August 2012 - openSUSE Security Announce

[security-announce] openSUSE-SU-2012:1065-1: critical: MozillaFirefox: Update to version 15
by opensuse-security＠opensuse.org 30 Aug '12

30 Aug '12

openSUSE Security Update: MozillaFirefox: Update to version 15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1065-1 Rating: critical References: #777588 Cross-References: CVE-2012-1956 CVE-2012-1970 CVE-2012-1972 CVE-2012-1973 CVE-2012-1974 CVE-2012-1975 CVE-2012-1976 CVE-2012-3956 CVE-2012-3957 CVE-2012-3958 CVE-2012-3959 CVE-2012-3960 CVE-2012-3961 CVE-2012-3962 CVE-2012-3963 CVE-2012-3964 CVE-2012-3965 CVE-2012-3966 CVE-2012-3967 CVE-2012-3968 CVE-2012-3969 CVE-2012-3970 CVE-2012-3971 CVE-2012-3972 CVE-2012-3973 CVE-2012-3975 CVE-2012-3976 CVE-2012-3978 CVE-2012-3980 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes 29 vulnerabilities is now available. Description: Mozilla Firefox, Thunderbird, xulrunner, seamonkey 15.0 update (bnc#777588) * MFSA 2012-57/CVE-2012-1970 Miscellaneous memory safety hazards * MFSA 2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-2012-1 975 CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/CVE- 2012-3959 CVE-2012-3960/CVE-2012-3961/CVE-2012-3962/CVE-2012-3963/CVE- 2012-3964 Use-after-free issues found using Address Sanitizer * MFSA 2012-59/CVE-2012-1956 (bmo#756719) Location object can be shadowed using Object.defineProperty * MFSA 2012-60/CVE-2012-3965 (bmo#769108) Escalation of privilege through about:newtab * MFSA 2012-61/CVE-2012-3966 (bmo#775794, bmo#775793) Memory corruption with bitmap format images with negative height * MFSA 2012-62/CVE-2012-3967/CVE-2012-3968 WebGL use-after-free and memory corruption * MFSA 2012-63/CVE-2012-3969/CVE-2012-3970 SVG buffer overflow and use-after-free issues * MFSA 2012-64/CVE-2012-3971 Graphite 2 memory corruption * MFSA 2012-65/CVE-2012-3972 (bmo#746855) Out-of-bounds read in format-number in XSLT * MFSA 2012-66/CVE-2012-3973 (bmo#757128) HTTPMonitor extension allows for remote debugging without explicit activation * MFSA 2012-68/CVE-2012-3975 (bmo#770684) DOMParser loads linked resources in extensions when parsing text/html * MFSA 2012-69/CVE-2012-3976 (bmo#768568) Incorrect site SSL certificate data display * MFSA 2012-70/CVE-2012-3978 (bmo#770429) Location object security checks bypassed by chrome code * MFSA 2012-72/CVE-2012-3980 (bmo#771859) Web console eval capable of executing chrome-privileged code - fix HTML5 video crash with GStreamer enabled (bmo#761030) - GStreamer is only used for MP4 (no WebM, OGG) - updated filelist - moved browser specific preferences to correct location Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-538 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): MozillaFirefox-15.0-2.7.1 MozillaFirefox-branding-upstream-15.0-2.7.1 MozillaFirefox-buildsymbols-15.0-2.7.1 MozillaFirefox-debuginfo-15.0-2.7.1 MozillaFirefox-debugsource-15.0-2.7.1 MozillaFirefox-devel-15.0-2.7.1 MozillaFirefox-translations-common-15.0-2.7.1 MozillaFirefox-translations-other-15.0-2.7.1 MozillaThunderbird-15.0-49.9.1 MozillaThunderbird-buildsymbols-15.0-49.9.1 MozillaThunderbird-debuginfo-15.0-49.9.1 MozillaThunderbird-debugsource-15.0-49.9.1 MozillaThunderbird-devel-15.0-49.9.1 MozillaThunderbird-devel-debuginfo-15.0-49.9.1 MozillaThunderbird-translations-common-15.0-49.9.1 MozillaThunderbird-translations-other-15.0-49.9.1 enigmail-1.4.4+15.0-49.9.1 enigmail-debuginfo-1.4.4+15.0-49.9.1 libfreebl3-3.13.6-2.7.1 libfreebl3-debuginfo-3.13.6-2.7.1 libsoftokn3-3.13.6-2.7.1 libsoftokn3-debuginfo-3.13.6-2.7.1 mozilla-js-15.0-2.8.1 mozilla-js-debuginfo-15.0-2.8.1 mozilla-nss-3.13.6-2.7.1 mozilla-nss-certs-3.13.6-2.7.1 mozilla-nss-certs-debuginfo-3.13.6-2.7.1 mozilla-nss-debuginfo-3.13.6-2.7.1 mozilla-nss-debugsource-3.13.6-2.7.1 mozilla-nss-devel-3.13.6-2.7.1 mozilla-nss-sysinit-3.13.6-2.7.1 mozilla-nss-sysinit-debuginfo-3.13.6-2.7.1 mozilla-nss-tools-3.13.6-2.7.1 mozilla-nss-tools-debuginfo-3.13.6-2.7.1 seamonkey-2.12-2.8.1 seamonkey-debuginfo-2.12-2.8.1 seamonkey-debugsource-2.12-2.8.1 seamonkey-dom-inspector-2.12-2.8.1 seamonkey-irc-2.12-2.8.1 seamonkey-translations-common-2.12-2.8.1 seamonkey-translations-other-2.12-2.8.1 seamonkey-venkman-2.12-2.8.1 xulrunner-15.0-2.8.1 xulrunner-buildsymbols-15.0-2.8.1 xulrunner-debuginfo-15.0-2.8.1 xulrunner-debugsource-15.0-2.8.1 xulrunner-devel-15.0-2.8.1 xulrunner-devel-debuginfo-15.0-2.8.1 - openSUSE 12.2 (x86_64): libfreebl3-32bit-3.13.6-2.7.1 libfreebl3-debuginfo-32bit-3.13.6-2.7.1 libsoftokn3-32bit-3.13.6-2.7.1 libsoftokn3-debuginfo-32bit-3.13.6-2.7.1 mozilla-js-32bit-15.0-2.8.1 mozilla-js-debuginfo-32bit-15.0-2.8.1 mozilla-nss-32bit-3.13.6-2.7.1 mozilla-nss-certs-32bit-3.13.6-2.7.1 mozilla-nss-certs-debuginfo-32bit-3.13.6-2.7.1 mozilla-nss-debuginfo-32bit-3.13.6-2.7.1 mozilla-nss-sysinit-32bit-3.13.6-2.7.1 mozilla-nss-sysinit-debuginfo-32bit-3.13.6-2.7.1 xulrunner-32bit-15.0-2.8.1 xulrunner-debuginfo-32bit-15.0-2.8.1 References: http://support.novell.com/security/cve/CVE-2012-1956.html http://support.novell.com/security/cve/CVE-2012-1970.html http://support.novell.com/security/cve/CVE-2012-1972.html http://support.novell.com/security/cve/CVE-2012-1973.html http://support.novell.com/security/cve/CVE-2012-1974.html http://support.novell.com/security/cve/CVE-2012-1975.html http://support.novell.com/security/cve/CVE-2012-1976.html http://support.novell.com/security/cve/CVE-2012-3956.html http://support.novell.com/security/cve/CVE-2012-3957.html http://support.novell.com/security/cve/CVE-2012-3958.html http://support.novell.com/security/cve/CVE-2012-3959.html http://support.novell.com/security/cve/CVE-2012-3960.html http://support.novell.com/security/cve/CVE-2012-3961.html http://support.novell.com/security/cve/CVE-2012-3962.html http://support.novell.com/security/cve/CVE-2012-3963.html http://support.novell.com/security/cve/CVE-2012-3964.html http://support.novell.com/security/cve/CVE-2012-3965.html http://support.novell.com/security/cve/CVE-2012-3966.html http://support.novell.com/security/cve/CVE-2012-3967.html http://support.novell.com/security/cve/CVE-2012-3968.html http://support.novell.com/security/cve/CVE-2012-3969.html http://support.novell.com/security/cve/CVE-2012-3970.html http://support.novell.com/security/cve/CVE-2012-3971.html http://support.novell.com/security/cve/CVE-2012-3972.html http://support.novell.com/security/cve/CVE-2012-3973.html http://support.novell.com/security/cve/CVE-2012-3975.html http://support.novell.com/security/cve/CVE-2012-3976.html http://support.novell.com/security/cve/CVE-2012-3978.html http://support.novell.com/security/cve/CVE-2012-3980.html https://bugzilla.novell.com/777588 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1064-1: critical: MozillaFirefox: Update to version 15
by opensuse-security＠opensuse.org 30 Aug '12

