September 2011 - openSUSE Security Announce

[security-announce] SUSE-SU-2011:1042-1: important: Security update for Mozilla NSS
by opensuse-security＠opensuse.org 15 Sep '11

15 Sep '11

SUSE Security Update: Security update for Mozilla NSS ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1042-1 Rating: important References: #714931 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Server 10 SP3 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 SLE SDK 10 SP3 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes four new package versions. Description: This update updates Mozilla NSS to 3.12.11. The update marks the compromised DigiNotar Certificate Authority as untrusted For more information read: MFSA 2011-34 <http://www.mozilla.org/security/announce/2011/mfsa2011-34.h tml> * update to 3.12.10 o root CA changes o filter certain bogus certs (bmo#642815) o fix minor memory leaks o other bugfixes * update to 3.12.9 o fix minor memory leaks (bmo#619268) o fix crash in nss_cms_decoder_work_data (bmo#607058) o fix crash in certutil (bmo#620908) o handle invalid argument in JPAKE (bmo#609068) o J-PAKE support (API requirement for Firefox >= 4.0b8) * replaced expired PayPal test certificate (fixing testsuite) * removed DigiNotar root certifiate from trusted db (bmo#682927) This update also brings the prerequired Mozilla NSPR to version 4.8.9. * update to 4.8.9 * update to 4.8.8 o support IPv6 on Android (bmo#626866) o use AI_ADDRCONFIG for loopback hostnames (bmo#614526) o support SDP sockets (bmo#518078) o support m32r architecture (bmo#635667) o use atomic functions on ARM (bmo#626309) o some other fixes not affecting the Linux platform Indications: Please install this update. Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 1.9.2.22,3.12.11 and 4.8.9]: mozilla-nspr-4.8.9-1.5.8 mozilla-nspr-devel-4.8.9-1.5.8 mozilla-nss-3.12.11-3.7.1 mozilla-nss-devel-3.12.11-3.7.1 mozilla-nss-tools-3.12.11-3.7.1 mozilla-xulrunner192-1.9.2.22-0.5.1 mozilla-xulrunner192-gnome-1.9.2.22-0.5.1 mozilla-xulrunner192-translations-1.9.2.22-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x) [New Version: 3.6.22]: MozillaFirefox-3.6.22-0.5.1 MozillaFirefox-translations-3.6.22-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64) [New Version: 1.9.2.22,3.12.11 and 4.8.9]: mozilla-nspr-32bit-4.8.9-1.5.8 mozilla-nss-32bit-3.12.11-3.7.1 mozilla-xulrunner192-32bit-1.9.2.22-0.5.1 mozilla-xulrunner192-gnome-32bit-1.9.2.22-0.5.1 mozilla-xulrunner192-translations-32bit-1.9.2.22-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (ia64) [New Version: 3.12.11 and 4.8.9]: mozilla-nspr-x86-4.8.9-1.5.8 mozilla-nss-x86-3.12.11-3.7.1 - SUSE Linux Enterprise Server 10 SP4 (ppc) [New Version: 3.12.11 and 4.8.9]: mozilla-nspr-64bit-4.8.9-1.5.8 mozilla-nss-64bit-3.12.11-3.7.1 - SUSE Linux