March 2013 - openSUSE Security Announce

[security-announce] SUSE-SU-2013:0519-1: important: Security update for Samba
by opensuse-security＠opensuse.org 22 Mar '13

22 Mar '13

SUSE Security Update: Security update for Samba ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0519-1 Rating: important References: #499233 #741623 #755663 #759731 #764577 #783384 #799641 #800982 Cross-References: CVE-2013-0213 CVE-2013-0214 Affected Products: SUSE Linux Enterprise Server 10 GPLv3 Extras ______________________________________________________________________________ An update that solves two vulnerabilities and has 6 fixes is now available. Description: The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery; CVE-2013-0214; (bnc#799641). The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 could possibly be used in clickjacking attacks; CVE-2013-0213; (bnc#800982). Also the following bugs have been fixed: * Don't clutter the spec file diff view; (bnc#783384). * s3: Fix uninitialized memory read in talloc_free(); (bnc#764577). * Attempt to use samlogon validation level 6; (bso#7945); (bnc#741623). * Add PreReq /etc/init.d/nscd to the winbind package; (bnc#759731). * Recover from ncacn_ip_tcp ACCESS_DENIED/SEC_PKG_ERROR lsa errors; (bso#7944); (bnc#755663). * Fix lsa_LookupSids3 and lsa_LookupNames4 arguments. Security Issue references: * CVE-2013-0213 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0213 > * CVE-2013-0214 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0214 > Package List: - SUSE Linux Enterprise Server 10 GPLv3 Extras (i586 ia64 ppc s390x x86_64): libnetapi-devel-3.4.3-0.47.3 libnetapi0-3.4.3-0.47.3 libtalloc-devel-3.4.3-0.47.3 libtalloc1-3.4.3-0.47.3 libtdb-devel-3.4.3-0.47.3 libtdb1-3.4.3-0.47.3 libwbclient-devel-3.4.3-0.47.3 libwbclient0-3.4.3-0.47.3 samba-gplv3-3.4.3-0.47.3 samba-gplv3-client-3.4.3-0.47.3 samba-gplv3-krb-printing-3.4.3-0.47.3 samba-gplv3-winbind-3.4.3-0.47.3 - SUSE Linux Enterprise Server 10 GPLv3 Extras (noarch): samba-gplv3-doc-3.4.3-0.47.3 References: http://support.novell.com/security/cve/CVE-2013-0213.html http://support.novell.com/security/cve/CVE-2013-0214.html https://bugzilla.novell.com/499233 https://bugzilla.novell.com/741623 https://bugzilla.novell.com/755663 https://bugzilla.novell.com/759731 https://bugzilla.novell.com/764577 https://bugzilla.novell.com/783384 https://bugzilla.novell.com/799641 https://bugzilla.novell.com/800982 http://download.novell.com/patch/finder/?keywords=2420a6d522645b2b55c7b8e17… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0511-1: important: pidgin: 2.10.7 update to fix security issues and bugs
by opensuse-security＠opensuse.org 21 Mar '13

