SUSE Security Update: Security update for Mozilla Firefox
______________________________________________________________________________
Announcement ID: SUSE-SU-2012:1426-1
Rating: important
References: #786522
Affected Products:
SUSE Linux Enterprise Software Development Kit 11 SP2
SUSE Linux Enterprise Server 11 SP2 for VMware
SUSE Linux Enterprise Server 11 SP2
SUSE Linux Enterprise Server 10 SP4
SUSE Linux Enterprise Desktop 11 SP2
SUSE Linux Enterprise Desktop 10 SP4
SLE SDK 10 SP4
______________________________________________________________________________
An update that contains security fixes can now be
installed. It includes two new package versions.
Description:
MozillaFirefox was updated to the 10.0.10ESR security
release.
The following issues have been fixed:
*
MFSA 2012-90: Mozilla has fixed a number of issues
related to the Location object in order to enhance overall
security. Details for each of the current fixed issues are
below.
Thunderbird is only affected by window.location
issues through RSS feeds and extensions that load web
content.
*
CVE-2012-4194: Security researcher Mariusz Mlynski
reported that the true value of window.location could be
shadowed by user content through the use of the valueOf
method, which can be combined with some plugins to perform
a cross-site scripting (XSS) attack on users.
*
CVE-2012-4195: Mozilla security researcher
moz_bug_r_a4 discovered that the CheckURL function in
window.location can be forced to return the wrong calling
document and principal, allowing a cross-site scripting
(XSS) attack. There is also the possibility of gaining
arbitrary code execution if the attacker can take advantage
of an add-on that interacts with the page content.
*
CVE-2012-4196: Security researcher Antoine
Delignat-Lavaud of the PROSECCO research team at INRIA
Paris reported the ability to use property injection by
prototype to bypass security wrapper protections on the
Location object, allowing the cross-origin reading of the
Location object.
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 11 SP2:
zypper in -t patch sdksp2-firefox-201210b-7004
- SUSE Linux Enterprise Server 11 SP2 for VMware:
zypper in -t patch slessp2-firefox-201210b-7004
- SUSE Linux Enterprise Server 11 SP2:
zypper in -t patch slessp2-firefox-201210b-7004
- SUSE Linux Enterprise Desktop 11 SP2:
zypper in -t patch sledsp2-firefox-201210b-7004
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 4.9.3]:
mozilla-nspr-devel-4.9.3-0.2.1
- SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 10.0.10 and 4.9.3]:
MozillaFirefox-10.0.10-0.3.1
MozillaFirefox-translations-10.0.10-0.3.1
mozilla-nspr-4.9.3-0.2.1
- SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 4.9.3]:
mozilla-nspr-32bit-4.9.3-0.2.1
- SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 10.0.10 and 4.9.3]:
MozillaFirefox-10.0.10-0.3.1
MozillaFirefox-translations-10.0.10-0.3.1
mozilla-nspr-4.9.3-0.2.1
- SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 4.9.3]:
mozilla-nspr-32bit-4.9.3-0.2.1
- SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 4.9.3]:
mozilla-nspr-x86-4.9.3-0.2.1
- SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 4.9.3]:
mozilla-nspr-4.9.3-0.5.1
mozilla-nspr-devel-4.9.3-0.5.1
- SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x):
MozillaFirefox-10.0.10-0.5.2
MozillaFirefox-translations-10.0.10-0.5.2
- SUSE Linux Enterprise Server 10 SP4 (s390x x86_64) [New Version: 4.9.3]:
mozilla-nspr-32bit-4.9.3-0.5.1
- SUSE Linux Enterprise Server 10 SP4 (ia64) [New Version: 4.9.3]:
mozilla-nspr-x86-4.9.3-0.5.1
- SUSE Linux Enterprise Server 10 SP4 (ppc) [New Version: 4.9.3]:
mozilla-nspr-64bit-4.9.3-0.5.1
- SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 10.0.10 and 4.9.3]:
MozillaFirefox-10.0.10-0.3.1
MozillaFirefox-translations-10.0.10-0.3.1
mozilla-nspr-4.9.3-0.2.1
- SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 4.9.3]:
mozilla-nspr-32bit-4.9.3-0.2.1
- SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64) [New Version: 4.9.3]:
mozilla-nspr-4.9.3-0.5.1
mozilla-nspr-devel-4.9.3-0.5.1
- SUSE Linux Enterprise Desktop 10 SP4 (x86_64) [New Version: 4.9.3]:
mozilla-nspr-32bit-4.9.3-0.5.1
- SUSE Linux Enterprise Desktop 10 SP4 (i586):
MozillaFirefox-10.0.10-0.5.2
MozillaFirefox-translations-10.0.10-0.5.2
- SLE SDK 10 SP4 (i586 ia64 ppc s390x):
MozillaFirefox-branding-upstream-10.0.10-0.5.2
References:
https://bugzilla.novell.com/786522http://download.novell.com/patch/finder/?keywords=67c3a0325cfb67cf4cabe8f44…http://download.novell.com/patch/finder/?keywords=a779e3f3d65e3943cbd34d5b9…
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: update for cgit
______________________________________________________________________________
Announcement ID: openSUSE-SU-2012:1422-1
Rating: important
References: #783012
Cross-References: CVE-2012-4465
Affected Products:
openSUSE 12.2
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
Specially-crafted commits could trigger a heap-based buffer
overflow
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.2:
zypper in -t patch openSUSE-2012-752
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.2 (i586 x86_64):
cgit-0.9.0.2-14.4.1
cgit-debuginfo-0.9.0.2-14.4.1
cgit-debugsource-0.9.0.2-14.4.1
References:
http://support.novell.com/security/cve/CVE-2012-4465.htmlhttps://bugzilla.novell.com/783012
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
openSUSE Security Update: update for cgit
______________________________________________________________________________
Announcement ID: openSUSE-SU-2012:1421-1
Rating: important
References: #783012
Cross-References: CVE-2012-4465
Affected Products:
openSUSE 12.1
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
Specially-crafted commits could trigger a heap-based buffer
overflow
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.1:
zypper in -t patch openSUSE-2012-753
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.1 (i586 x86_64):
cgit-0.9.0.2-9.4.1
cgit-debuginfo-0.9.0.2-9.4.1
cgit-debugsource-0.9.0.2-9.4.1
References:
http://support.novell.com/security/cve/CVE-2012-4465.htmlhttps://bugzilla.novell.com/783012
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org
SUSE Security Update: Security update for qemu
______________________________________________________________________________
Announcement ID: SUSE-SU-2012:1203-2
Rating: important
References: #777084
Cross-References: CVE-2012-3515
Affected Products:
SLE SDK 10 SP4
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
The qemu vt100 emulation was affected by a problem where
specific vt100 sequences could have been used by guest
users to affect the host. (CVE-2012-3515 aka XSA-17). This
has been fixed.
Security Issue reference:
* CVE-2012-3515
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515
>
Package List:
- SLE SDK 10 SP4 (i586 ia64 x86_64):
qemu-0.8.2-37.14.1
References:
http://support.novell.com/security/cve/CVE-2012-3515.htmlhttps://bugzilla.novell.com/777084http://download.novell.com/patch/finder/?keywords=30f612a13ba8c3e5184ba89d4…
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org
For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org