March 2013 - openSUSE Security Announce

[security-announce] SUSE-SU-2013:0519-1: important: Security update for Samba
by opensuse-security＠opensuse.org 22 Mar '13

22 Mar '13

SUSE Security Update: Security update for Samba ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0519-1 Rating: important References: #499233 #741623 #755663 #759731 #764577 #783384 #799641 #800982 Cross-References: CVE-2013-0213 CVE-2013-0214 Affected Products: SUSE Linux Enterprise Server 10 GPLv3 Extras ______________________________________________________________________________ An update that solves two vulnerabilities and has 6 fixes is now available. Description: The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery; CVE-2013-0214; (bnc#799641). The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 could possibly be used in clickjacking attacks; CVE-2013-0213; (bnc#800982). Also the following bugs have been fixed: * Don't clutter the spec file diff view; (bnc#783384). * s3: Fix uninitialized memory read in talloc_free(); (bnc#764577). * Attempt to use samlogon validation level 6; (bso#7945); (bnc#741623). * Add PreReq /etc/init.d/nscd to the winbind package; (bnc#759731). * Recover from ncacn_ip_tcp ACCESS_DENIED/SEC_PKG_ERROR lsa errors; (bso#7944); (bnc#755663). * Fix lsa_LookupSids3 and lsa_LookupNames4 arguments. Security Issue references: * CVE-2013-0213 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0213 > * CVE-2013-0214 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0214 > Package List: - SUSE Linux Enterprise Server 10 GPLv3 Extras (i586 ia64 ppc s390x x86_64): libnetapi-devel-3.4.3-0.47.3 libnetapi0-3.4.3-0.47.3 libtalloc-devel-3.4.3-0.47.3 libtalloc1-3.4.3-0.47.3 libtdb-devel-3.4.3-0.47.3 libtdb1-3.4.3-0.47.3 libwbclient-devel-3.4.3-0.47.3 libwbclient0-3.4.3-0.47.3 samba-gplv3-3.4.3-0.47.3 samba-gplv3-client-3.4.3-0.47.3 samba-gplv3-krb-printing-3.4.3-0.47.3 samba-gplv3-winbind-3.4.3-0.47.3 - SUSE Linux Enterprise Server 10 GPLv3 Extras (noarch): samba-gplv3-doc-3.4.3-0.47.3 References: http://support.novell.com/security/cve/CVE-2013-0213.html http://support.novell.com/security/cve/CVE-2013-0214.html https://bugzilla.novell.com/499233 https://bugzilla.novell.com/741623 https://bugzilla.novell.com/755663 https://bugzilla.novell.com/759731 https://bugzilla.novell.com/764577 https://bugzilla.novell.com/783384 https://bugzilla.novell.com/799641 https://bugzilla.novell.com/800982 http://download.novell.com/patch/finder/?keywords=2420a6d522645b2b55c7b8e17… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0511-1: important: pidgin: 2.10.7 update to fix security issues and bugs
by opensuse-security＠opensuse.org 21 Mar '13

