October 2012 - openSUSE Security Announce

[security-announce] SUSE-SU-2012:1426-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 31 Oct '12

31 Oct '12

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1426-1 Rating: important References: #786522 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes two new package versions. Description: MozillaFirefox was updated to the 10.0.10ESR security release. The following issues have been fixed: * MFSA 2012-90: Mozilla has fixed a number of issues related to the Location object in order to enhance overall security. Details for each of the current fixed issues are below. Thunderbird is only affected by window.location issues through RSS feeds and extensions that load web content. * CVE-2012-4194: Security researcher Mariusz Mlynski reported that the true value of window.location could be shadowed by user content through the use of the valueOf method, which can be combined with some plugins to perform a cross-site scripting (XSS) attack on users. * CVE-2012-4195: Mozilla security researcher moz_bug_r_a4 discovered that the CheckURL function in window.location can be forced to return the wrong calling document and principal, allowing a cross-site scripting (XSS) attack. There is also the possibility of gaining arbitrary code execution if the attacker can take advantage of an add-on that interacts with the page content. * CVE-2012-4196: Security researcher Antoine Delignat-Lavaud of the PROSECCO research team at INRIA Paris reported the ability to use property injection by prototype to bypass security wrapper protections on the Location object, allowing the cross-origin reading of the Location object. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-firefox-201210b-7004 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-firefox-201210b-7004 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-firefox-201210b-7004 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-firefox-201210b-7004 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 4.9.3]: mozilla-nspr-devel-4.9.3-0.2.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 10.0.10 and 4.9.3]: MozillaFirefox-10.0.10-0.3.1 MozillaFirefox-translations-10.0.10-0.3.1 mozilla-nspr-4.9.3-0.2.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 4.9.3]: mozilla-nspr-32bit-4.9.3-0.2.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 10.0.10 and 4.9.3]: MozillaFirefox-10.0.10-0.3.1 MozillaFirefox-translations-10.0.10-0.3.1 mozilla-nspr-4.9.3-0.2.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 4.9.3]: mozilla-nspr-32bit-4.9.3-0.2.1 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 4.9.3]: mozilla-nspr-x86-4.9.3-0.2.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 4.9.3]: mozilla-nspr-4.9.3-0.5.1 mozilla-nspr-devel-4.9.3-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x): MozillaFirefox-10.0.10-0.5.2 MozillaFirefox-translations-10.0.10-0.5.2 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64) [New Version: 4.9.3]: mozilla-nspr-32bit-4.9.3-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (ia64) [New Version: 4.9.3]: mozilla-nspr-x86-4.9.3-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (ppc) [New Version: 4.9.3]: mozilla-nspr-64bit-4.9.3-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 10.0.10 and 4.9.3]: MozillaFirefox-10.0.10-0.3.1 MozillaFirefox-translations-10.0.10-0.3.1 mozilla-nspr-4.9.3-0.2.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 4.9.3]: mozilla-nspr-32bit-4.9.3-0.2.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64) [New Version: 4.9.3]: mozilla-nspr-4.9.3-0.5.1 mozilla-nspr-devel-4.9.3-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64) [New Version: 4.9.3]: mozilla-nspr-32bit-4.9.3-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586): MozillaFirefox-10.0.10-0.5.2 MozillaFirefox-translations-10.0.10-0.5.2 - SLE SDK 10 SP4 (i586 ia64 ppc s390x): MozillaFirefox-branding-upstream-10.0.10-0.5.2 References: https://bugzilla.novell.com/786522 http://download.novell.com/patch/finder/?keywords=67c3a0325cfb67cf4cabe8f44… http://download.novell.com/patch/finder/?keywords=a779e3f3d65e3943cbd34d5b9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1424-1: important: java-1_6_0-openjdk: update to 1.11.5
by opensuse-security＠opensuse.org 31 Oct '12

31 Oct '12

openSUSE Security Update: java-1_6_0-openjdk: update to 1.11.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1424-1 Rating: important References: #785433 Cross-References: CVE-2012-3216 CVE-2012-4416 CVE-2012-5068 CVE-2012-5069 CVE-2012-5071 CVE-2012-5072 CVE-2012-5073 CVE-2012-5075 CVE-2012-5077 CVE-2012-5079 CVE-2012-5081 CVE-2012-5084 CVE-2012-5085 CVE-2012-5086 CVE-2012-5089 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: java 1.6.0 openjdk / icedtea was updated to 1.11.5 (bnc#785433) * Security fixes - S6631398, CVE-2012-3216: FilePermission improved path checking - S7093490: adjust package access in rmiregistry - S7143535, CVE-2012-5068: ScriptEngine corrected permissions - S7167656, CVE-2012-5077: Multiple Seeders are being created - S7169884, CVE-2012-5073: LogManager checks do not work correctly for sub-types - S7169888, CVE-2012-5075: Narrowing resource definitions in JMX RMI connector - S7172522, CVE-2012-5072: Improve DomainCombiner checking - S7186286, CVE-2012-5081: TLS implementation to better adhere to RFC - S7189103, CVE-2012-5069: Executors needs to maintain state - S7189490: More improvements to DomainCombiner checking - S7189567, CVE-2012-5085: java net obselete protocol - S7192975, CVE-2012-5071: Conditional usage check is wrong - S7195194, CVE-2012-5084: Better data validation for Swing - S7195917, CVE-2012-5086: XMLDecoder parsing at close-time should be improved - S7195919, CVE-2012-5079: (sl) ServiceLoader can throw CCE without needing to create instance - S7198296, CVE-2012-5089: Refactor classloader usage - S7158800: Improve storage of symbol tables - S7158801: Improve VM CompileOnly option - S7158804: Improve config file parsing - S7176337: Additional changes needed for 7158801 fix - S7198606, CVE-2012-4416: Improve VM optimization * Backports - S7175845: "jar uf" changes file permissions unexpectedly - S7177216: native2ascii changes file permissions of input file - S7199153: TEST_BUG: try-with-resources syntax pushed to 6-open repo * Bug fixes - PR1194: IcedTea tries to build with /usr/lib/jvm/java-openjdk (now a 1.7 VM) by default Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-755 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b24.1.11.5-21.1 java-1_6_0-openjdk-debuginfo-1.6.0.0_b24.1.11.5-21.1 java-1_6_0-openjdk-debugsource-1.6.0.0_b24.1.11.5-21.1 java-1_6_0-openjdk-demo-1.6.0.0_b24.1.11.5-21.1 java-1_6_0-openjdk-demo-debuginfo-1.6.0.0_b24.1.11.5-21.1 java-1_6_0-openjdk-devel-1.6.0.0_b24.1.11.5-21.1 java-1_6_0-openjdk-devel-debuginfo-1.6.0.0_b24.1.11.5-21.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b24.1.11.5-21.1 java-1_6_0-openjdk-src-1.6.0.0_b24.1.11.5-21.1 References: http://support.novell.com/security/cve/CVE-2012-3216.html http://support.novell.com/security/cve/CVE-2012-4416.html http://support.novell.com/security/cve/CVE-2012-5068.html http://support.novell.com/security/cve/CVE-2012-5069.html http://support.novell.com/security/cve/CVE-2012-5071.html http://support.novell.com/security/cve/CVE-2012-5072.html http://support.novell.com/security/cve/CVE-2012-5073.html http://support.novell.com/security/cve/CVE-2012-5075.html http://support.novell.com/security/cve/CVE-2012-5077.html http://support.novell.com/security/cve/CVE-2012-5079.html http://support.novell.com/security/cve/CVE-2012-5081.html http://support.novell.com/security/cve/CVE-2012-5084.html http://support.novell.com/security/cve/CVE-2012-5085.html http://support.novell.com/security/cve/CVE-2012-5086.html http://support.novell.com/security/cve/CVE-2012-5089.html https://bugzilla.novell.com/785433 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1423-1: important: java-1_6_0-openjdk: update to 1.11.5 icedtea
by opensuse-security＠opensuse.org 31 Oct '12

31 Oct '12

openSUSE Security Update: java-1_6_0-openjdk: update to 1.11.5 icedtea ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1423-1 Rating: important References: #785433 Cross-References: CVE-2012-3216 CVE-2012-4416 CVE-2012-5068 CVE-2012-5069 CVE-2012-5071 CVE-2012-5072 CVE-2012-5073 CVE-2012-5075 CVE-2012-5077 CVE-2012-5079 CVE-2012-5081 CVE-2012-5084 CVE-2012-5085 CVE-2012-5086 CVE-2012-5089 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This version upgrade to 1.11.5 fixed various security and non-security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-754 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b24.1.11.5-16.1 java-1_6_0-openjdk-debuginfo-1.6.0.0_b24.1.11.5-16.1 java-1_6_0-openjdk-debugsource-1.6.0.0_b24.1.11.5-16.1 java-1_6_0-openjdk-demo-1.6.0.0_b24.1.11.5-16.1 java-1_6_0-openjdk-demo-debuginfo-1.6.0.0_b24.1.11.5-16.1 java-1_6_0-openjdk-devel-1.6.0.0_b24.1.11.5-16.1 java-1_6_0-openjdk-devel-debuginfo-1.6.0.0_b24.1.11.5-16.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b24.1.11.5-16.1 java-1_6_0-openjdk-src-1.6.0.0_b24.1.11.5-16.1 References: http://support.novell.com/security/cve/CVE-2012-3216.html http://support.novell.com/security/cve/CVE-2012-4416.html http://support.novell.com/security/cve/CVE-2012-5068.html http://support.novell.com/security/cve/CVE-2012-5069.html http://support.novell.com/security/cve/CVE-2012-5071.html http://support.novell.com/security/cve/CVE-2012-5072.html http://support.novell.com/security/cve/CVE-2012-5073.html http://support.novell.com/security/cve/CVE-2012-5075.html http://support.novell.com/security/cve/CVE-2012-5077.html http://support.novell.com/security/cve/CVE-2012-5079.html http://support.novell.com/security/cve/CVE-2012-5081.html http://support.novell.com/security/cve/CVE-2012-5084.html http://support.novell.com/security/cve/CVE-2012-5085.html http://support.novell.com/security/cve/CVE-2012-5086.html http://support.novell.com/security/cve/CVE-2012-5089.html https://bugzilla.novell.com/785433 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1422-1: important: update for cgit
by opensuse-security＠opensuse.org 31 Oct '12

31 Oct '12

openSUSE Security Update: update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1422-1 Rating: important References: #783012 Cross-References: CVE-2012-4465 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially-crafted commits could trigger a heap-based buffer overflow Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-752 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): cgit-0.9.0.2-14.4.1 cgit-debuginfo-0.9.0.2-14.4.1 cgit-debugsource-0.9.0.2-14.4.1 References: http://support.novell.com/security/cve/CVE-2012-4465.html https://bugzilla.novell.com/783012 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1421-1: important: update for cgit
by opensuse-security＠opensuse.org 31 Oct '12

31 Oct '12

openSUSE Security Update: update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1421-1 Rating: important References: #783012 Cross-References: CVE-2012-4465 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially-crafted commits could trigger a heap-based buffer overflow Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-753 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): cgit-0.9.0.2-9.4.1 cgit-debuginfo-0.9.0.2-9.4.1 cgit-debugsource-0.9.0.2-9.4.1 References: http://support.novell.com/security/cve/CVE-2012-4465.html https://bugzilla.novell.com/783012 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1419-1: important: java-1_7_0-openjdk: Update to icedtea-2.3.3
by opensuse-security＠opensuse.org 31 Oct '12

