January 2012 - openSUSE Security Announce

[security-announce] SUSE-SU-2012:0122-1: important: Security update for IBM Java 1.4.2
by opensuse-security＠opensuse.org 26 Jan '12

26 Jan '12

SUSE Security Update: Security update for IBM Java 1.4.2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0122-1 Rating: important References: #739256 Cross-References: CVE-2011-3389 CVE-2011-3545 CVE-2011-3547 CVE-2011-3548 CVE-2011-3549 CVE-2011-3552 CVE-2011-3556 CVE-2011-3557 CVE-2011-3560 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 10 SP4 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: IBM Java 1.4.2 SR13 FP11 has been released and contains various security fixes. http://www.ibm.com/developerworks/java/jdk/alerts/ http://www.mozilla.org/en-US/firefox/10.0/releasenotes/ <http://www.mozilla.org/en-US/firefox/10.0/releasenotes/> (CVEs fixed: CVE-2011-3547 CVE-2011-3548 CVE-2011-3549 CVE-2011-3552 CVE-2011-3545 CVE-2011-3556 CVE-2011-3557 CVE-2011-3389 CVE-2011-3560 ) Security Issues: * CVE-2011-3389 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389 > * CVE-2011-3545 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3545 > * CVE-2011-3547 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3547 > * CVE-2011-3548 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3548 > * CVE-2011-3549 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3549 > * CVE-2011-3552 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3552 > * CVE-2011-3556 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3556 > * CVE-2011-3557 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3557 > * CVE-2011-3560 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3560 > Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.11-0.10.1 java-1_4_2-ibm-devel-1.4.2_sr13.11-0.10.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc): java-1_4_2-ibm-jdbc-1.4.2_sr13.11-0.10.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_4_2-ibm-plugin-1.4.2_sr13.11-0.10.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ia64 ppc s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.11-0.10.1 java-1_4_2-ibm-devel-1.4.2_sr13.11-0.10.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ppc): java-1_4_2-ibm-jdbc-1.4.2_sr13.11-0.10.1 - SUSE Linux Enterprise Java 10 SP4 (i586): java-1_4_2-ibm-plugin-1.4.2_sr13.11-0.10.1 References: http://support.novell.com/security/cve/CVE-2011-3389.html http://support.novell.com/security/cve/CVE-2011-3545.html http://support.novell.com/security/cve/CVE-2011-3547.html http://support.novell.com/security/cve/CVE-2011-3548.html http://support.novell.com/security/cve/CVE-2011-3549.html http://support.novell.com/security/cve/CVE-2011-3552.html http://support.novell.com/security/cve/CVE-2011-3556.html http://support.novell.com/security/cve/CVE-2011-3557.html http://support.novell.com/security/cve/CVE-2011-3560.html https://bugzilla.novell.com/739256 http://download.novell.com/patch/finder/?keywords=051986200790170b4eac52e27… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0117-1: important: Security update for libxml2
by opensuse-security＠opensuse.org 24 Jan '12

24 Jan '12

SUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0117-1 Rating: important References: #739894 Cross-References: CVE-2011-3919 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A heap-based buffer overflow during decoding of entity references with overly long names has been fixed. CVE-2011-3919 has been assigned. Security Issue reference: * CVE-2011-3919 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3919 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-libxml2-5654 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-libxml2-5654 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-libxml2-5654 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-libxml2-5654 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): libxml2-devel-2.7.6-0.13.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ppc64 s390x x86_64): libxml2-devel-32bit-2.7.6-0.13.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): libxml2-2.7.6-0.13.1 libxml2-doc-2.7.6-0.13.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64): libxml2-32bit-2.7.6-0.13.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64): libxml2-2.7.6-0.13.1 libxml2-doc-2.7.6-0.13.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64): libxml2-32bit-2.7.6-0.13.1 - SUSE Linux Enterprise Server 11 SP1 (ia64): libxml2-x86-2.7.6-0.13.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): libxml2-2.6.23-15.27.1 libxml2-devel-2.6.23-15.27.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): libxml2-32bit-2.6.23-15.27.1 libxml2-devel-32bit-2.6.23-15.27.1 - SUSE Linux Enterprise Server 10 SP4 (ia64): libxml2-x86-2.6.23-15.27.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): libxml2-64bit-2.6.23-15.27.1 libxml2-devel-64bit-2.6.23-15.27.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): libxml2-2.7.6-0.13.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64): libxml2-32bit-2.7.6-0.13.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): libxml2-2.6.23-15.27.1 libxml2-devel-2.6.23-15.27.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): libxml2-32bit-2.6.23-15.27.1 libxml2-devel-32bit-2.6.23-15.27.1 References: http://support.novell.com/security/cve/CVE-2011-3919.html https://bugzilla.novell.com/739894 http://download.novell.com/patch/finder/?keywords=2a9a16773f62000d9967a5742… http://download.novell.com/patch/finder/?keywords=bdfcc7d229d9bdc2471a30fac… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0114-1: important: Security update for IBM Java
by opensuse-security＠opensuse.org 23 Jan '12

23 Jan '12

SUSE Security Update: Security update for IBM Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0114-1 Rating: important References: #739248 Cross-References: CVE-2011-3389 CVE-2011-3516 CVE-2011-3521 CVE-2011-3544 CVE-2011-3545 CVE-2011-3546 CVE-2011-3547 CVE-2011-3548 CVE-2011-3549 CVE-2011-3550 CVE-2011-3551 CVE-2011-3552 CVE-2011-3553 CVE-2011-3554 CVE-2011-3556 CVE-2011-3557 CVE-2011-3560 CVE-2011-3561 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 10 SP4 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: IBM Java 1.6.0 SR10 has been released fixing the following CVE's: * CVE-2011-3389 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389 > * CVE-2011-3516 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3516 > * CVE-2011-3521 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3521 > * CVE-2011-3544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3544 > * CVE-2011-3545 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3545 > * CVE-2011-3546 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3546 > * CVE-2011-3547 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3547 > * CVE-2011-3548 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3548 > * CVE-2011-3549 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3549 > * CVE-2011-3550 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3550 > * CVE-2011-3551 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3551 > * CVE-2011-3552 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3552 > * CVE-2011-3553 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3553 > * CVE-2011-3554 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3554 > * CVE-2011-3556 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3556 > * CVE-2011-3557 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3557 > * CVE-2011-3560 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3560 > * CVE-2011-3561 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3561 > Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ppc s390x x86_64): java-1_6_0-ibm-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-devel-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-fonts-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-jdbc-1.6.0_sr10.0-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc x86_64): java-1_6_0-ibm-plugin-1.6.0_sr10.0-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr10.0-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr10.0-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_6_0-ibm-alsa-1.6.0_sr10.0-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): java-1_6_0-ibm-64bit-1.6.0_sr10.0-0.8.1 - SUSE Linux Enterprise Java 10 SP4 (x86_64): java-1_6_0-ibm-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-devel-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-fonts-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-jdbc-1.6.0_sr10.0-0.8.1 java-1_6_0-ibm-plugin-1.6.0_sr10.0-0.8.1 References: http://support.novell.com/security/cve/CVE-2011-3389.html http://support.novell.com/security/cve/CVE-2011-3516.html http://support.novell.com/security/cve/CVE-2011-3521.html http://support.novell.com/security/cve/CVE-2011-3544.html http://support.novell.com/security/cve/CVE-2011-3545.html http://support.novell.com/security/cve/CVE-2011-3546.html http://support.novell.com/security/cve/CVE-2011-3547.html http://support.novell.com/security/cve/CVE-2011-3548.html http://support.novell.com/security/cve/CVE-2011-3549.html http://support.novell.com/security/cve/CVE-2011-3550.html http://support.novell.com/security/cve/CVE-2011-3551.html http://support.novell.com/security/cve/CVE-2011-3552.html http://support.novell.com/security/cve/CVE-2011-3553.html http://support.novell.com/security/cve/CVE-2011-3554.html http://support.novell.com/security/cve/CVE-2011-3556.html http://support.novell.com/security/cve/CVE-2011-3557.html http://support.novell.com/security/cve/CVE-2011-3560.html http://support.novell.com/security/cve/CVE-2011-3561.html https://bugzilla.novell.com/739248 http://download.novell.com/patch/finder/?keywords=ea376c01db551281b5801fde1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE 11.3 has reached end of SUSE support
by Marcus Meissner 23 Jan '12