30 Aug '12

openSUSE Security Update: MozillaFirefox: Update to version 15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1064-1 Rating: critical References: #777588 Cross-References: CVE-2012-1956 CVE-2012-1970 CVE-2012-1972 CVE-2012-1973 CVE-2012-1974 CVE-2012-1975 CVE-2012-1976 CVE-2012-3956 CVE-2012-3957 CVE-2012-3958 CVE-2012-3959 CVE-2012-3960 CVE-2012-3961 CVE-2012-3962 CVE-2012-3963 CVE-2012-3964 CVE-2012-3965 CVE-2012-3966 CVE-2012-3967 CVE-2012-3968 CVE-2012-3969 CVE-2012-3970 CVE-2012-3971 CVE-2012-3972 CVE-2012-3973 CVE-2012-3975 CVE-2012-3976 CVE-2012-3978 CVE-2012-3980 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes 29 vulnerabilities is now available. Description: Mozilla Firefox, Thunderbird, xulrunner, seamonkey 15.0 update (bnc#777588) * MFSA 2012-57/CVE-2012-1970 Miscellaneous memory safety hazards * MFSA 2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-2012-1 975 CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/CVE- 2012-3959 CVE-2012-3960/CVE-2012-3961/CVE-2012-3962/CVE-2012-3963/CVE- 2012-3964 Use-after-free issues found using Address Sanitizer * MFSA 2012-59/CVE-2012-1956 (bmo#756719) Location object can be shadowed using Object.defineProperty * MFSA 2012-60/CVE-2012-3965 (bmo#769108) Escalation of privilege through about:newtab * MFSA 2012-61/CVE-2012-3966 (bmo#775794, bmo#775793) Memory corruption with bitmap format images with negative height * MFSA 2012-62/CVE-2012-3967/CVE-2012-3968 WebGL use-after-free and memory corruption * MFSA 2012-63/CVE-2012-3969/CVE-2012-3970 SVG buffer overflow and use-after-free issues * MFSA 2012-64/CVE-2012-3971 Graphite 2 memory corruption * MFSA 2012-65/CVE-2012-3972 (bmo#746855) Out-of-bounds read in format-number in XSLT * MFSA 2012-66/CVE-2012-3973 (bmo#757128) HTTPMonitor extension allows for remote debugging without explicit activation * MFSA 2012-68/CVE-2012-3975 (bmo#770684) DOMParser loads linked resources in extensions when parsing text/html * MFSA 2012-69/CVE-2012-3976 (bmo#768568) Incorrect site SSL certificate data display * MFSA 2012-70/CVE-2012-3978 (bmo#770429) Location object security checks bypassed by chrome code * MFSA 2012-72/CVE-2012-3980 (bmo#771859) Web console eval capable of executing chrome-privileged code - fix HTML5 video crash with GStreamer enabled (bmo#761030) - GStreamer is only used for MP4 (no WebM, OGG) - updated filelist - moved browser specific preferences to correct location Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-534 - openSUSE 11.4: zypper in -t patch openSUSE-2012-534 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): MozillaFirefox-15.0-2.36.1 MozillaFirefox-branding-upstream-15.0-2.36.1 MozillaFirefox-buildsymbols-15.0-2.36.1 MozillaFirefox-debuginfo-15.0-2.36.1 MozillaFirefox-debugsource-15.0-2.36.1 MozillaFirefox-devel-15.0-2.36.1 MozillaFirefox-translations-common-15.0-2.36.1 MozillaFirefox-translations-other-15.0-2.36.1 MozillaThunderbird-15.0-33.29.1 MozillaThunderbird-buildsymbols-15.0-33.29.1 MozillaThunderbird-debuginfo-15.0-33.29.1 MozillaThunderbird-debugsource-15.0-33.29.1 MozillaThunderbird-devel-15.0-33.29.1 MozillaThunderbird-devel-debuginfo-15.0-33.29.1 MozillaThunderbird-translations-common-15.0-33.29.1 MozillaThunderbird-translations-other-15.0-33.29.1 enigmail-1.4.4+15.0-33.29.1 enigmail-debuginfo-1.4.4+15.0-33.29.1 libfreebl3-3.13.6-9.17.1 libfreebl3-debuginfo-3.13.6-9.17.1 libsoftokn3-3.13.6-9.17.1 libsoftokn3-debuginfo-3.13.6-9.17.1 mozilla-js-15.0-2.35.1 mozilla-js-debuginfo-15.0-2.35.1 mozilla-nspr-4.9.2-3.6.1 mozilla-nspr-debuginfo-4.9.2-3.6.1 mozilla-nspr-debugsource-4.9.2-3.6.1 mozilla-nspr-devel-4.9.2-3.6.1 mozilla-nss-3.13.6-9.17.1 mozilla-nss-certs-3.13.6-9.17.1 mozilla-nss-certs-debuginfo-3.13.6-9.17.1 mozilla-nss-debuginfo-3.13.6-9.17.1 mozilla-nss-debugsource-3.13.6-9.17.1 mozilla-nss-devel-3.13.6-9.17.1 mozilla-nss-sysinit-3.13.6-9.17.1 mozilla-nss-sysinit-debuginfo-3.13.6-9.17.1 mozilla-nss-tools-3.13.6-9.17.1 mozilla-nss-tools-debuginfo-3.13.6-9.17.1 seamonkey-2.12-2.27.1 seamonkey-debuginfo-2.12-2.27.1 seamonkey-debugsource-2.12-2.27.1 seamonkey-dom-inspector-2.12-2.27.1 seamonkey-irc-2.12-2.27.1 seamonkey-translations-common-2.12-2.27.1 seamonkey-translations-other-2.12-2.27.1 seamonkey-venkman-2.12-2.27.1 xulrunner-15.0-2.35.1 xulrunner-buildsymbols-15.0-2.35.1 xulrunner-debuginfo-15.0-2.35.1 xulrunner-debugsource-15.0-2.35.1 xulrunner-devel-15.0-2.35.1 xulrunner-devel-debuginfo-15.0-2.35.1 - openSUSE 12.1 (x86_64): libfreebl3-32bit-3.13.6-9.17.1 libfreebl3-debuginfo-32bit-3.13.6-9.17.1 libsoftokn3-32bit-3.13.6-9.17.1 libsoftokn3-debuginfo-32bit-3.13.6-9.17.1 mozilla-js-32bit-15.0-2.35.1 mozilla-js-debuginfo-32bit-15.0-2.35.1 mozilla-nspr-32bit-4.9.2-3.6.1 mozilla-nspr-debuginfo-32bit-4.9.2-3.6.1 mozilla-nss-32bit-3.13.6-9.17.1 mozilla-nss-certs-32bit-3.13.6-9.17.1 mozilla-nss-certs-debuginfo-32bit-3.13.6-9.17.1 mozilla-nss-debuginfo-32bit-3.13.6-9.17.1 mozilla-nss-sysinit-32bit-3.13.6-9.17.1 mozilla-nss-sysinit-debuginfo-32bit-3.13.6-9.17.1 xulrunner-32bit-15.0-2.35.1 xulrunner-debuginfo-32bit-15.0-2.35.1 - openSUSE 12.1 (ia64): libfreebl3-debuginfo-x86-3.13.6-9.17.1 libfreebl3-x86-3.13.6-9.17.1 libsoftokn3-debuginfo-x86-3.13.6-9.17.1 libsoftokn3-x86-3.13.6-9.17.1 mozilla-js-debuginfo-x86-15.0-2.35.1 mozilla-js-x86-15.0-2.35.1 mozilla-nspr-debuginfo-x86-4.9.2-3.6.1 mozilla-nspr-x86-4.9.2-3.6.1 mozilla-nss-certs-debuginfo-x86-3.13.6-9.17.1 mozilla-nss-certs-x86-3.13.6-9.17.1 mozilla-nss-debuginfo-x86-3.13.6-9.17.1 mozilla-nss-sysinit-debuginfo-x86-3.13.6-9.17.1 mozilla-nss-sysinit-x86-3.13.6-9.17.1 mozilla-nss-x86-3.13.6-9.17.1 xulrunner-debuginfo-x86-15.0-2.35.1 xulrunner-x86-15.0-2.35.1 - openSUSE 11.4 (i586 x86_64): MozillaFirefox-15.0-31.1 MozillaFirefox-branding-upstream-15.0-31.1 MozillaFirefox-buildsymbols-15.0-31.1 MozillaFirefox-debuginfo-15.0-31.1 MozillaFirefox-debugsource-15.0-31.1 MozillaFirefox-devel-15.0-31.1 MozillaFirefox-translations-common-15.0-31.1 MozillaFirefox-translations-other-15.0-31.1 MozillaThunderbird-15.0-27.1 MozillaThunderbird-buildsymbols-15.0-27.1 MozillaThunderbird-debuginfo-15.0-27.1 MozillaThunderbird-debugsource-15.0-27.1 MozillaThunderbird-devel-15.0-27.1 MozillaThunderbird-devel-debuginfo-15.0-27.1 MozillaThunderbird-translations-common-15.0-27.1 MozillaThunderbird-translations-other-15.0-27.1 enigmail-1.4.4+15.0-27.1 enigmail-debuginfo-1.4.4+15.0-27.1 libfreebl3-3.13.6-47.1 libfreebl3-debuginfo-3.13.6-47.1 libsoftokn3-3.13.6-47.1 libsoftokn3-debuginfo-3.13.6-47.1 mozilla-nspr-4.9.2-16.1 mozilla-nspr-debuginfo-4.9.2-16.1 mozilla-nspr-debugsource-4.9.2-16.1 mozilla-nspr-devel-4.9.2-16.1 mozilla-nss-3.13.6-47.1 mozilla-nss-certs-3.13.6-47.1 mozilla-nss-certs-debuginfo-3.13.6-47.1 mozilla-nss-debuginfo-3.13.6-47.1 mozilla-nss-debugsource-3.13.6-47.1 mozilla-nss-devel-3.13.6-47.1 mozilla-nss-sysinit-3.13.6-47.1 mozilla-nss-sysinit-debuginfo-3.13.6-47.1 mozilla-nss-tools-3.13.6-47.1 mozilla-nss-tools-debuginfo-3.13.6-47.1 seamonkey-2.12-27.1 seamonkey-debuginfo-2.12-27.1 seamonkey-debugsource-2.12-27.1 seamonkey-dom-inspector-2.12-27.1 seamonkey-irc-2.12-27.1 seamonkey-translations-common-2.12-27.1 seamonkey-translations-other-2.12-27.1 seamonkey-venkman-2.12-27.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.13.6-47.1 libfreebl3-debuginfo-32bit-3.13.6-47.1 libsoftokn3-32bit-3.13.6-47.1 libsoftokn3-debuginfo-32bit-3.13.6-47.1 mozilla-nspr-32bit-4.9.2-16.1 mozilla-nspr-debuginfo-32bit-4.9.2-16.1 mozilla-nss-32bit-3.13.6-47.1 mozilla-nss-certs-32bit-3.13.6-47.1 mozilla-nss-certs-debuginfo-32bit-3.13.6-47.1 mozilla-nss-debuginfo-32bit-3.13.6-47.1 mozilla-nss-sysinit-32bit-3.13.6-47.1 mozilla-nss-sysinit-debuginfo-32bit-3.13.6-47.1 - openSUSE 11.4 (ia64): libfreebl3-debuginfo-x86-3.13.6-47.1 libfreebl3-x86-3.13.6-47.1 libsoftokn3-debuginfo-x86-3.13.6-47.1 libsoftokn3-x86-3.13.6-47.1 mozilla-nspr-debuginfo-x86-4.9.2-16.1 mozilla-nspr-x86-4.9.2-16.1 mozilla-nss-certs-debuginfo-x86-3.13.6-47.1 mozilla-nss-certs-x86-3.13.6-47.1 mozilla-nss-debuginfo-x86-3.13.6-47.1 mozilla-nss-sysinit-debuginfo-x86-3.13.6-47.1 mozilla-nss-sysinit-x86-3.13.6-47.1 mozilla-nss-x86-3.13.6-47.1 References: http://support.novell.com/security/cve/CVE-2012-1956.html http://support.novell.com/security/cve/CVE-2012-1970.html http://support.novell.com/security/cve/CVE-2012-1972.html http://support.novell.com/security/cve/CVE-2012-1973.html http://support.novell.com/security/cve/CVE-2012-1974.html http://support.novell.com/security/cve/CVE-2012-1975.html http://support.novell.com/security/cve/CVE-2012-1976.html http://support.novell.com/security/cve/CVE-2012-3956.html http://support.novell.com/security/cve/CVE-2012-3957.html http://support.novell.com/security/cve/CVE-2012-3958.html http://support.novell.com/security/cve/CVE-2012-3959.html http://support.novell.com/security/cve/CVE-2012-3960.html http://support.novell.com/security/cve/CVE-2012-3961.html http://support.novell.com/security/cve/CVE-2012-3962.html http://support.novell.com/security/cve/CVE-2012-3963.html http://support.novell.com/security/cve/CVE-2012-3964.html http://support.novell.com/security/cve/CVE-2012-3965.html http://support.novell.com/security/cve/CVE-2012-3966.html http://support.novell.com/security/cve/CVE-2012-3967.html http://support.novell.com/security/cve/CVE-2012-3968.html http://support.novell.com/security/cve/CVE-2012-3969.html http://support.novell.com/security/cve/CVE-2012-3970.html http://support.novell.com/security/cve/CVE-2012-3971.html http://support.novell.com/security/cve/CVE-2012-3972.html http://support.novell.com/security/cve/CVE-2012-3973.html http://support.novell.com/security/cve/CVE-2012-3975.html http://support.novell.com/security/cve/CVE-2012-3976.html http://support.novell.com/security/cve/CVE-2012-3978.html http://support.novell.com/security/cve/CVE-2012-3980.html https://bugzilla.novell.com/777588 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1061-1: important: calligra: security and bugfix update.
by opensuse-security＠opensuse.org 30 Aug '12