31 Oct '12

openSUSE Security Update: java-1_7_0-openjdk: Update to icedtea-2.3.3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1419-1 Rating: important References: #785814 Cross-References: CVE-2012-3216 CVE-2012-4416 CVE-2012-5068 CVE-2012-5069 CVE-2012-5070 CVE-2012-5071 CVE-2012-5073 CVE-2012-5074 CVE-2012-5075 CVE-2012-5076 CVE-2012-5077 CVE-2012-5084 CVE-2012-5085 CVE-2012-5086 CVE-2012-5087 CVE-2012-5088 CVE-2012-5089 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: java-1_7_0-opendjk was updated to icedtea-2.3.3 (bnc#785814) * Security fixes - S6631398, CVE-2012-3216: FilePermission improved path checking - S7093490: adjust package access in rmiregistry - S7143535, CVE-2012-5068: ScriptEngine corrected permissions - S7158796, CVE-2012-5070: Tighten properties checking in EnvHelp - S7158807: Revise stack management with volatile call sites - S7163198, CVE-2012-5076: Tightened package accessibility - S7167656, CVE-2012-5077: Multiple Seeders are being created - S7169884, CVE-2012-5073: LogManager checks do not work correctly for sub-types - S7169887, CVE-2012-5074: Tightened package accessibility - S7169888, CVE-2012-5075: Narrowing resource definitions in JMX RMI connector - S7172522, CVE-2012-5072: Improve DomainCombiner checking - S7186286, CVE-2012-5081: TLS implementation to better adhere to RFC - S7189103, CVE-2012-5069: Executors needs to maintain state - S7189490: More improvements to DomainCombiner checking - S7189567, CVE-2012-5085: java net obselete protocol - S7192975, CVE-2012-5071: Issue with JMX reflection - S7195194, CVE-2012-5084: Better data validation for Swing - S7195549, CVE-2012-5087: Better bean object persistence - S7195917, CVE-2012-5086: XMLDecoder parsing at close-time should be improved - S7195919, CVE-2012-5079: (sl) ServiceLoader can throw CCE without needing to create instance - S7196190, CVE-2012-5088: Improve method of handling MethodHandles - S7198296, CVE-2012-5089: Refactor classloader usage - S7158800: Improve storage of symbol tables - S7158801: Improve VM CompileOnly option - S7158804: Improve config file parsing - S7198606, CVE-2012-4416: Improve VM optimization * Bug fixes - Remove merge artefact. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-749 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.6-3.16.1 java-1_7_0-openjdk-debuginfo-1.7.0.6-3.16.1 java-1_7_0-openjdk-debugsource-1.7.0.6-3.16.1 java-1_7_0-openjdk-demo-1.7.0.6-3.16.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.6-3.16.1 java-1_7_0-openjdk-devel-1.7.0.6-3.16.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.6-3.16.1 java-1_7_0-openjdk-javadoc-1.7.0.6-3.16.1 java-1_7_0-openjdk-src-1.7.0.6-3.16.1 References: http://support.novell.com/security/cve/CVE-2012-3216.html http://support.novell.com/security/cve/CVE-2012-4416.html http://support.novell.com/security/cve/CVE-2012-5068.html http://support.novell.com/security/cve/CVE-2012-5069.html http://support.novell.com/security/cve/CVE-2012-5070.html http://support.novell.com/security/cve/CVE-2012-5071.html http://support.novell.com/security/cve/CVE-2012-5073.html http://support.novell.com/security/cve/CVE-2012-5074.html http://support.novell.com/security/cve/CVE-2012-5075.html http://support.novell.com/security/cve/CVE-2012-5076.html http://support.novell.com/security/cve/CVE-2012-5077.html http://support.novell.com/security/cve/CVE-2012-5084.html http://support.novell.com/security/cve/CVE-2012-5085.html http://support.novell.com/security/cve/CVE-2012-5086.html http://support.novell.com/security/cve/CVE-2012-5087.html http://support.novell.com/security/cve/CVE-2012-5088.html http://support.novell.com/security/cve/CVE-2012-5089.html https://bugzilla.novell.com/785814 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1412-1: important: Mozilla Suite: Update to 16.0.2
by opensuse-security＠opensuse.org 30 Oct '12

30 Oct '12

openSUSE Security Update: Mozilla Suite: Update to 16.0.2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1412-1 Rating: important References: #786522 Cross-References: CVE-2012-4194 CVE-2012-4195 CVE-2012-4196 Affected Products: openSUSE 12.2 openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Mozilla Firefox, Thunderbird and XULRunner were updated to 16.0.2. Mozilla Seamonkey was updated to 2.13.2. Tracker bug: bnc#786522 A security issues was fixed: * MFSA 2012-90/CVE-2012-4194/CVE-2012-4195/CVE-2012-4196 (bmo#800666, bmo#793121, bmo#802557) Fixes for Location object issues The update also brings back Obsoletes for libproxy's mozjs plugin for distributions before 12.2 to avoid crashes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-745 - openSUSE 12.1: zypper in -t patch openSUSE-2012-745 - openSUSE 11.4: zypper in -t patch openSUSE-2012-745 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): MozillaFirefox-16.0.2-2.21.1 MozillaFirefox-branding-upstream-16.0.2-2.21.1 MozillaFirefox-buildsymbols-16.0.2-2.21.1 MozillaFirefox-debuginfo-16.0.2-2.21.1 MozillaFirefox-debugsource-16.0.2-2.21.1 MozillaFirefox-devel-16.0.2-2.21.1 MozillaFirefox-translations-common-16.0.2-2.21.1 MozillaFirefox-translations-other-16.0.2-2.21.1 MozillaThunderbird-16.0.2-49.19.1 MozillaThunderbird-buildsymbols-16.0.2-49.19.1 MozillaThunderbird-debuginfo-16.0.2-49.19.1 MozillaThunderbird-debugsource-16.0.2-49.19.1 MozillaThunderbird-devel-16.0.2-49.19.1 MozillaThunderbird-devel-debuginfo-16.0.2-49.19.1 MozillaThunderbird-translations-common-16.0.2-49.19.1 MozillaThunderbird-translations-other-16.0.2-49.19.1 enigmail-1.4.5.+16.0.2-49.19.1 enigmail-debuginfo-1.4.5.+16.0.2-49.19.1 mozilla-js-16.0.2-2.18.1 mozilla-js-debuginfo-16.0.2-2.18.1 seamonkey-2.13.2-2.22.1 seamonkey-debuginfo-2.13.2-2.22.1 seamonkey-debugsource-2.13.2-2.22.1 seamonkey-dom-inspector-2.13.2-2.22.1 seamonkey-irc-2.13.2-2.22.1 seamonkey-translations-common-2.13.2-2.22.1 seamonkey-translations-other-2.13.2-2.22.1 seamonkey-venkman-2.13.2-2.22.1 xulrunner-16.0.2-2.18.1 xulrunner-buildsymbols-16.0.2-2.18.1 xulrunner-debuginfo-16.0.2-2.18.1 xulrunner-debugsource-16.0.2-2.18.1 xulrunner-devel-16.0.2-2.18.1 xulrunner-devel-debuginfo-16.0.2-2.18.1 - openSUSE 12.2 (x86_64): mozilla-js-32bit-16.0.2-2.18.1 mozilla-js-debuginfo-32bit-16.0.2-2.18.1 xulrunner-32bit-16.0.2-2.18.1 xulrunner-debuginfo-32bit-16.0.2-2.18.1 - openSUSE 12.1 (i586 x86_64): MozillaFirefox-16.0.2-2.50.1 MozillaFirefox-branding-upstream-16.0.2-2.50.1 MozillaFirefox-buildsymbols-16.0.2-2.50.1 MozillaFirefox-debuginfo-16.0.2-2.50.1 MozillaFirefox-debugsource-16.0.2-2.50.1 MozillaFirefox-devel-16.0.2-2.50.1 MozillaFirefox-translations-common-16.0.2-2.50.1 MozillaFirefox-translations-other-16.0.2-2.50.1 MozillaThunderbird-16.0.2-33.39.1 MozillaThunderbird-buildsymbols-16.0.2-33.39.1 MozillaThunderbird-debuginfo-16.0.2-33.39.1 MozillaThunderbird-debugsource-16.0.2-33.39.1 MozillaThunderbird-devel-16.0.2-33.39.1 MozillaThunderbird-devel-debuginfo-16.0.2-33.39.1 MozillaThunderbird-translations-common-16.0.2-33.39.1 MozillaThunderbird-translations-other-16.0.2-33.39.1 enigmail-1.4.5.+16.0.2-33.39.1 enigmail-debuginfo-1.4.5.+16.0.2-33.39.1 mozilla-js-16.0.2-2.45.1 mozilla-js-debuginfo-16.0.2-2.45.1 seamonkey-2.13.2-2.41.1 seamonkey-debuginfo-2.13.2-2.41.1 seamonkey-debugsource-2.13.2-2.41.1 seamonkey-dom-inspector-2.13.2-2.41.1 seamonkey-irc-2.13.2-2.41.1 seamonkey-translations-common-2.13.2-2.41.1 seamonkey-translations-other-2.13.2-2.41.1 seamonkey-venkman-2.13.2-2.41.1 xulrunner-16.0.2-2.45.1 xulrunner-buildsymbols-16.0.2-2.45.1 xulrunner-debuginfo-16.0.2-2.45.1 xulrunner-debugsource-16.0.2-2.45.1 xulrunner-devel-16.0.2-2.45.1 xulrunner-devel-debuginfo-16.0.2-2.45.1 - openSUSE 12.1 (x86_64): mozilla-js-32bit-16.0.2-2.45.1 mozilla-js-debuginfo-32bit-16.0.2-2.45.1 xulrunner-32bit-16.0.2-2.45.1 xulrunner-debuginfo-32bit-16.0.2-2.45.1 - openSUSE 12.1 (ia64): mozilla-js-debuginfo-x86-16.0.2-2.45.1 mozilla-js-x86-16.0.2-2.45.1 xulrunner-debuginfo-x86-16.0.2-2.45.1 xulrunner-x86-16.0.2-2.45.1 - openSUSE 11.4 (i586 x86_64): MozillaFirefox-16.0.2-45.1 MozillaFirefox-branding-upstream-16.0.2-45.1 MozillaFirefox-buildsymbols-16.0.2-45.1 MozillaFirefox-debuginfo-16.0.2-45.1 MozillaFirefox-debugsource-16.0.2-45.1 MozillaFirefox-devel-16.0.2-45.1 MozillaFirefox-translations-common-16.0.2-45.1 MozillaFirefox-translations-other-16.0.2-45.1 MozillaThunderbird-16.0.2-37.1 MozillaThunderbird-buildsymbols-16.0.2-37.1 MozillaThunderbird-debuginfo-16.0.2-37.1 MozillaThunderbird-debugsource-16.0.2-37.1 MozillaThunderbird-devel-16.0.2-37.1 MozillaThunderbird-devel-debuginfo-16.0.2-37.1 MozillaThunderbird-translations-common-16.0.2-37.1 MozillaThunderbird-translations-other-16.0.2-37.1 enigmail-1.4.5.+16.0.2-37.1 enigmail-debuginfo-1.4.5.+16.0.2-37.1 seamonkey-2.13.2-41.1 seamonkey-debuginfo-2.13.2-41.1 seamonkey-debugsource-2.13.2-41.1 seamonkey-dom-inspector-2.13.2-41.1 seamonkey-irc-2.13.2-41.1 seamonkey-translations-common-2.13.2-41.1 seamonkey-translations-other-2.13.2-41.1 seamonkey-venkman-2.13.2-41.1 References: http://support.novell.com/security/cve/CVE-2012-4194.html http://support.novell.com/security/cve/CVE-2012-4195.html http://support.novell.com/security/cve/CVE-2012-4196.html https://bugzilla.novell.com/786522 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1404-1: critical: exim: overflow in DKIM handling fixed
by opensuse-security＠opensuse.org 27 Oct '12

27 Oct '12

openSUSE Security Update: exim: overflow in DKIM handling fixed ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1404-1 Rating: critical References: #670711 #786652 Cross-References: CVE-2011-1764 CVE-2012-5671 Affected Products: openSUSE 12.2 openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes a remotely exploitable overflow in DKIM handling. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-738 - openSUSE 12.1: zypper in -t patch openSUSE-2012-738 - openSUSE 11.4: zypper in -t patch openSUSE-2012-738 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): exim-4.80.1-2.4.1 exim-debuginfo-4.80.1-2.4.1 exim-debugsource-4.80.1-2.4.1 eximon-4.80.1-2.4.1 eximon-debuginfo-4.80.1-2.4.1 eximstats-html-4.80.1-2.4.1 - openSUSE 12.1 (i586 x86_64): exim-4.80.1-5.4.1 exim-debuginfo-4.80.1-5.4.1 exim-debugsource-4.80.1-5.4.1 eximon-4.80.1-5.4.1 eximon-debuginfo-4.80.1-5.4.1 eximstats-html-4.80.1-5.4.1 - openSUSE 11.4 (i586 x86_64): exim-4.80.1-23.1 exim-debuginfo-4.80.1-23.1 exim-debugsource-4.80.1-23.1 eximon-4.80.1-23.1 eximon-debuginfo-4.80.1-23.1 eximstats-html-4.80.1-23.1 References: http://support.novell.com/security/cve/CVE-2011-1764.html http://support.novell.com/security/cve/CVE-2012-5671.html https://bugzilla.novell.com/670711 https://bugzilla.novell.com/786652 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1203-2: important: Security update for qemu
by opensuse-security＠opensuse.org 24 Oct '12

24 Oct '12

SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1203-2 Rating: important References: #777084 Cross-References: CVE-2012-3515 Affected Products: SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The qemu vt100 emulation was affected by a problem where specific vt100 sequences could have been used by guest users to affect the host. (CVE-2012-3515 aka XSA-17). This has been fixed. Security Issue reference: * CVE-2012-3515 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515 > Package List: - SLE SDK 10 SP4 (i586 ia64 x86_64): qemu-0.8.2-37.14.1 References: http://support.novell.com/security/cve/CVE-2012-3515.html https://bugzilla.novell.com/777084 http://download.novell.com/patch/finder/?keywords=30f612a13ba8c3e5184ba89d4… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1398-1: important: Security update for OpenJDK
by opensuse-security＠opensuse.org 24 Oct '12