21 Mar '13

openSUSE Security Update: pidgin: 2.10.7 update to fix security issues and bugs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0511-1 Rating: important References: #804742 #806975 Cross-References: CVE-2013-0271 CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Pidgin was updated to 2.10.7 to fix various security issues and the bug that IRC did not work at all in 12.3. Changes: - Add pidgin-irc-sasl.patch: link irc module to SASL. Allows the IRC module to be loaded (bnc#806975). - Update to version 2.10.7 (bnc#804742): + Alien hatchery: - No changes + General: - The configure script will now exit with status 1 when specifying invalid protocol plugins using the --with-static-prpls and --with-dynamic-prpls arguments. (pidgin.im#15316) + libpurple: - Fix a crash when receiving UPnP responses with abnormally long values. (CVE-2013-0274) - Don't link directly to libgcrypt when building with GnuTLS support. (pidgin.im#15329) - Fix UPnP mappings on routers that return empty <URLBase/> elements in their response. (pidgin.im#15373) - Tcl plugin uses saner, race-free plugin loading. - Fix the Tcl signals-test plugin for savedstatus-changed. (pidgin.im#15443) + Pidgin: - Make Pidgin more friendly to non-X11 GTK+, such as MacPorts' +no_x11 variant. + Gadu-Gadu: - Fix a crash at startup with large contact list. Avatar support for buddies will be disabled until 3.0.0. (pidgin.im#15226, pidgin.im#14305) + IRC: - Support for SASL authentication. (pidgin.im#13270) - Print topic setter information at channel join. (pidgin.im#13317) + MSN: - Fix SSL certificate issue when signing into MSN for some users. - Fix a crash when removing a user before its icon is loaded. (pidgin.im#15217) + MXit: - Fix a bug where a remote MXit user could possibly specify a local file path to be written to. (CVE-2013-0271) - Fix a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution. (CVE-2013-0272) - Display farewell messages in a different colour to distinguish them from normal messages. - Add support for typing notification. - Add support for the Relationship Status profile attribute. - Remove all reference to Hidden Number. - Ignore new invites to join a GroupChat if you're already joined, or still have a pending invite. - The buddy's name was not centered vertically in the buddy-list if they did not have a status-message or mood set. - Fix decoding of font-size changes in the markup of received messages. - Increase the maximum file size that can be transferred to 1 MB. - When setting an avatar image, no longer downscale it to 96x96. + Sametime: - Fix a crash in Sametime when a malicious server sends us an abnormally long user ID. (CVE-2013-0273) + Yahoo!: - Fix a double-free in profile/picture loading code. (pidgin.im#15053) - Fix retrieving server-side buddy aliases. (pidgin.im#15381) + Plugins: - The Voice/Video Settings plugin supports using the sndio GStreamer backends. (pidgin.im#14414) - Fix a crash in the Contact Availability Detection plugin. (pidgin.im#15327) - Make the Message Notification plugin more friendly to non-X11 GTK+, such as MacPorts' +no_x11 variant. + Windows-Specific Changes: - Compile with secure flags (pidgin.im#15290) - Installer downloads GTK+ Runtime and Debug Symbols more securely. (pidgin.im#15277) - Updates to a number of dependencies, some of which have security related fixes. (pidgin.im#14571, pidgin.im#15285, pidgin.im#15286) . ATK 1.32.0-2 . Cyrus SASL 2.1.25 . expat 2.1.0-1 . freetype 2.4.10-1 . gettext 0.18.1.1-2 . Glib 2.28.8-1 . libpng 1.4.12-1 . libxml2 2.9.0-1 . NSS 3.13.6 and NSPR 4.9.2 . Pango 1.29.4-1 . SILC 1.1.10 . zlib 1.2.5-2 - Patch libmeanwhile (sametime library) to fix crash. (pidgin.im#12637) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-231 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): finch-2.10.7-4.4.1 finch-debuginfo-2.10.7-4.4.1 finch-devel-2.10.7-4.4.1 libpurple-2.10.7-4.4.1 libpurple-debuginfo-2.10.7-4.4.1 libpurple-devel-2.10.7-4.4.1 libpurple-meanwhile-2.10.7-4.4.1 libpurple-meanwhile-debuginfo-2.10.7-4.4.1 libpurple-tcl-2.10.7-4.4.1 libpurple-tcl-debuginfo-2.10.7-4.4.1 pidgin-2.10.7-4.4.1 pidgin-debuginfo-2.10.7-4.4.1 pidgin-debugsource-2.10.7-4.4.1 pidgin-devel-2.10.7-4.4.1 - openSUSE 12.3 (noarch): libpurple-branding-upstream-2.10.7-4.4.1 libpurple-lang-2.10.7-4.4.1 References: http://support.novell.com/security/cve/CVE-2013-0271.html http://support.novell.com/security/cve/CVE-2013-0272.html http://support.novell.com/security/cve/CVE-2013-0273.html http://support.novell.com/security/cve/CVE-2013-0274.html https://bugzilla.novell.com/804742 https://bugzilla.novell.com/806975 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0508-1: important: Security update for rubygem-merb-core
by opensuse-security＠opensuse.org 20 Mar '13