30 Aug '12

openSUSE Security Update: calligra: security and bugfix update. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1061-1 Rating: important References: #774534 Cross-References: CVE-2012-3456 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Fix buffer overflow in MS Word ODF filter among other non-security related bugs. Also a version update to 2.4.3 happened: * Words: - Always show vertical scroll bar to avoid race condition (kde#301076) - Do not save with an attribue that makes LibreOffice and OpenOffice crash (kde#298689 ) * Kexi: - Fixed import from csv when “Start at Line” value changed (kde#302209) - Set limit to 255 characters for Text type (VARCHAR) (kde#301277 and 301136) + - Remove limits for Text data type, leave as option (kde#301277) - Fixed data saving when focus policy for one of widgets is NoFocus (kde#301109) * Krita: - Read and set the resolution for psd images * Charts: - Fix load/save styles of all shapes (title,subtitle,axistitles,footer,etc.) - Lines in the chart should be displayed (kde#271771) - Combined Bar and Line Charts only show bars (Trendlines not supported) (kde#288537) - Load/save chart type for each dataset (kde#271771 and 288537) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-533 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): calligra-2.4.3-2.4.1 calligra-braindump-2.4.3-2.4.1 calligra-braindump-debuginfo-2.4.3-2.4.1 calligra-debuginfo-2.4.3-2.4.1 calligra-debugsource-2.4.3-2.4.1 calligra-devel-2.4.3-2.4.1 calligra-flow-2.4.3-2.4.1 calligra-flow-debuginfo-2.4.3-2.4.1 calligra-karbon-2.4.3-2.4.1 calligra-karbon-debuginfo-2.4.3-2.4.1 calligra-kexi-2.4.3-2.4.1 calligra-kexi-debuginfo-2.4.3-2.4.1 calligra-kexi-mssql-driver-2.4.3-2.4.1 calligra-kexi-mssql-driver-debuginfo-2.4.3-2.4.1 calligra-kexi-mysql-driver-2.4.3-2.4.1 calligra-kexi-mysql-driver-debuginfo-2.4.3-2.4.1 calligra-kexi-postgresql-driver-2.4.3-2.4.1 calligra-kexi-postgresql-driver-debuginfo-2.4.3-2.4.1 calligra-kexi-spreadsheet-import-2.4.3-2.4.1 calligra-kexi-spreadsheet-import-debuginfo-2.4.3-2.4.1 calligra-kexi-xbase-driver-2.4.3-2.4.1 calligra-kexi-xbase-driver-debuginfo-2.4.3-2.4.1 calligra-krita-2.4.3-2.4.1 calligra-krita-debuginfo-2.4.3-2.4.1 calligra-kthesaurus-2.4.3-2.4.1 calligra-kthesaurus-debuginfo-2.4.3-2.4.1 calligra-plan-2.4.3-2.4.1 calligra-plan-debuginfo-2.4.3-2.4.1 calligra-sheets-2.4.3-2.4.1 calligra-sheets-debuginfo-2.4.3-2.4.1 calligra-stage-2.4.3-2.4.1 calligra-stage-debuginfo-2.4.3-2.4.1 calligra-tools-2.4.3-2.4.1 calligra-tools-debuginfo-2.4.3-2.4.1 calligra-words-2.4.3-2.4.1 calligra-words-debuginfo-2.4.3-2.4.1 - openSUSE 12.2 (noarch): calligra-doc-2.4.3-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-3456.html https://bugzilla.novell.com/774534 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1044-1: important: Security update for Xen
by opensuse-security＠opensuse.org 27 Aug '12

27 Aug '12

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1044-1 Rating: important References: #744771 #746702 #762484 #762963 #773393 #773401 Cross-References: CVE-2012-2625 CVE-2012-3432 CVE-2012-3433 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that solves three vulnerabilities and has three fixes is now available. It includes one version update. Description: Xen was updated to fix several security issues: * CVE-2012-3433: A xen HVM guest destroy p2m teardown host DoS vulnerability was fixed, where malicious guest could lock/crash the host. * CVE-2012-3432: A xen HVM guest user mode MMIO emulation DoS was fixed. * CVE-2012-2625: The xen pv bootloader doesn't check the size of the bzip2 or lzma compressed kernel, leading to denial of service (crash). Also the following bug in XEN was fixed: * bnc#746702 - Xen HVM DomU crash during Windows Server 2008 R2 install, when maxmem > memory This update also included bugfixes for: * vm-install: - bnc#762963 - ReaR: Unable to recover a paravirtualized XEN guest Security Issue references: * CVE-2012-3432 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3432 > * CVE-2012-3433 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3433 > * CVE-2012-2625 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2625 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-xen-201208-6653 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-xen-201208-6653 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-xen-201208-6653 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-xen-201208-6653 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 x86_64): xen-devel-4.0.3_21548_08-0.7.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): xen-kmp-trace-4.0.3_21548_08_2.6.32.59_0.7-0.7.1 - SUSE Linux Enterprise Server 11 SP1 (i586 x86_64) [New Version: 0.4.34]: vm-install-0.4.34-0.3.1 xen-4.0.3_21548_08-0.7.1 xen-doc-html-4.0.3_21548_08-0.7.1 xen-doc-pdf-4.0.3_21548_08-0.7.1 xen-kmp-default-4.0.3_21548_08_2.6.32.59_0.7-0.7.1 xen-kmp-trace-4.0.3_21548_08_2.6.32.59_0.7-0.7.1 xen-libs-4.0.3_21548_08-0.7.1 xen-tools-4.0.3_21548_08-0.7.1 xen-tools-domU-4.0.3_21548_08-0.7.1 - SUSE Linux Enterprise Server 11 SP1 (i586): xen-kmp-pae-4.0.3_21548_08_2.6.32.59_0.7-0.7.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 0.4.34]: vm-install-0.4.34-0.3.1 xen-4.0.3_21548_08-0.7.1 xen-kmp-default-4.0.3_21548_08_2.6.32.59_0.7-0.7.1 xen-libs-4.0.3_21548_08-0.7.1 xen-tools-4.0.3_21548_08-0.7.1 xen-tools-domU-4.0.3_21548_08-0.7.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586): xen-kmp-pae-4.0.3_21548_08_2.6.32.59_0.7-0.7.1 References: http://support.novell.com/security/cve/CVE-2012-2625.html http://support.novell.com/security/cve/CVE-2012-3432.html http://support.novell.com/security/cve/CVE-2012-3433.html https://bugzilla.novell.com/744771 https://bugzilla.novell.com/746702 https://bugzilla.novell.com/762484 https://bugzilla.novell.com/762963 https://bugzilla.novell.com/773393 https://bugzilla.novell.com/773401 http://download.novell.com/patch/finder/?keywords=872c7f98262a167c6598ea04d… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1043-1: important: Security update for Xen and libvirt
by opensuse-security＠opensuse.org 27 Aug '12

27 Aug '12

SUSE Security Update: Security update for Xen and libvirt ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1043-1 Rating: important References: #746702 #762484 #762963 #764982 #766283 #773393 #773401 #773955 Cross-References: CVE-2012-3432 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that solves one vulnerability and has 7 fixes is now available. It includes one version update. Description: Xen was updated to fix several security issues: * CVE-2012-3433: A xen HVM guest destroy p2m teardown host DoS vulnerability was fixed, where malicious guest could lock/crash the host. * CVE-2012-3432: A xen HVM guest user mode MMIO emulation DoS was fixed. * CVE-2012-2625: The xen pv bootloader doesn't check the size of the bzip2 or lzma compressed kernel, leading to denial of service (crash). Also the following bug in XEN has been fixed: * bnc#746702 - Xen HVM DomU crash during Windows Server 2008 R2 install, when maxmem > memory This update also included bugfixes for: * vm-install: - bnc#762963 - ReaR: Unable to recover a paravirtualized XEN guest * virt-manager - SLE11-SP2 ONLY * bnc#764982 - virt-manager fails to start after upgrade to SLES11 SP2 from SLES10 Security Issue reference: * CVE-2012-3432 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3432 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-xen-201208-6640 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-xen-201208-6640 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-xen-201208-6640 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (x86_64): libvirt-devel-0.9.6-0.21.3 libvirt-devel-32bit-0.9.6-0.21.3 xen-devel-4.1.2_20-0.5.2 - SUSE Linux Enterprise Server 11 SP2 (x86_64) [New Version: 0.5.10]: libvirt-0.9.6-0.21.3 libvirt-client-0.9.6-0.21.3 libvirt-client-32bit-0.9.6-0.21.3 libvirt-doc-0.9.6-0.21.3 libvirt-python-0.9.6-0.21.3 virt-manager-0.9.0-3.19.1 vm-install-0.5.10-0.5.1 xen-4.1.2_20-0.5.2 xen-doc-html-4.1.2_20-0.5.2 xen-doc-pdf-4.1.2_20-0.5.2 xen-kmp-default-4.1.2_20_3.0.38_0.5-0.5.2 xen-kmp-trace-4.1.2_20_3.0.38_0.5-0.5.2 xen-libs-32bit-4.1.2_20-0.5.2 xen-libs-4.1.2_20-0.5.2 xen-tools-4.1.2_20-0.5.2 xen-tools-domU-4.1.2_20-0.5.2 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 0.5.10]: libvirt-0.9.6-0.21.3 libvirt-client-0.9.6-0.21.3 libvirt-client-32bit-0.9.6-0.21.3 libvirt-doc-0.9.6-0.21.3 libvirt-python-0.9.6-0.21.3 virt-manager-0.9.0-3.19.1 vm-install-0.5.10-0.5.1 xen-4.1.2_20-0.5.2 xen-doc-html-4.1.2_20-0.5.2 xen-doc-pdf-4.1.2_20-0.5.2 xen-kmp-default-4.1.2_20_3.0.38_0.5-0.5.2 xen-kmp-trace-4.1.2_20_3.0.38_0.5-0.5.2 xen-libs-32bit-4.1.2_20-0.5.2 xen-libs-4.1.2_20-0.5.2 xen-tools-4.1.2_20-0.5.2 xen-tools-domU-4.1.2_20-0.5.2 References: http://support.novell.com/security/cve/CVE-2012-3432.html https://bugzilla.novell.com/746702 https://bugzilla.novell.com/762484 https://bugzilla.novell.com/762963 https://bugzilla.novell.com/764982 https://bugzilla.novell.com/766283 https://bugzilla.novell.com/773393 https://bugzilla.novell.com/773401 https://bugzilla.novell.com/773955 http://download.novell.com/patch/finder/?keywords=6aa25504d39edb169f3b6d3e1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1038-1: important: Security update for gimp
by opensuse-security＠opensuse.org 24 Aug '12

24 Aug '12

SUSE Security Update: Security update for gimp ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1038-1 Rating: important References: #724628 Cross-References: CVE-2012-3481 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of The Gimp fixes a heap overflow that could have been exploited by attackers to cause a Denial of Service (application crash) or to potentially execute arbitrary code (CVE-2012-3481). Security Issue reference: * CVE-2012-3481 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3481 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp1-gimp-6712 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-gimp-6712 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp1-gimp-6712 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-gimp-6712 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): gimp-2.6.2-3.34.39.1 gimp-devel-2.6.2-3.34.39.1 gimp-lang-2.6.2-3.34.39.1 gimp-plugins-python-2.6.2-3.34.39.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): gimp-2.6.2-3.34.39.1 gimp-devel-2.6.2-3.34.39.1 gimp-lang-2.6.2-3.34.39.1 gimp-plugins-python-2.6.2-3.34.39.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): gimp-2.6.2-3.34.39.1 gimp-lang-2.6.2-3.34.39.1 gimp-plugins-python-2.6.2-3.34.39.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): gimp-2.6.2-3.34.39.1 gimp-lang-2.6.2-3.34.39.1 gimp-plugins-python-2.6.2-3.34.39.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): gimp-2.2.10-22.46.1 gimp-devel-2.2.10-22.46.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): gimp-2.2.10-22.46.1 gimp-devel-2.2.10-22.46.1 References: http://support.novell.com/security/cve/CVE-2012-3481.html https://bugzilla.novell.com/724628 http://download.novell.com/patch/finder/?keywords=12c9a930398cff75c99abf194… http://download.novell.com/patch/finder/?keywords=e035e67d5f659aef60e434860… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1034-1: important: Security update for php5
by opensuse-security＠opensuse.org 24 Aug '12