24 Oct '12

SUSE Security Update: Security update for OpenJDK ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1398-1 Rating: important References: #785433 Cross-References: CVE-2012-1531 CVE-2012-1532 CVE-2012-1533 CVE-2012-3143 CVE-2012-3159 CVE-2012-3216 CVE-2012-4416 CVE-2012-4681 CVE-2012-5067 CVE-2012-5068 CVE-2012-5069 CVE-2012-5070 CVE-2012-5071 CVE-2012-5072 CVE-2012-5073 CVE-2012-5074 CVE-2012-5075 CVE-2012-5076 CVE-2012-5077 CVE-2012-5078 CVE-2012-5079 CVE-2012-5080 CVE-2012-5081 CVE-2012-5082 CVE-2012-5083 CVE-2012-5084 CVE-2012-5085 CVE-2012-5086 CVE-2012-5087 CVE-2012-5088 CVE-2012-5089 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes 31 vulnerabilities is now available. Description: java-openjdk was upgraded to version 1.11.5 to fix various security and non-security issues. Security Issue references: * CVE-2012-4681 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4681 > * CVE-2012-5083 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5083 > * CVE-2012-1531 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1531 > * CVE-2012-5086 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5086 > * CVE-2012-5087 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5087 > * CVE-2012-1533 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1533 > * CVE-2012-1532 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1532 > * CVE-2012-5076 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5076 > * CVE-2012-3143 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3143 > * CVE-2012-5088 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5088 > * CVE-2012-5078 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5078 > * CVE-2012-5089 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5089 > * CVE-2012-5084 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5084 > * CVE-2012-5080 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5080 > * CVE-2012-3159 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3159 > * CVE-2012-5068 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5068 > * CVE-2012-4416 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4416 > * CVE-2012-5074 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5074 > * CVE-2012-5071 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5071 > * CVE-2012-5069 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5069 > * CVE-2012-5067 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5067 > * CVE-2012-5070 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5070 > * CVE-2012-5075 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5075 > * CVE-2012-5073 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5073 > * CVE-2012-5079 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5079 > * CVE-2012-5072 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5072 > * CVE-2012-5081 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5081 > * CVE-2012-5082 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5082 > * CVE-2012-3216 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3216 > * CVE-2012-5077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5077 > * CVE-2012-5085 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5085 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-java-1_6_0-openjdk-6987 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b24.1.11.5-0.2.1 java-1_6_0-openjdk-demo-1.6.0.0_b24.1.11.5-0.2.1 java-1_6_0-openjdk-devel-1.6.0.0_b24.1.11.5-0.2.1 References: http://support.novell.com/security/cve/CVE-2012-1531.html http://support.novell.com/security/cve/CVE-2012-1532.html http://support.novell.com/security/cve/CVE-2012-1533.html http://support.novell.com/security/cve/CVE-2012-3143.html http://support.novell.com/security/cve/CVE-2012-3159.html http://support.novell.com/security/cve/CVE-2012-3216.html http://support.novell.com/security/cve/CVE-2012-4416.html http://support.novell.com/security/cve/CVE-2012-4681.html http://support.novell.com/security/cve/CVE-2012-5067.html http://support.novell.com/security/cve/CVE-2012-5068.html http://support.novell.com/security/cve/CVE-2012-5069.html http://support.novell.com/security/cve/CVE-2012-5070.html http://support.novell.com/security/cve/CVE-2012-5071.html http://support.novell.com/security/cve/CVE-2012-5072.html http://support.novell.com/security/cve/CVE-2012-5073.html http://support.novell.com/security/cve/CVE-2012-5074.html http://support.novell.com/security/cve/CVE-2012-5075.html http://support.novell.com/security/cve/CVE-2012-5076.html http://support.novell.com/security/cve/CVE-2012-5077.html http://support.novell.com/security/cve/CVE-2012-5078.html http://support.novell.com/security/cve/CVE-2012-5079.html http://support.novell.com/security/cve/CVE-2012-5080.html http://support.novell.com/security/cve/CVE-2012-5081.html http://support.novell.com/security/cve/CVE-2012-5082.html http://support.novell.com/security/cve/CVE-2012-5083.html http://support.novell.com/security/cve/CVE-2012-5084.html http://support.novell.com/security/cve/CVE-2012-5085.html http://support.novell.com/security/cve/CVE-2012-5086.html http://support.novell.com/security/cve/CVE-2012-5087.html http://support.novell.com/security/cve/CVE-2012-5088.html http://support.novell.com/security/cve/CVE-2012-5089.html https://bugzilla.novell.com/785433 http://download.novell.com/patch/finder/?keywords=c230e2b1023ded8fd1041aa18… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1391-1: important: Security update for Linux kernel
by opensuse-security＠opensuse.org 24 Oct '12

24 Oct '12

SUSE Security Update: Security update for Linux kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1391-1 Rating: important References: #674284 #703156 #734056 #738400 #738528 #747576 #755546 #758985 #760974 #762581 #763526 #765102 #765320 #767277 #767504 #767766 #767939 #769784 #770507 #770697 #772409 #773272 #773831 #776888 #777575 #783058 Cross-References: CVE-2011-1044 CVE-2011-4110 CVE-2012-2136 CVE-2012-2663 CVE-2012-2744 CVE-2012-3510 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has 20 fixes is now available. Description: This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel. The following security issues have been fixed: * CVE-2011-2494: kernel/taskstats.c in the Linux kernel allowed local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another users password (a side channel attack). * CVE-2012-2744: net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel, when the nf_conntrack_ipv6 module is enabled, allowed remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets. * CVE-2012-3510: Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel allowed local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command. * CVE-2011-4110: The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allowed local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and updating a negative key into a fully instantiated key. * CVE-2011-1044: The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel did not initialize a certain response buffer, which allowed local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled, a different vulnerability than CVE-2010-4649. * CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel allowed remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem. * CVE-2012-2136: The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel did not properly validate a certain length value, which allowed local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device. * CVE-2012-2663: A small denial of service leak in dropping syn+fin messages was fixed. The following non-security issues have been fixed: Packaging: * kbuild: Fix gcc -x syntax (bnc#773831). NFS: * knfsd: An assortment of little fixes to the sunrpc cache code (bnc#767766). * knfsd: Unexport cache_fresh and fix a small race (bnc#767766). * knfsd: nfsd: do not drop silently on upcall deferral (bnc#767766). * knfsd: svcrpc: remove another silent drop from deferral code (bnc#767766). * sunrpc/cache: simplify cache_fresh_locked and cache_fresh_unlocked (bnc#767766). * sunrpc/cache: recheck cache validity after cache_defer_req (bnc#767766). * sunrpc/cache: use list_del_init for the list_head entries in cache_deferred_req (bnc#767766). * sunrpc/cache: avoid variable over-loading in cache_defer_req (bnc#767766). * sunrpc/cache: allow thread to block while waiting for cache update (bnc#767766). * sunrpc/cache: Fix race in sunrpc/cache introduced by patch to allow thread to block while waiting for cache update (bnc#767766). * sunrpc/cache: Another fix for race problem with sunrpc cache deferal (bnc#767766). * knfsd: nfsd: make all exp_finding functions return -errnos on err (bnc#767766). * Fix kabi breakage in previous nfsd patch series (bnc#767766). * nfsd: Work around incorrect return type for wait_for_completion_interruptible_timeout (bnc#767766). * nfs: Fix a potential file corruption issue when writing (bnc#773272). * nfs: Allow sync writes to be multiple pages (bnc#763526). * nfs: fix reference counting for NFSv4 callback thread (bnc#767504). * nfs: flush signals before taking down callback thread (bnc#767504). * nfsv4: Ensure nfs_callback_down() calls svc_destroy() (bnc#767504). SCSI: * SCSI/ch: Check NULL for kmalloc() return (bnc#783058). * drivers/scsi/aic94xx/aic94xx_init.c: correct the size argument to kmalloc (bnc#783058). * block: fail SCSI passthrough ioctls on partition devices (bnc#738400). * dm: do not forward ioctls from logical volumes to the underlying device (bnc#738400). * vmware: Fix VMware hypervisor detection (bnc#777575, bnc#770507). S/390: * lgr: Make lgr_page static (bnc#772409,LTC#83520). * zfcp: Fix oops in _blk_add_trace() (bnc#772409,LTC#83510). * kernel: Add z/VM LGR detection (bnc#767277,LTC#RAS1203). * be2net: Fix EEH error reset before a flash dump completes (bnc#755546). * mptfusion: fix msgContext in mptctl_hp_hostinfo (bnc#767939). * PCI: Fix bus resource assignment on 32 bits with 64b resources. (bnc#762581) * PCI: fix up setup-bus.c #ifdef. (bnc#762581) * x86: powernow-k8: Fix indexing issue (bnc#758985). * net: Fix race condition about network device name allocation (bnc#747576). XEN: * smpboot: adjust ordering of operations. * xen/x86-64: provide a memset() that can deal with 4Gb or above at a time (bnc#738528). * xen: fix VM_FOREIGN users after c/s 878:eba6fe6d8d53 (bnc#760974). * xen/gntdev: fix multi-page slot allocation (bnc#760974). Security Issues: * CVE-2011-1044 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1044 > * CVE-2011-4110 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4110 > * CVE-2012-2136 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2136 > * CVE-2012-2663 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2663 > * CVE-2012-2744 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2744 > * CVE-2012-3510 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3510 > Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): kernel-default-2.6.16.60-0.99.1 kernel-source-2.6.16.60-0.99.1 kernel-syms-2.6.16.60-0.99.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 x86_64): kernel-debug-2.6.16.60-0.99.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc x86_64): kernel-kdump-2.6.16.60-0.99.1 - SUSE Linux Enterprise Server 10 SP4 (i586 x86_64): kernel-smp-2.6.16.60-0.99.1 kernel-xen-2.6.16.60-0.99.1 - SUSE Linux Enterprise Server 10 SP4 (i586): kernel-bigsmp-2.6.16.60-0.99.1 kernel-kdumppae-2.6.16.60-0.99.1 kernel-vmi-2.6.16.60-0.99.1 kernel-vmipae-2.6.16.60-0.99.1 kernel-xenpae-2.6.16.60-0.99.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): kernel-iseries64-2.6.16.60-0.99.1 kernel-ppc64-2.6.16.60-0.99.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): kernel-default-2.6.16.60-0.99.1 kernel-smp-2.6.16.60-0.99.1 kernel-source-2.6.16.60-0.99.1 kernel-syms-2.6.16.60-0.99.1 kernel-xen-2.6.16.60-0.99.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586): kernel-bigsmp-2.6.16.60-0.99.1 kernel-xenpae-2.6.16.60-0.99.1 - SLE SDK 10 SP4 (i586 ia64 x86_64): kernel-debug-2.6.16.60-0.99.1 - SLE SDK 10 SP4 (i586 ppc x86_64): kernel-kdump-2.6.16.60-0.99.1 - SLE SDK 10 SP4 (i586 x86_64): kernel-xen-2.6.16.60-0.99.1 - SLE SDK 10 SP4 (i586): kernel-xenpae-2.6.16.60-0.99.1 References: http://support.novell.com/security/cve/CVE-2011-1044.html http://support.novell.com/security/cve/CVE-2011-4110.html http://support.novell.com/security/cve/CVE-2012-2136.html http://support.novell.com/security/cve/CVE-2012-2663.html http://support.novell.com/security/cve/CVE-2012-2744.html http://support.novell.com/security/cve/CVE-2012-3510.html https://bugzilla.novell.com/674284 https://bugzilla.novell.com/703156 https://bugzilla.novell.com/734056 https://bugzilla.novell.com/738400 https://bugzilla.novell.com/738528 https://bugzilla.novell.com/747576 https://bugzilla.novell.com/755546 https://bugzilla.novell.com/758985 https://bugzilla.novell.com/760974 https://bugzilla.novell.com/762581 https://bugzilla.novell.com/763526 https://bugzilla.novell.com/765102 https://bugzilla.novell.com/765320 https://bugzilla.novell.com/767277 https://bugzilla.novell.com/767504 https://bugzilla.novell.com/767766 https://bugzilla.novell.com/767939 https://bugzilla.novell.com/769784 https://bugzilla.novell.com/770507 https://bugzilla.novell.com/770697 https://bugzilla.novell.com/772409 https://bugzilla.novell.com/773272 https://bugzilla.novell.com/773831 https://bugzilla.novell.com/776888 https://bugzilla.novell.com/777575 https://bugzilla.novell.com/783058 http://download.novell.com/patch/finder/?keywords=118cf41af33f48911c473f3bd… http://download.novell.com/patch/finder/?keywords=1d5bd8295622191606c935851… http://download.novell.com/patch/finder/?keywords=3b3320a96f49fe4615b35ba22… http://download.novell.com/patch/finder/?keywords=9dc087603b172b449aa9a07b5… http://download.novell.com/patch/finder/?keywords=c77cfcc87d8e54df006cb42c1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1390-2: important: Security update for bind
by opensuse-security＠opensuse.org 24 Oct '12