20 Mar '13

SUSE Security Update: Security update for rubygem-merb-core ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0508-1 Rating: important References: #805759 Cross-References: CVE-2012-2695 CVE-2012-5664 CVE-2012-6109 CVE-2013-0155 CVE-2013-0156 CVE-2013-0183 CVE-2013-0184 Affected Products: SUSE Cloud 1.0 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: rubygem-merb-core has been updated to change the rack version dependency. Now any rack 1.1 version is accepted. This update needs to be installed in parallel with the 2.3.17 rails update. Security Issue references: * CVE-2013-0184 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0184 > * CVE-2012-6109 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6109 > * CVE-2013-0183 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0183 > * CVE-2012-5664 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5664 > * CVE-2012-2695 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2695 > * CVE-2013-0155 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0155 > * CVE-2013-0156 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0156 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Cloud 1.0: zypper in -t patch sleclo10sp2-rubygem-merb-core-7405 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Cloud 1.0 (x86_64): rubygem-merb-core-1.1.3-0.9.1 References: http://support.novell.com/security/cve/CVE-2012-2695.html http://support.novell.com/security/cve/CVE-2012-5664.html http://support.novell.com/security/cve/CVE-2012-6109.html http://support.novell.com/security/cve/CVE-2013-0155.html http://support.novell.com/security/cve/CVE-2013-0156.html http://support.novell.com/security/cve/CVE-2013-0183.html http://support.novell.com/security/cve/CVE-2013-0184.html https://bugzilla.novell.com/805759 http://download.novell.com/patch/finder/?keywords=fe3baf16da4284805596caf98… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0504-1: important: firebird: fix for remote stack overflow
by opensuse-security＠opensuse.org 20 Mar '13

20 Mar '13

openSUSE Security Update: firebird: fix for remote stack overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0504-1 Rating: important References: #808268 Cross-References: CVE-2013-2492 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a bug which allows an unauthenticated remote attacker to cause a stack overflow in server code, resulting in either server crash or even code execution as the user running firebird. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-43 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): firebird-2.1.3.18185.0-16.1 firebird-classic-2.1.3.18185.0-16.1 firebird-classic-debuginfo-2.1.3.18185.0-16.1 firebird-debuginfo-2.1.3.18185.0-16.1 firebird-debugsource-2.1.3.18185.0-16.1 firebird-devel-2.1.3.18185.0-16.1 firebird-devel-debuginfo-2.1.3.18185.0-16.1 firebird-doc-2.1.3.18185.0-16.1 firebird-filesystem-2.1.3.18185.0-16.1 firebird-superserver-2.1.3.18185.0-16.1 firebird-superserver-debuginfo-2.1.3.18185.0-16.1 libfbclient2-2.1.3.18185.0-16.1 libfbclient2-debuginfo-2.1.3.18185.0-16.1 libfbembed2-2.1.3.18185.0-16.1 libfbembed2-debuginfo-2.1.3.18185.0-16.1 References: http://support.novell.com/security/cve/CVE-2013-2492.html https://bugzilla.novell.com/808268 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0502-1: important: update for perl
by opensuse-security＠opensuse.org 20 Mar '13

20 Mar '13

openSUSE Security Update: update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0502-1 Rating: important References: #789994 #797060 #804415 Cross-References: CVE-2012-5526 CVE-2012-6329 CVE-2013-1667 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Perl was updated to fix 3 security issues: - fix rehash denial of service (compute time) [bnc#804415] [CVE-2013-1667] - improve CGI crlf escaping [bnc#789994] [CVE-2012-5526] - sanitize input in Maketext.pm to avoid code injection [bnc#797060] [CVE-2012-6329] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-46 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): perl-5.12.3-11.36.1 perl-base-5.12.3-11.36.1 perl-base-debuginfo-5.12.3-11.36.1 perl-debuginfo-5.12.3-11.36.1 perl-debugsource-5.12.3-11.36.1 - openSUSE 11.4 (x86_64): perl-32bit-5.12.3-11.36.1 perl-base-32bit-5.12.3-11.36.1 perl-base-debuginfo-32bit-5.12.3-11.36.1 perl-debuginfo-32bit-5.12.3-11.36.1 - openSUSE 11.4 (noarch): perl-doc-5.12.3-11.36.1 - openSUSE 11.4 (ia64): perl-base-debuginfo-x86-5.12.3-11.36.1 perl-base-x86-5.12.3-11.36.1 perl-debuginfo-x86-5.12.3-11.36.1 perl-x86-5.12.3-11.36.1 References: http://support.novell.com/security/cve/CVE-2012-5526.html http://support.novell.com/security/cve/CVE-2012-6329.html http://support.novell.com/security/cve/CVE-2013-1667.html https://bugzilla.novell.com/789994 https://bugzilla.novell.com/797060 https://bugzilla.novell.com/804415 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0497-1: important: update for perl
by opensuse-security＠opensuse.org 20 Mar '13

