-2011-2895.html https://bugzilla.novell.com/709851 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1298-1: important: Security update for IBM Java
by opensuse-security＠opensuse.org 02 Dec '11

02 Dec '11

SUSE Security Update: Security update for IBM Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1298-1 Rating: important References: #731939 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 5 was updated to SR13, fixing various bugs and security issues. Security issues addressed are tracked by: CVE-2011-3545, CVE-2011-3547, CVE-2011-3548 CVE-2011-3549, CVE-2011-3552, CVE-2011-3554 CVE-2011-3557 Indications: Please install this update. Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ppc s390x x86_64): java-1_5_0-ibm-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-devel-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-fonts-1.5.0_sr13.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): java-1_5_0-ibm-32bit-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr13.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc): java-1_5_0-ibm-jdbc-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-plugin-1.5.0_sr13.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (x86_64): java-1_5_0-ibm-alsa-32bit-1.5.0_sr13.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_5_0-ibm-alsa-1.5.0_sr13.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): java-1_5_0-ibm-64bit-1.5.0_sr13.0-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ppc s390x x86_64): java-1_5_0-ibm-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-devel-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-fonts-1.5.0_sr13.0-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (ppc): java-1_5_0-ibm-jdbc-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-plugin-1.5.0_sr13.0-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): java-1_5_0-ibm-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-demo-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-devel-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-fonts-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-src-1.5.0_sr13.0-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): java-1_5_0-ibm-32bit-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-alsa-32bit-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr13.0-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586): java-1_5_0-ibm-alsa-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-jdbc-1.5.0_sr13.0-0.5.1 java-1_5_0-ibm-plugin-1.5.0_sr13.0-0.5.1 References: https://bugzilla.novell.com/731939 http://download.novell.com/patch/finder/?keywords=f4937ae002dcdee7a337098f0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1292-1: important: Security update for xorg-x11-server
by opensuse-security＠opensuse.org 02 Dec '11

02 Dec '11

SUSE Security Update: Security update for xorg-x11-server ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1292-1 Rating: important References: #722944 Cross-References: CVE-2011-4028 CVE-2011-4029 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes two security issues with the X server: * A local attacker could find out if a file exists by exploiting the way that Xorg creates its lock files. (CVE-2011-4028 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4028 > ) * A non-root local user could set the read permission for all users on any file or directory. (CVE-2011-4029 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4029 > ) Indications: Please install this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-xorg-x11-Xvnc-5479 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-xorg-x11-Xvnc-5479 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-xorg-x11-Xvnc-5479 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-xorg-x11-Xvnc-5479 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): xorg-x11-server-sdk-7.4-27.40.52.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): xorg-x11-Xvnc-7.4-27.40.52.1 xorg-x11-server-7.4-27.40.52.1 xorg-x11-server-extra-7.4-27.40.52.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64): xorg-x11-Xvnc-7.4-27.40.52.1 xorg-x11-server-7.4-27.40.52.1 xorg-x11-server-extra-7.4-27.40.52.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): xorg-x11-Xvnc-7.4-27.40.52.1 xorg-x11-server-7.4-27.40.52.1 xorg-x11-server-extra-7.4-27.40.52.1 References: http://support.novell.com/security/cve/CVE-2011-4028.html http://support.novell.com/security/cve/CVE-2011-4029.html https://bugzilla.novell.com/722944 http://download.novell.com/patch/finder/?keywords=a425a7733f910d0e1b72d89e9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:1290-1: critical: Seamonkey update
by opensuse-security＠opensuse.org 01 Dec '11