24 Oct '12

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1390-2 Rating: important References: #784602 Cross-References: CVE-2012-5166 Affected Products: SUSE Linux Enterprise Server 10 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The following issue has been fixed: * Specially crafted RDATA could have caused bind to lockup. This was a different flaw than CVE-2012-4244. Security Issue reference: * CVE-2012-5166 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5166 > Package List: - SUSE Linux Enterprise Server 10 SP2 (i586 s390x x86_64): bind-9.3.4-1.31.33.1 bind-chrootenv-9.3.4-1.31.33.1 bind-devel-9.3.4-1.31.33.1 bind-doc-9.3.4-1.31.33.1 bind-libs-9.3.4-1.31.33.1 bind-utils-9.3.4-1.31.33.1 - SUSE Linux Enterprise Server 10 SP2 (s390x x86_64): bind-libs-32bit-9.3.4-1.31.33.1 References: http://support.novell.com/security/cve/CVE-2012-5166.html https://bugzilla.novell.com/784602 http://download.novell.com/patch/finder/?keywords=a8e673632571bbd76e46ad336… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1390-1: important: Security update for bind
by opensuse-security＠opensuse.org 23 Oct '12

23 Oct '12

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1390-1 Rating: important References: #784602 Cross-References: CVE-2012-5166 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Server 10 SP3 LTSS SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: The following issue has been fixed: * Specially crafted RDATA could have caused bind to lockup. This was a different flaw than CVE-2012-4244. Security Issue reference: * CVE-2012-5166 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5166 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-bind-6944 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-bind-6944 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-bind-6944 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-bind-6980 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-bind-6944 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.6ESVR7P4]: bind-devel-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (ppc64) [New Version: 9.6ESVR7P4]: bind-devel-32bit-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 9.6ESVR7P4]: bind-9.6ESVR7P4-0.8.1 bind-chrootenv-9.6ESVR7P4-0.8.1 bind-doc-9.6ESVR7P4-0.8.1 bind-libs-9.6ESVR7P4-0.8.1 bind-utils-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 9.6ESVR7P4]: bind-libs-32bit-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.6ESVR7P4]: bind-9.6ESVR7P4-0.8.1 bind-chrootenv-9.6ESVR7P4-0.8.1 bind-doc-9.6ESVR7P4-0.8.1 bind-libs-9.6ESVR7P4-0.8.1 bind-utils-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 9.6ESVR7P4]: bind-libs-32bit-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 9.6ESVR7P4]: bind-libs-x86-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 9.6ESVR7P4]: bind-9.6ESVR7P4-0.2.3.1 bind-chrootenv-9.6ESVR7P4-0.2.3.1 bind-doc-9.6ESVR7P4-0.2.3.1 bind-libs-9.6ESVR7P4-0.2.3.1 bind-utils-9.6ESVR7P4-0.2.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 9.6ESVR7P4]: bind-libs-32bit-9.6ESVR7P4-0.2.3.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 9.6ESVR7P4]: bind-9.6ESVR7P4-0.7.1 bind-chrootenv-9.6ESVR7P4-0.7.1 bind-devel-9.6ESVR7P4-0.7.1 bind-doc-9.6ESVR7P4-0.7.1 bind-libs-9.6ESVR7P4-0.7.1 bind-utils-9.6ESVR7P4-0.7.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64) [New Version: 9.6ESVR7P4]: bind-libs-32bit-9.6ESVR7P4-0.7.1 - SUSE Linux Enterprise Server 10 SP4 (ia64) [New Version: 9.6ESVR7P4]: bind-libs-x86-9.6ESVR7P4-0.7.1 - SUSE Linux Enterprise Server 10 SP4 (ppc) [New Version: 9.6ESVR7P4]: bind-devel-64bit-9.6ESVR7P4-0.7.1 bind-libs-64bit-9.6ESVR7P4-0.7.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): bind-9.3.4-1.42.1 bind-chrootenv-9.3.4-1.42.1 bind-devel-9.3.4-1.42.1 bind-doc-9.3.4-1.42.1 bind-libs-9.3.4-1.42.1 bind-utils-9.3.4-1.42.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): bind-libs-32bit-9.3.4-1.42.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 9.6ESVR7P4]: bind-libs-9.6ESVR7P4-0.8.1 bind-utils-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 9.6ESVR7P4]: bind-libs-32bit-9.6ESVR7P4-0.8.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64) [New Version: 9.6ESVR7P4]: bind-libs-9.6ESVR7P4-0.7.1 bind-utils-9.6ESVR7P4-0.7.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64) [New Version: 9.6ESVR7P4]: bind-libs-32bit-9.6ESVR7P4-0.7.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 9.6ESVR7P4]: bind-9.6ESVR7P4-0.7.1 bind-chrootenv-9.6ESVR7P4-0.7.1 bind-devel-9.6ESVR7P4-0.7.1 bind-doc-9.6ESVR7P4-0.7.1 - SLE SDK 10 SP4 (ppc) [New Version: 9.6ESVR7P4]: bind-devel-64bit-9.6ESVR7P4-0.7.1 References: http://support.novell.com/security/cve/CVE-2012-5166.html https://bugzilla.novell.com/784602 http://download.novell.com/patch/finder/?keywords=0491290854c3af020f68ff0d5… http://download.novell.com/patch/finder/?keywords=43e6060a96c82b013f497e12b… http://download.novell.com/patch/finder/?keywords=746fd176e23d559fd877814c8… http://download.novell.com/patch/finder/?keywords=b317f08d89c8077faca5bab8b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1376-1: important: update for chromium
by opensuse-security＠opensuse.org 22 Oct '12

22 Oct '12

openSUSE Security Update: update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1376-1 Rating: important References: #782257 Cross-References: CVE-2012-2874 CVE-2012-2876 CVE-2012-2877 CVE-2012-2878 CVE-2012-2879 CVE-2012-2880 CVE-2012-2881 CVE-2012-2882 CVE-2012-2883 CVE-2012-2884 CVE-2012-2885 CVE-2012-2886 CVE-2012-2887 CVE-2012-2888 CVE-2012-2889 CVE-2012-2891 CVE-2012-2892 CVE-2012-2893 CVE-2012-2894 CVE-2012-2896 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: Chromium was upgraded to version 24.0.1290 which fixed multiple security flaws. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-721 - openSUSE 12.1: zypper in -t patch openSUSE-2012-721 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): chromedriver-24.0.1290.0-1.19.1 chromedriver-debuginfo-24.0.1290.0-1.19.1 chromium-24.0.1290.0-1.19.1 chromium-debuginfo-24.0.1290.0-1.19.1 chromium-debugsource-24.0.1290.0-1.19.1 chromium-desktop-gnome-24.0.1290.0-1.19.1 chromium-desktop-kde-24.0.1290.0-1.19.1 chromium-suid-helper-24.0.1290.0-1.19.1 chromium-suid-helper-debuginfo-24.0.1290.0-1.19.1 - openSUSE 12.1 (i586 x86_64): chromedriver-24.0.1290.0-1.39.1 chromedriver-debuginfo-24.0.1290.0-1.39.1 chromium-24.0.1290.0-1.39.1 chromium-debuginfo-24.0.1290.0-1.39.1 chromium-debugsource-24.0.1290.0-1.39.1 chromium-desktop-gnome-24.0.1290.0-1.39.1 chromium-desktop-kde-24.0.1290.0-1.39.1 chromium-suid-helper-24.0.1290.0-1.39.1 chromium-suid-helper-debuginfo-24.0.1290.0-1.39.1 References: http://support.novell.com/security/cve/CVE-2012-2874.html http://support.novell.com/security/cve/CVE-2012-2876.html http://support.novell.com/security/cve/CVE-2012-2877.html http://support.novell.com/security/cve/CVE-2012-2878.html http://support.novell.com/security/cve/CVE-2012-2879.html http://support.novell.com/security/cve/CVE-2012-2880.html http://support.novell.com/security/cve/CVE-2012-2881.html http://support.novell.com/security/cve/CVE-2012-2882.html http://support.novell.com/security/cve/CVE-2012-2883.html http://support.novell.com/security/cve/CVE-2012-2884.html http://support.novell.com/security/cve/CVE-2012-2885.html http://support.novell.com/security/cve/CVE-2012-2886.html http://support.novell.com/security/cve/CVE-2012-2887.html http://support.novell.com/security/cve/CVE-2012-2888.html http://support.novell.com/security/cve/CVE-2012-2889.html http://support.novell.com/security/cve/CVE-2012-2891.html http://support.novell.com/security/cve/CVE-2012-2892.html http://support.novell.com/security/cve/CVE-2012-2893.html http://support.novell.com/security/cve/CVE-2012-2894.html http://support.novell.com/security/cve/CVE-2012-2896.html https://bugzilla.novell.com/782257 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1372-1: important: bind: Specially crafted DNS data can cause a lockup in named.
by opensuse-security＠opensuse.org 19 Oct '12

19 Oct '12

openSUSE Security Update: bind: Specially crafted DNS data can cause a lockup in named. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1372-1 Rating: important References: #784602 Cross-References: CVE-2012-5166 Affected Products: openSUSE 12.2 openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The bind nameserver was updated to fix specially crafted DNS data can cause a lockup in named. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-716 - openSUSE 12.1: zypper in -t patch openSUSE-2012-716 - openSUSE 11.4: zypper in -t patch openSUSE-2012-716 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): bind-9.9.1P4-1.8.1 bind-chrootenv-9.9.1P4-1.8.1 bind-debuginfo-9.9.1P4-1.8.1 bind-debugsource-9.9.1P4-1.8.1 bind-devel-9.9.1P4-1.8.1 bind-libs-9.9.1P4-1.8.1 bind-libs-debuginfo-9.9.1P4-1.8.1 bind-lwresd-9.9.1P4-1.8.1 bind-lwresd-debuginfo-9.9.1P4-1.8.1 bind-utils-9.9.1P4-1.8.1 bind-utils-debuginfo-9.9.1P4-1.8.1 - openSUSE 12.2 (x86_64): bind-libs-32bit-9.9.1P4-1.8.1 bind-libs-debuginfo-32bit-9.9.1P4-1.8.1 - openSUSE 12.2 (noarch): bind-doc-9.9.1P4-1.8.1 - openSUSE 12.1 (i586 x86_64): bind-9.8.3P4-4.24.1 bind-chrootenv-9.8.3P4-4.24.1 bind-debuginfo-9.8.3P4-4.24.1 bind-debugsource-9.8.3P4-4.24.1 bind-devel-9.8.3P4-4.24.1 bind-libs-9.8.3P4-4.24.1 bind-libs-debuginfo-9.8.3P4-4.24.1 bind-lwresd-9.8.3P4-4.24.1 bind-lwresd-debuginfo-9.8.3P4-4.24.1 bind-utils-9.8.3P4-4.24.1 bind-utils-debuginfo-9.8.3P4-4.24.1 - openSUSE 12.1 (x86_64): bind-libs-32bit-9.8.3P4-4.24.1 bind-libs-debuginfo-32bit-9.8.3P4-4.24.1 - openSUSE 12.1 (noarch): bind-doc-9.8.3P4-4.24.1 - openSUSE 12.1 (ia64): bind-libs-debuginfo-x86-9.8.3P4-4.24.1 bind-libs-x86-9.8.3P4-4.24.1 - openSUSE 11.4 (i586 x86_64): bind-9.7.6P4-0.41.1 bind-chrootenv-9.7.6P4-0.41.1 bind-debuginfo-9.7.6P4-0.41.1 bind-debugsource-9.7.6P4-0.41.1 bind-devel-9.7.6P4-0.41.1 bind-libs-9.7.6P4-0.41.1 bind-libs-debuginfo-9.7.6P4-0.41.1 bind-lwresd-9.7.6P4-0.41.1 bind-lwresd-debuginfo-9.7.6P4-0.41.1 bind-utils-9.7.6P4-0.41.1 bind-utils-debuginfo-9.7.6P4-0.41.1 - openSUSE 11.4 (x86_64): bind-libs-32bit-9.7.6P4-0.41.1 bind-libs-debuginfo-32bit-9.7.6P4-0.41.1 - openSUSE 11.4 (noarch): bind-doc-9.7.6P4-0.41.1 - openSUSE 11.4 (ia64): bind-libs-debuginfo-x86-9.7.6P4-0.41.1 bind-libs-x86-9.7.6P4-0.41.1 References: http://support.novell.com/security/cve/CVE-2012-5166.html https://bugzilla.novell.com/784602 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1351-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 16 Oct '12