Enterprise Server 10 SP3 (i586 ia64 ppc s390x x86_64) [New Version: 1.9.2.22,3.12.11 and 4.8.9]: mozilla-nspr-4.8.9-1.5.8 mozilla-nspr-devel-4.8.9-1.5.8 mozilla-nss-3.12.11-3.7.1 mozilla-nss-devel-3.12.11-3.7.1 mozilla-nss-tools-3.12.11-3.7.1 mozilla-xulrunner192-1.9.2.22-0.5.1 mozilla-xulrunner192-gnome-1.9.2.22-0.5.1 mozilla-xulrunner192-translations-1.9.2.22-0.5.1 - SUSE Linux Enterprise Server 10 SP3 (i586 ia64 ppc s390x) [New Version: 3.6.22]: MozillaFirefox-3.6.22-0.5.1 MozillaFirefox-translations-3.6.22-0.5.1 - SUSE Linux Enterprise Server 10 SP3 (s390x x86_64) [New Version: 1.9.2.22,3.12.11 and 4.8.9]: mozilla-nspr-32bit-4.8.9-1.5.8 mozilla-nss-32bit-3.12.11-3.7.1 mozilla-xulrunner192-32bit-1.9.2.22-0.5.1 mozilla-xulrunner192-gnome-32bit-1.9.2.22-0.5.1 mozilla-xulrunner192-translations-32bit-1.9.2.22-0.5.1 - SUSE Linux Enterprise Server 10 SP3 (ia64) [New Version: 3.12.11 and 4.8.9]: mozilla-nspr-x86-4.8.9-1.5.8 mozilla-nss-x86-3.12.11-3.7.1 - SUSE Linux Enterprise Server 10 SP3 (ppc) [New Version: 3.12.11 and 4.8.9]: mozilla-nspr-64bit-4.8.9-1.5.8 mozilla-nss-64bit-3.12.11-3.7.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64) [New Version: 1.9.2.22,3.12.11 and 4.8.9]: mozilla-nspr-4.8.9-1.5.8 mozilla-nspr-devel-4.8.9-1.5.8 mozilla-nss-3.12.11-3.7.1 mozilla-nss-devel-3.12.11-3.7.1 mozilla-nss-tools-3.12.11-3.7.1 mozilla-xulrunner192-1.9.2.22-0.5.1 mozilla-xulrunner192-gnome-1.9.2.22-0.5.1 mozilla-xulrunner192-translations-1.9.2.22-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64) [New Version: 1.9.2.22,3.12.11 and 4.8.9]: mozilla-nspr-32bit-4.8.9-1.5.8 mozilla-nss-32bit-3.12.11-3.7.1 mozilla-xulrunner192-32bit-1.9.2.22-0.5.1 mozilla-xulrunner192-gnome-32bit-1.9.2.22-0.5.1 mozilla-xulrunner192-translations-32bit-1.9.2.22-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 3.6.22]: MozillaFirefox-3.6.22-0.5.1 MozillaFirefox-translations-3.6.22-0.5.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 3.12.11]: mozilla-nss-tools-3.12.11-3.7.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x): MozillaFirefox-branding-upstream-3.6.22-0.5.1 - SLE SDK 10 SP3 (i586 ia64 ppc s390x x86_64) [New Version: 3.12.11]: mozilla-nss-tools-3.12.11-3.7.1 - SLE SDK 10 SP3 (i586 ia64 ppc s390x) [New Version: 3.6.22]: MozillaFirefox-branding-upstream-3.6.22-0.5.1 References: https://bugzilla.novell.com/714931 http://download.novell.com/patch/finder/?keywords=0cbbd57fe88e0d56f99e55b02… http://download.novell.com/patch/finder/?keywords=0fa2d48df2a14d895b40a9898… http://download.novell.com/patch/finder/?keywords=60cc7c3ba5950c0ed48767065… http://download.novell.com/patch/finder/?keywords=9ef69b89f3d89e966afa74994… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1035-1: important: Security update for Xorg X11
by opensuse-security＠opensuse.org 13 Sep '11