24 Aug '12

SUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1034-1 Rating: important References: #772580 #772582 Cross-References: CVE-2012-2688 CVE-2012-3365 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Server 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: This update fixes two security issues of PHP5: * Potential overflow in _php_stream_scandir. (CVE-2012-2688 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2688 > ) * open_basedir bypass via SQLite extension. (CVE-2012-3365 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365 > ) Indications: Everyone using PHP5 should update.. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp1-apache2-mod_php5-6627 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-apache2-mod_php5-6627 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp1-apache2-mod_php5-6627 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-apache2-mod_php5-6627 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-apache2-mod_php5-6627 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.2.14]: php5-devel-5.2.14-0.7.30.42.1 php5-imap-5.2.14-0.7.30.42.1 php5-ncurses-5.2.14-0.7.30.42.1 php5-posix-5.2.14-0.7.30.42.1 php5-readline-5.2.14-0.7.30.42.1 php5-sockets-5.2.14-0.7.30.42.1 php5-sqlite-5.2.14-0.7.30.42.1 php5-tidy-5.2.14-0.7.30.42.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64) [New Version: 5.2.14]: apache2-mod_php5-5.2.14-0.7.30.42.1 php5-5.2.14-0.7.30.42.1 php5-bcmath-5.2.14-0.7.30.42.1 php5-bz2-5.2.14-0.7.30.42.1 php5-calendar-5.2.14-0.7.30.42.1 php5-ctype-5.2.14-0.7.30.42.1 php5-curl-5.2.14-0.7.30.42.1 php5-dba-5.2.14-0.7.30.42.1 php5-dbase-5.2.14-0.7.30.42.1 php5-dom-5.2.14-0.7.30.42.1 php5-exif-5.2.14-0.7.30.42.1 php5-fastcgi-5.2.14-0.7.30.42.1 php5-ftp-5.2.14-0.7.30.42.1 php5-gd-5.2.14-0.7.30.42.1 php5-gettext-5.2.14-0.7.30.42.1 php5-gmp-5.2.14-0.7.30.42.1 php5-hash-5.2.14-0.7.30.42.1 php5-iconv-5.2.14-0.7.30.42.1 php5-json-5.2.14-0.7.30.42.1 php5-ldap-5.2.14-0.7.30.42.1 php5-mbstring-5.2.14-0.7.30.42.1 php5-mcrypt-5.2.14-0.7.30.42.1 php5-mysql-5.2.14-0.7.30.42.1 php5-odbc-5.2.14-0.7.30.42.1 php5-openssl-5.2.14-0.7.30.42.1 php5-pcntl-5.2.14-0.7.30.42.1 php5-pdo-5.2.14-0.7.30.42.1 php5-pear-5.2.14-0.7.30.42.1 php5-pgsql-5.2.14-0.7.30.42.1 php5-pspell-5.2.14-0.7.30.42.1 php5-shmop-5.2.14-0.7.30.42.1 php5-snmp-5.2.14-0.7.30.42.1 php5-soap-5.2.14-0.7.30.42.1 php5-suhosin-5.2.14-0.7.30.42.1 php5-sysvmsg-5.2.14-0.7.30.42.1 php5-sysvsem-5.2.14-0.7.30.42.1 php5-sysvshm-5.2.14-0.7.30.42.1 php5-tokenizer-5.2.14-0.7.30.42.1 php5-wddx-5.2.14-0.7.30.42.1 php5-xmlreader-5.2.14-0.7.30.42.1 php5-xmlrpc-5.2.14-0.7.30.42.1 php5-xmlwriter-5.2.14-0.7.30.42.1 php5-xsl-5.2.14-0.7.30.42.1 php5-zip-5.2.14-0.7.30.42.1 php5-zlib-5.2.14-0.7.30.42.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.2.14]: php5-devel-5.2.14-0.7.30.42.1 php5-imap-5.2.14-0.7.30.42.1 php5-ncurses-5.2.14-0.7.30.42.1 php5-posix-5.2.14-0.7.30.42.1 php5-readline-5.2.14-0.7.30.42.1 php5-sockets-5.2.14-0.7.30.42.1 php5-sqlite-5.2.14-0.7.30.42.1 php5-tidy-5.2.14-0.7.30.42.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 x86_64) [New Version: 5.2.14]: apache2-mod_php5-5.2.14-0.7.30.42.1 php5-5.2.14-0.7.30.42.1 php5-bcmath-5.2.14-0.7.30.42.1 php5-bz2-5.2.14-0.7.30.42.1 php5-calendar-5.2.14-0.7.30.42.1 php5-ctype-5.2.14-0.7.30.42.1 php5-curl-5.2.14-0.7.30.42.1 php5-dba-5.2.14-0.7.30.42.1 php5-dbase-5.2.14-0.7.30.42.1 php5-dom-5.2.14-0.7.30.42.1 php5-exif-5.2.14-0.7.30.42.1 php5-fastcgi-5.2.14-0.7.30.42.1 php5-ftp-5.2.14-0.7.30.42.1 php5-gd-5.2.14-0.7.30.42.1 php5-gettext-5.2.14-0.7.30.42.1 php5-gmp-5.2.14-0.7.30.42.1 php5-hash-5.2.14-0.7.30.42.1 php5-iconv-5.2.14-0.7.30.42.1 php5-json-5.2.14-0.7.30.42.1 php5-ldap-5.2.14-0.7.30.42.1 php5-mbstring-5.2.14-0.7.30.42.1 php5-mcrypt-5.2.14-0.7.30.42.1 php5-mysql-5.2.14-0.7.30.42.1 php5-odbc-5.2.14-0.7.30.42.1 php5-openssl-5.2.14-0.7.30.42.1 php5-pcntl-5.2.14-0.7.30.42.1 php5-pdo-5.2.14-0.7.30.42.1 php5-pear-5.2.14-0.7.30.42.1 php5-pgsql-5.2.14-0.7.30.42.1 php5-pspell-5.2.14-0.7.30.42.1 php5-shmop-5.2.14-0.7.30.42.1 php5-snmp-5.2.14-0.7.30.42.1 php5-soap-5.2.14-0.7.30.42.1 php5-suhosin-5.2.14-0.7.30.42.1 php5-sysvmsg-5.2.14-0.7.30.42.1 php5-sysvsem-5.2.14-0.7.30.42.1 php5-sysvshm-5.2.14-0.7.30.42.1 php5-tokenizer-5.2.14-0.7.30.42.1 php5-wddx-5.2.14-0.7.30.42.1 php5-xmlreader-5.2.14-0.7.30.42.1 php5-xmlrpc-5.2.14-0.7.30.42.1 php5-xmlwriter-5.2.14-0.7.30.42.1 php5-xsl-5.2.14-0.7.30.42.1 php5-zip-5.2.14-0.7.30.42.1 php5-zlib-5.2.14-0.7.30.42.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.2.14]: apache2-mod_php5-5.2.14-0.7.30.42.1 php5-5.2.14-0.7.30.42.1 php5-bcmath-5.2.14-0.7.30.42.1 php5-bz2-5.2.14-0.7.30.42.1 php5-calendar-5.2.14-0.7.30.42.1 php5-ctype-5.2.14-0.7.30.42.1 php5-curl-5.2.14-0.7.30.42.1 php5-dba-5.2.14-0.7.30.42.1 php5-dbase-5.2.14-0.7.30.42.1 php5-dom-5.2.14-0.7.30.42.1 php5-exif-5.2.14-0.7.30.42.1 php5-fastcgi-5.2.14-0.7.30.42.1 php5-ftp-5.2.14-0.7.30.42.1 php5-gd-5.2.14-0.7.30.42.1 php5-gettext-5.2.14-0.7.30.42.1 php5-gmp-5.2.14-0.7.30.42.1 php5-hash-5.2.14-0.7.30.42.1 php5-iconv-5.2.14-0.7.30.42.1 php5-json-5.2.14-0.7.30.42.1 php5-ldap-5.2.14-0.7.30.42.1 php5-mbstring-5.2.14-0.7.30.42.1 php5-mcrypt-5.2.14-0.7.30.42.1 php5-mysql-5.2.14-0.7.30.42.1 php5-odbc-5.2.14-0.7.30.42.1 php5-openssl-5.2.14-0.7.30.42.1 php5-pcntl-5.2.14-0.7.30.42.1 php5-pdo-5.2.14-0.7.30.42.1 php5-pear-5.2.14-0.7.30.42.1 php5-pgsql-5.2.14-0.7.30.42.1 php5-pspell-5.2.14-0.7.30.42.1 php5-shmop-5.2.14-0.7.30.42.1 php5-snmp-5.2.14-0.7.30.42.1 php5-soap-5.2.14-0.7.30.42.1 php5-suhosin-5.2.14-0.7.30.42.1 php5-sysvmsg-5.2.14-0.7.30.42.1 php5-sysvsem-5.2.14-0.7.30.42.1 php5-sysvshm-5.2.14-0.7.30.42.1 php5-tokenizer-5.2.14-0.7.30.42.1 php5-wddx-5.2.14-0.7.30.42.1 php5-xmlreader-5.2.14-0.7.30.42.1 php5-xmlrpc-5.2.14-0.7.30.42.1 php5-xmlwriter-5.2.14-0.7.30.42.1 php5-xsl-5.2.14-0.7.30.42.1 php5-zip-5.2.14-0.7.30.42.1 php5-zlib-5.2.14-0.7.30.42.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 5.2.14]: apache2-mod_php5-5.2.14-0.7.30.42.1 php5-5.2.14-0.7.30.42.1 php5-bcmath-5.2.14-0.7.30.42.1 php5-bz2-5.2.14-0.7.30.42.1 php5-calendar-5.2.14-0.7.30.42.1 php5-ctype-5.2.14-0.7.30.42.1 php5-curl-5.2.14-0.7.30.42.1 php5-dba-5.2.14-0.7.30.42.1 php5-dbase-5.2.14-0.7.30.42.1 php5-dom-5.2.14-0.7.30.42.1 php5-exif-5.2.14-0.7.30.42.1 php5-fastcgi-5.2.14-0.7.30.42.1 php5-ftp-5.2.14-0.7.30.42.1 php5-gd-5.2.14-0.7.30.42.1 php5-gettext-5.2.14-0.7.30.42.1 php5-gmp-5.2.14-0.7.30.42.1 php5-hash-5.2.14-0.7.30.42.1 php5-iconv-5.2.14-0.7.30.42.1 php5-json-5.2.14-0.7.30.42.1 php5-ldap-5.2.14-0.7.30.42.1 php5-mbstring-5.2.14-0.7.30.42.1 php5-mcrypt-5.2.14-0.7.30.42.1 php5-mysql-5.2.14-0.7.30.42.1 php5-odbc-5.2.14-0.7.30.42.1 php5-openssl-5.2.14-0.7.30.42.1 php5-pcntl-5.2.14-0.7.30.42.1 php5-pdo-5.2.14-0.7.30.42.1 php5-pear-5.2.14-0.7.30.42.1 php5-pgsql-5.2.14-0.7.30.42.1 php5-pspell-5.2.14-0.7.30.42.1 php5-shmop-5.2.14-0.7.30.42.1 php5-snmp-5.2.14-0.7.30.42.1 php5-soap-5.2.14-0.7.30.42.1 php5-suhosin-5.2.14-0.7.30.42.1 php5-sysvmsg-5.2.14-0.7.30.42.1 php5-sysvsem-5.2.14-0.7.30.42.1 php5-sysvshm-5.2.14-0.7.30.42.1 php5-tokenizer-5.2.14-0.7.30.42.1 php5-wddx-5.2.14-0.7.30.42.1 php5-xmlreader-5.2.14-0.7.30.42.1 php5-xmlrpc-5.2.14-0.7.30.42.1 php5-xmlwriter-5.2.14-0.7.30.42.1 php5-xsl-5.2.14-0.7.30.42.1 php5-zip-5.2.14-0.7.30.42.1 php5-zlib-5.2.14-0.7.30.42.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.2.14]: apache2-mod_php5-5.2.14-0.7.30.42.1 php5-5.2.14-0.7.30.42.1 php5-bcmath-5.2.14-0.7.30.42.1 php5-bz2-5.2.14-0.7.30.42.1 php5-calendar-5.2.14-0.7.30.42.1 php5-ctype-5.2.14-0.7.30.42.1 php5-curl-5.2.14-0.7.30.42.1 php5-dba-5.2.14-0.7.30.42.1 php5-dbase-5.2.14-0.7.30.42.1 php5-dom-5.2.14-0.7.30.42.1 php5-exif-5.2.14-0.7.30.42.1 php5-fastcgi-5.2.14-0.7.30.42.1 php5-ftp-5.2.14-0.7.30.42.1 php5-gd-5.2.14-0.7.30.42.1 php5-gettext-5.2.14-0.7.30.42.1 php5-gmp-5.2.14-0.7.30.42.1 php5-hash-5.2.14-0.7.30.42.1 php5-iconv-5.2.14-0.7.30.42.1 php5-json-5.2.14-0.7.30.42.1 php5-ldap-5.2.14-0.7.30.42.1 php5-mbstring-5.2.14-0.7.30.42.1 php5-mcrypt-5.2.14-0.7.30.42.1 php5-mysql-5.2.14-0.7.30.42.1 php5-odbc-5.2.14-0.7.30.42.1 php5-openssl-5.2.14-0.7.30.42.1 php5-pcntl-5.2.14-0.7.30.42.1 php5-pdo-5.2.14-0.7.30.42.1 php5-pear-5.2.14-0.7.30.42.1 php5-pgsql-5.2.14-0.7.30.42.1 php5-pspell-5.2.14-0.7.30.42.1 php5-shmop-5.2.14-0.7.30.42.1 php5-snmp-5.2.14-0.7.30.42.1 php5-soap-5.2.14-0.7.30.42.1 php5-suhosin-5.2.14-0.7.30.42.1 php5-sysvmsg-5.2.14-0.7.30.42.1 php5-sysvsem-5.2.14-0.7.30.42.1 php5-sysvshm-5.2.14-0.7.30.42.1 php5-tokenizer-5.2.14-0.7.30.42.1 php5-wddx-5.2.14-0.7.30.42.1 php5-xmlreader-5.2.14-0.7.30.42.1 php5-xmlrpc-5.2.14-0.7.30.42.1 php5-xmlwriter-5.2.14-0.7.30.42.1 php5-xsl-5.2.14-0.7.30.42.1 php5-zip-5.2.14-0.7.30.42.1 php5-zlib-5.2.14-0.7.30.42.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): apache2-mod_php5-5.2.14-0.36.1 php5-5.2.14-0.36.1 php5-bcmath-5.2.14-0.36.1 php5-bz2-5.2.14-0.36.1 php5-calendar-5.2.14-0.36.1 php5-ctype-5.2.14-0.36.1 php5-curl-5.2.14-0.36.1 php5-dba-5.2.14-0.36.1 php5-dbase-5.2.14-0.36.1 php5-devel-5.2.14-0.36.1 php5-dom-5.2.14-0.36.1 php5-exif-5.2.14-0.36.1 php5-fastcgi-5.2.14-0.36.1 php5-ftp-5.2.14-0.36.1 php5-gd-5.2.14-0.36.1 php5-gettext-5.2.14-0.36.1 php5-gmp-5.2.14-0.36.1 php5-hash-5.2.14-0.36.1 php5-iconv-5.2.14-0.36.1 php5-imap-5.2.14-0.36.1 php5-json-5.2.14-0.36.1 php5-ldap-5.2.14-0.36.1 php5-mbstring-5.2.14-0.36.1 php5-mcrypt-5.2.14-0.36.1 php5-mhash-5.2.14-0.36.1 php5-mysql-5.2.14-0.36.1 php5-ncurses-5.2.14-0.36.1 php5-odbc-5.2.14-0.36.1 php5-openssl-5.2.14-0.36.1 php5-pcntl-5.2.14-0.36.1 php5-pdo-5.2.14-0.36.1 php5-pear-5.2.14-0.36.1 php5-pgsql-5.2.14-0.36.1 php5-posix-5.2.14-0.36.1 php5-pspell-5.2.14-0.36.1 php5-shmop-5.2.14-0.36.1 php5-snmp-5.2.14-0.36.1 php5-soap-5.2.14-0.36.1 php5-sockets-5.2.14-0.36.1 php5-sqlite-5.2.14-0.36.1 php5-suhosin-5.2.14-0.36.1 php5-sysvmsg-5.2.14-0.36.1 php5-sysvsem-5.2.14-0.36.1 php5-sysvshm-5.2.14-0.36.1 php5-tokenizer-5.2.14-0.36.1 php5-wddx-5.2.14-0.36.1 php5-xmlreader-5.2.14-0.36.1 php5-xmlrpc-5.2.14-0.36.1 php5-xsl-5.2.14-0.36.1 php5-zlib-5.2.14-0.36.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): apache2-mod_php5-5.2.14-0.36.1 php5-5.2.14-0.36.1 php5-bcmath-5.2.14-0.36.1 php5-bz2-5.2.14-0.36.1 php5-calendar-5.2.14-0.36.1 php5-ctype-5.2.14-0.36.1 php5-curl-5.2.14-0.36.1 php5-dba-5.2.14-0.36.1 php5-dbase-5.2.14-0.36.1 php5-devel-5.2.14-0.36.1 php5-dom-5.2.14-0.36.1 php5-exif-5.2.14-0.36.1 php5-fastcgi-5.2.14-0.36.1 php5-ftp-5.2.14-0.36.1 php5-gd-5.2.14-0.36.1 php5-gettext-5.2.14-0.36.1 php5-gmp-5.2.14-0.36.1 php5-hash-5.2.14-0.36.1 php5-iconv-5.2.14-0.36.1 php5-imap-5.2.14-0.36.1 php5-ldap-5.2.14-0.36.1 php5-mbstring-5.2.14-0.36.1 php5-mcrypt-5.2.14-0.36.1 php5-mhash-5.2.14-0.36.1 php5-mysql-5.2.14-0.36.1 php5-ncurses-5.2.14-0.36.1 php5-odbc-5.2.14-0.36.1 php5-openssl-5.2.14-0.36.1 php5-pcntl-5.2.14-0.36.1 php5-pdo-5.2.14-0.36.1 php5-pear-5.2.14-0.36.1 php5-pgsql-5.2.14-0.36.1 php5-posix-5.2.14-0.36.1 php5-pspell-5.2.14-0.36.1 php5-shmop-5.2.14-0.36.1 php5-snmp-5.2.14-0.36.1 php5-soap-5.2.14-0.36.1 php5-sockets-5.2.14-0.36.1 php5-sqlite-5.2.14-0.36.1 php5-suhosin-5.2.14-0.36.1 php5-sysvmsg-5.2.14-0.36.1 php5-sysvsem-5.2.14-0.36.1 php5-sysvshm-5.2.14-0.36.1 php5-tidy-5.2.14-0.36.1 php5-tokenizer-5.2.14-0.36.1 php5-wddx-5.2.14-0.36.1 php5-xmlreader-5.2.14-0.36.1 php5-xmlrpc-5.2.14-0.36.1 php5-xsl-5.2.14-0.36.1 php5-zlib-5.2.14-0.36.1 References: http://support.novell.com/security/cve/CVE-2012-2688.html http://support.novell.com/security/cve/CVE-2012-3365.html https://bugzilla.novell.com/772580 https://bugzilla.novell.com/772582 http://download.novell.com/patch/finder/?keywords=f1cb3933c34c88daac7ac3933… http://download.novell.com/patch/finder/?keywords=fc638212971731cdbc6514110… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1033-1: important: Security update for PHP5
by opensuse-security＠opensuse.org 24 Aug '12