20 Mar '13

openSUSE Security Update: update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0497-1 Rating: important References: #755278 #789994 #797060 #804415 Cross-References: CVE-2012-5526 CVE-2012-6329 CVE-2013-1667 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: Perl was updated to fix 3 security issues: - fix rehash denial of service (compute time) [bnc#804415] [CVE-2013-1667] - improve CGI crlf escaping [bnc#789994] [CVE-2012-5526] - sanitize input in Maketext.pm to avoid code injection [bnc#797060] [CVE-2012-6329] In openSUSE 12.1 also the following non-security bug was fixed: - fix IPC::Open3 bug when '-' is used [bnc#755278] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-225 - openSUSE 12.2: zypper in -t patch openSUSE-2013-225 - openSUSE 12.1: zypper in -t patch openSUSE-2013-225 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): perl-5.16.2-2.5.1 perl-base-5.16.2-2.5.1 perl-base-debuginfo-5.16.2-2.5.1 perl-debuginfo-5.16.2-2.5.1 perl-debugsource-5.16.2-2.5.1 - openSUSE 12.3 (x86_64): perl-32bit-5.16.2-2.5.1 perl-base-32bit-5.16.2-2.5.1 perl-base-debuginfo-32bit-5.16.2-2.5.1 perl-debuginfo-32bit-5.16.2-2.5.1 - openSUSE 12.3 (noarch): perl-doc-5.16.2-2.5.1 - openSUSE 12.2 (i586 x86_64): perl-5.16.0-3.5.1 perl-base-5.16.0-3.5.1 perl-base-debuginfo-5.16.0-3.5.1 perl-debuginfo-5.16.0-3.5.1 perl-debugsource-5.16.0-3.5.1 - openSUSE 12.2 (x86_64): perl-32bit-5.16.0-3.5.1 perl-base-32bit-5.16.0-3.5.1 perl-base-debuginfo-32bit-5.16.0-3.5.1 perl-debuginfo-32bit-5.16.0-3.5.1 - openSUSE 12.2 (noarch): perl-doc-5.16.0-3.5.1 - openSUSE 12.1 (i586 x86_64): perl-5.14.2-9.1 perl-base-5.14.2-9.1 perl-base-debuginfo-5.14.2-9.1 perl-debuginfo-5.14.2-9.1 perl-debugsource-5.14.2-9.1 - openSUSE 12.1 (x86_64): perl-32bit-5.14.2-9.1 perl-base-32bit-5.14.2-9.1 perl-base-debuginfo-32bit-5.14.2-9.1 perl-debuginfo-32bit-5.14.2-9.1 - openSUSE 12.1 (noarch): perl-doc-5.14.2-9.1 - openSUSE 12.1 (ia64): perl-base-debuginfo-x86-5.14.2-9.1 perl-base-x86-5.14.2-9.1 perl-debuginfo-x86-5.14.2-9.1 perl-x86-5.14.2-9.1 References: http://support.novell.com/security/cve/CVE-2012-5526.html http://support.novell.com/security/cve/CVE-2012-6329.html http://support.novell.com/security/cve/CVE-2013-1667.html https://bugzilla.novell.com/755278 https://bugzilla.novell.com/789994 https://bugzilla.novell.com/797060 https://bugzilla.novell.com/804415 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0496-1: important: fix for remote stack overflow
by opensuse-security＠opensuse.org 20 Mar '13