23 Jan '12

Hi, (also announced by Benjamin on opensuse-announce) With the release of release-notes-openSUSE on Friday 20th of January SUSE has released the last update for openSUSE 11.3. openSUSE 11.3 is now officially discontinued and out of support by SUSE. Here are some security statistics: openSUSE 11.3 was released on July 15th 2010, making it 18 months of security and bugfix support. Some statistics on the released patches (compared to 11.2): Total updates: 581 (+92) Security: 358 (+41) Recommended: 221 (+49) Optional: 2 (+2) CVE Entries: 1212 (+78) Top issues (compared to 11.2 for issues down to 5) 14 seamonkey (+3) 12 MozillaFirefox (-6) 12 flash-player (+2) 11 MozillaThunderbird (+3) 10 opera (-3) 9 kernel (+4) 7 mozilla-xulrunner191 (+1) 7 libopenssl-devel (+2) 7 java-1_6_0-openjdk (+2) 6 krb5 (-3) 6 bind (+3) 6 acroread (-2) 5 wireshark (+1) 5 tomcat6 (0) 5 exim (+2) 5 dhcp (+4) 5 clamav (0) 5 apache2-mod_php5 (0) And top issues sorted by CVE (Common Vulnerability Enumeration) count down to 5) (compared to 11.2 for the top): 214 libwebkit (+34) 138 seamonkey (+18) 128 kernel (+22) 113 MozillaFirefox (-6) 111 MozillaThunderbird (-16) 96 mozilla-xulrunner191 (+12) 90 java-1_6_0-sun (-4) 86 acroread (-27) 82 flash-player (-1) 54 opera (+27) 51 java-1_6_0-openjdk (-43) 49 apache2-mod_php5 (+4) 32 wireshark (+6) 21 freetype2 (+3) 16 icedtea-web 13 krb5 (-2) 12 OpenOffice_org (0) 12 libopenssl-devel (+6) 11 tomcat6 (0) 10 apache2 (+8) 10 quagga 9 libmariadbclient16 8 rubygem-actionmailer 8 gimp (+2) 8 libmysqlclient-devel (-15) 8 perl (-1) 8 dhcp (+6) 8 libmysqlclusterclient16 8 clamav (-2) 8 bind (+2) 8 libmodplug (+7) 7 libtiff-devel (+2) 7 exim (+2) 7 libsvn_auth_gnome_keyring-1-0 (+4) 7 libvirt (+1) 7 finch (-5) 7 NetworkManager (+5) 6 ecryptfs-utils 6 libpng14 6 puppet (+5) 6 sysconfig (+2) 6 xorg-x11-Xvnc (+4) 6 sudo (0) 6 libpng12 6 python-feedparser (+1) 6 kvm (+5) 5 compat-openssl097g (+4) 5 otrs (+3) 5 glibc (-1) 5 libmoon-devel 5 radvd 5 evince (0) 5 libxml2 (+3) 5 libpcsclite1 (0) 5 cyrus-imapd # security updates by count # grep -l type..secur updateinfo-*|sed -e 's/^updateinfo-//;s/-[0-9]*.xml$//;'|sort|uniq -c|sort -n +0 -r|less # grep CVE- update* |perl -e '%cves=();while (<>) { while (/(CVE-2...-....)/) { $cve{$1}++; s/CVE-2...-....//;} } print join("\n",sort keys %cve)."\n";' | wc -l # for i in updateinfo-* ; do echo -n "$i " ; grep CVE- $i|perl -e '%cves=();while (<>) { while (/(CVE-2...-....)/) { $cve{$1}++; s/CVE-2...-....//;} } print join("\n",sort keys %cve)."\n";' | wc -l ; done |perl -e 'while (<>) { /^updateinfo-(\S*)-\d*.xml (\d*)$/; $cnt{$1}+=$2; } ; foreach (sort { $cnt{$b} <=> $cnt{$a} } keys %cnt) { print "$cnt{$_}\t\t$_\n";} ' -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0107-1: important: libxml2: fixing heap-based buffer overflow (CVE-2011-3919)
by opensuse-security＠opensuse.org 19 Jan '12

19 Jan '12

openSUSE Security Update: libxml2: fixing heap-based buffer overflow (CVE-2011-3919) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0107-1 Rating: important References: #739894 Cross-References: CVE-2011-3919 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A heap-based buffer overflow during decoding of entity references with overly long names has been fixed. CVE-2011-3919 has been assigned. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libxml2-5659 - openSUSE 11.3: zypper in -t patch libxml2-5659 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libxml2-2.7.8-16.21.1 libxml2-devel-2.7.8-16.21.1 - openSUSE 11.4 (x86_64): libxml2-32bit-2.7.8-16.21.1 libxml2-devel-32bit-2.7.8-16.21.1 - openSUSE 11.4 (noarch): libxml2-doc-2.7.8-16.21.1 - openSUSE 11.3 (i586 x86_64): libxml2-2.7.7-4.11.1 libxml2-devel-2.7.7-4.11.1 - openSUSE 11.3 (x86_64): libxml2-32bit-2.7.7-4.11.1 libxml2-devel-32bit-2.7.7-4.11.1 - openSUSE 11.3 (noarch): libxml2-doc-2.7.7-4.11.1 References: http://support.novell.com/security/cve/CVE-2011-3919.html https://bugzilla.novell.com/739894 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0097-1: important: Security update for libqt4
by opensuse-security＠opensuse.org 19 Jan '12