24 Aug '12

SUSE Security Update: Security update for PHP5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1033-1 Rating: important References: #769785 #772580 #772582 Cross-References: CVE-2012-2688 CVE-2012-3365 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: Three security bugs have been fixed in PHP5. * CVE-2012-2688: php5: potential overflow in _php_stream_scandir * CVE-2012-3365: open_basedir bypass via SQLite extension * CVE-2012-3450: An out of band read sql denial of service has been fixed (bnc#769785) Security Issue reference: * CVE-2012-2688 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2688 > * CVE-2012-3365 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365 > * CVE-2012-3450 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3450 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-apache2-mod_php53-6634 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-apache2-mod_php53-6634 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-apache2-mod_php53-6634 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): php53-devel-5.3.8-0.35.1 php53-imap-5.3.8-0.35.1 php53-posix-5.3.8-0.35.1 php53-readline-5.3.8-0.35.1 php53-sockets-5.3.8-0.35.1 php53-sqlite-5.3.8-0.35.1 php53-tidy-5.3.8-0.35.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): apache2-mod_php53-5.3.8-0.35.1 php53-5.3.8-0.35.1 php53-bcmath-5.3.8-0.35.1 php53-bz2-5.3.8-0.35.1 php53-calendar-5.3.8-0.35.1 php53-ctype-5.3.8-0.35.1 php53-curl-5.3.8-0.35.1 php53-dba-5.3.8-0.35.1 php53-dom-5.3.8-0.35.1 php53-exif-5.3.8-0.35.1 php53-fastcgi-5.3.8-0.35.1 php53-fileinfo-5.3.8-0.35.1 php53-ftp-5.3.8-0.35.1 php53-gd-5.3.8-0.35.1 php53-gettext-5.3.8-0.35.1 php53-gmp-5.3.8-0.35.1 php53-iconv-5.3.8-0.35.1 php53-intl-5.3.8-0.35.1 php53-json-5.3.8-0.35.1 php53-ldap-5.3.8-0.35.1 php53-mbstring-5.3.8-0.35.1 php53-mcrypt-5.3.8-0.35.1 php53-mysql-5.3.8-0.35.1 php53-odbc-5.3.8-0.35.1 php53-openssl-5.3.8-0.35.1 php53-pcntl-5.3.8-0.35.1 php53-pdo-5.3.8-0.35.1 php53-pear-5.3.8-0.35.1 php53-pgsql-5.3.8-0.35.1 php53-pspell-5.3.8-0.35.1 php53-shmop-5.3.8-0.35.1 php53-snmp-5.3.8-0.35.1 php53-soap-5.3.8-0.35.1 php53-suhosin-5.3.8-0.35.1 php53-sysvmsg-5.3.8-0.35.1 php53-sysvsem-5.3.8-0.35.1 php53-sysvshm-5.3.8-0.35.1 php53-tokenizer-5.3.8-0.35.1 php53-wddx-5.3.8-0.35.1 php53-xmlreader-5.3.8-0.35.1 php53-xmlrpc-5.3.8-0.35.1 php53-xmlwriter-5.3.8-0.35.1 php53-xsl-5.3.8-0.35.1 php53-zip-5.3.8-0.35.1 php53-zlib-5.3.8-0.35.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php53-5.3.8-0.35.1 php53-5.3.8-0.35.1 php53-bcmath-5.3.8-0.35.1 php53-bz2-5.3.8-0.35.1 php53-calendar-5.3.8-0.35.1 php53-ctype-5.3.8-0.35.1 php53-curl-5.3.8-0.35.1 php53-dba-5.3.8-0.35.1 php53-dom-5.3.8-0.35.1 php53-exif-5.3.8-0.35.1 php53-fastcgi-5.3.8-0.35.1 php53-fileinfo-5.3.8-0.35.1 php53-ftp-5.3.8-0.35.1 php53-gd-5.3.8-0.35.1 php53-gettext-5.3.8-0.35.1 php53-gmp-5.3.8-0.35.1 php53-iconv-5.3.8-0.35.1 php53-intl-5.3.8-0.35.1 php53-json-5.3.8-0.35.1 php53-ldap-5.3.8-0.35.1 php53-mbstring-5.3.8-0.35.1 php53-mcrypt-5.3.8-0.35.1 php53-mysql-5.3.8-0.35.1 php53-odbc-5.3.8-0.35.1 php53-openssl-5.3.8-0.35.1 php53-pcntl-5.3.8-0.35.1 php53-pdo-5.3.8-0.35.1 php53-pear-5.3.8-0.35.1 php53-pgsql-5.3.8-0.35.1 php53-pspell-5.3.8-0.35.1 php53-shmop-5.3.8-0.35.1 php53-snmp-5.3.8-0.35.1 php53-soap-5.3.8-0.35.1 php53-suhosin-5.3.8-0.35.1 php53-sysvmsg-5.3.8-0.35.1 php53-sysvsem-5.3.8-0.35.1 php53-sysvshm-5.3.8-0.35.1 php53-tokenizer-5.3.8-0.35.1 php53-wddx-5.3.8-0.35.1 php53-xmlreader-5.3.8-0.35.1 php53-xmlrpc-5.3.8-0.35.1 php53-xmlwriter-5.3.8-0.35.1 php53-xsl-5.3.8-0.35.1 php53-zip-5.3.8-0.35.1 php53-zlib-5.3.8-0.35.1 References: http://support.novell.com/security/cve/CVE-2012-2688.html http://support.novell.com/security/cve/CVE-2012-3365.html https://bugzilla.novell.com/769785 https://bugzilla.novell.com/772580 https://bugzilla.novell.com/772582 http://download.novell.com/patch/finder/?keywords=420b5b682c991063fad653127… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1029-1: important: Security update for gimp
by opensuse-security＠opensuse.org 23 Aug '12