20 Mar '13

openSUSE Security Update: fix for remote stack overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0496-1 Rating: important References: #808268 Cross-References: CVE-2013-2492 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a bug which allows an unauthenticated remote attacker to cause a stack overflow in server code, resulting in either server crash or even code execution as the user running firebird. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-222 - openSUSE 12.2: zypper in -t patch openSUSE-2013-222 - openSUSE 12.1: zypper in -t patch openSUSE-2013-222 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): firebird-2.5.2.26539-2.5.1 firebird-classic-2.5.2.26539-2.5.1 firebird-classic-debuginfo-2.5.2.26539-2.5.1 firebird-classic-debugsource-2.5.2.26539-2.5.1 firebird-debuginfo-2.5.2.26539-2.5.1 firebird-debugsource-2.5.2.26539-2.5.1 firebird-devel-2.5.2.26539-2.5.1 firebird-superserver-2.5.2.26539-2.5.1 firebird-superserver-debuginfo-2.5.2.26539-2.5.1 libfbclient2-2.5.2.26539-2.5.1 libfbclient2-debuginfo-2.5.2.26539-2.5.1 libfbclient2-devel-2.5.2.26539-2.5.1 libfbembed-devel-2.5.2.26539-2.5.1 libfbembed2_5-2.5.2.26539-2.5.1 libfbembed2_5-debuginfo-2.5.2.26539-2.5.1 - openSUSE 12.3 (x86_64): firebird-32bit-2.5.2.26539-2.5.1 firebird-debuginfo-32bit-2.5.2.26539-2.5.1 libfbclient2-32bit-2.5.2.26539-2.5.1 libfbclient2-debuginfo-32bit-2.5.2.26539-2.5.1 - openSUSE 12.3 (noarch): firebird-doc-2.5.2.26539-2.5.1 - openSUSE 12.2 (i586 x86_64): firebird-2.5.2.26539-2.8.1 firebird-classic-2.5.2.26539-2.8.1 firebird-classic-debuginfo-2.5.2.26539-2.8.1 firebird-classic-debugsource-2.5.2.26539-2.8.1 firebird-debuginfo-2.5.2.26539-2.8.1 firebird-debugsource-2.5.2.26539-2.8.1 firebird-devel-2.5.2.26539-2.8.1 firebird-superserver-2.5.2.26539-2.8.1 firebird-superserver-debuginfo-2.5.2.26539-2.8.1 libfbclient2-2.5.2.26539-2.8.1 libfbclient2-debuginfo-2.5.2.26539-2.8.1 libfbclient2-devel-2.5.2.26539-2.8.1 libfbembed-devel-2.5.2.26539-2.8.1 libfbembed2_5-2.5.2.26539-2.8.1 libfbembed2_5-debuginfo-2.5.2.26539-2.8.1 - openSUSE 12.2 (x86_64): firebird-32bit-2.5.2.26539-2.8.1 firebird-debuginfo-32bit-2.5.2.26539-2.8.1 libfbclient2-32bit-2.5.2.26539-2.8.1 libfbclient2-debuginfo-32bit-2.5.2.26539-2.8.1 - openSUSE 12.2 (noarch): firebird-doc-2.5.2.26539-2.8.1 - openSUSE 12.1 (i586 x86_64): firebird-2.1.3.18185.0-22.4.1 firebird-classic-2.1.3.18185.0-22.4.1 firebird-classic-debuginfo-2.1.3.18185.0-22.4.1 firebird-debuginfo-2.1.3.18185.0-22.4.1 firebird-debugsource-2.1.3.18185.0-22.4.1 firebird-devel-2.1.3.18185.0-22.4.1 firebird-devel-debuginfo-2.1.3.18185.0-22.4.1 firebird-doc-2.1.3.18185.0-22.4.1 firebird-filesystem-2.1.3.18185.0-22.4.1 firebird-superserver-2.1.3.18185.0-22.4.1 firebird-superserver-debuginfo-2.1.3.18185.0-22.4.1 libfbclient2-2.1.3.18185.0-22.4.1 libfbclient2-debuginfo-2.1.3.18185.0-22.4.1 libfbembed2-2.1.3.18185.0-22.4.1 libfbembed2-debuginfo-2.1.3.18185.0-22.4.1 - openSUSE 12.1 (x86_64): libfbclient2-32bit-2.1.3.18185.0-22.4.1 libfbclient2-debuginfo-32bit-2.1.3.18185.0-22.4.1 libfbembed2-32bit-2.1.3.18185.0-22.4.1 libfbembed2-debuginfo-32bit-2.1.3.18185.0-22.4.1 - openSUSE 12.1 (ia64): libfbclient2-debuginfo-x86-2.1.3.18185.0-22.4.1 libfbclient2-x86-2.1.3.18185.0-22.4.1 libfbembed2-debuginfo-x86-2.1.3.18185.0-22.4.1 libfbembed2-x86-2.1.3.18185.0-22.4.1 References: http://support.novell.com/security/cve/CVE-2013-2492.html https://bugzilla.novell.com/808268 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0486-1: important: Security update for Ruby On Rails
by opensuse-security＠opensuse.org 19 Mar '13