16 Oct '12

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1351-1 Rating: important References: #783533 Cross-References: CVE-2012-3977 CVE-2012-3982 CVE-2012-3983 CVE-2012-3984 CVE-2012-3985 CVE-2012-3986 CVE-2012-3987 CVE-2012-3988 CVE-2012-3989 CVE-2012-3990 CVE-2012-3991 CVE-2012-3992 CVE-2012-3993 CVE-2012-3994 CVE-2012-3995 CVE-2012-4179 CVE-2012-4180 CVE-2012-4181 CVE-2012-4182 CVE-2012-4183 CVE-2012-4184 CVE-2012-4185 CVE-2012-4186 CVE-2012-4187 CVE-2012-4188 CVE-2012-4192 CVE-2012-4193 Affected Products: SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. It includes two new package versions. Description: MozillaFirefox was updated to the 10.0.9ESR security release which fixes bugs and security issues: * MFSA 2012-73 / CVE-2012-3977: Security researchers Thai Duong and Juliano Rizzo reported that SPDY's request header compression leads to information leakage, which can allow the extraction of private data such as session cookies, even over an encrypted SSL connection. (This does not affect Firefox 10 as it does not feature the SPDY extension. It was silently fixed for Firefox 15.) * MFSA 2012-74: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. * CVE-2012-3983: Henrik Skupin, Jesse Ruderman and moz_bug_r_a4 reported memory safety problems and crashes that affect Firefox 15. * CVE-2012-3982: Christian Holler and Jesse Ruderman reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 15. * MFSA 2012-75 / CVE-2012-3984: Security researcher David Bloom of Cue discovered that "select" elements are always-on-top chromeless windows and that navigation away from a page with an active "select" menu does not remove this window.When another menu is opened programmatically on a new page, the original "select" menu can be retained and arbitrary HTML content within it rendered, allowing an attacker to cover arbitrary portions of the new page through absolute positioning/scrolling, leading to spoofing attacks. Security researcher Jordi Chancel found a variation that would allow for click-jacking attacks was well. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. References Navigation away from a page with an active "select" dropdown menu can be used for URL spoofing, other evil Firefox 10.0.1 : Navigation away from a page with multiple active "select" dropdown menu can be used for Spoofing And ClickJacking with XPI using window.open and geolocalisation * MFSA 2012-76 / CVE-2012-3985: Security researcher Collin Jackson reported a violation of the HTML5 specifications for document.domain behavior. Specified behavior requires pages to only have access to windows in a new document.domain but the observed violation allowed pages to retain access to windows from the page's initial origin in addition to the new document.domain. This could potentially lead to cross-site scripting (XSS) attacks. * MFSA 2012-77 / CVE-2012-3986: Mozilla developer Johnny Stenback discovered that several methods of a feature used for testing (DOMWindowUtils) are not protected by existing security checks, allowing these methods to be called through script by web pages. This was addressed by adding the existing security checks to these methods. * MFSA 2012-78 / CVE-2012-3987: Security researcher Warren He reported that when a page is transitioned into Reader Mode in Firefox for Android, the resulting page has chrome privileges and its content is not thoroughly sanitized. A successful attack requires user enabling of reader mode for a malicious page, which could then perform an attack similar to cross-site scripting (XSS) to gain the privileges allowed to Firefox on an Android device. This has been fixed by changing the Reader Mode page into an unprivileged page. This vulnerability only affects Firefox for Android. * MFSA 2012-79 / CVE-2012-3988: Security researcher Soroush Dalili reported that a combination of invoking full screen mode and navigating backwards in history could, in some circumstances, cause a hang or crash due to a timing dependent use-after-free pointer reference. This crash may be potentially exploitable. * MFSA 2012-80 / CVE-2012-3989: Mozilla community member Ms2ger reported a crash due to an invalid cast when using the instanceof operator on certain types of JavaScript objects. This can lead to a potentially exploitable crash. * MFSA 2012-81 / CVE-2012-3991: Mozilla community member Alice White reported that when the GetProperty function is invoked through JSAPI, security checking can be bypassed when getting cross-origin properties. This potentially allowed for arbitrary code execution. * MFSA 2012-82 / CVE-2012-3994: Security researcher Mariusz Mlynski reported that the location property can be accessed by binary plugins through top.location and top can be shadowed by Object.defineProperty as well. This can allow for possible cross-site scripting (XSS) attacks through plugins. * MFSA 2012-83: Security researcher Mariusz Mlynski reported that when InstallTrigger fails, it throws an error wrapped in a Chrome Object Wrapper (COW) that fails to specify exposed properties. These can then be added to the resulting object by an attacker, allowing access to chrome privileged functions through script. While investigating this issue, Mozilla security researcher moz_bug_r_a4 found that COW did not disallow accessing of properties from a standard prototype in some situations, even when the original issue had been fixed. These issues could allow for a cross-site scripting (XSS) attack or arbitrary code execution. * CVE-2012-3993: XrayWrapper pollution via unsafe COW * CVE-2012-4184: ChromeObjectWrapper is not implemented as intended * MFSA 2012-84 / CVE-2012-3992: Security researcher Mariusz Mlynski reported an issue with spoofing of the location property. In this issue, writes to location.hash can be used in concert with scripted history navigation to cause a specific website to be loaded into the history object. The baseURI can then be changed to this stored site, allowing an attacker to inject a script or intercept posted data posted to a location specified with a relative path. * MFSA 2012-85: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team discovered a series of use-after-free, buffer overflow, and out of bounds read issues using the Address Sanitizer tool in shipped software. These issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting two additional use-after-free flaws introduced during Firefox 16 development and fixed before general release. * CVE-2012-3995: Out of bounds read in IsCSSWordSpacingSpace * CVE-2012-4179: Heap-use-after-free in nsHTMLCSSUtils::CreateCSSPropertyTxn * CVE-2012-4180: Heap-buffer-overflow in nsHTMLEditor::IsPrevCharInNodeWhitespace * CVE-2012-4181: Heap-use-after-free in nsSMILAnimationController::DoSample * CVE-2012-4182: Heap-use-after-free in nsTextEditRules::WillInsert * CVE-2012-4183: Heap-use-after-free in DOMSVGTests::GetRequiredFeatures * MFSA 2012-86: Security researcher Atte Kettunen from OUSPG reported several heap memory corruption issues found using the Address Sanitizer tool. These issues are potentially exploitable, allowing for remote code execution. * CVE-2012-4185: Global-buffer-overflow in nsCharTraits::length * CVE-2012-4186: Heap-buffer-overflow in nsWaveReader::DecodeAudioData * CVE-2012-4187: Crash with ASSERTION: insPos too small * CVE-2012-4188: Heap-buffer-overflow in Convolve3x3 * MFSA 2012-87 / CVE-2012-3990: Security researcher miaubiz used the Address Sanitizer tool to discover a use-after-free in the IME State Manager code. This could lead to a potentially exploitable crash. * MFSA 2012-89 / CVE-2012-4192 / CVE-2012-4193: Mozilla security researcher moz_bug_r_a4 reported a regression where security wrappers are unwrapped without doing a security check in defaultValue(). This can allow for improper access access to the Location object. In versions 15 and earlier of affected products, there was also the potential for arbitrary code execution. Security Issue reference: * CVE-2012-3977 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3977 > * CVE-2012-3982 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3982 > * CVE-2012-3983 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3983 > * CVE-2012-3984 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3984 > * CVE-2012-3985 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3985 > * CVE-2012-3986 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3986 > * CVE-2012-3987 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3987 > * CVE-2012-3988 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3988 > * CVE-2012-3989 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3989 > * CVE-2012-3990 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3990 > * CVE-2012-3991 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3991 > * CVE-2012-3992 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3992 > * CVE-2012-3993 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3993 > * CVE-2012-3994 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3994 > * CVE-2012-3995 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3995 > * CVE-2012-4179 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4179 > * CVE-2012-4180 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4180 > * CVE-2012-4181 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4181 > * CVE-2012-4182 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4182 > * CVE-2012-4183 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4183 > * CVE-2012-4184 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4184 > * CVE-2012-4185 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4185 > * CVE-2012-4186 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4186 > * CVE-2012-4187 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4187 > * CVE-2012-4188 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4188 > * CVE-2012-4192 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4192 > * CVE-2012-4193 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4193 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-firefox-201210-6951 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-firefox-201210-6951 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-firefox-201210-6951 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 10.0.9]: MozillaFirefox-10.0.9-0.3.1 MozillaFirefox-translations-10.0.9-0.3.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 10.0.9]: MozillaFirefox-10.0.9-0.3.1 MozillaFirefox-branding-SLED-7-0.6.7.85 MozillaFirefox-translations-10.0.9-0.3.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x) [New Version: 7]: MozillaFirefox-10.0.9-0.5.1 MozillaFirefox-branding-SLED-7-0.8.35 MozillaFirefox-translations-10.0.9-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 10.0.9]: MozillaFirefox-10.0.9-0.3.1 MozillaFirefox-branding-SLED-7-0.6.7.85 MozillaFirefox-translations-10.0.9-0.3.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 7]: MozillaFirefox-10.0.9-0.5.1 MozillaFirefox-branding-SLED-7-0.8.35 MozillaFirefox-translations-10.0.9-0.5.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x): MozillaFirefox-branding-upstream-10.0.9-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-3977.html http://support.novell.com/security/cve/CVE-2012-3982.html http://support.novell.com/security/cve/CVE-2012-3983.html http://support.novell.com/security/cve/CVE-2012-3984.html http://support.novell.com/security/cve/CVE-2012-3985.html http://support.novell.com/security/cve/CVE-2012-3986.html http://support.novell.com/security/cve/CVE-2012-3987.html http://support.novell.com/security/cve/CVE-2012-3988.html http://support.novell.com/security/cve/CVE-2012-3989.html http://support.novell.com/security/cve/CVE-2012-3990.html http://support.novell.com/security/cve/CVE-2012-3991.html http://support.novell.com/security/cve/CVE-2012-3992.html http://support.novell.com/security/cve/CVE-2012-3993.html http://support.novell.com/security/cve/CVE-2012-3994.html http://support.novell.com/security/cve/CVE-2012-3995.html http://support.novell.com/security/cve/CVE-2012-4179.html http://support.novell.com/security/cve/CVE-2012-4180.html http://support.novell.com/security/cve/CVE-2012-4181.html http://support.novell.com/security/cve/CVE-2012-4182.html http://support.novell.com/security/cve/CVE-2012-4183.html http://support.novell.com/security/cve/CVE-2012-4184.html http://support.novell.com/security/cve/CVE-2012-4185.html http://support.novell.com/security/cve/CVE-2012-4186.html http://support.novell.com/security/cve/CVE-2012-4187.html http://support.novell.com/security/cve/CVE-2012-4188.html http://support.novell.com/security/cve/CVE-2012-4192.html http://support.novell.com/security/cve/CVE-2012-4193.html https://bugzilla.novell.com/783533 http://download.novell.com/patch/finder/?keywords=9df8424f201589e4fca1abdc2… http://download.novell.com/patch/finder/?keywords=b54051bb7b93d9b879c04f373… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] Advance SUSE support discontinuation notice for openSUSE 11.4 - Evergreen goes on!
by Marcus Meissner 16 Oct '12

16 Oct '12

Dear opensuse-security-announce subscribers and openSUSE users, SUSE Security and the openSUSE Maintenance Team announce that the SUSE sponsored security and maintenance teams will stop releasing updates for openSUSE 11.4 soon. Having provided both security and bug fixes for the last two releases and two months, we will stop releasing updates after November 5th 2012. However, the community Evergreen team plans to provide ongoing maintenance for openSUSE 11.4. More details on this will be published when they are known. As a consequence, the openSUSE 11.4 distribution directory on our server download.opensuse.org will be removed from /distribution/11.4/ to free space on our mirror sites. The 11.4 directory in the update tree /update/11.4 will follow, as soon as all updates have been published. Also the openSUSE buildservice repositories containing openSUSE 11.4 will be moved to DISCONTINUED:openSUSE:11.4 and building against openSUSE 11.4 will be disabled and removed in all buildservice projects. The discontinuation of openSUSE 11.4 enables SUSE to focus on the openSUSE distributions of a newer release dates to ensure that our users can continuously take advantage of the quality that they are used to with openSUSE products. This announcement holds true for openSUSE 11.4 only. As usual, the openSUSE project will continue to provide update packages for the following products: openSUSE 12.1 (supported until 2 months after openSUSE "Next" release, around May 2013) openSUSE 12.2 (supported until 2 months after openSUSE "Next+2" release) openSUSE Next (naming is discussed currently) (currently in development, to be released early 2013) for the next two openSUSE releases plus a two months overlap period. (As the schedule is under discussion these dates cannot be predicted exactly at this time. It will be 2 releases + 2 months usually.) Please note that the maintenance cycles of SUSE Linux Enterprise products and products based on the SUSE Linux Enterprise Server operating system are not affected by this announcement and have longer life cycles. Our openSUSE lifetimes are tracked on http://en.opensuse.org/Lifetime . To learn more about SUSE Linux Enterprise products, please visit http://www.novell.com/linux/suse/ . For a detailed list of the life cycles of our Enterprise Products please visit http://support.novell.com/lifecycle/ and http://support.novell.com/lifecycle/lcSearchResults.jsp?sl=suse If you have any questions regarding this announcement, please do not hesitate to contact SUSE Security at <security(a)suse.de> or openSUSE Maintenance at <maintenance(a)opensuse.org>. -- Open Linux Security Engineer Position at SUSE: http://bit.ly/Li4RbS