23 Aug '12

SUSE Security Update: Security update for gimp ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1029-1 Rating: important References: #775433 Cross-References: CVE-2012-3403 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of The Gimp fixes a heap overflow that could have been exploited by attackers to cause a Denial of Service (application crash) or even to potentially execute arbitrary code (CVE-2012-3403). Security Issue reference: * CVE-2012-3403 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3403 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp1-gimp-6683 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-gimp-6683 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp1-gimp-6683 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-gimp-6683 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): gimp-2.6.2-3.34.37.1 gimp-devel-2.6.2-3.34.37.1 gimp-lang-2.6.2-3.34.37.1 gimp-plugins-python-2.6.2-3.34.37.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): gimp-2.6.2-3.34.37.1 gimp-devel-2.6.2-3.34.37.1 gimp-lang-2.6.2-3.34.37.1 gimp-plugins-python-2.6.2-3.34.37.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): gimp-2.6.2-3.34.37.1 gimp-lang-2.6.2-3.34.37.1 gimp-plugins-python-2.6.2-3.34.37.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): gimp-2.6.2-3.34.37.1 gimp-lang-2.6.2-3.34.37.1 gimp-plugins-python-2.6.2-3.34.37.1 References: http://support.novell.com/security/cve/CVE-2012-3403.html https://bugzilla.novell.com/775433 http://download.novell.com/patch/finder/?keywords=ca4c519bd6348192da66901f8… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1027-1: important: Security update for gimp
by opensuse-security＠opensuse.org 23 Aug '12

23 Aug '12

SUSE Security Update: Security update for gimp ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1027-1 Rating: important References: #775429 Cross-References: CVE-2012-3403 Affected Products: SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of The Gimp fixes a heap overflow that could have been exploited by attackers to cause a Denial of Service (application crash) or even to potentially execute arbitrary code (CVE-2012-3402). Security Issue reference: * CVE-2012-3403 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3403 > Package List: - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): gimp-2.2.10-22.44.1 gimp-devel-2.2.10-22.44.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): gimp-2.2.10-22.44.1 gimp-devel-2.2.10-22.44.1 References: http://support.novell.com/security/cve/CVE-2012-3403.html https://bugzilla.novell.com/775429 http://download.novell.com/patch/finder/?keywords=5d18ef4dd81fda3effcb7cb85… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1020-1: important: Security update for oracle-update
by opensuse-security＠opensuse.org 22 Aug '12

22 Aug '12

SUSE Security Update: Security update for oracle-update ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1020-1 Rating: important References: #757762 #771994 Cross-References: CVE-2012-0525 CVE-2012-0526 CVE-2012-0527 CVE-2012-0534 CVE-2012-0552 CVE-2012-1737 CVE-2012-1745 CVE-2012-3134 Affected Products: SUSE Manager 1.7 for SLE 11 SP2 SUSE Manager 1.2 for SLE 11 SP1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update fixes two large sets of security issues in the Oracle Server. * http://www.oracle.com/technetwork/topics/security/cpujul2012 -392727.html <http://www.oracle.com/technetwork/topics/security/cpujul201 2-392727.html> (CVE-2012-1737, CVE-2012-1745, CVE-2012-3134) * http://www.oracle.com/technetwork/topics/security/cpuapr2012 -366314.html <http://www.oracle.com/technetwork/topics/security/cpuapr201 2-366314.html> (CVE-2012-0552, CVE-2012-0534, CVE-2012-0527, CVE-2012-0526, CVE-2012-0525) Security Issue references: * CVE-2012-0552 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0552 > * CVE-2012-0534 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0534 > * CVE-2012-1737 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1737 > * CVE-2012-1745 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1745 > * CVE-2012-3134 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3134 > * CVE-2012-0527 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0527 > * CVE-2012-0526 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0526 > * CVE-2012-0525 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0525 > Indications: Everyone using the Oracle DB on SUSE Manager should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.7 for SLE 11 SP2: zypper in -t patch sleman17sp2-oracle-update-6685 - SUSE Manager 1.2 for SLE 11 SP1: zypper in -t patch sleman12sp1-oracle-update-6684 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.7 for SLE 11 SP2 (x86_64): oracle-update-1.7-0.13.1 - SUSE Manager 1.2 for SLE 11 SP1 (x86_64): oracle-update-1.7-0.4.10.1 References: http://support.novell.com/security/cve/CVE-2012-0525.html http://support.novell.com/security/cve/CVE-2012-0526.html http://support.novell.com/security/cve/CVE-2012-0527.html http://support.novell.com/security/cve/CVE-2012-0534.html http://support.novell.com/security/cve/CVE-2012-0552.html http://support.novell.com/security/cve/CVE-2012-1737.html http://support.novell.com/security/cve/CVE-2012-1745.html http://support.novell.com/security/cve/CVE-2012-3134.html https://bugzilla.novell.com/757762 https://bugzilla.novell.com/771994 http://download.novell.com/patch/finder/?keywords=205067d3ac29a7b3a4b0a8d7f… http://download.novell.com/patch/finder/?keywords=c66e6782ca5a697b1ab08f6ec… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1015-1: important: Security update for rubygem-actionpack
by opensuse-security＠opensuse.org 21 Aug '12

21 Aug '12

SUSE Security Update: Security update for rubygem-actionpack ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1015-1 Rating: important References: #765097 #766791 Cross-References: CVE-2012-2660 CVE-2012-2694 Affected Products: WebYaST [Appliance - Tools] WebYaST 1.2 SUSE Studio Standard Edition 1.2 SUSE Studio Onsite 1.2 SUSE Studio Extension for System z 1.2 SUSE Linux Enterprise Software Development Kit 11 SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: This update to rubygem-actionpack fixes two unsafe query generations with "IS NULL" in the WHERE clause. (CVE-2012-2660 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2660 > , CVE-2012-2694 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2694 > ) Indications: Everyone using rubygem-actionpack should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - WebYaST [Appliance - Tools]: zypper in -t patch slewystsp1-rubygem-actionpack-2_3-6619 - WebYaST 1.2: zypper in -t patch slewyst12-rubygem-actionpack-2_3-6665 - SUSE Studio Standard Edition 1.2: zypper in -t patch sleslms12-rubygem-actionpack-2_3-6665 - SUSE Studio Onsite 1.2: zypper in -t patch slestso12-rubygem-actionpack-2_3-6665 - SUSE Studio Extension for System z 1.2: zypper in -t patch slestso12-rubygem-actionpack-2_3-6665 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-rubygem-actionpack-2_3-6619 To bring your system up-to-date, use "zypper patch". Package List: - WebYaST [Appliance - Tools] (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.14]: rubygem-actionpack-2_3-2.3.14-0.7.6.1 - WebYaST 1.2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.14]: rubygem-actionpack-2_3-2.3.14-0.7.6.1 - SUSE Studio Standard Edition 1.2 (x86_64) [New Version: 2.3.14]: rubygem-actionpack-2_3-2.3.14-0.7.6.1 - SUSE Studio Onsite 1.2 (x86_64) [New Version: 2.3.14]: rubygem-actionpack-2_3-2.3.14-0.7.6.1 - SUSE Studio Extension for System z 1.2 (s390x) [New Version: 2.3.14]: rubygem-actionpack-2_3-2.3.14-0.7.6.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.14]: rubygem-actionpack-2_3-2.3.14-0.7.6.1 References: http://support.novell.com/security/cve/CVE-2012-2660.html http://support.novell.com/security/cve/CVE-2012-2694.html https://bugzilla.novell.com/765097 https://bugzilla.novell.com/766791 http://download.novell.com/patch/finder/?keywords=53095f9d9f8560f19044c15e6… http://download.novell.com/patch/finder/?keywords=625e07d428b32e10138b5c460… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1014-1: important: Security update for rubygem-activerecord
by opensuse-security＠opensuse.org 21 Aug '12

21 Aug '12

SUSE Security Update: Security update for rubygem-activerecord ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1014-1 Rating: important References: #766792 Cross-References: CVE-2012-2660 CVE-2012-2661 CVE-2012-2694 CVE-2012-2695 Affected Products: WebYaST 1.2 SUSE Studio Standard Edition 1.2 SUSE Studio Onsite 1.2 SUSE Studio Extension for System z 1.2 SUSE Linux Enterprise Software Development Kit 11 SP2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: This update to rubygem-activerecord fixes a SQL injection caused by mishandling nested parameters . ( CVE-2012-2695 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2695 > ) Indications: Everyone using rubygem-activerecord should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - WebYaST 1.2: zypper in -t patch slewyst12-rubygem-activerecord-2_3-6633 - SUSE Studio Standard Edition 1.2: zypper in -t patch sleslms12-rubygem-activerecord-2_3-6633 - SUSE Studio Onsite 1.2: zypper in -t patch slestso12-rubygem-activerecord-2_3-6633 - SUSE Studio Extension for System z 1.2: zypper in -t patch slestso12-rubygem-activerecord-2_3-6633 - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-rubygem-activerecord-2_3-6632 To bring your system up-to-date, use "zypper patch". Package List: - WebYaST 1.2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.14]: rubygem-activerecord-2_3-2.3.14-0.7.6.1 - SUSE Studio Standard Edition 1.2 (x86_64) [New Version: 2.3.14]: rubygem-activerecord-2_3-2.3.14-0.7.6.1 - SUSE Studio Onsite 1.2 (x86_64) [New Version: 2.3.14]: rubygem-activerecord-2_3-2.3.14-0.7.6.1 - SUSE Studio Extension for System z 1.2 (s390x) [New Version: 2.3.14]: rubygem-activerecord-2_3-2.3.14-0.7.6.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): rubygem-activerecord-2_3-2.3.14-0.10.1 References: http://support.novell.com/security/cve/CVE-2012-2660.html http://support.novell.com/security/cve/CVE-2012-2661.html http://support.novell.com/security/cve/CVE-2012-2694.html http://support.novell.com/security/cve/CVE-2012-2695.html https://bugzilla.novell.com/766792 http://download.novell.com/patch/finder/?keywords=4db5459b2ac69e20925f9e05c… http://download.novell.com/patch/finder/?keywords=61bc7e2d0afb2e10760ccbe02… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1013-1: important: Security update for java-1_4_2-ibm-sap
by opensuse-security＠opensuse.org 21 Aug '12

21 Aug '12

SUSE Security Update: Security update for java-1_4_2-ibm-sap ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1013-1 Rating: important References: #768611 Affected Products: SUSE Linux Enterprise for SAP Applications 11 SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.4.2 SR13 FP12 has been released which fixes various bugs and security issues. The CVEs being addressed are CVE-2011-3563 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3563 > , CVE-2012-0499 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0499 > , CVE-2012-0502 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0502 > , CVE-2012-0503 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0503 > , CVE-2012-0505 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0505 > and CVE-2012-0506 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0506 > . Further information on this update is available from http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> . Indications: Everyone using java-1_4_2-sap should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise for SAP Applications 11 SP2: zypper in -t patch slesapp2-java-1_4_2-ibm-sap-6637 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise for SAP Applications 11 SP2 (x86_64): java-1_4_2-ibm-sap-1.4.2_sr13.12-0.3.1 java-1_4_2-ibm-sap-devel-1.4.2_sr13.12-0.3.1 References: https://bugzilla.novell.com/768611 http://download.novell.com/patch/finder/?keywords=f91fba551e97a31809b6ccaf5… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1012-1: important: Security update for rubygem-actionpack
by opensuse-security＠opensuse.org 21 Aug '12