13 Sep '11

SUSE Security Update: Security update for Xorg X11 ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1035-1 Rating: important References: #709851 Cross-References: CVE-2011-2895 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted font files could cause a buffer overflow in applications that use libXfont to load such files (CVE-2011-2895). Security Issue reference: * CVE-2011-2895 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2895 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-libpciaccess0-5103 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-libpciaccess0-5103 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-libpciaccess0-5103 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-libpciaccess0-5103 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): libpciaccess0-devel-7.4-8.26.3.1 xorg-x11-devel-7.4-8.26.3.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ppc64 s390x x86_64): xorg-x11-devel-32bit-7.4-8.26.3.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): libpciaccess0-7.4-8.26.3.1 xorg-x11-libs-7.4-8.26.3.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64): libpciaccess0-32bit-7.4-8.26.3.1 xorg-x11-libs-32bit-7.4-8.26.3.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64): libpciaccess0-7.4-8.26.3.1 xorg-x11-libs-7.4-8.26.3.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64): libpciaccess0-32bit-7.4-8.26.3.1 xorg-x11-libs-32bit-7.4-8.26.3.1 - SUSE Linux Enterprise Server 11 SP1 (ia64): libpciaccess0-x86-7.4-8.26.3.1 xorg-x11-libs-x86-7.4-8.26.3.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): libpciaccess0-7.4-8.26.3.1 libpciaccess0-devel-7.4-8.26.3.1 xorg-x11-devel-7.4-8.26.3.1 xorg-x11-libs-7.4-8.26.3.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64): libpciaccess0-32bit-7.4-8.26.3.1 xorg-x11-libs-32bit-7.4-8.26.3.1 References: http://support.novell.com/security/cve/CVE-2011-2895.html https://bugzilla.novell.com/709851 http://download.novell.com/patch/finder/?keywords=243cfa96e18e5e50f1a5b1fee… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:1031-2: important: MozillaThunderbird: 3.1.13
by opensuse-security＠opensuse.org 09 Sep '11

09 Sep '11

openSUSE Security Update: MozillaThunderbird: 3.1.13 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1031-2 Rating: important References: #714931 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes 5 new package versions. Description: This update brings Mozilla Thunderbird to 3.1.13. The purpose of this update is to blacklist the compromised DigiNotar Certificate Authority. For more information read: MFSA 2011-34 http://www.mozilla.org/security/announce/2011/mfsa2011-34.ht ml Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch MozillaThunderbird-5120 mozilla-js192-5127 seamonkey-5122 - openSUSE 11.3: zypper in -t patch MozillaFirefox-5118 MozillaThunderbird-5120 seamonkey-5122 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.9.2.22,2.3.3 and 3.1.14]: MozillaThunderbird-3.1.14-0.15.1 MozillaThunderbird-buildsymbols-3.1.14-0.15.1 MozillaThunderbird-devel-3.1.14-0.15.1 MozillaThunderbird-translations-common-3.1.14-0.15.1 MozillaThunderbird-translations-other-3.1.14-0.15.1 enigmail-1.1.2+3.1.14-0.15.1 mozilla-js192-1.9.2.22-0.2.1 mozilla-xulrunner192-1.9.2.22-0.2.1 mozilla-xulrunner192-buildsymbols-1.9.2.22-0.2.1 mozilla-xulrunner192-devel-1.9.2.22-0.2.1 mozilla-xulrunner192-gnome-1.9.2.22-0.2.1 mozilla-xulrunner192-translations-common-1.9.2.22-0.2.1 mozilla-xulrunner192-translations-other-1.9.2.22-0.2.1 seamonkey-2.3.3-0.2.1 seamonkey-dom-inspector-2.3.3-0.2.1 seamonkey-irc-2.3.3-0.2.1 seamonkey-translations-common-2.3.3-0.2.1 seamonkey-translations-other-2.3.3-0.2.1 seamonkey-venkman-2.3.3-0.2.1 - openSUSE 11.4 (x86_64) [New Version: 1.9.2.22]: mozilla-js192-32bit-1.9.2.22-0.2.1 mozilla-xulrunner192-32bit-1.9.2.22-0.2.1 mozilla-xulrunner192-gnome-32bit-1.9.2.22-0.2.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.22-0.2.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.22-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.9.2.22,2.3.3,3.1.14 and 3.6.22]: MozillaFirefox-3.6.22-0.2.1 MozillaFirefox-branding-upstream-3.6.22-0.2.1 MozillaFirefox-translations-common-3.6.22-0.2.1 MozillaFirefox-translations-other-3.6.22-0.2.1 MozillaThunderbird-3.1.14-0.19.1 MozillaThunderbird-devel-3.1.14-0.19.1 MozillaThunderbird-translations-common-3.1.14-0.19.1 MozillaThunderbird-translations-other-3.1.14-0.19.1 enigmail-1.1.2+3.1.14-0.19.1 mozilla-js192-1.9.2.22-0.2.1 mozilla-xulrunner192-1.9.2.22-0.2.1 mozilla-xulrunner192-buildsymbols-1.9.2.22-0.2.1 mozilla-xulrunner192-devel-1.9.2.22-0.2.1 mozilla-xulrunner192-gnome-1.9.2.22-0.2.1 mozilla-xulrunner192-translations-common-1.9.2.22-0.2.1 mozilla-xulrunner192-translations-other-1.9.2.22-0.2.1 seamonkey-2.3.3-0.2.1 seamonkey-dom-inspector-2.3.3-0.2.1 seamonkey-irc-2.3.3-0.2.1 seamonkey-translations-common-2.3.3-0.2.1 seamonkey-translations-other-2.3.3-0.2.1 seamonkey-venkman-2.3.3-0.2.1 - openSUSE 11.3 (x86_64) [New Version: 1.9.2.22]: mozilla-js192-32bit-1.9.2.22-0.2.1 mozilla-xulrunner192-32bit-1.9.2.22-0.2.1 mozilla-xulrunner192-gnome-32bit-1.9.2.22-0.2.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.22-0.2.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.22-0.2.1 References: https://bugzilla.novell.com/714931 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:1031-1: important: MozillaFirefox: 6.0.2
by opensuse-security＠opensuse.org 09 Sep '11