1 0

[security-announce] openSUSE-SU-2012:1345-1: important: MozillaFirefox: update to Firefox 16.0.1
by opensuse-security＠opensuse.org 15 Oct '12

15 Oct '12

openSUSE Security Update: MozillaFirefox: update to Firefox 16.0.1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1345-1 Rating: important References: #783533 Cross-References: CVE-2012-3982 CVE-2012-3983 CVE-2012-3984 CVE-2012-3985 CVE-2012-3986 CVE-2012-3988 CVE-2012-3989 CVE-2012-3990 CVE-2012-3991 CVE-2012-3992 CVE-2012-3993 CVE-2012-3994 CVE-2012-3995 CVE-2012-4179 CVE-2012-4180 CVE-2012-4182 CVE-2012-4183 CVE-2012-4184 CVE-2012-4185 CVE-2012-4186 CVE-2012-4187 CVE-2012-4188 CVE-2012-4191 CVE-2012-4192 CVE-2012-4193 Affected Products: openSUSE 12.2 openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: The Mozilla suite received following security updates (bnc#783533): Mozilla Firefox was updated to 16.0.1. Mozilla Seamonkey was updated to 2.13.1. Mozilla Thunderbird was updated to 16.0.1. Mozilla XULRunner was updated to 16.0.1. * MFSA 2012-88/CVE-2012-4191 (bmo#798045) Miscellaneous memory safety hazards * MFSA 2012-89/CVE-2012-4192/CVE-2012-4193 (bmo#799952, bmo#720619) defaultValue security checks not applied * MFSA 2012-74/CVE-2012-3982/CVE-2012-3983 Miscellaneous memory safety hazards * MFSA 2012-75/CVE-2012-3984 (bmo#575294) select element persistance allows for attacks * MFSA 2012-76/CVE-2012-3985 (bmo#655649) Continued access to initial origin after setting document.domain * MFSA 2012-77/CVE-2012-3986 (bmo#775868) Some DOMWindowUtils methods bypass security checks * MFSA 2012-79/CVE-2012-3988 (bmo#725770) DOS and crash with full screen and history navigation * MFSA 2012-80/CVE-2012-3989 (bmo#783867) Crash with invalid cast when using instanceof operator * MFSA 2012-81/CVE-2012-3991 (bmo#783260) GetProperty function can bypass security checks * MFSA 2012-82/CVE-2012-3994 (bmo#765527) top object and location property accessible by plugins * MFSA 2012-83/CVE-2012-3993/CVE-2012-4184 (bmo#768101, bmo#780370) Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties * MFSA 2012-84/CVE-2012-3992 (bmo#775009) Spoofing and script injection through location.hash * MFSA 2012-85/CVE-2012-3995/CVE-2012-4179/CVE-2012-4180/ CVE-2012-4181/CVE-2012-4182/CVE-2012-4183 Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer * MFSA 2012-86/CVE-2012-4185/CVE-2012-4186/CVE-2012-4187/ CVE-2012-4188 Heap memory corruption issues found using Address Sanitizer * MFSA 2012-87/CVE-2012-3990 (bmo#787704) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-709 - openSUSE 12.1: zypper in -t patch openSUSE-2012-709 - openSUSE 11.4: zypper in -t patch openSUSE-2012-709 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): MozillaFirefox-16.0.1-2.17.1 MozillaFirefox-branding-upstream-16.0.1-2.17.1 MozillaFirefox-buildsymbols-16.0.1-2.17.1 MozillaFirefox-debuginfo-16.0.1-2.17.1 MozillaFirefox-debugsource-16.0.1-2.17.1 MozillaFirefox-devel-16.0.1-2.17.1 MozillaFirefox-translations-common-16.0.1-2.17.1 MozillaFirefox-translations-other-16.0.1-2.17.1 MozillaThunderbird-16.0.1-49.15.1 MozillaThunderbird-buildsymbols-16.0.1-49.15.1 MozillaThunderbird-debuginfo-16.0.1-49.15.1 MozillaThunderbird-debugsource-16.0.1-49.15.1 MozillaThunderbird-devel-16.0.1-49.15.1 MozillaThunderbird-devel-debuginfo-16.0.1-49.15.1 MozillaThunderbird-translations-common-16.0.1-49.15.1 MozillaThunderbird-translations-other-16.0.1-49.15.1 enigmail-1.4.5.+16.0.1-49.15.1 enigmail-debuginfo-1.4.5.+16.0.1-49.15.1 mozilla-js-16.0.1-2.14.1 mozilla-js-debuginfo-16.0.1-2.14.1 mozilla-kde4-integration-0.6.4-10.4.1 mozilla-kde4-integration-debuginfo-0.6.4-10.4.1 mozilla-kde4-integration-debugsource-0.6.4-10.4.1 seamonkey-2.13.1-2.18.1 seamonkey-debuginfo-2.13.1-2.18.1 seamonkey-debugsource-2.13.1-2.18.1 seamonkey-dom-inspector-2.13.1-2.18.1 seamonkey-irc-2.13.1-2.18.1 seamonkey-translations-common-2.13.1-2.18.1 seamonkey-translations-other-2.13.1-2.18.1 seamonkey-venkman-2.13.1-2.18.1 xulrunner-16.0.1-2.14.1 xulrunner-buildsymbols-16.0.1-2.14.1 xulrunner-debuginfo-16.0.1-2.14.1 xulrunner-debugsource-16.0.1-2.14.1 xulrunner-devel-16.0.1-2.14.1 xulrunner-devel-debuginfo-16.0.1-2.14.1 - openSUSE 12.2 (x86_64): mozilla-js-32bit-16.0.1-2.14.1 mozilla-js-debuginfo-32bit-16.0.1-2.14.1 xulrunner-32bit-16.0.1-2.14.1 xulrunner-debuginfo-32bit-16.0.1-2.14.1 - openSUSE 12.1 (i586 x86_64): MozillaFirefox-16.0.1-2.46.1 MozillaFirefox-branding-upstream-16.0.1-2.46.1 MozillaFirefox-buildsymbols-16.0.1-2.46.1 MozillaFirefox-debuginfo-16.0.1-2.46.1 MozillaFirefox-debugsource-16.0.1-2.46.1 MozillaFirefox-devel-16.0.1-2.46.1 MozillaFirefox-translations-common-16.0.1-2.46.1 MozillaFirefox-translations-other-16.0.1-2.46.1 MozillaThunderbird-16.0.1-33.35.1 MozillaThunderbird-buildsymbols-16.0.1-33.35.1 MozillaThunderbird-debuginfo-16.0.1-33.35.1 MozillaThunderbird-debugsource-16.0.1-33.35.1 MozillaThunderbird-devel-16.0.1-33.35.1 MozillaThunderbird-devel-debuginfo-16.0.1-33.35.1 MozillaThunderbird-translations-common-16.0.1-33.35.1 MozillaThunderbird-translations-other-16.0.1-33.35.1 enigmail-1.4.5.+16.0.1-33.35.1 enigmail-debuginfo-1.4.5.+16.0.1-33.35.1 mozilla-js-16.0.1-2.41.1 mozilla-js-debuginfo-16.0.1-2.41.1 mozilla-kde4-integration-0.6.4-6.4.1 mozilla-kde4-integration-debuginfo-0.6.4-6.4.1 mozilla-kde4-integration-debugsource-0.6.4-6.4.1 seamonkey-2.13.1-2.37.1 seamonkey-debuginfo-2.13.1-2.37.1 seamonkey-debugsource-2.13.1-2.37.1 seamonkey-dom-inspector-2.13.1-2.37.1 seamonkey-irc-2.13.1-2.37.1 seamonkey-translations-common-2.13.1-2.37.1 seamonkey-translations-other-2.13.1-2.37.1 seamonkey-venkman-2.13.1-2.37.1 xulrunner-16.0.1-2.41.1 xulrunner-buildsymbols-16.0.1-2.41.1 xulrunner-debuginfo-16.0.1-2.41.1 xulrunner-debugsource-16.0.1-2.41.1 xulrunner-devel-16.0.1-2.41.1 xulrunner-devel-debuginfo-16.0.1-2.41.1 - openSUSE 12.1 (x86_64): mozilla-js-32bit-16.0.1-2.41.1 mozilla-js-debuginfo-32bit-16.0.1-2.41.1 xulrunner-32bit-16.0.1-2.41.1 xulrunner-debuginfo-32bit-16.0.1-2.41.1 - openSUSE 12.1 (ia64): mozilla-js-debuginfo-x86-16.0.1-2.41.1 mozilla-js-x86-16.0.1-2.41.1 xulrunner-debuginfo-x86-16.0.1-2.41.1 xulrunner-x86-16.0.1-2.41.1 - openSUSE 11.4 (i586 x86_64): MozillaFirefox-16.0.1-41.1 MozillaFirefox-branding-upstream-16.0.1-41.1 MozillaFirefox-buildsymbols-16.0.1-41.1 MozillaFirefox-debuginfo-16.0.1-41.1 MozillaFirefox-debugsource-16.0.1-41.1 MozillaFirefox-devel-16.0.1-41.1 MozillaFirefox-translations-common-16.0.1-41.1 MozillaFirefox-translations-other-16.0.1-41.1 MozillaThunderbird-16.0.1-33.1 MozillaThunderbird-buildsymbols-16.0.1-33.1 MozillaThunderbird-debuginfo-16.0.1-33.1 MozillaThunderbird-debugsource-16.0.1-33.1 MozillaThunderbird-devel-16.0.1-33.1 MozillaThunderbird-devel-debuginfo-16.0.1-33.1 MozillaThunderbird-translations-common-16.0.1-33.1 MozillaThunderbird-translations-other-16.0.1-33.1 enigmail-1.4.5.+16.0.1-33.1 enigmail-debuginfo-1.4.5.+16.0.1-33.1 mozilla-kde4-integration-0.6.4-6.1 mozilla-kde4-integration-debuginfo-0.6.4-6.1 mozilla-kde4-integration-debugsource-0.6.4-6.1 seamonkey-2.13.1-37.1 seamonkey-debuginfo-2.13.1-37.1 seamonkey-debugsource-2.13.1-37.1 seamonkey-dom-inspector-2.13.1-37.1 seamonkey-irc-2.13.1-37.1 seamonkey-translations-common-2.13.1-37.1 seamonkey-translations-other-2.13.1-37.1 seamonkey-venkman-2.13.1-37.1 References: http://support.novell.com/security/cve/CVE-2012-3982.html http://support.novell.com/security/cve/CVE-2012-3983.html http://support.novell.com/security/cve/CVE-2012-3984.html http://support.novell.com/security/cve/CVE-2012-3985.html http://support.novell.com/security/cve/CVE-2012-3986.html http://support.novell.com/security/cve/CVE-2012-3988.html http://support.novell.com/security/cve/CVE-2012-3989.html http://support.novell.com/security/cve/CVE-2012-3990.html http://support.novell.com/security/cve/CVE-2012-3991.html http://support.novell.com/security/cve/CVE-2012-3992.html http://support.novell.com/security/cve/CVE-2012-3993.html http://support.novell.com/security/cve/CVE-2012-3994.html http://support.novell.com/security/cve/CVE-2012-3995.html http://support.novell.com/security/cve/CVE-2012-4179.html http://support.novell.com/security/cve/CVE-2012-4180.html http://support.novell.com/security/cve/CVE-2012-4182.html http://support.novell.com/security/cve/CVE-2012-4183.html http://support.novell.com/security/cve/CVE-2012-4184.html http://support.novell.com/security/cve/CVE-2012-4185.html http://support.novell.com/security/cve/CVE-2012-4186.html http://support.novell.com/security/cve/CVE-2012-4187.html http://support.novell.com/security/cve/CVE-2012-4188.html http://support.novell.com/security/cve/CVE-2012-4191.html http://support.novell.com/security/cve/CVE-2012-4192.html http://support.novell.com/security/cve/CVE-2012-4193.html https://bugzilla.novell.com/783533 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1333-1: critical: Security update for bind
by opensuse-security＠opensuse.org 13 Oct '12

13 Oct '12

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1333-1 Rating: critical References: #780157 Cross-References: CVE-2012-4244 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a bug where specially-crafted RRs could have caused a Denial of Service (Application crash) in named. CVE-2012-4244 was assigned to this issue. Security Issue reference: * CVE-2012-4244 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4244 > Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): bind-9.3.4-1.40.1 bind-chrootenv-9.3.4-1.40.1 bind-devel-9.3.4-1.40.1 bind-doc-9.3.4-1.40.1 bind-libs-9.3.4-1.40.1 bind-utils-9.3.4-1.40.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): bind-libs-32bit-9.3.4-1.40.1 References: http://support.novell.com/security/cve/CVE-2012-4244.html https://bugzilla.novell.com/780157 http://download.novell.com/patch/finder/?keywords=5798d03a4e2045a2e1ed416f1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1326-2: critical: Security update for flash-player
by opensuse-security＠opensuse.org 13 Oct '12