21 Aug '12

SUSE Security Update: Security update for rubygem-actionpack ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1012-1 Rating: important References: #765097 #766791 Cross-References: CVE-2012-2660 CVE-2012-2661 CVE-2012-2694 CVE-2012-2695 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update to rubygem-actionpack fixes two unsafe query generations with "IS NULL" in the WHERE clause. (CVE-2012-2660 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2660 > , CVE-2012-2694 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2694 > ) Indications: Everyone using rubygem-actionpack should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-rubygem-actionpack-2_3-6630 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): rubygem-actionpack-2_3-2.3.14-0.10.1 References: http://support.novell.com/security/cve/CVE-2012-2660.html http://support.novell.com/security/cve/CVE-2012-2661.html http://support.novell.com/security/cve/CVE-2012-2694.html http://support.novell.com/security/cve/CVE-2012-2695.html https://bugzilla.novell.com/765097 https://bugzilla.novell.com/766791 http://download.novell.com/patch/finder/?keywords=2f5d4cde838678b72eb3a71ff… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1011-1: important: Security update for rubygem-activerecord
by opensuse-security＠opensuse.org 21 Aug '12

21 Aug '12

SUSE Security Update: Security update for rubygem-activerecord ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1011-1 Rating: important References: #766792 Cross-References: CVE-2012-2695 Affected Products: WebYaST [Appliance - Tools] SUSE Linux Enterprise Software Development Kit 11 SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update to rubygem-activerecord fixes a SQL injection caused by mishandling nested parameters . ( CVE-2012-2695 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2695 > ) Indications: Everyone using rubygem-activerecord should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - WebYaST [Appliance - Tools]: zypper in -t patch slewystsp1-rubygem-activerecord-2_3-6620 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-rubygem-activerecord-2_3-6620 To bring your system up-to-date, use "zypper patch". Package List: - WebYaST [Appliance - Tools] (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.14]: rubygem-activerecord-2_3-2.3.14-0.7.6.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.14]: rubygem-activerecord-2_3-2.3.14-0.7.6.1 References: http://support.novell.com/security/cve/CVE-2012-2695.html https://bugzilla.novell.com/766792 http://download.novell.com/patch/finder/?keywords=f213753c3fb3cf96e214395b7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1001-2: important: Security update for flash-player
by opensuse-security＠opensuse.org 17 Aug '12

17 Aug '12

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1001-2 Rating: important References: #775986 Cross-References: CVE-2012-1535 Affected Products: SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update of flash-player fixes a security issue that could allow attackers to execute arbitrary code remotely. (CVE-2012-1535 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1535 > ) Package List: - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 11.2.202.238]: flash-player-11.2.202.238-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-1535.html https://bugzilla.novell.com/775986 http://download.novell.com/patch/finder/?keywords=288a9919aa9137400b6d0a7a6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1001-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 17 Aug '12

17 Aug '12

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1001-1 Rating: important References: #775986 Cross-References: CVE-2012-1535 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update of flash-player fixes a security issue that could allow attackers to execute arbitrary code remotely. (CVE-2012-1535 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1535 > ) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp1-flash-player-6678 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-flash-player-6678 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 11.2.202.238]: flash-player-11.2.202.238-0.3.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 11.2.202.238]: flash-player-11.2.202.238-0.3.1 References: http://support.novell.com/security/cve/CVE-2012-1535.html https://bugzilla.novell.com/775986 http://download.novell.com/patch/finder/?keywords=69ad427c45a606a21500c688f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0996-1: critical: flash-player to 11.2.202.238
by opensuse-security＠opensuse.org 16 Aug '12

16 Aug '12

openSUSE Security Update: flash-player to 11.2.202.238 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0996-1 Rating: critical References: #775986 Cross-References: CVE-2012-1535 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.238 fixing various bugs and security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-518 - openSUSE 11.4: zypper in -t patch openSUSE-2012-518 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.238-27.1 flash-player-gnome-11.2.202.238-27.1 flash-player-kde4-11.2.202.238-27.1 - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.238-20.1 flash-player-gnome-11.2.202.238-20.1 flash-player-kde4-11.2.202.238-20.1 References: http://support.novell.com/security/cve/CVE-2012-1535.html https://bugzilla.novell.com/775986 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0993-1: important: update for chromium, v8
by opensuse-security＠opensuse.org 15 Aug '12

15 Aug '12

openSUSE Security Update: update for chromium, v8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0993-1 Rating: important References: #760264 #770821 Cross-References: CVE-2011-3084 CVE-2011-3098 CVE-2012-2842 CVE-2012-2843 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Version upgrade of chromium to address multiple security vulnerabilities. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-516 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): chromedriver-22.0.1226.0-1.29.1 chromedriver-debuginfo-22.0.1226.0-1.29.1 chromium-22.0.1226.0-1.29.1 chromium-debuginfo-22.0.1226.0-1.29.1 chromium-debugsource-22.0.1226.0-1.29.1 chromium-desktop-gnome-22.0.1226.0-1.29.1 chromium-desktop-kde-22.0.1226.0-1.29.1 chromium-suid-helper-22.0.1226.0-1.29.1 chromium-suid-helper-debuginfo-22.0.1226.0-1.29.1 libv8-3-3.12.19.1-1.33.1 libv8-3-debuginfo-3.12.19.1-1.33.1 v8-devel-3.12.19.1-1.33.1 v8-private-headers-devel-3.12.19.1-1.33.1 References: http://support.novell.com/security/cve/CVE-2011-3084.html http://support.novell.com/security/cve/CVE-2011-3098.html http://support.novell.com/security/cve/CVE-2012-2842.html http://support.novell.com/security/cve/CVE-2012-2843.html https://bugzilla.novell.com/760264 https://bugzilla.novell.com/770821 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0992-1: important: opera to 12.01
by opensuse-security＠opensuse.org 15 Aug '12

15 Aug '12

openSUSE Security Update: opera to 12.01 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0992-1 Rating: important References: #774191 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Opera was updated to version 12.1, fixing various bugs and security issues. http://www.opera.com/docs/changelogs/unix/1201/ Fixes and Stability Enhancements since Opera 12.00 General and User Interface Several general fixes and stability improvements Website thumbnail memory usage improvements Address bar inline auto-completion no longer prefers shortest domain Corrected an error that could occur after removing the plugin wrapper Resolved an issue where favicons were squeezed too much when many tabs were open Display and Scripting Resolved an error with XHR transfers where content-type was incorrectly determined Improved handling of object literals with numeric duplicate properties Changed behavior of nested/chained comma expressions: now expressing and compiling them as a list rather than a tree Aligned behavior of the #caller property on function code objects in ECMAScript 5 strict mode with the specification Fixed an issue where input type=month would return an incorrect value in its valueAsDate property Resolved an issue with JSON.stringify() that could occur on cached number conversion Fixed a problem with redefining special properties using Object.defineProperty() Network and Site-Specific Fixed an issue where loading would stop at "Document 100%" but the page would still be loading tuenti.com: Corrected behavior when long content was displayed https://twitter.com: Fixed an issue with secure transaction errors Fixed an issue with Google Maps Labs that occured when compiling top-level loops inside strict evals Corrected a problem that could occur with DISQUS Fixed a crash occurring on Lenovo's "Shop now" page Corrected issues when calling window.console.log via a variable at watch4you Resolved an issue with Yahoo! chat Mail, News, Chat Resolved an issue where under certain conditions the mail panel would continuously scroll up Fixed a crash occurring when loading mail databases on startup Security Re-fixed an issue where certain URL constructs could allow arbitrary code execution, as reported by Andrey Stroganov; see our advisory Fixed an issue where certain characters in HTML could incorrectly be ignored, which could facilitate XSS attacks; see our advisory Fixed another issue where small windows could be used to trick users into executing downloads as reported by Jordi Chancel; see our advisory Fixed an issue where an element's HTML content could be incorrectly returned without escaping, bypassing some HTML sanitizers; see our advisory Fixed a low severity issue, details will be disclosed at a later date Advisory links from above: http://www.opera.com/support/kb/view/1016/ http://www.opera.com/support/kb/view/1026/ http://www.opera.com/support/kb/view/1027/ http://www.opera.com/support/kb/view/1025/ Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-515 - openSUSE 11.4: zypper in -t patch openSUSE-2012-515 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): opera-12.01-19.1 opera-gtk-12.01-19.1 opera-kde4-12.01-19.1 - openSUSE 11.4 (i586 x86_64): opera-12.01-25.1 opera-gtk-12.01-25.1 opera-kde4-12.01-25.1 References: https://bugzilla.novell.com/774191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0984-1: important: Security update for MySQL
by opensuse-security＠opensuse.org 13 Aug '12

13 Aug '12

SUSE Security Update: Security update for MySQL ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0984-1 Rating: important References: #765092 #769062 Cross-References: CVE-2012-2122 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. It includes one version update. Description: MySQL has been upgraded to version 5.0.96 to fix several vulnerabilities. Security Issue reference: * CVE-2012-2122 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2122 > * CVE-2012-0075 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0075 > * CVE-2012-0114 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0114 > * CVE-2012-0490 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0490 > * CVE-2012-0484 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0484 > * CVE-2012-0102 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0102 > * CVE-2012-0101 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0101 > * CVE-2012-0087 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0087 > * CVE-2009-5026 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5026 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp1-libmysqlclient-devel-6613 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-libmysqlclient-devel-6613 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp1-libmysqlclient-devel-6613 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-libmysqlclient-devel-6613 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-libmysqlclient-devel-6613 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp1-libmysqlclient-devel-6613 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-libmysqlclient-devel-6613 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient-devel-5.0.96-0.4.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient_r15-32bit-5.0.96-0.4.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (ia64) [New Version: 5.0.96]: libmysqlclient_r15-x86-5.0.96-0.4.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient-devel-5.0.96-0.4.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient_r15-32bit-5.0.96-0.4.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ia64) [New Version: 5.0.96]: libmysqlclient_r15-x86-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.4.1 libmysqlclient_r15-5.0.96-0.4.1 mysql-5.0.96-0.4.1 mysql-Max-5.0.96-0.4.1 mysql-client-5.0.96-0.4.1 mysql-tools-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 5.0.96]: libmysqlclient15-x86-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.4.1 libmysqlclient_r15-5.0.96-0.4.1 mysql-5.0.96-0.4.1 mysql-Max-5.0.96-0.4.1 mysql-client-5.0.96-0.4.1 mysql-tools-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.4.1 libmysqlclient_r15-5.0.96-0.4.1 mysql-5.0.96-0.4.1 mysql-Max-5.0.96-0.4.1 mysql-client-5.0.96-0.4.1 mysql-tools-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.4.1 - SUSE Linux Enterprise Server 11 SP1 (ia64) [New Version: 5.0.96]: libmysqlclient15-x86-5.0.96-0.4.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.4.1 libmysqlclient_r15-5.0.96-0.4.1 mysql-5.0.96-0.4.1 mysql-client-5.0.96-0.4.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.4.1 libmysqlclient_r15-32bit-5.0.96-0.4.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 5.0.96]: libmysqlclient15-5.0.96-0.4.1 libmysqlclient_r15-5.0.96-0.4.1 mysql-5.0.96-0.4.1 mysql-client-5.0.96-0.4.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64) [New Version: 5.0.96]: libmysqlclient15-32bit-5.0.96-0.4.1 libmysqlclient_r15-32bit-5.0.96-0.4.1 References: http://support.novell.com/security/cve/CVE-2012-2122.html https://bugzilla.novell.com/765092 https://bugzilla.novell.com/769062 http://download.novell.com/patch/finder/?keywords=35c5a59a35da626d86071585e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0983-1: important: Security update for puppet
by opensuse-security＠opensuse.org 13 Aug '12