09 Sep '11

openSUSE Security Update: MozillaFirefox: 6.0.2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1031-1 Rating: important References: #714931 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: This update brings Mozilla Firefox to 6.0.2. The purpose of this update is to blacklist the compromised DigiNotar Certificate Authority. For more information read: MFSA 2011-34 http://www.mozilla.org/security/announce/2011/mfsa2011-34.ht ml Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch MozillaFirefox-5119 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 6.0.2]: MozillaFirefox-6.0.2-0.2.1 MozillaFirefox-branding-upstream-6.0.2-0.2.1 MozillaFirefox-buildsymbols-6.0.2-0.2.1 MozillaFirefox-devel-6.0.2-0.2.1 MozillaFirefox-translations-common-6.0.2-0.2.1 MozillaFirefox-translations-other-6.0.2-0.2.1 References: https://bugzilla.novell.com/714931 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1029-1: important: Security update for pure-ftpd
by opensuse-security＠opensuse.org 08 Sep '11

08 Sep '11

SUSE Security Update: Security update for pure-ftpd ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1029-1 Rating: important References: #685447 #699300 #700335 #703035 Affected Products: SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Server 10 SP3 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: The OES Netware add-ons in pure-ftpd had a security problem and some bugs, which are fixed by this update. A local attacker could overwrite local files when the OES remote server feature of pure-ftpd is enabled due to a directory traversal. ( CVE-2011-3171) Additionally the following bugs have been fixed: * bnc#699300 - FTP remote server navigation does not always succeed * bnc#685447 - pure-ftpd does not throw an error when the name resolution fails during remote server navigation * bnc#700335 - put files into NCP volumes fails * bnc#703035 - remote_server feature opens a vulnerability with directory traversal & file overwriting Indications: Please install this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-pure-ftpd-5091 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-pure-ftpd-5091 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-pure-ftpd-5091 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 1.0.22]: pure-ftpd-1.0.22-3.13.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.0.22]: pure-ftpd-1.0.22-3.13.1 - SUSE Linux Enterprise Server 10 SP3 (i586 ia64 ppc s390x x86_64): pure-ftpd-1.0.22-0.26.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 1.0.22]: pure-ftpd-1.0.22-3.13.1 References: https://bugzilla.novell.com/685447 https://bugzilla.novell.com/699300 https://bugzilla.novell.com/700335 https://bugzilla.novell.com/703035 http://download.novell.com/patch/finder/?keywords=c52bd104fe2da41024af9337e… http://download.novell.com/patch/finder/?keywords=dd45c5f4faa971592d516df47… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1028-1: important: Security update for pure-ftpd, pure-ftpd-debuginfo
by opensuse-security＠opensuse.org 08 Sep '11