19 Mar '13

SUSE Security Update: Security update for Ruby On Rails ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0486-1 Rating: important References: #796712 #797449 #797452 #800320 #803336 #803339 Cross-References: CVE-2012-5664 CVE-2013-0155 CVE-2013-0156 CVE-2013-0276 CVE-2013-0277 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Cloud 1.0 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. It includes one version update. Description: The Ruby on Rails stack has been updated to 2.3.17 to fix various security issues and bugs. The rails gems have been updated to fix: * Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0155) * Multiple vulnerabilities in parameter parsing in Action Pack (CVE-2013-0156) * activerecord: SQL Injection (CVE-2012-5664) * rails: Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 (CVE-2013-0333) * activerecord: Circumvention of attr_protected (CVE-2013-0276) * activerecord: Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0 (CVE-2013-0277) Security Issue references: * CVE-2012-5664 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5664 > * CVE-2013-0155 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0155 > * CVE-2013-0156 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0156 > * CVE-2013-0277 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0277 > * CVE-2013-0276 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0276 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-rubygem-actionmailer-2_3-7363 - SUSE Cloud 1.0: zypper in -t patch sleclo10sp2-rubygem-actionmailer-2_3-7363 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.17]: rubygem-actionmailer-2_3-2.3.17-0.9.1 rubygem-actionpack-2_3-2.3.17-0.9.1 rubygem-activerecord-2_3-2.3.17-0.9.1 rubygem-activeresource-2_3-2.3.17-0.9.1 rubygem-activesupport-2_3-2.3.17-0.9.1 rubygem-rails-2_3-2.3.17-0.9.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (noarch) [New Version: 2.3.17]: rubygem-rails-2.3.17-0.8.1 - SUSE Cloud 1.0 (x86_64) [New Version: 2.3.17]: rubygem-actionmailer-2_3-2.3.17-0.9.1 rubygem-actionpack-2_3-2.3.17-0.9.1 rubygem-activerecord-2_3-2.3.17-0.9.1 rubygem-activeresource-2_3-2.3.17-0.9.1 rubygem-activesupport-2_3-2.3.17-0.9.1 rubygem-rails-2_3-2.3.17-0.9.1 References: http://support.novell.com/security/cve/CVE-2012-5664.html http://support.novell.com/security/cve/CVE-2013-0155.html http://support.novell.com/security/cve/CVE-2013-0156.html http://support.novell.com/security/cve/CVE-2013-0276.html http://support.novell.com/security/cve/CVE-2013-0277.html https://bugzilla.novell.com/796712 https://bugzilla.novell.com/797449 https://bugzilla.novell.com/797452 https://bugzilla.novell.com/800320 https://bugzilla.novell.com/803336 https://bugzilla.novell.com/803339 http://download.novell.com/patch/finder/?keywords=262e345a7ecb482ffca687eed… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0478-1: important: Security update for IBM Java2 JRE and SDK
by opensuse-security＠opensuse.org 18 Mar '13

18 Mar '13

SUSE Security Update: Security update for IBM Java2 JRE and SDK ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0478-1 Rating: important References: #438695 #603353 #798535 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.4.2 has been updated to SR13-FP15 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1478, CVE-2013-1480, CVE-2013-1476, CVE-2013-0442, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-1481, CVE-2013-0432, CVE-2013-0434, CVE-2013-0424, CVE-2013-0440, CVE-2013-0443. Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): IBMJava2-JRE-1.4.2_sr13.15-0.4 IBMJava2-SDK-1.4.2_sr13.15-0.4 References: https://bugzilla.novell.com/438695 https://bugzilla.novell.com/603353 https://bugzilla.novell.com/798535 http://download.novell.com/patch/finder/?keywords=514bd0c17c6dce42bd680235a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0440-6: important: Security update for Java
by opensuse-security＠opensuse.org 18 Mar '13

18 Mar '13

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0440-6 Rating: important References: #798535 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 5 has been updated to SR16 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1486, CVE-2013-1478, CVE-2013-0445, CVE-2013-1480, CVE-2013-1476, CVE-2013-0442, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-1481, CVE-2013-0432, CVE-2013-0434, CVE-2013-0409, CVE-2013-0427, CVE-2013-0433, CVE-2013-0424, CVE-2013-0440, CVE-2013-0443. Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): java-1_5_0-ibm-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-devel-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-fonts-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): java-1_5_0-ibm-32bit-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (x86_64): java-1_5_0-ibm-alsa-32bit-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586): java-1_5_0-ibm-alsa-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-jdbc-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-plugin-1.5.0_sr16.0-0.6.1 References: https://bugzilla.novell.com/798535 http://download.novell.com/patch/finder/?keywords=5ea58c1fb829cad73b10e1234… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0