19 Jan '12

SUSE Security Update: Security update for libqt4 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0097-1 Rating: important References: #739904 Cross-References: CVE-2011-3922 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: A stack-based buffer overflow in the glyph handling of libqt4's harfbuzz has been fixed. CVE-2011-3922 has been assigned to this issue. Security Issuereference: * CVE-2011-3922 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3922 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-libQtWebKit-devel-5624 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-libQtWebKit-devel-5624 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-libQtWebKit-devel-5624 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-libQtWebKit-devel-5624 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 4.6.3]: libQtWebKit-devel-4.6.3-5.12.1 libqt4-devel-4.6.3-5.12.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ppc64 s390x x86_64) [New Version: 4.6.3]: libQtWebKit4-32bit-4.6.3-5.12.1 libqt4-sql-sqlite-32bit-4.6.3-5.12.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ia64) [New Version: 4.6.3]: libQtWebKit4-x86-4.6.3-5.12.1 libqt4-sql-sqlite-x86-4.6.3-5.12.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 4.6.3]: libQtWebKit4-4.6.3-5.12.1 libqt4-4.6.3-5.12.1 libqt4-qt3support-4.6.3-5.12.1 libqt4-sql-4.6.3-5.12.1 libqt4-sql-sqlite-4.6.3-5.12.1 libqt4-x11-4.6.3-5.12.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64) [New Version: 4.6.3]: libQtWebKit4-32bit-4.6.3-5.12.1 libqt4-32bit-4.6.3-5.12.1 libqt4-qt3support-32bit-4.6.3-5.12.1 libqt4-sql-32bit-4.6.3-5.12.1 libqt4-x11-32bit-4.6.3-5.12.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 4.6.3]: libQtWebKit4-4.6.3-5.12.1 libqt4-4.6.3-5.12.1 libqt4-qt3support-4.6.3-5.12.1 libqt4-sql-4.6.3-5.12.1 libqt4-sql-sqlite-4.6.3-5.12.1 libqt4-x11-4.6.3-5.12.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64) [New Version: 4.6.3]: libQtWebKit4-32bit-4.6.3-5.12.1 libqt4-32bit-4.6.3-5.12.1 libqt4-qt3support-32bit-4.6.3-5.12.1 libqt4-sql-32bit-4.6.3-5.12.1 libqt4-x11-32bit-4.6.3-5.12.1 - SUSE Linux Enterprise Server 11 SP1 (ia64) [New Version: 4.6.3]: libQtWebKit4-x86-4.6.3-5.12.1 libqt4-qt3support-x86-4.6.3-5.12.1 libqt4-sql-x86-4.6.3-5.12.1 libqt4-x11-x86-4.6.3-5.12.1 libqt4-x86-4.6.3-5.12.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 4.6.3]: libQtWebKit4-4.6.3-5.12.1 libqt4-4.6.3-5.12.1 libqt4-qt3support-4.6.3-5.12.1 libqt4-sql-4.6.3-5.12.1 libqt4-sql-sqlite-4.6.3-5.12.1 libqt4-x11-4.6.3-5.12.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64) [New Version: 4.6.3]: libQtWebKit4-32bit-4.6.3-5.12.1 libqt4-32bit-4.6.3-5.12.1 libqt4-qt3support-32bit-4.6.3-5.12.1 libqt4-sql-32bit-4.6.3-5.12.1 libqt4-sql-sqlite-32bit-4.6.3-5.12.1 libqt4-x11-32bit-4.6.3-5.12.1 References: http://support.novell.com/security/cve/CVE-2011-3922.html https://bugzilla.novell.com/739904 http://download.novell.com/patch/finder/?keywords=a173a1a6d496f9364a4dbb524… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0091-1: important: libqt4: fixed stack-based buffer overflow in glyph handling (CVE-2011-3922)
by opensuse-security＠opensuse.org 19 Jan '12

19 Jan '12

openSUSE Security Update: libqt4: fixed stack-based buffer overflow in glyph handling (CVE-2011-3922) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0091-1 Rating: important References: #739904 Cross-References: CVE-2011-3922 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A stack-based buffer overflow in the glyph handling of libqt4's harfbuzz has been fixed. CVE-2011-3922 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libQtWebKit-devel-5628 - openSUSE 11.3: zypper in -t patch libQtWebKit-devel-5628 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libQtWebKit-devel-4.7.1-8.17.1 libQtWebKit4-4.7.1-8.17.1 libqt4-4.7.1-8.17.1 libqt4-devel-4.7.1-8.17.1 libqt4-qt3support-4.7.1-8.17.1 libqt4-sql-4.7.1-8.17.1 libqt4-sql-sqlite-4.7.1-8.17.1 libqt4-x11-4.7.1-8.17.1 - openSUSE 11.4 (x86_64): libQtWebKit4-32bit-4.7.1-8.17.1 libqt4-32bit-4.7.1-8.17.1 libqt4-qt3support-32bit-4.7.1-8.17.1 libqt4-sql-32bit-4.7.1-8.17.1 libqt4-sql-sqlite-32bit-4.7.1-8.17.1 libqt4-x11-32bit-4.7.1-8.17.1 - openSUSE 11.3 (i586 x86_64): libQtWebKit-devel-4.6.3-2.7.1 libQtWebKit4-4.6.3-2.7.1 libqt4-4.6.3-2.7.1 libqt4-devel-4.6.3-2.7.1 libqt4-qt3support-4.6.3-2.7.1 libqt4-sql-4.6.3-2.7.1 libqt4-sql-sqlite-4.6.3-2.7.1 libqt4-x11-4.6.3-2.7.1 - openSUSE 11.3 (x86_64): libQtWebKit4-32bit-4.6.3-2.7.1 libqt4-32bit-4.6.3-2.7.1 libqt4-qt3support-32bit-4.6.3-2.7.1 libqt4-sql-32bit-4.6.3-2.7.1 libqt4-sql-sqlite-32bit-4.6.3-2.7.1 libqt4-x11-32bit-4.6.3-2.7.1 References: http://support.novell.com/security/cve/CVE-2011-3922.html https://bugzilla.novell.com/739904 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0087-1: important: acroread
by opensuse-security＠opensuse.org 17 Jan '12

17 Jan '12

openSUSE Security Update: acroread ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0087-1 Rating: important References: #735275 Cross-References: CVE-2011-2462 CVE-2011-4369 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: Acrobat Reader was updated to version 9.4.7 to fix security issues (CVE-2011-2462, CVE-2011-4369) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch acroread-5650 - openSUSE 11.3: zypper in -t patch acroread-5650 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586) [New Version: 9.4.7]: acroread-9.4.7-0.3.1 - openSUSE 11.3 (i586) [New Version: 9.4.7]: acroread-9.4.7-0.3.1 References: http://support.novell.com/security/cve/CVE-2011-2462.html http://support.novell.com/security/cve/CVE-2011-4369.html https://bugzilla.novell.com/735275 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0086-1: important: Security update for Acrobat Reader
by opensuse-security＠opensuse.org 17 Jan '12

17 Jan '12

SUSE Security Update: Security update for Acrobat Reader ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0086-1 Rating: important References: #735275 Cross-References: CVE-2011-2462 CVE-2011-4369 Affected Products: SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes two new package versions. Description: Acrobat Reader was updated to version 9.4.7 to fix two security issues (CVE-2011-2462, CVE-2011-4369) Security Issue references: * CVE-2011-4369 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4369 > * CVE-2011-2462 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2462 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-acroread-5649 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP1 (noarch) [New Version: 9.4.6]: acroread-cmaps-9.4.6-0.4.2.2 acroread-fonts-ja-9.4.6-0.4.2.2 acroread-fonts-ko-9.4.6-0.4.2.2 acroread-fonts-zh_CN-9.4.6-0.4.2.2 acroread-fonts-zh_TW-9.4.6-0.4.2.2 - SUSE Linux Enterprise Desktop 11 SP1 (i586) [New Version: 9.4.7]: acroread-9.4.7-0.2.2.1 - SUSE Linux Enterprise Desktop 10 SP4 (noarch) [New Version: 9.4.6]: acroread-cmaps-9.4.6-0.5.9 acroread-fonts-ja-9.4.6-0.5.9 acroread-fonts-ko-9.4.6-0.5.9 acroread-fonts-zh_CN-9.4.6-0.5.9 acroread-fonts-zh_TW-9.4.6-0.5.9 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 9.4.7]: acroread-9.4.7-0.5.1 References: http://support.novell.com/security/cve/CVE-2011-2462.html http://support.novell.com/security/cve/CVE-2011-4369.html https://bugzilla.novell.com/735275 http://download.novell.com/patch/finder/?keywords=b7032f742fda7a15dea6b1561… http://download.novell.com/patch/finder/?keywords=c4cebcc03c1219adc40eac640… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0084-1: important: Security update for OpenSSL
by opensuse-security＠opensuse.org 16 Jan '12