08 Sep '11

SUSE Security Update: Security update for pure-ftpd, pure-ftpd-debuginfo ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1028-1 Rating: important References: #685447 #699300 #700335 #703035 Cross-References: CVE-2011-3171 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: The OES Netware add-ons in pure-ftpd had a security problem and some bugs, which are fixed by this update. A local attacker could overwrite local files when the OES remote server feature of pure-ftpd is enabled due to a directory traversal. (CVE-2011-3171) Additionally the following bugs have been fixed: * bnc#699300 - FTP remote server navigation does not always succeed * bnc#685447 - pure-ftpd does not throw an error when the name resolution fails during remote server navigation * bnc#700335 - put files into NCP volumes fails * bnc#703035 - remote_server feature opens a vulnerability with directory traversal & file overwriting Security Issue reference: * CVE-2011-3171 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3171 > Indications: Please install this update. Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): pure-ftpd-1.0.22-0.26.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): pure-ftpd-1.0.22-0.26.1 References: http://support.novell.com/security/cve/CVE-2011-3171.html https://bugzilla.novell.com/685447 https://bugzilla.novell.com/699300 https://bugzilla.novell.com/700335 https://bugzilla.novell.com/703035 http://download.novell.com/patch/finder/?keywords=9a99a741b9d38804b2622f8b9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:1024-1: important: mozilla-nss: Update 3.12.11 update
by opensuse-security＠opensuse.org 08 Sep '11

08 Sep '11

openSUSE Security Update: mozilla-nss: Update 3.12.11 update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1024-1 Rating: important References: #691669 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: This update updates mozilla nss to 3.12.11. It blacklists the lately compromised DigiNotar Certificate Authority. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libfreebl3-5097 - openSUSE 11.3: zypper in -t patch libfreebl3-5097 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 3.12.11]: libfreebl3-3.12.11-1.5.1 libsoftokn3-3.12.11-1.5.1 mozilla-nss-3.12.11-1.5.1 mozilla-nss-certs-3.12.11-1.5.1 mozilla-nss-devel-3.12.11-1.5.1 mozilla-nss-sysinit-3.12.11-1.5.1 mozilla-nss-tools-3.12.11-1.5.1 - openSUSE 11.4 (x86_64) [New Version: 3.12.11]: libfreebl3-32bit-3.12.11-1.5.1 libsoftokn3-32bit-3.12.11-1.5.1 mozilla-nss-32bit-3.12.11-1.5.1 mozilla-nss-certs-32bit-3.12.11-1.5.1 mozilla-nss-sysinit-32bit-3.12.11-1.5.1 - openSUSE 11.3 (i586 x86_64) [New Version: 3.12.11]: libfreebl3-3.12.11-1.4.1 libsoftokn3-3.12.11-1.4.1 mozilla-nss-3.12.11-1.4.1 mozilla-nss-certs-3.12.11-1.4.1 mozilla-nss-devel-3.12.11-1.4.1 mozilla-nss-sysinit-3.12.11-1.4.1 mozilla-nss-tools-3.12.11-1.4.1 - openSUSE 11.3 (x86_64) [New Version: 3.12.11]: libfreebl3-32bit-3.12.11-1.4.1 libsoftokn3-32bit-3.12.11-1.4.1 mozilla-nss-32bit-3.12.11-1.4.1 mozilla-nss-certs-32bit-3.12.11-1.4.1 mozilla-nss-sysinit-32bit-3.12.11-1.4.1 References: https://bugzilla.novell.com/691669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1019-1: important: Security update for squid3
by opensuse-security＠opensuse.org 07 Sep '11