13 Aug '12

SUSE Security Update: Security update for puppet ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0983-1 Rating: important References: #770828 #770829 #770833 Cross-References: CVE-2012-3864 CVE-2012-3865 CVE-2012-3867 Affected Products: SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes one version update. Description: The following bugs have been fixed in puppet: * bnc#770828, CVE-2012-3864: puppet: authenticated clients can read arbitrary files via a flaw in puppet master * bnc#770829, CVE-2012-3865: puppet: arbitrary file delete / Denial of Service on Puppet Master by authenticated clients * bnc#770833, CVE-2012-3867: puppet: insufficient input validation for agent certificate names Security Issue references: * CVE-2012-3867 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3867 > * CVE-2012-3864 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3864 > * CVE-2012-3865 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3865 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp1-puppet-6561 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-puppet-6561 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-puppet-6561 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp1-puppet-6561 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-puppet-6561 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.6.17]: puppet-2.6.17-0.3.1 puppet-server-2.6.17-0.3.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 2.6.17]: puppet-2.6.17-0.3.1 puppet-server-2.6.17-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.6.17]: puppet-2.6.17-0.3.1 puppet-server-2.6.17-0.3.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 2.6.17]: puppet-2.6.17-0.3.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 2.6.17]: puppet-2.6.17-0.3.1 References: http://support.novell.com/security/cve/CVE-2012-3864.html http://support.novell.com/security/cve/CVE-2012-3865.html http://support.novell.com/security/cve/CVE-2012-3867.html https://bugzilla.novell.com/770828 https://bugzilla.novell.com/770829 https://bugzilla.novell.com/770833 http://download.novell.com/patch/finder/?keywords=546d90cdf89ec25e98329eee8… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0982-1: important: update for icedtea-web
by opensuse-security＠opensuse.org 13 Aug '12

13 Aug '12

openSUSE Security Update: update for icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0982-1 Rating: important References: #773458 Cross-References: CVE-2012-3422 CVE-2012-3423 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of icedtea-web fixed multiple hewap buffer overflows. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-513 - openSUSE 11.4: zypper in -t patch openSUSE-2012-513 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): icedtea-web-1.2.1-10.1 icedtea-web-debuginfo-1.2.1-10.1 icedtea-web-debugsource-1.2.1-10.1 - openSUSE 12.1 (noarch): icedtea-web-javadoc-1.2.1-10.1 - openSUSE 11.4 (i586 x86_64): icedtea-web-1.2.1-0.17.1 icedtea-web-debuginfo-1.2.1-0.17.1 icedtea-web-debugsource-1.2.1-0.17.1 - openSUSE 11.4 (noarch): icedtea-web-javadoc-1.2.1-0.17.1 References: http://support.novell.com/security/cve/CVE-2012-3422.html http://support.novell.com/security/cve/CVE-2012-3423.html https://bugzilla.novell.com/773458 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0981-1: important: icedtea-web: Update to 1.2.1 (bnc#)
by opensuse-security＠opensuse.org 10 Aug '12

10 Aug '12

openSUSE Security Update: icedtea-web: Update to 1.2.1 (bnc#) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0981-1 Rating: important References: #773458 Cross-References: CVE-2012-3422 CVE-2012-3423 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: - update to 1.2.1 (bnc#773458) - Security Updates * CVE-2012-3422, RH840592: Potential read from an uninitialized memory location * CVE-2012-3423, RH841345: Incorrect handling of not 0-terminated strings - NetX * PR898: signed applications with big jnlp-file doesn't start (webstart affect like "frozen") * PR811: javaws is not handling urls with spaces (and other characters needing encoding) correctly * 816592: icedtea-web not loading GeoGebra java applets in Firefox or Chrome - Plugin * PR863: Error passing strings to applet methods in Chromium * PR895: IcedTea-Web searches for missing classes on each loadClass or findClass * PR518: NPString.utf8characters not guaranteed to be nul-terminated - Common * RH838417: Disambiguate signed applet security prompt from certificate warning * RH838559: Disambiguate signed applet security prompt from certificate warning Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-512 - openSUSE 11.4: zypper in -t patch openSUSE-2012-512 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): icedtea-web-1.2.1-6.1 icedtea-web-debuginfo-1.2.1-6.1 icedtea-web-debugsource-1.2.1-6.1 - openSUSE 12.1 (noarch): icedtea-web-javadoc-1.2.1-6.1 - openSUSE 11.4 (i586 x86_64): icedtea-web-1.2.1-0.13.1 icedtea-web-debuginfo-1.2.1-0.13.1 icedtea-web-debugsource-1.2.1-0.13.1 - openSUSE 11.4 (noarch): icedtea-web-javadoc-1.2.1-0.13.1 References: http://support.novell.com/security/cve/CVE-2012-3422.html http://support.novell.com/security/cve/CVE-2012-3423.html https://bugzilla.novell.com/773458 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0979-1: important: Security update for icedtea-web
by opensuse-security＠opensuse.org 09 Aug '12

09 Aug '12

SUSE Security Update: Security update for icedtea-web ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0979-1 Rating: important References: #773458 Cross-References: CVE-2012-3422 CVE-2012-3423 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: The icedtea-web Java browser plugin was updated to 1.2.1 to fix security issues and bugs. * CVE-2012-3422: Potential read from a uninitialized memory location has been fixed. * CVE-2012-3423: Incorrect handling of not-0 terminated strings has been fixed. Security Issue references: * CVE-2012-3422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3422 > * CVE-2012-3423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3423 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-icedtea-web-6626 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-icedtea-web-6621 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 1.2.1]: icedtea-web-1.2.1-0.7.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 1.2.1]: icedtea-web-1.2.1-0.2.1 References: http://support.novell.com/security/cve/CVE-2012-3422.html http://support.novell.com/security/cve/CVE-2012-3423.html https://bugzilla.novell.com/773458 http://download.novell.com/patch/finder/?keywords=5f0430d04113f5d3e980b6c97… http://download.novell.com/patch/finder/?keywords=d6a8bcd6fbc566e30623b17ca… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0978-1: important: rubygem-actionpack/activerecord-2_3
by opensuse-security＠opensuse.org 09 Aug '12

09 Aug '12

openSUSE Security Update: rubygem-actionpack/activerecord-2_3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0978-1 Rating: important References: #765097 #766792 Cross-References: CVE-2012-2660 CVE-2012-2694 CVE-2012-2695 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: 3 Security issues were fixed in rails 2.3 core components. 2 NULL query issues where fixed in the actionpack gem. 1 SQL injection was fixed in the activerecord gem. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-508 - openSUSE 11.4: zypper in -t patch openSUSE-2012-508 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): rubygem-actionpack-2_3-2.3.14-3.8.1 rubygem-actionpack-2_3-doc-2.3.14-3.8.1 rubygem-actionpack-2_3-testsuite-2.3.14-3.8.1 rubygem-activerecord-2_3-2.3.14-3.8.1 rubygem-activerecord-2_3-doc-2.3.14-3.8.1 rubygem-activerecord-2_3-testsuite-2.3.14-3.8.1 - openSUSE 11.4 (i586 x86_64): rubygem-actionpack-2_3-2.3.14-0.16.1 rubygem-actionpack-2_3-doc-2.3.14-0.16.1 rubygem-actionpack-2_3-testsuite-2.3.14-0.16.1 rubygem-activerecord-2_3-2.3.14-0.16.1 rubygem-activerecord-2_3-doc-2.3.14-0.16.1 rubygem-activerecord-2_3-testsuite-2.3.14-0.16.1 References: http://support.novell.com/security/cve/CVE-2012-2660.html http://support.novell.com/security/cve/CVE-2012-2694.html http://support.novell.com/security/cve/CVE-2012-2695.html https://bugzilla.novell.com/765097 https://bugzilla.novell.com/766792 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0958-1: important: Security update for auditlog-keeper
by opensuse-security＠opensuse.org 06 Aug '12

06 Aug '12

SUSE Security Update: Security update for auditlog-keeper ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0958-1 Rating: important References: #771335 Cross-References: CVE-2012-0421 Affected Products: SUSE Manager 1.2 for SLE 11 SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: auditlog-keeper was updated to fix the following issue: * /etc/auditlog-keeper.conf was world-readable and contains various passwords. (CVE-2012-0421) Security Issue reference: * CVE-2012-0421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0421 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.2 for SLE 11 SP1: zypper in -t patch sleman12sp1-auditlog-keeper-6603 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.2 for SLE 11 SP1 (noarch) [New Version: 0.2.1]: auditlog-keeper-0.2.1-0.4.6.1 References: http://support.novell.com/security/cve/CVE-2012-0421.html https://bugzilla.novell.com/771335 http://download.novell.com/patch/finder/?keywords=286a6089e03a2dc757e711cf4… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0935-1: important: seamonkey: Update to Seamonkey 2.11
by opensuse-security＠opensuse.org 01 Aug '12

01 Aug '12

openSUSE Security Update: seamonkey: Update to Seamonkey 2.11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0935-1 Rating: important References: #771583 Cross-References: CVE-2012-1948 CVE-2012-1949 CVE-2012-1951 CVE-2012-1952 CVE-2012-1953 CVE-2012-1954 CVE-2012-1955 CVE-2012-1957 CVE-2012-1958 CVE-2012-1959 CVE-2012-1960 CVE-2012-1961 CVE-2012-1962 CVE-2012-1963 CVE-2012-1967 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: Seamonkey was updated to version 2.11 (bnc#771583) * MFSA 2012-42/CVE-2012-1949/CVE-2012-1948 Miscellaneous memory safety hazards * MFSA 2012-44/CVE-2012-1951/CVE-2012-1954/CVE-2012-1953/CVE-2012-1 952 Gecko memory corruption * MFSA 2012-45/CVE-2012-1955 (bmo#757376) Spoofing issue with location * MFSA 2012-47/CVE-2012-1957 (bmo#750096) Improper filtering of javascript in HTML feed-view * MFSA 2012-48/CVE-2012-1958 (bmo#750820) use-after-free in nsGlobalWindow::PageHidden * MFSA 2012-49/CVE-2012-1959 (bmo#754044, bmo#737559) Same-compartment Security Wrappers can be bypassed * MFSA 2012-50/CVE-2012-1960 (bmo#761014) Out of bounds read in QCMS * MFSA 2012-51/CVE-2012-1961 (bmo#761655) X-Frame-Options header ignored when duplicated * MFSA 2012-52/CVE-2012-1962 (bmo#764296) JSDependentString::undepend string conversion results in memory corruption * MFSA 2012-53/CVE-2012-1963 (bmo#767778) Content Security Policy 1.0 implementation errors cause data leakage * MFSA 2012-56/CVE-2012-1967 (bmo#758344) Code execution through javascript: URLs * relicensed to MPL-2.0 - updated/removed patches - requires NSS 3.13.5 - update to Seamonkey 2.10.1 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-473 - openSUSE 11.4: zypper in -t patch openSUSE-2012-473 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): seamonkey-2.11-2.24.2 seamonkey-debuginfo-2.11-2.24.2 seamonkey-debugsource-2.11-2.24.2 seamonkey-dom-inspector-2.11-2.24.2 seamonkey-irc-2.11-2.24.2 seamonkey-translations-common-2.11-2.24.2 seamonkey-translations-other-2.11-2.24.2 seamonkey-venkman-2.11-2.24.2 - openSUSE 11.4 (i586 x86_64): seamonkey-2.11-24.3 seamonkey-debuginfo-2.11-24.3 seamonkey-debugsource-2.11-24.3 seamonkey-dom-inspector-2.11-24.3 seamonkey-irc-2.11-24.3 seamonkey-translations-common-2.11-24.3 seamonkey-translations-other-2.11-24.3 seamonkey-venkman-2.11-24.3 References: http://support.novell.com/security/cve/CVE-2012-1948.html http://support.novell.com/security/cve/CVE-2012-1949.html http://support.novell.com/security/cve/CVE-2012-1951.html http://support.novell.com/security/cve/CVE-2012-1952.html http://support.novell.com/security/cve/CVE-2012-1953.html http://support.novell.com/security/cve/CVE-2012-1954.html http://support.novell.com/security/cve/CVE-2012-1955.html http://support.novell.com/security/cve/CVE-2012-1957.html http://support.novell.com/security/cve/CVE-2012-1958.html http://support.novell.com/security/cve/CVE-2012-1959.html http://support.novell.com/security/cve/CVE-2012-1960.html http://support.novell.com/security/cve/CVE-2012-1961.html http://support.novell.com/security/cve/CVE-2012-1962.html http://support.novell.com/security/cve/CVE-2012-1963.html http://support.novell.com/security/cve/CVE-2012-1967.html https://bugzilla.novell.com/771583 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0