16 Jan '12

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0084-1 Rating: important References: #739719 Cross-References: CVE-2011-4108 CVE-2011-4109 CVE-2011-4576 CVE-2011-4577 CVE-2011-4619 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. It includes one version update. Description: Various security vulnerabilities have been fixed in OpenSSL: * DTLS plaintext recovery attack (CVE-2011-4108) * double-free in Policy Checks (CVE-2011-4109) * uninitialized SSL 3.0 padding (CVE-2011-4576) * malformed RFC 3779 data can cause assertion failures (CVE-2011-4577) * SGC restart DoS attack (CVE-2011-4619) Security Issue references: * CVE-2011-4108 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4108 > * CVE-2011-4109 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4109 > * CVE-2011-4576 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4576 > * CVE-2011-4577 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4577 > * CVE-2011-4619 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4619 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-libopenssl-devel-5635 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-libopenssl-devel-5635 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-libopenssl-devel-5635 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-libopenssl-devel-5635 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 0.9.8j]: libopenssl-devel-0.9.8j-0.26.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 0.9.8j]: libopenssl0_9_8-0.9.8j-0.26.1 openssl-0.9.8j-0.26.1 openssl-doc-0.9.8j-0.26.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64) [New Version: 0.9.8j]: libopenssl0_9_8-32bit-0.9.8j-0.26.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 0.9.8j]: libopenssl0_9_8-0.9.8j-0.26.1 openssl-0.9.8j-0.26.1 openssl-doc-0.9.8j-0.26.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64) [New Version: 0.9.8j]: libopenssl0_9_8-32bit-0.9.8j-0.26.1 - SUSE Linux Enterprise Server 11 SP1 (ia64) [New Version: 0.9.8j]: libopenssl0_9_8-x86-0.9.8j-0.26.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): openssl-0.9.8a-18.56.3 openssl-devel-0.9.8a-18.56.3 openssl-doc-0.9.8a-18.56.3 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): openssl-32bit-0.9.8a-18.56.3 openssl-devel-32bit-0.9.8a-18.56.3 - SUSE Linux Enterprise Server 10 SP4 (ia64): openssl-x86-0.9.8a-18.56.3 - SUSE Linux Enterprise Server 10 SP4 (ppc): openssl-64bit-0.9.8a-18.56.3 openssl-devel-64bit-0.9.8a-18.56.3 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 0.9.8j]: libopenssl0_9_8-0.9.8j-0.26.1 openssl-0.9.8j-0.26.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64) [New Version: 0.9.8j]: libopenssl0_9_8-32bit-0.9.8j-0.26.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): openssl-0.9.8a-18.56.3 openssl-devel-0.9.8a-18.56.3 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): openssl-32bit-0.9.8a-18.56.3 openssl-devel-32bit-0.9.8a-18.56.3 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): openssl-doc-0.9.8a-18.56.3 References: http://support.novell.com/security/cve/CVE-2011-4108.html http://support.novell.com/security/cve/CVE-2011-4109.html http://support.novell.com/security/cve/CVE-2011-4576.html http://support.novell.com/security/cve/CVE-2011-4577.html http://support.novell.com/security/cve/CVE-2011-4619.html https://bugzilla.novell.com/739719 http://download.novell.com/patch/finder/?keywords=00effca53ebc7841a642ba4e7… http://download.novell.com/patch/finder/?keywords=16f27ddd5506ebb38dc001550… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0083-1: important: openssl: fixing various security issues
by opensuse-security＠opensuse.org 16 Jan '12

16 Jan '12

openSUSE Security Update: openssl: fixing various security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0083-1 Rating: important References: #739719 Cross-References: CVE-2011-4108 CVE-2011-4576 CVE-2011-4577 CVE-2011-4619 CVE-2012-0027 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: Various security vulnerabilities have been fixed in openssl: - DTLS plaintext recovery attack (CVE-2011-4108) - uninitialized SSL 3.0 padding (CVE-2011-4576) - malformed RFC 3779 data can cause assertion failures (CVE-2011-4577) - SGC restart DoS attack (CVE-2011-4619) - invalid GOST parameters DoS attack (CVE-2012-0027) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libopenssl-devel-5634 - openSUSE 11.3: zypper in -t patch libopenssl-devel-5634 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libopenssl-devel-1.0.0c-18.23.1 libopenssl1_0_0-1.0.0c-18.23.1 openssl-1.0.0c-18.23.1 - openSUSE 11.4 (x86_64): libopenssl1_0_0-32bit-1.0.0c-18.23.1 - openSUSE 11.4 (noarch): openssl-doc-1.0.0c-18.23.1 - openSUSE 11.3 (i586 x86_64): libopenssl-devel-1.0.0-6.13.1 libopenssl1_0_0-1.0.0-6.13.1 openssl-1.0.0-6.13.1 - openSUSE 11.3 (x86_64): libopenssl1_0_0-32bit-1.0.0-6.13.1 - openSUSE 11.3 (noarch): openssl-doc-1.0.0-6.13.1 References: http://support.novell.com/security/cve/CVE-2011-4108.html http://support.novell.com/security/cve/CVE-2011-4576.html http://support.novell.com/security/cve/CVE-2011-4577.html http://support.novell.com/security/cve/CVE-2011-4619.html http://support.novell.com/security/cve/CVE-2012-0027.html https://bugzilla.novell.com/739719 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0064-1: important: glibc
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0064-1 Rating: important References: #735850 Cross-References: CVE-2009-5029 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted time zone files could cause a heap overflow in glibc (CVE-2009-5029). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch glibc-5554 - openSUSE 11.3: zypper in -t patch glibc-5554 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 i686 x86_64): glibc-2.11.3-12.21.1 glibc-devel-2.11.3-12.21.1 - openSUSE 11.4 (i586 x86_64): glibc-html-2.11.3-12.21.1 glibc-i18ndata-2.11.3-12.21.1 glibc-info-2.11.3-12.21.1 glibc-locale-2.11.3-12.21.1 glibc-obsolete-2.11.3-12.21.1 glibc-profile-2.11.3-12.21.1 nscd-2.11.3-12.21.1 - openSUSE 11.4 (x86_64): glibc-32bit-2.11.3-12.21.1 glibc-devel-32bit-2.11.3-12.21.1 glibc-locale-32bit-2.11.3-12.21.1 glibc-profile-32bit-2.11.3-12.21.1 - openSUSE 11.3 (i586 i686 x86_64): glibc-2.11.2-3.7.1 glibc-devel-2.11.2-3.7.1 - openSUSE 11.3 (i586 x86_64): glibc-html-2.11.2-3.7.1 glibc-i18ndata-2.11.2-3.7.1 glibc-info-2.11.2-3.7.1 glibc-locale-2.11.2-3.7.1 glibc-obsolete-2.11.2-3.7.1 glibc-profile-2.11.2-3.7.1 nscd-2.11.2-3.7.1 - openSUSE 11.3 (x86_64): glibc-32bit-2.11.2-3.7.1 glibc-devel-32bit-2.11.2-3.7.1 glibc-locale-32bit-2.11.2-3.7.1 glibc-profile-32bit-2.11.2-3.7.1 References: http://support.novell.com/security/cve/CVE-2009-5029.html https://bugzilla.novell.com/735850 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0056-1: important: Security update for heimdal
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