07 Sep '11

SUSE Security Update: Security update for squid3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1019-1 Rating: important References: #715171 Cross-References: CVE-2011-3205 Affected Products: SUSE Linux Enterprise Server 11 SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of squid3 fixes a buffer overflow vulnerability in the Gopher reply parser code (CVE-2011-3205). Security Issue reference: * CVE-2011-3205 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3205 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-squid3-5095 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64): squid3-3.1.12-8.8.1 References: http://support.novell.com/security/cve/CVE-2011-3205.html https://bugzilla.novell.com/715171 http://download.novell.com/patch/finder/?keywords=e20f40f0a8730186e0dc0ba6b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:1018-1: important: VUL-0: CVE-2011-3205: squid: buffer overflow in Gopher reply parser
by opensuse-security＠opensuse.org 07 Sep '11

07 Sep '11

openSUSE Security Update: VUL-0: CVE-2011-3205: squid: buffer overflow in Gopher reply parser ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1018-1 Rating: important References: #715171 Cross-References: CVE-2011-3205 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of squid3 fixes a buffer overflow vulnerability in the Gopher reply parser code (CVE-2011-3205). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch squid3-5094 - openSUSE 11.3: zypper in -t patch squid3-5094 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): squid3-3.1.11-4.7.1 - openSUSE 11.3 (i586 x86_64): squid3-3.0.STABLE25-2.3.1 References: http://support.novell.com/security/cve/CVE-2011-3205.html https://bugzilla.novell.com/715171 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1010-1: important: Security update for Apache
by opensuse-security＠opensuse.org 06 Sep '11

06 Sep '11

SUSE Security Update: Security update for Apache ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1010-1 Rating: important References: #555098 #661597 #663359 #690734 #713966 Cross-References: CVE-2011-3192 Affected Products: SUSE Linux Enterprise Server 10 SP3 SLE SDK 10 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: This update fixes a remote denial of service bug (memory exhaustion) in the Apache 2 HTTP server, that could be triggered by remote attackers using multiple overlapping Request Ranges. (CVE-2011-3192) It also fixes some non-security bugs: * take LimitRequestFieldsize config option into account when parsing headers from backend. Thereby avoid that the receiving buffers are too small. bnc#690734. * add / when on a directory to feed correctly linked listings. bnc#661597 * a2enmod shalt not disable a module in query mode. bnc#663359 * New option SSLRenegBufferSize fixes "413 Request Entity Too Large occur" problem. * fixes graceful restart hangs, bnc#555098. Security Issue reference: * CVE-2011-3192 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192 > Indications: Please install this update. Package List: - SUSE Linux Enterprise Server 10 SP3 (i586 ia64 ppc s390x x86_64): apache2-2.2.3-16.32.35.1 apache2-devel-2.2.3-16.32.35.1 apache2-doc-2.2.3-16.32.35.1 apache2-example-pages-2.2.3-16.32.35.1 apache2-prefork-2.2.3-16.32.35.1 apache2-worker-2.2.3-16.32.35.1 - SLE SDK 10 SP3 (i586 ia64 ppc s390x x86_64): apache2-2.2.3-16.32.35.1 apache2-devel-2.2.3-16.32.35.1 apache2-doc-2.2.3-16.32.35.1 apache2-example-pages-2.2.3-16.32.35.1 apache2-prefork-2.2.3-16.32.35.1 apache2-worker-2.2.3-16.32.35.1 References: http://support.novell.com/security/cve/CVE-2011-3192.html https://bugzilla.novell.com/555098 https://bugzilla.novell.com/661597 https://bugzilla.novell.com/663359 https://bugzilla.novell.com/690734 https://bugzilla.novell.com/713966 http://download.novell.com/patch/finder/?keywords=c1d4ee926550fcf7502509517… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0