13 Oct '12

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1326-2 Rating: critical References: #784168 Cross-References: CVE-2012-5248 CVE-2012-5249 CVE-2012-5250 CVE-2012-5251 CVE-2012-5252 CVE-2012-5253 CVE-2012-5254 CVE-2012-5255 CVE-2012-5256 CVE-2012-5257 CVE-2012-5258 CVE-2012-5259 CVE-2012-5260 CVE-2012-5261 CVE-2012-5262 CVE-2012-5263 CVE-2012-5264 CVE-2012-5265 CVE-2012-5266 CVE-2012-5267 CVE-2012-5268 CVE-2012-5269 CVE-2012-5270 CVE-2012-5271 CVE-2012-5272 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. It includes one version update. Description: flash player was updated to version 11.2.202.243, fixing a lot of security issues: CVE-2012-5248, CVE-2012-5249, CVE-2012-5250, CVE-2012-5251, CVE-2012-5252, CVE-2012-5253, CVE-2012-5254, CVE-2012-5255, CVE-2012-5256, CVE-2012-5257, CVE-2012-5258, CVE-2012-5259, CVE-2012-5260, CVE-2012-5261, CVE-2012-5262, CVE-2012-5263, CVE-2012-5264, CVE-2012-5265, CVE-2012-5266, CVE-2012-5267, CVE-2012-5268, CVE-2012-5269, CVE-2012-5270, CVE-2012-5271, CVE-2012-5272 Please visit http://www.adobe.com/support/security/bulletins/apsb12-22.ht ml <http://www.adobe.com/support/security/bulletins/apsb12-22.h tml> for details. Security Issue references: * CVE-2012-5248 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5248 > * CVE-2012-5249 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5249 > * CVE-2012-5250 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5250 > * CVE-2012-5251 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5251 > * CVE-2012-5253 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5253 > * CVE-2012-5254 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5254 > * CVE-2012-5255 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5255 > * CVE-2012-5257 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5257 > * CVE-2012-5259 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5259 > * CVE-2012-5260 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5260 > * CVE-2012-5262 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5262 > * CVE-2012-5264 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5264 > * CVE-2012-5265 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5265 > * CVE-2012-5266 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5266 > * CVE-2012-5252 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5252 > * CVE-2012-5256 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5256 > * CVE-2012-5258 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5258 > * CVE-2012-5261 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5261 > * CVE-2012-5263 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5263 > * CVE-2012-5267 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5267 > * CVE-2012-5268 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5268 > * CVE-2012-5269 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5269 > * CVE-2012-5270 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5270 > * CVE-2012-5271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5271 > * CVE-2012-5272 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5272 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-flash-player-6937 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 11.2.202.243]: flash-player-11.2.202.243-0.3.1 References: http://support.novell.com/security/cve/CVE-2012-5248.html http://support.novell.com/security/cve/CVE-2012-5249.html http://support.novell.com/security/cve/CVE-2012-5250.html http://support.novell.com/security/cve/CVE-2012-5251.html http://support.novell.com/security/cve/CVE-2012-5252.html http://support.novell.com/security/cve/CVE-2012-5253.html http://support.novell.com/security/cve/CVE-2012-5254.html http://support.novell.com/security/cve/CVE-2012-5255.html http://support.novell.com/security/cve/CVE-2012-5256.html http://support.novell.com/security/cve/CVE-2012-5257.html http://support.novell.com/security/cve/CVE-2012-5258.html http://support.novell.com/security/cve/CVE-2012-5259.html http://support.novell.com/security/cve/CVE-2012-5260.html http://support.novell.com/security/cve/CVE-2012-5261.html http://support.novell.com/security/cve/CVE-2012-5262.html http://support.novell.com/security/cve/CVE-2012-5263.html http://support.novell.com/security/cve/CVE-2012-5264.html http://support.novell.com/security/cve/CVE-2012-5265.html http://support.novell.com/security/cve/CVE-2012-5266.html http://support.novell.com/security/cve/CVE-2012-5267.html http://support.novell.com/security/cve/CVE-2012-5268.html http://support.novell.com/security/cve/CVE-2012-5269.html http://support.novell.com/security/cve/CVE-2012-5270.html http://support.novell.com/security/cve/CVE-2012-5271.html http://support.novell.com/security/cve/CVE-2012-5272.html https://bugzilla.novell.com/784168 http://download.novell.com/patch/finder/?keywords=713cd3d91b738edf8089a1736… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1330-1: important: kernel: security and bugfix update
by opensuse-security＠opensuse.org 12 Oct '12

12 Oct '12

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1330-1 Rating: important References: #762693 #765230 #771392 #772566 #772831 #772923 #773406 #774523 #774859 #776925 #778630 #779432 #780624 #781134 Cross-References: CVE-2012-3412 CVE-2012-3520 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has 12 fixes is now available. Description: This kernel update to 3.4.11 fixes various bugs and security issues. The changes up to 3.4.11 contain both security and bugfixes and are not explicitly listed here. Following security issues were fixed: CVE-2012-3520: Force passing credentials, otherwise local services could be fooled to assume requests coming from root. CVE-2012-3412: Do not allow extreme TSO parameters in the sfc driver and tcp stack. Following non-security bugs were fixed: - nbd: clear waiting_queue on shutdown (bnc#778630). - NFS: avoid warning from nfs_drop_nlink (bnc#780624). - net: do not disable sg for packets requiring no checksum (bnc#774859). - sfc: Fix maximum number of TSO segments and minimum TX queue size (bnc#774523 CVE-2012-3412). - net: Allow driver to limit number of GSO segments per skb (bnc#774523 CVE-2012-3412). - drm/nouveau: fix booting with plymouth + dumb support (bnc#771392). - memcg: warn on deeper hierarchies with use_hierarchy==0 (bnc#781134). - Linux 3.4.11. - Update config files. - Refresh patches.suse/scsi-error-test-unit-ready-timeout. - Btrfs: fix tree log remove space corner case (bnc#779432) - irq_remap: disable IRQ remapping if any IOAPIC lacks an IOMMU. - Linux 3.4.10. - Linux 3.4.9. - kABI: protect struct irq_desc. - Linux 3.4.8. - kABI: sdhci, remove inclusion. - reiserfs: fix deadlock with nfs racing on create/lookup (bnc#762693). - Properly update Xen patches to 3.4.7. - Refresh other Xen patches (bnc#772831). - config: enable various ARM errata workarounds to improve stability - Import kabi files for 12.2 - rpm/config.sh: Build the KOTD against 12.2 - ASoC: omap: Add missing modules aliases to get sound working on omap devices. - Update config files to fix build - rt2800: add chipset revision RT5390R support (bnc#772566). - reiserfs: fix deadlocks with quotas - ACPI, APEI: Fixup common access width firmware bug (bnc#765230). - i2c/busses: Fix build error if CONFIG_I2C_DESIGNWARE_PLATFORM=y and CONFIG_I2C_DESIGN. - Update ARM configs to match kernel 3.4.7 - Update ARM omap2plus config to match kernel 3.4.7 and add Smartreflex support (auto voltage) - ALSA: hda - Fix mute-LED GPIO initialization for IDT codecs (bnc#772923). - ALSA: hda - Fix polarity of mute LED on HP Mini 210 (bnc#772923). - Linux 3.4.7. - Refresh patches.suse/dm-raid45-26-Nov-2009.patch. - Enable RTL8150 for omap2plus Generic USB Network device that also works fine on ARM, so enable it - update RNDIS_OID_GEN_RNDIS_CONFIG_PARAMETER patch name - Drivers: hv: Cleanup the guest ID computation. - hyperv: Add a check for ring_size value. - hyperv: Add error handling to rndis_filter_device_add(). - Drivers: hv: Change the hex constant to a decimal constant. - hyperv: Add support for setting MAC from within guests. - net/hyperv: Use wait_event on outstanding sends during device removal. - hv: add RNDIS_OID_GEN_RNDIS_CONFIG_PARAMETER. - Refresh patches.suse/SUSE-bootsplash. Fix wrong vfree() (bnc#773406) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-700 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): kernel-default-3.4.11-2.16.1 kernel-default-base-3.4.11-2.16.1 kernel-default-base-debuginfo-3.4.11-2.16.1 kernel-default-debuginfo-3.4.11-2.16.1 kernel-default-debugsource-3.4.11-2.16.1 kernel-default-devel-3.4.11-2.16.1 kernel-default-devel-debuginfo-3.4.11-2.16.1 kernel-syms-3.4.11-2.16.1 - openSUSE 12.2 (i686 x86_64): kernel-debug-3.4.11-2.16.1 kernel-debug-base-3.4.11-2.16.1 kernel-debug-base-debuginfo-3.4.11-2.16.1 kernel-debug-debuginfo-3.4.11-2.16.1 kernel-debug-debugsource-3.4.11-2.16.1 kernel-debug-devel-3.4.11-2.16.1 kernel-debug-devel-debuginfo-3.4.11-2.16.1 kernel-desktop-3.4.11-2.16.1 kernel-desktop-base-3.4.11-2.16.1 kernel-desktop-base-debuginfo-3.4.11-2.16.1 kernel-desktop-debuginfo-3.4.11-2.16.1 kernel-desktop-debugsource-3.4.11-2.16.1 kernel-desktop-devel-3.4.11-2.16.1 kernel-desktop-devel-debuginfo-3.4.11-2.16.1 kernel-ec2-3.4.11-2.16.1 kernel-ec2-base-3.4.11-2.16.1 kernel-ec2-base-debuginfo-3.4.11-2.16.1 kernel-ec2-debuginfo-3.4.11-2.16.1 kernel-ec2-debugsource-3.4.11-2.16.1 kernel-ec2-devel-3.4.11-2.16.1 kernel-ec2-devel-debuginfo-3.4.11-2.16.1 kernel-ec2-extra-3.4.11-2.16.1 kernel-ec2-extra-debuginfo-3.4.11-2.16.1 kernel-trace-3.4.11-2.16.1 kernel-trace-base-3.4.11-2.16.1 kernel-trace-base-debuginfo-3.4.11-2.16.1 kernel-trace-debuginfo-3.4.11-2.16.1 kernel-trace-debugsource-3.4.11-2.16.1 kernel-trace-devel-3.4.11-2.16.1 kernel-trace-devel-debuginfo-3.4.11-2.16.1 kernel-vanilla-3.4.11-2.16.1 kernel-vanilla-debuginfo-3.4.11-2.16.1 kernel-vanilla-debugsource-3.4.11-2.16.1 kernel-vanilla-devel-3.4.11-2.16.1 kernel-vanilla-devel-debuginfo-3.4.11-2.16.1 kernel-xen-3.4.11-2.16.1 kernel-xen-base-3.4.11-2.16.1 kernel-xen-base-debuginfo-3.4.11-2.16.1 kernel-xen-debuginfo-3.4.11-2.16.1 kernel-xen-debugsource-3.4.11-2.16.1 kernel-xen-devel-3.4.11-2.16.1 kernel-xen-devel-debuginfo-3.4.11-2.16.1 - openSUSE 12.2 (noarch): kernel-devel-3.4.11-2.16.1 kernel-docs-3.4.11-2.16.2 kernel-source-3.4.11-2.16.1 kernel-source-vanilla-3.4.11-2.16.1 - openSUSE 12.2 (i686): kernel-pae-3.4.11-2.16.1 kernel-pae-base-3.4.11-2.16.1 kernel-pae-base-debuginfo-3.4.11-2.16.1 kernel-pae-debuginfo-3.4.11-2.16.1 kernel-pae-debugsource-3.4.11-2.16.1 kernel-pae-devel-3.4.11-2.16.1 kernel-pae-devel-debuginfo-3.4.11-2.16.1 References: http://support.novell.com/security/cve/CVE-2012-3412.html http://support.novell.com/security/cve/CVE-2012-3520.html https://bugzilla.novell.com/762693 https://bugzilla.novell.com/765230 https://bugzilla.novell.com/771392 https://bugzilla.novell.com/772566 https://bugzilla.novell.com/772831 https://bugzilla.novell.com/772923 https://bugzilla.novell.com/773406 https://bugzilla.novell.com/774523 https://bugzilla.novell.com/774859 https://bugzilla.novell.com/776925 https://bugzilla.novell.com/778630 https://bugzilla.novell.com/779432 https://bugzilla.novell.com/780624 https://bugzilla.novell.com/781134 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1326-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 10 Oct '12