SUSE Security Update: Security update for heimdal ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0056-1 Rating: important References: #738632 Cross-References: CVE-2011-4862 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of heimdal fixes one security issues: * CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the heimdal RPM, not the regular telnetd supplied by SUSE.) Security Issue reference: * CVE-2011-4862 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4862 > Indications: Please install this update. Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): heimdal-0.6.1rc3-55.29 heimdal-devel-0.6.1rc3-55.29 heimdal-lib-0.6.1rc3-55.29 heimdal-tools-0.6.1rc3-55.29 - SUSE CORE 9 (x86_64): heimdal-devel-32bit-9-201112301024 heimdal-lib-32bit-9-201112301024 - SUSE CORE 9 (s390x): heimdal-devel-32bit-9-201112301034 heimdal-lib-32bit-9-201112301034 References: http://support.novell.com/security/cve/CVE-2011-4862.html https://bugzilla.novell.com/738632 http://download.novell.com/patch/finder/?keywords=826c068adcfd8a672a0756aae… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0055-1: important: Security update for glibc
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0055-1 Rating: important References: #661460 #735850 Cross-References: CVE-2009-5029 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The following bug has been fixed: * Specially crafted time zone files could cause a heap overflow in glibc. Security Issue reference: * CVE-2009-5029 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5029 > Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 i686 ia64 ppc s390x x86_64): glibc-2.4-31.97.1 glibc-devel-2.4-31.97.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): glibc-html-2.4-31.97.1 glibc-i18ndata-2.4-31.97.1 glibc-info-2.4-31.97.1 glibc-locale-2.4-31.97.1 glibc-profile-2.4-31.97.1 nscd-2.4-31.97.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): glibc-32bit-2.4-31.97.1 glibc-devel-32bit-2.4-31.97.1 glibc-locale-32bit-2.4-31.97.1 glibc-profile-32bit-2.4-31.97.1 - SUSE Linux Enterprise Server 10 SP4 (ia64): glibc-locale-x86-2.4-31.97.1 glibc-profile-x86-2.4-31.97.1 glibc-x86-2.4-31.97.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): glibc-64bit-2.4-31.97.1 glibc-devel-64bit-2.4-31.97.1 glibc-locale-64bit-2.4-31.97.1 glibc-profile-64bit-2.4-31.97.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 i686 x86_64): glibc-2.4-31.97.1 glibc-devel-2.4-31.97.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): glibc-html-2.4-31.97.1 glibc-i18ndata-2.4-31.97.1 glibc-info-2.4-31.97.1 glibc-locale-2.4-31.97.1 nscd-2.4-31.97.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): glibc-32bit-2.4-31.97.1 glibc-devel-32bit-2.4-31.97.1 glibc-locale-32bit-2.4-31.97.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): glibc-dceext-2.4-31.97.1 glibc-html-2.4-31.97.1 glibc-profile-2.4-31.97.1 - SLE SDK 10 SP4 (s390x x86_64): glibc-dceext-32bit-2.4-31.97.1 glibc-profile-32bit-2.4-31.97.1 - SLE SDK 10 SP4 (ia64): glibc-dceext-x86-2.4-31.97.1 glibc-profile-x86-2.4-31.97.1 - SLE SDK 10 SP4 (ppc): glibc-dceext-64bit-2.4-31.97.1 glibc-profile-64bit-2.4-31.97.1 References: http://support.novell.com/security/cve/CVE-2009-5029.html https://bugzilla.novell.com/661460 https://bugzilla.novell.com/735850 http://download.novell.com/patch/finder/?keywords=aba5a35b05cac6339a45d9264… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0051-1: important: krb5-appl: Fixed remote buffer overflow in ktelnetd
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: krb5-appl: Fixed remote buffer overflow in ktelnetd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0051-1 Rating: important References: #698471 #738632 Cross-References: CVE-2011-4862 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of krb5 applications fixes two security issues. CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE.) CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file access problems. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch krb5-appl-5593 - openSUSE 11.3: zypper in -t patch krb5-appl-5593 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): krb5-appl-clients-1.0-7.12.1 krb5-appl-servers-1.0-7.12.1 - openSUSE 11.3 (i586 x86_64): krb5-appl-clients-1.0-4.5.1 krb5-appl-servers-1.0-4.5.1 References: http://support.novell.com/security/cve/CVE-2011-4862.html https://bugzilla.novell.com/698471 https://bugzilla.novell.com/738632 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0050-1: important: Security update for Kerberos 5
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

SUSE Security Update: Security update for Kerberos 5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0050-1 Rating: important References: #698471 #738632 Cross-References: CVE-2011-4862 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Server 10 SP3 LTSS SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of krb5 fixes two security issues. * CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE.) * CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file access problems. Security Issue reference: * CVE-2011-4862 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4862 > Indications: Please install this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-krb5-5594 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-krb5-5594 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-krb5-5594 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-krb5-5594 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): krb5-devel-1.6.3-133.48.48.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ppc64 s390x x86_64): krb5-devel-32bit-1.6.3-133.48.48.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 x86_64): krb5-server-1.6.3-133.48.48.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): krb5-1.6.3-133.48.48.1 krb5-apps-clients-1.6.3-133.48.48.1 krb5-apps-servers-1.6.3-133.48.48.1 krb5-client-1.6.3-133.48.48.1 krb5-server-1.6.3-133.48.48.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64): krb5-32bit-1.6.3-133.48.48.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64): krb5-1.6.3-133.48.48.1 krb5-apps-clients-1.6.3-133.48.48.1 krb5-apps-servers-1.6.3-133.48.48.1 krb5-client-1.6.3-133.48.48.1 krb5-server-1.6.3-133.48.48.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64): krb5-32bit-1.6.3-133.48.48.1 - SUSE Linux Enterprise Server 11 SP1 (ia64): krb5-x86-1.6.3-133.48.48.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): krb5-1.4.3-19.49.49.1 krb5-apps-clients-1.4.3-19.49.49.1 krb5-apps-servers-1.4.3-19.49.49.1 krb5-client-1.4.3-19.49.49.1 krb5-devel-1.4.3-19.49.49.1 krb5-server-1.4.3-19.49.49.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): krb5-32bit-1.4.3-19.49.49.1 krb5-devel-32bit-1.4.3-19.49.49.1 - SUSE Linux Enterprise Server 10 SP4 (ia64): krb5-x86-1.4.3-19.49.49.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): krb5-64bit-1.4.3-19.49.49.1 krb5-devel-64bit-1.4.3-19.49.49.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): krb5-1.4.3-19.49.49.1 krb5-apps-clients-1.4.3-19.49.49.1 krb5-apps-servers-1.4.3-19.49.49.1 krb5-client-1.4.3-19.49.49.1 krb5-devel-1.4.3-19.49.49.1 krb5-server-1.4.3-19.49.49.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): krb5-32bit-1.4.3-19.49.49.1 krb5-devel-32bit-1.4.3-19.49.49.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): krb5-1.6.3-133.48.48.1 krb5-client-1.6.3-133.48.48.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64): krb5-32bit-1.6.3-133.48.48.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): krb5-1.4.3-19.49.49.1 krb5-client-1.4.3-19.49.49.1 krb5-devel-1.4.3-19.49.49.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): krb5-32bit-1.4.3-19.49.49.1 krb5-devel-32bit-1.4.3-19.49.49.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): krb5-apps-clients-1.4.3-19.49.49.1 krb5-apps-servers-1.4.3-19.49.49.1 krb5-server-1.4.3-19.49.49.1 References: http://support.novell.com/security/cve/CVE-2011-4862.html https://bugzilla.novell.com/698471 https://bugzilla.novell.com/738632 http://download.novell.com/patch/finder/?keywords=14b571ec5c63a7c3f2a6c6f9f… http://download.novell.com/patch/finder/?keywords=1827558e7c86f395bb141c509… http://download.novell.com/patch/finder/?keywords=af1f89f792c1b454611bd0a8d… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0047-1: important: freetype2
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0047-1 Rating: important References: #730124 Cross-References: CVE-2011-3256 CVE-2011-3439 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of freetype2 fixes multiple security flaws that could allow attackers to cause a denial of service or to execute arbitrary code via specially crafted fonts (CVE-2011-3256, CVE-2011-3439). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch freetype2-5548 - openSUSE 11.3: zypper in -t patch freetype2-5548 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): freetype2-devel-2.4.4-7.10.1 libfreetype6-2.4.4-7.10.1 - openSUSE 11.4 (x86_64): freetype2-devel-32bit-2.4.4-7.10.1 libfreetype6-32bit-2.4.4-7.10.1 - openSUSE 11.3 (i586 x86_64): freetype2-devel-2.3.12-7.8.1 libfreetype6-2.3.12-7.8.1 - openSUSE 11.3 (x86_64): freetype2-devel-32bit-2.3.12-7.8.1 libfreetype6-32bit-2.3.12-7.8.1 References: http://support.novell.com/security/cve/CVE-2011-3256.html http://support.novell.com/security/cve/CVE-2011-3439.html https://bugzilla.novell.com/730124 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0042-1: important: Security update for krb5
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

SUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0042-1 Rating: important References: #596826 #650650 #698471 #738632 Cross-References: CVE-2011-4862 Affected Products: SUSE Linux Enterprise Server 10 SP2 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update of krb5 fixes several security issues. * CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE.) * CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file access problems. * CVE-2010-1323 / MITKRB5-SA-2010-007: Fixed multiple checksum handling vulnerabilities, where: o krb5 clients might have accepted unkeyed SAM-2 challenge checksums o krb5 might have accepted KRB-SAFE checksums with low-entropy derived keys * CVE-2010-1321, MITKRB5-SA-2010-005: Fixed GSS-API library null pointer dereference Security Issue reference: * CVE-2011-4862 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4862 > Indications: Please install this update. Package List: - SUSE Linux Enterprise Server 10 SP2 (i586 s390x x86_64): krb5-1.4.3-19.43.37.1 krb5-apps-clients-1.4.3-19.43.37.1 krb5-apps-servers-1.4.3-19.43.37.1 krb5-client-1.4.3-19.43.37.1 krb5-devel-1.4.3-19.43.37.1 krb5-server-1.4.3-19.43.37.1 - SUSE Linux Enterprise Server 10 SP2 (s390x x86_64): krb5-32bit-1.4.3-19.43.37.1 krb5-devel-32bit-1.4.3-19.43.37.1 References: http://support.novell.com/security/cve/CVE-2011-4862.html https://bugzilla.novell.com/596826 https://bugzilla.novell.com/650650 https://bugzilla.novell.com/698471 https://bugzilla.novell.com/738632 http://download.novell.com/patch/finder/?keywords=c6533e0368b2b223506fedc65… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0039-1: important: seamonkey
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0039-1 Rating: important References: #737533 Cross-References: CVE-2011-3658 CVE-2011-3660 CVE-2011-3661 CVE-2011-3663 CVE-2011-3665 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. It includes one version update. Description: seamonkey version 2.6 fixes several security issues: * MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety hazards * MFSA 2011-54/CVE-2011-3661: Potentially exploitable crash in the YARR regular expression library * MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds access * MFSA 2011-56/CVE-2011-3663: Key detection without JavaScript via SVG animation * MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to extreme sizes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch seamonkey-5574 - openSUSE 11.3: zypper in -t patch seamonkey-5574 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.6]: seamonkey-2.6-0.2.1 seamonkey-dom-inspector-2.6-0.2.1 seamonkey-irc-2.6-0.2.1 seamonkey-translations-common-2.6-0.2.1 seamonkey-translations-other-2.6-0.2.1 seamonkey-venkman-2.6-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.6]: seamonkey-2.6-0.2.1 seamonkey-dom-inspector-2.6-0.2.1 seamonkey-irc-2.6-0.2.1 seamonkey-translations-common-2.6-0.2.1 seamonkey-translations-other-2.6-0.2.1 seamonkey-venkman-2.6-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3658.html http://support.novell.com/security/cve/CVE-2011-3660.html http://support.novell.com/security/cve/CVE-2011-3661.html http://support.novell.com/security/cve/CVE-2011-3663.html http://support.novell.com/security/cve/CVE-2011-3665.html https://bugzilla.novell.com/737533 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0033-1: important: Security update for glibc
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0033-1 Rating: important References: #678195 #735850 Cross-References: CVE-2009-5029 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The following bug has been fixed: * Specially crafted time zone files could cause a heap overflow in glibc. Security Issue reference: * CVE-2009-5029 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5029 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-glibc-5555 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-glibc-5555 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-glibc-5555 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-glibc-5555 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 x86_64): glibc-html-2.11.1-0.34.1 glibc-info-2.11.1-0.34.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 i686 x86_64): glibc-2.11.1-0.34.1 glibc-devel-2.11.1-0.34.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): glibc-html-2.11.1-0.34.1 glibc-i18ndata-2.11.1-0.34.1 glibc-info-2.11.1-0.34.1 glibc-locale-2.11.1-0.34.1 glibc-profile-2.11.1-0.34.1 nscd-2.11.1-0.34.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64): glibc-32bit-2.11.1-0.34.1 glibc-devel-32bit-2.11.1-0.34.1 glibc-locale-32bit-2.11.1-0.34.1 glibc-profile-32bit-2.11.1-0.34.1 - SUSE Linux Enterprise Server 11 SP1 (i586 i686 ia64 ppc64 s390x x86_64): glibc-2.11.1-0.34.1 glibc-devel-2.11.1-0.34.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64): glibc-html-2.11.1-0.34.1 glibc-i18ndata-2.11.1-0.34.1 glibc-info-2.11.1-0.34.1 glibc-locale-2.11.1-0.34.1 glibc-profile-2.11.1-0.34.1 nscd-2.11.1-0.34.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64): glibc-32bit-2.11.1-0.34.1 glibc-devel-32bit-2.11.1-0.34.1 glibc-locale-32bit-2.11.1-0.34.1 glibc-profile-32bit-2.11.1-0.34.1 - SUSE Linux Enterprise Server 11 SP1 (ia64): glibc-locale-x86-2.11.1-0.34.1 glibc-profile-x86-2.11.1-0.34.1 glibc-x86-2.11.1-0.34.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 i686 x86_64): glibc-2.11.1-0.34.1 glibc-devel-2.11.1-0.34.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): glibc-i18ndata-2.11.1-0.34.1 glibc-locale-2.11.1-0.34.1 nscd-2.11.1-0.34.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64): glibc-32bit-2.11.1-0.34.1 glibc-devel-32bit-2.11.1-0.34.1 glibc-locale-32bit-2.11.1-0.34.1 References: http://support.novell.com/security/cve/CVE-2009-5029.html https://bugzilla.novell.com/678195 https://bugzilla.novell.com/735850 http://download.novell.com/patch/finder/?keywords=465d0206a0a64cb1c71ef81d3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0024-1: important: Security update for heimdal
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