01 Dec '11

openSUSE Security Update: Seamonkey update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1290-1 Rating: critical References: #728520 Cross-References: CVE-2011-2372 CVE-2011-2996 CVE-2011-2998 CVE-2011-2999 CVE-2011-3000 CVE-2011-3001 CVE-2011-3640 CVE-2011-3647 CVE-2011-3648 CVE-2011-3649 CVE-2011-3650 CVE-2011-3651 CVE-2011-3653 CVE-2011-3655 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. It includes one version update. Description: Seamonkey was upgraded to version 2.5 in order to fix the following security problems: * MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS against sites using Shift-JIS * MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654 Miscellaneous memory safety hazards * MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory corruption while profiling using Firebug * MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution via NoWaiverWrapper Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch seamonkey-5487 - openSUSE 11.3: zypper in -t patch seamonkey-5487 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.5]: seamonkey-2.5-0.2.1 seamonkey-dom-inspector-2.5-0.2.1 seamonkey-irc-2.5-0.2.1 seamonkey-translations-common-2.5-0.2.1 seamonkey-translations-other-2.5-0.2.1 seamonkey-venkman-2.5-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.5]: seamonkey-2.5-0.2.1 seamonkey-dom-inspector-2.5-0.2.1 seamonkey-irc-2.5-0.2.1 seamonkey-translations-common-2.5-0.2.1 seamonkey-translations-other-2.5-0.2.1 seamonkey-venkman-2.5-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-2372.html http://support.novell.com/security/cve/CVE-2011-2996.html http://support.novell.com/security/cve/CVE-2011-2998.html http://support.novell.com/security/cve/CVE-2011-2999.html http://support.novell.com/security/cve/CVE-2011-3000.html http://support.novell.com/security/cve/CVE-2011-3001.html http://support.novell.com/security/cve/CVE-2011-3640.html http://support.novell.com/security/cve/CVE-2011-3647.html http://support.novell.com/security/cve/CVE-2011-3648.html http://support.novell.com/security/cve/CVE-2011-3649.html http://support.novell.com/security/cve/CVE-2011-3650.html http://support.novell.com/security/cve/CVE-2011-3651.html http://support.novell.com/security/cve/CVE-2011-3653.html http://support.novell.com/security/cve/CVE-2011-3655.html https://bugzilla.novell.com/728520 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] Advance discontinuation notice for openSUSE 11.3
by Marcus Meissner 01 Dec '11

01 Dec '11

Hi, Dear opensuse-security-announce subscribers and openSUSE users, SUSE Security announces that the SUSE Security Team and the SUSE sponsored openSUSE maintenance team will stop releasing updates for openSUSE 11.3 soon. Having provided security-relevant and bug fixes for the last two releases and two months, we will stop releasing updates after Jan 16th 2012. A community driven extension of the maintenance like Evergreen for openSUSE 11.1 and 11.2 is possible and will be announced when happening. As a consequence, the openSUSE 11.3 distribution directory on our server download.opensuse.org will be removed from /distribution/11.3/ to free space on our mirror sites. The 11.3 directory in the update tree /update/11.3 will follow, some time after all updates have been published. Also the openSUSE buildservice repositories containing openSUSE 11.3 will be moved to DISCONTINUED:openSUSE:11.3 and building against openSUSE 11.3 will be disabled in all buildservice projects. The discontinuation of openSUSE 11.3 enables us to focus on the openSUSE distributions of a newer release dates to ensure that our users can continuously take advantage of the quality that they are used to with openSUSE products. This announcement holds true for openSUSE 11.3 only. As usual, the openSUSE project will continue to provide update packages for the following products: openSUSE 11.4 (supported until approximately Sep 15th 2012) openSUSE 12.1 (supported until approximately May 15th 2012) openSUSE 12.2 (currently in development, to be released in July 2011) for the next two openSUSE releases plus a two months overlap period. Please note that the maintenance cycles of SUSE Linux Enterprise products and products based on the SUSE Linux Enterprise Server operating system are not affected by this announcement and have longer life cycles. Our openSUSE lifetimes are tracked on http://en.opensuse.org/Lifetime . To learn more about SUSE Linux Enterprise products, please visit http://www.novell.com/linux/suse/ . For a detailed list of the life cycles of our Enterprise Products please visit http://support.novell.com/lifecycle/ and http://support.novell.com/lifecycle/lcSearchResults.jsp?sl=suse If you have any questions regarding this announcement, please do not hesitate to contact SUSE Security at <security(a)suse.de>.

1 1