10 Oct '12

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1326-1 Rating: critical References: #784168 Cross-References: CVE-2012-5248 CVE-2012-5249 CVE-2012-5250 CVE-2012-5251 CVE-2012-5252 CVE-2012-5253 CVE-2012-5254 CVE-2012-5255 CVE-2012-5256 CVE-2012-5257 CVE-2012-5258 CVE-2012-5259 CVE-2012-5260 CVE-2012-5261 CVE-2012-5262 CVE-2012-5263 CVE-2012-5264 CVE-2012-5265 CVE-2012-5266 CVE-2012-5267 CVE-2012-5268 CVE-2012-5269 CVE-2012-5270 CVE-2012-5271 CVE-2012-5272 Affected Products: SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. It includes one version update. Description: flash player was updated to version 11.2.202.243 fixing a lot of security issues: CVE-2012-5248, CVE-2012-5249, CVE-2012-5250, CVE-2012-5251, CVE-2012-5252, CVE-2012-5253, CVE-2012-5254, CVE-2012-5255, CVE-2012-5256, CVE-2012-5257, CVE-2012-5258, CVE-2012-5259, CVE-2012-5260, CVE-2012-5261, CVE-2012-5262, CVE-2012-5263, CVE-2012-5264, CVE-2012-5265, CVE-2012-5266, CVE-2012-5267, CVE-2012-5268, CVE-2012-5269, CVE-2012-5270, CVE-2012-5271, CVE-2012-5272 Please visit http://www.adobe.com/support/security/bulletins/apsb12-22.ht ml <http://www.adobe.com/support/security/bulletins/apsb12-22.h tml> for details. Security Issue references: * CVE-2012-5248 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5248 > * CVE-2012-5249 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5249 > * CVE-2012-5250 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5250 > * CVE-2012-5251 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5251 > * CVE-2012-5253 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5253 > * CVE-2012-5254 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5254 > * CVE-2012-5255 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5255 > * CVE-2012-5257 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5257 > * CVE-2012-5259 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5259 > * CVE-2012-5260 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5260 > * CVE-2012-5262 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5262 > * CVE-2012-5264 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5264 > * CVE-2012-5265 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5265 > * CVE-2012-5266 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5266 > * CVE-2012-5252 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5252 > * CVE-2012-5256 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5256 > * CVE-2012-5258 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5258 > * CVE-2012-5261 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5261 > * CVE-2012-5263 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5263 > * CVE-2012-5267 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5267 > * CVE-2012-5268 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5268 > * CVE-2012-5269 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5269 > * CVE-2012-5270 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5270 > * CVE-2012-5271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5271 > * CVE-2012-5272 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5272 > Package List: - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 11.2.202.243]: flash-player-11.2.202.243-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-5248.html http://support.novell.com/security/cve/CVE-2012-5249.html http://support.novell.com/security/cve/CVE-2012-5250.html http://support.novell.com/security/cve/CVE-2012-5251.html http://support.novell.com/security/cve/CVE-2012-5252.html http://support.novell.com/security/cve/CVE-2012-5253.html http://support.novell.com/security/cve/CVE-2012-5254.html http://support.novell.com/security/cve/CVE-2012-5255.html http://support.novell.com/security/cve/CVE-2012-5256.html http://support.novell.com/security/cve/CVE-2012-5257.html http://support.novell.com/security/cve/CVE-2012-5258.html http://support.novell.com/security/cve/CVE-2012-5259.html http://support.novell.com/security/cve/CVE-2012-5260.html http://support.novell.com/security/cve/CVE-2012-5261.html http://support.novell.com/security/cve/CVE-2012-5262.html http://support.novell.com/security/cve/CVE-2012-5263.html http://support.novell.com/security/cve/CVE-2012-5264.html http://support.novell.com/security/cve/CVE-2012-5265.html http://support.novell.com/security/cve/CVE-2012-5266.html http://support.novell.com/security/cve/CVE-2012-5267.html http://support.novell.com/security/cve/CVE-2012-5268.html http://support.novell.com/security/cve/CVE-2012-5269.html http://support.novell.com/security/cve/CVE-2012-5270.html http://support.novell.com/security/cve/CVE-2012-5271.html http://support.novell.com/security/cve/CVE-2012-5272.html https://bugzilla.novell.com/784168 http://download.novell.com/patch/finder/?keywords=9861c635f16f057af9420d20f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1324-1: critical: flash-player: Update to 11.2.202.243
by opensuse-security＠opensuse.org 10 Oct '12

10 Oct '12

openSUSE Security Update: flash-player: Update to 11.2.202.243 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1324-1 Rating: critical References: #784168 Cross-References: CVE-2012-5252 CVE-2012-5256 CVE-2012-5260 CVE-2012-5264 CVE-2012-5268 CVE-2012-5272 CVE-2012-5248 CVE-2012-5249 CVE-2012-5250 CVE-2012-5251 CVE-2012-5253 CVE-2012-5254 CVE-2012-5255 CVE-2012-5257 CVE-2012-5258 CVE-2012-5259 CVE-2012-5261 CVE-2012-5262 CVE-2012-5263 CVE-2012-5265 CVE-2012-5266 CVE-2012-5267 CVE-2012-5269 CVE-2012-5270 CVE-2012-5271 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: Flash Player was updated to 11.2.202.243 * CVE-2012-5248, CVE-2012-5249, CVE-2012-5250, CVE-2012-5251, CVE-2012-5252, CVE-2012-5253, CVE-2012-5254, CVE-2012-5255, CVE-2012-5256, CVE-2012-5257, CVE-2012-5258, CVE-2012-5259, CVE-2012-5260, CVE-2012-5261, CVE-2012-5262, CVE-2012-5263, CVE-2012-5264, CVE-2012-5265, CVE-2012-5266, CVE-2012-5267, CVE-2012-5268, CVE-2012-5269, CVE-2012-5270, CVE-2012-5271, CVE-2012-5272 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-697 - openSUSE 11.4: zypper in -t patch openSUSE-2012-697 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.243-30.1 flash-player-gnome-11.2.202.243-30.1 flash-player-kde4-11.2.202.243-30.1 - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.243-23.1 flash-player-gnome-11.2.202.243-23.1 flash-player-kde4-11.2.202.243-23.1 References: http://support.novell.com/security/cve/ CVE-2012-5252.html http://support.novell.com/security/cve/ CVE-2012-5256.html http://support.novell.com/security/cve/ CVE-2012-5260.html http://support.novell.com/security/cve/ CVE-2012-5264.html http://support.novell.com/security/cve/ CVE-2012-5268.html http://support.novell.com/security/cve/ CVE-2012-5272.html http://support.novell.com/security/cve/CVE-2012-5248.html http://support.novell.com/security/cve/CVE-2012-5249.html http://support.novell.com/security/cve/CVE-2012-5250.html http://support.novell.com/security/cve/CVE-2012-5251.html http://support.novell.com/security/cve/CVE-2012-5253.html http://support.novell.com/security/cve/CVE-2012-5254.html http://support.novell.com/security/cve/CVE-2012-5255.html http://support.novell.com/security/cve/CVE-2012-5257.html http://support.novell.com/security/cve/CVE-2012-5258.html http://support.novell.com/security/cve/CVE-2012-5259.html http://support.novell.com/security/cve/CVE-2012-5261.html http://support.novell.com/security/cve/CVE-2012-5262.html http://support.novell.com/security/cve/CVE-2012-5263.html http://support.novell.com/security/cve/CVE-2012-5265.html http://support.novell.com/security/cve/CVE-2012-5266.html http://support.novell.com/security/cve/CVE-2012-5267.html http://support.novell.com/security/cve/CVE-2012-5269.html http://support.novell.com/security/cve/CVE-2012-5270.html http://support.novell.com/security/cve/CVE-2012-5271.html https://bugzilla.novell.com/784168 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1320-1: important: Security update for qemu
by opensuse-security＠opensuse.org 09 Oct '12

09 Oct '12

SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1320-1 Rating: important References: #740165 #777084 Cross-References: CVE-2012-0029 CVE-2012-3515 Affected Products: SUSE Studio Onsite 1.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The qemu vt100 emulation was affected by a problem where specific vt100 sequences could have been used by guest users to affect the host. (CVE-2012-3515 aka XSA-17). CVE-2012-0029: A buffer overflow in the e1000 device emulation was fixed Security Issue references: * CVE-2012-3515 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515 > * CVE-2012-0029 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0029 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Studio Onsite 1.2: zypper in -t patch slestso12-qemu-6852 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Studio Onsite 1.2 (x86_64): qemu-0.10.1-0.5.7.1 References: http://support.novell.com/security/cve/CVE-2012-0029.html http://support.novell.com/security/cve/CVE-2012-3515.html https://bugzilla.novell.com/740165 https://bugzilla.novell.com/777084 http://download.novell.com/patch/finder/?keywords=86d45c23c62093dbb012d29f0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1289-1: important: ghostscript
by opensuse-security＠opensuse.org 04 Oct '12

04 Oct '12

openSUSE Security Update: ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1289-1 Rating: important References: #779700 Cross-References: CVE-2012-4405 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The following security issue was fixed in ghostscript: Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-668 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): ghostscript-devel-9.00-4.48.1 ghostscript-ijs-devel-9.00-4.48.1 ghostscript-library-9.00-4.48.1 ghostscript-library-debuginfo-9.00-4.48.1 ghostscript-library-debugsource-9.00-4.48.1 ghostscript-x11-9.00-4.48.1 ghostscript-x11-debuginfo-9.00-4.48.1 libgimpprint-4.2.7-334.48.1 libgimpprint-debuginfo-4.2.7-334.48.1 libgimpprint-devel-4.2.7-334.48.1 - openSUSE 11.4 (noarch): ghostscript-fonts-other-9.00-4.48.1 ghostscript-fonts-rus-9.00-4.48.1 ghostscript-fonts-std-9.00-4.48.1 References: http://support.novell.com/security/cve/CVE-2012-4405.html https://bugzilla.novell.com/779700 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1287-1: important: update for dbus-1, dbus-1-x11
by opensuse-security＠opensuse.org 04 Oct '12

04 Oct '12

openSUSE Security Update: update for dbus-1, dbus-1-x11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1287-1 Rating: important References: #697105 Cross-References: CVE-2012-3524 Affected Products: openSUSE 12.2 openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixed CVE-2012-3524 (getenv() vulnerability), which can be used by local attackers to escalate privileges to root. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-670 - openSUSE 12.1: zypper in -t patch openSUSE-2012-670 - openSUSE 11.4: zypper in -t patch openSUSE-2012-670 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): dbus-1-1.5.12-4.6.1 dbus-1-debuginfo-1.5.12-4.6.1 dbus-1-debugsource-1.5.12-4.6.1 dbus-1-devel-1.5.12-4.6.1 dbus-1-x11-1.5.12-4.6.1 dbus-1-x11-debuginfo-1.5.12-4.6.1 dbus-1-x11-debugsource-1.5.12-4.6.1 libdbus-1-3-1.5.12-4.6.1 libdbus-1-3-debuginfo-1.5.12-4.6.1 - openSUSE 12.2 (x86_64): dbus-1-32bit-1.5.12-4.6.1 dbus-1-debuginfo-32bit-1.5.12-4.6.1 dbus-1-devel-32bit-1.5.12-4.6.1 libdbus-1-3-32bit-1.5.12-4.6.1 libdbus-1-3-debuginfo-32bit-1.5.12-4.6.1 - openSUSE 12.2 (noarch): dbus-1-devel-doc-1.5.12-4.6.1 - openSUSE 12.1 (i586 x86_64): dbus-1-1.5.8-2.6.1 dbus-1-debuginfo-1.5.8-2.6.1 dbus-1-debugsource-1.5.8-2.6.1 dbus-1-devel-1.5.8-2.6.1 dbus-1-x11-1.5.8-2.6.1 dbus-1-x11-debuginfo-1.5.8-2.6.1 dbus-1-x11-debugsource-1.5.8-2.6.1 - openSUSE 12.1 (x86_64): dbus-1-32bit-1.5.8-2.6.1 dbus-1-debuginfo-32bit-1.5.8-2.6.1 dbus-1-devel-32bit-1.5.8-2.6.1 - openSUSE 12.1 (noarch): dbus-1-devel-doc-1.5.8-2.6.1 - openSUSE 12.1 (ia64): dbus-1-debuginfo-x86-1.5.8-2.6.1 dbus-1-x86-1.5.8-2.6.1 - openSUSE 11.4 (i586 x86_64): dbus-1-1.4.1-7.27.1 dbus-1-debuginfo-1.4.1-7.27.1 dbus-1-debugsource-1.4.1-7.27.1 dbus-1-devel-1.4.1-7.27.1 - openSUSE 11.4 (x86_64): dbus-1-32bit-1.4.1-7.27.1 dbus-1-debuginfo-32bit-1.4.1-7.27.1 dbus-1-devel-32bit-1.4.1-7.27.1 - openSUSE 11.4 (noarch): dbus-1-devel-doc-1.4.1-7.27.1 - openSUSE 11.4 (ia64): dbus-1-debuginfo-x86-1.4.1-7.27.1 dbus-1-x86-1.4.1-7.27.1 References: http://support.novell.com/security/cve/CVE-2012-3524.html https://bugzilla.novell.com/697105 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0