SUSE Security Update: Security update for heimdal ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0024-1 Rating: important References: #738632 Cross-References: CVE-2011-4862 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of heimdal fixes one security issues: * CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the heimdal RPM, not the regular telnetd supplied by SUSE.) Security Issue reference: * CVE-2011-4862 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4862 > Indications: Please install this update. Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): heimdal-0.6.1rc3-55.29 heimdal-devel-0.6.1rc3-55.29 heimdal-lib-0.6.1rc3-55.29 heimdal-tools-0.6.1rc3-55.29 - SUSE CORE 9 (x86_64): heimdal-devel-32bit-9-201112301024 heimdal-lib-32bit-9-201112301024 - SUSE CORE 9 (s390x): heimdal-devel-32bit-9-201112301034 heimdal-lib-32bit-9-201112301034 References: http://support.novell.com/security/cve/CVE-2011-4862.html https://bugzilla.novell.com/738632 http://download.novell.com/patch/finder/?keywords=826c068adcfd8a672a0756aae… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0023-1: important: Security update for glibc
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0023-1 Rating: important References: #661460 #735850 Cross-References: CVE-2009-5029 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The following bug has been fixed: * Specially crafted time zone files could cause a heap overflow in glibc. Security Issue reference: * CVE-2009-5029 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5029 > Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 i686 ia64 ppc s390x x86_64): glibc-2.4-31.97.1 glibc-devel-2.4-31.97.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): glibc-html-2.4-31.97.1 glibc-i18ndata-2.4-31.97.1 glibc-info-2.4-31.97.1 glibc-locale-2.4-31.97.1 glibc-profile-2.4-31.97.1 nscd-2.4-31.97.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): glibc-32bit-2.4-31.97.1 glibc-devel-32bit-2.4-31.97.1 glibc-locale-32bit-2.4-31.97.1 glibc-profile-32bit-2.4-31.97.1 - SUSE Linux Enterprise Server 10 SP4 (ia64): glibc-locale-x86-2.4-31.97.1 glibc-profile-x86-2.4-31.97.1 glibc-x86-2.4-31.97.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): glibc-64bit-2.4-31.97.1 glibc-devel-64bit-2.4-31.97.1 glibc-locale-64bit-2.4-31.97.1 glibc-profile-64bit-2.4-31.97.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 i686 x86_64): glibc-2.4-31.97.1 glibc-devel-2.4-31.97.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): glibc-html-2.4-31.97.1 glibc-i18ndata-2.4-31.97.1 glibc-info-2.4-31.97.1 glibc-locale-2.4-31.97.1 nscd-2.4-31.97.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): glibc-32bit-2.4-31.97.1 glibc-devel-32bit-2.4-31.97.1 glibc-locale-32bit-2.4-31.97.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): glibc-dceext-2.4-31.97.1 glibc-html-2.4-31.97.1 glibc-profile-2.4-31.97.1 - SLE SDK 10 SP4 (s390x x86_64): glibc-dceext-32bit-2.4-31.97.1 glibc-profile-32bit-2.4-31.97.1 - SLE SDK 10 SP4 (ia64): glibc-dceext-x86-2.4-31.97.1 glibc-profile-x86-2.4-31.97.1 - SLE SDK 10 SP4 (ppc): glibc-dceext-64bit-2.4-31.97.1 glibc-profile-64bit-2.4-31.97.1 References: http://support.novell.com/security/cve/CVE-2009-5029.html https://bugzilla.novell.com/661460 https://bugzilla.novell.com/735850 http://download.novell.com/patch/finder/?keywords=aba5a35b05cac6339a45d9264… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0019-1: important: krb5-appl: Fixed remote buffer overflow in ktelnetd
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: krb5-appl: Fixed remote buffer overflow in ktelnetd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0019-1 Rating: important References: #698471 #738632 Cross-References: CVE-2011-4862 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of krb5 applications fixes two security issues. CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE.) CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file access problems. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch krb5-appl-5593 - openSUSE 11.3: zypper in -t patch krb5-appl-5593 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): krb5-appl-clients-1.0-7.12.1 krb5-appl-servers-1.0-7.12.1 - openSUSE 11.3 (i586 x86_64): krb5-appl-clients-1.0-4.5.1 krb5-appl-servers-1.0-4.5.1 References: http://support.novell.com/security/cve/CVE-2011-4862.html https://bugzilla.novell.com/698471 https://bugzilla.novell.com/738632 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0018-1: important: Security update for Kerberos 5
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

SUSE Security Update: Security update for Kerberos 5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0018-1 Rating: important References: #698471 #738632 Cross-References: CVE-2011-4862 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Server 10 SP3 LTSS SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of krb5 fixes two security issues. * CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE.) * CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file access problems. Security Issue reference: * CVE-2011-4862 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4862 > Indications: Please install this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-krb5-5594 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-krb5-5594 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-krb5-5594 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-krb5-5594 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): krb5-devel-1.6.3-133.48.48.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ppc64 s390x x86_64): krb5-devel-32bit-1.6.3-133.48.48.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 x86_64): krb5-server-1.6.3-133.48.48.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): krb5-1.6.3-133.48.48.1 krb5-apps-clients-1.6.3-133.48.48.1 krb5-apps-servers-1.6.3-133.48.48.1 krb5-client-1.6.3-133.48.48.1 krb5-server-1.6.3-133.48.48.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64): krb5-32bit-1.6.3-133.48.48.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64): krb5-1.6.3-133.48.48.1 krb5-apps-clients-1.6.3-133.48.48.1 krb5-apps-servers-1.6.3-133.48.48.1 krb5-client-1.6.3-133.48.48.1 krb5-server-1.6.3-133.48.48.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64): krb5-32bit-1.6.3-133.48.48.1 - SUSE Linux Enterprise Server 11 SP1 (ia64): krb5-x86-1.6.3-133.48.48.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): krb5-1.4.3-19.49.49.1 krb5-apps-clients-1.4.3-19.49.49.1 krb5-apps-servers-1.4.3-19.49.49.1 krb5-client-1.4.3-19.49.49.1 krb5-devel-1.4.3-19.49.49.1 krb5-server-1.4.3-19.49.49.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): krb5-32bit-1.4.3-19.49.49.1 krb5-devel-32bit-1.4.3-19.49.49.1 - SUSE Linux Enterprise Server 10 SP4 (ia64): krb5-x86-1.4.3-19.49.49.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): krb5-64bit-1.4.3-19.49.49.1 krb5-devel-64bit-1.4.3-19.49.49.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): krb5-1.4.3-19.49.49.1 krb5-apps-clients-1.4.3-19.49.49.1 krb5-apps-servers-1.4.3-19.49.49.1 krb5-client-1.4.3-19.49.49.1 krb5-devel-1.4.3-19.49.49.1 krb5-server-1.4.3-19.49.49.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): krb5-32bit-1.4.3-19.49.49.1 krb5-devel-32bit-1.4.3-19.49.49.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): krb5-1.6.3-133.48.48.1 krb5-client-1.6.3-133.48.48.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64): krb5-32bit-1.6.3-133.48.48.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): krb5-1.4.3-19.49.49.1 krb5-client-1.4.3-19.49.49.1 krb5-devel-1.4.3-19.49.49.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): krb5-32bit-1.4.3-19.49.49.1 krb5-devel-32bit-1.4.3-19.49.49.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): krb5-apps-clients-1.4.3-19.49.49.1 krb5-apps-servers-1.4.3-19.49.49.1 krb5-server-1.4.3-19.49.49.1 References: http://support.novell.com/security/cve/CVE-2011-4862.html https://bugzilla.novell.com/698471 https://bugzilla.novell.com/738632 http://download.novell.com/patch/finder/?keywords=14b571ec5c63a7c3f2a6c6f9f… http://download.novell.com/patch/finder/?keywords=1827558e7c86f395bb141c509… http://download.novell.com/patch/finder/?keywords=af1f89f792c1b454611bd0a8d… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0015-1: important: freetype2
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0015-1 Rating: important References: #730124 Cross-References: CVE-2011-3256 CVE-2011-3439 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of freetype2 fixes multiple security flaws that could allow attackers to cause a denial of service or to execute arbitrary code via specially crafted fonts (CVE-2011-3256, CVE-2011-3439). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch freetype2-5548 - openSUSE 11.3: zypper in -t patch freetype2-5548 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): freetype2-devel-2.4.4-7.10.1 libfreetype6-2.4.4-7.10.1 - openSUSE 11.4 (x86_64): freetype2-devel-32bit-2.4.4-7.10.1 libfreetype6-32bit-2.4.4-7.10.1 - openSUSE 11.3 (i586 x86_64): freetype2-devel-2.3.12-7.8.1 libfreetype6-2.3.12-7.8.1 - openSUSE 11.3 (x86_64): freetype2-devel-32bit-2.3.12-7.8.1 libfreetype6-32bit-2.3.12-7.8.1 References: http://support.novell.com/security/cve/CVE-2011-3256.html http://support.novell.com/security/cve/CVE-2011-3439.html https://bugzilla.novell.com/730124 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0010-1: important: Security update for krb5
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

SUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0010-1 Rating: important References: #596826 #650650 #698471 #738632 Cross-References: CVE-2011-4862 Affected Products: SUSE Linux Enterprise Server 10 SP2 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update of krb5 fixes several security issues. * CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE.) * CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file access problems. * CVE-2010-1323 / MITKRB5-SA-2010-007: Fixed multiple checksum handling vulnerabilities, where: o krb5 clients might have accepted unkeyed SAM-2 challenge checksums o krb5 might have accepted KRB-SAFE checksums with low-entropy derived keys * CVE-2010-1321, MITKRB5-SA-2010-005: Fixed GSS-API library null pointer dereference Security Issue reference: * CVE-2011-4862 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4862 > Indications: Please install this update. Package List: - SUSE Linux Enterprise Server 10 SP2 (i586 s390x x86_64): krb5-1.4.3-19.43.37.1 krb5-apps-clients-1.4.3-19.43.37.1 krb5-apps-servers-1.4.3-19.43.37.1 krb5-client-1.4.3-19.43.37.1 krb5-devel-1.4.3-19.43.37.1 krb5-server-1.4.3-19.43.37.1 - SUSE Linux Enterprise Server 10 SP2 (s390x x86_64): krb5-32bit-1.4.3-19.43.37.1 krb5-devel-32bit-1.4.3-19.43.37.1 References: http://support.novell.com/security/cve/CVE-2011-4862.html https://bugzilla.novell.com/596826 https://bugzilla.novell.com/650650 https://bugzilla.novell.com/698471 https://bugzilla.novell.com/738632 http://download.novell.com/patch/finder/?keywords=c6533e0368b2b223506fedc65… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0007-1: important: seamonkey
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0007-1 Rating: important References: #737533 Cross-References: CVE-2011-3658 CVE-2011-3660 CVE-2011-3661 CVE-2011-3663 CVE-2011-3665 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. It includes one version update. Description: seamonkey version 2.6 fixes several security issues: * MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety hazards * MFSA 2011-54/CVE-2011-3661: Potentially exploitable crash in the YARR regular expression library * MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds access * MFSA 2011-56/CVE-2011-3663: Key detection without JavaScript via SVG animation * MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to extreme sizes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch seamonkey-5574 - openSUSE 11.3: zypper in -t patch seamonkey-5574 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.6]: seamonkey-2.6-0.2.1 seamonkey-dom-inspector-2.6-0.2.1 seamonkey-irc-2.6-0.2.1 seamonkey-translations-common-2.6-0.2.1 seamonkey-translations-other-2.6-0.2.1 seamonkey-venkman-2.6-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.6]: seamonkey-2.6-0.2.1 seamonkey-dom-inspector-2.6-0.2.1 seamonkey-irc-2.6-0.2.1 seamonkey-translations-common-2.6-0.2.1 seamonkey-translations-other-2.6-0.2.1 seamonkey-venkman-2.6-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3658.html http://support.novell.com/security/cve/CVE-2011-3660.html http://support.novell.com/security/cve/CVE-2011-3661.html http://support.novell.com/security/cve/CVE-2011-3663.html http://support.novell.com/security/cve/CVE-2011-3665.html https://bugzilla.novell.com/737533 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-403 Forbidden-1: important: Security update for openSSL
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

SUSE Security Update: Security update for openSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-403 Forbidden-1 Rating: important References: #670526 #678195 #735850 Cross-References: CVE-2009-5029 CVE-2011-0014 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update improves the ClientHello handshake message parsing function. Prior to this update is was possible that this function reads beyond the end of a message leading to invalid memory access and a crash. Under some circumstances it was possible that information from the OCSP extensions was disclosed. (CVE-2011-0014: CVSS v2 Base Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:N/A:P)) Security Issue reference: * CVE-2011-0014 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0014 > Indications: Please update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-glibc-5555 sdksp1-libopenssl-devel-3938 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-glibc-5555 slessp1-libopenssl-devel-3938 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-glibc-5555 slessp1-libopenssl-devel-3938 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-glibc-5555 sledsp1-libopenssl-devel-3938 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): libopenssl-devel-0.9.8h-30.32.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 x86_64): glibc-html-2.11.1-0.34.1 glibc-info-2.11.1-0.34.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 i686 x86_64): glibc-2.11.1-0.34.1 glibc-devel-2.11.1-0.34.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): glibc-html-2.11.1-0.34.1 glibc-i18ndata-2.11.1-0.34.1 glibc-info-2.11.1-0.34.1 glibc-locale-2.11.1-0.34.1 glibc-profile-2.11.1-0.34.1 libopenssl0_9_8-0.9.8h-30.32.1 nscd-2.11.1-0.34.1 openssl-0.9.8h-30.32.1 openssl-doc-0.9.8h-30.32.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64): glibc-32bit-2.11.1-0.34.1 glibc-devel-32bit-2.11.1-0.34.1 glibc-locale-32bit-2.11.1-0.34.1 glibc-profile-32bit-2.11.1-0.34.1 libopenssl0_9_8-32bit-0.9.8h-30.32.1 - SUSE Linux Enterprise Server 11 SP1 (i586 i686 ia64 ppc64 s390x x86_64): glibc-2.11.1-0.34.1 glibc-devel-2.11.1-0.34.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64): glibc-html-2.11.1-0.34.1 glibc-i18ndata-2.11.1-0.34.1 glibc-info-2.11.1-0.34.1 glibc-locale-2.11.1-0.34.1 glibc-profile-2.11.1-0.34.1 libopenssl0_9_8-0.9.8h-30.32.1 nscd-2.11.1-0.34.1 openssl-0.9.8h-30.32.1 openssl-doc-0.9.8h-30.32.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64): glibc-32bit-2.11.1-0.34.1 glibc-devel-32bit-2.11.1-0.34.1 glibc-locale-32bit-2.11.1-0.34.1 glibc-profile-32bit-2.11.1-0.34.1 libopenssl0_9_8-32bit-0.9.8h-30.32.1 - SUSE Linux Enterprise Server 11 SP1 (ia64): glibc-locale-x86-2.11.1-0.34.1 glibc-profile-x86-2.11.1-0.34.1 glibc-x86-2.11.1-0.34.1 libopenssl0_9_8-x86-0.9.8h-30.32.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 i686 x86_64): glibc-2.11.1-0.34.1 glibc-devel-2.11.1-0.34.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): glibc-i18ndata-2.11.1-0.34.1 glibc-locale-2.11.1-0.34.1 libopenssl0_9_8-0.9.8h-30.32.1 nscd-2.11.1-0.34.1 openssl-0.9.8h-30.32.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64): glibc-32bit-2.11.1-0.34.1 glibc-devel-32bit-2.11.1-0.34.1 glibc-locale-32bit-2.11.1-0.34.1 libopenssl0_9_8-32bit-0.9.8h-30.32.1 References: http://support.novell.com/security/cve/CVE-2009-5029.html http://support.novell.com/security/cve/CVE-2011-0014.html https://bugzilla.novell.com/670526 https://bugzilla.novell.com/678195 https://bugzilla.novell.com/735850 http://download.novell.com/patch/finder/?keywords=2adddddaf0d4d6c89870ab7b9… http://download.novell.com/patch/finder/?keywords=465d0206a0a64cb1c71ef81d3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0