21 Mar '13

openSUSE Security Update: pidgin: 2.10.7 update to fix security issues and bugs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0511-1 Rating: important References: #804742 #806975 Cross-References: CVE-2013-0271 CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Pidgin was updated to 2.10.7 to fix various security issues and the bug that IRC did not work at all in 12.3. Changes: - Add pidgin-irc-sasl.patch: link irc module to SASL. Allows the IRC module to be loaded (bnc#806975). - Update to version 2.10.7 (bnc#804742): + Alien hatchery: - No changes + General: - The configure script will now exit with status 1 when specifying invalid protocol plugins using the --with-static-prpls and --with-dynamic-prpls arguments. (pidgin.im#15316) + libpurple: - Fix a crash when receiving UPnP responses with abnormally long values. (CVE-2013-0274) - Don't link directly to libgcrypt when building with GnuTLS support. (pidgin.im#15329) - Fix UPnP mappings on routers that return empty <URLBase/> elements in their response. (pidgin.im#15373) - Tcl plugin uses saner, race-free plugin loading. - Fix the Tcl signals-test plugin for savedstatus-changed. (pidgin.im#15443) + Pidgin: - Make Pidgin more friendly to non-X11 GTK+, such as MacPorts' +no_x11 variant. + Gadu-Gadu: - Fix a crash at startup with large contact list. Avatar support for buddies will be disabled until 3.0.0. (pidgin.im#15226, pidgin.im#14305) + IRC: - Support for SASL authentication. (pidgin.im#13270) - Print topic setter information at channel join. (pidgin.im#13317) + MSN: - Fix SSL certificate issue when signing into MSN for some users. - Fix a crash when removing a user before its icon is loaded. (pidgin.im#15217) + MXit: - Fix a bug where a remote MXit user could possibly specify a local file path to be written to. (CVE-2013-0271) - Fix a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution. (CVE-2013-0272) - Display farewell messages in a different colour to distinguish them from normal messages. - Add support for typing notification. - Add support for the Relationship Status profile attribute. - Remove all reference to Hidden Number. - Ignore new invites to join a GroupChat if you're already joined, or still have a pending invite. - The buddy's name was not centered vertically in the buddy-list if they did not have a status-message or mood set. - Fix decoding of font-size changes in the markup of received messages. - Increase the maximum file size that can be transferred to 1 MB. - When setting an avatar image, no longer downscale it to 96x96. + Sametime: - Fix a crash in Sametime when a malicious server sends us an abnormally long user ID. (CVE-2013-0273) + Yahoo!: - Fix a double-free in profile/picture loading code. (pidgin.im#15053) - Fix retrieving server-side buddy aliases. (pidgin.im#15381) + Plugins: - The Voice/Video Settings plugin supports using the sndio GStreamer backends. (pidgin.im#14414) - Fix a crash in the Contact Availability Detection plugin. (pidgin.im#15327) - Make the Message Notification plugin more friendly to non-X11 GTK+, such as MacPorts' +no_x11 variant. + Windows-Specific Changes: - Compile with secure flags (pidgin.im#15290) - Installer downloads GTK+ Runtime and Debug Symbols more securely. (pidgin.im#15277) - Updates to a number of dependencies, some of which have security related fixes. (pidgin.im#14571, pidgin.im#15285, pidgin.im#15286) . ATK 1.32.0-2 . Cyrus SASL 2.1.25 . expat 2.1.0-1 . freetype 2.4.10-1 . gettext 0.18.1.1-2 . Glib 2.28.8-1 . libpng 1.4.12-1 . libxml2 2.9.0-1 . NSS 3.13.6 and NSPR 4.9.2 . Pango 1.29.4-1 . SILC 1.1.10 . zlib 1.2.5-2 - Patch libmeanwhile (sametime library) to fix crash. (pidgin.im#12637) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-231 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): finch-2.10.7-4.4.1 finch-debuginfo-2.10.7-4.4.1 finch-devel-2.10.7-4.4.1 libpurple-2.10.7-4.4.1 libpurple-debuginfo-2.10.7-4.4.1 libpurple-devel-2.10.7-4.4.1 libpurple-meanwhile-2.10.7-4.4.1 libpurple-meanwhile-debuginfo-2.10.7-4.4.1 libpurple-tcl-2.10.7-4.4.1 libpurple-tcl-debuginfo-2.10.7-4.4.1 pidgin-2.10.7-4.4.1 pidgin-debuginfo-2.10.7-4.4.1 pidgin-debugsource-2.10.7-4.4.1 pidgin-devel-2.10.7-4.4.1 - openSUSE 12.3 (noarch): libpurple-branding-upstream-2.10.7-4.4.1 libpurple-lang-2.10.7-4.4.1 References: http://support.novell.com/security/cve/CVE-2013-0271.html http://support.novell.com/security/cve/CVE-2013-0272.html http://support.novell.com/security/cve/CVE-2013-0273.html http://support.novell.com/security/cve/CVE-2013-0274.html https://bugzilla.novell.com/804742 https://bugzilla.novell.com/806975 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0508-1: important: Security update for rubygem-merb-core
by opensuse-security＠opensuse.org 20 Mar '13

20 Mar '13

SUSE Security Update: Security update for rubygem-merb-core ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0508-1 Rating: important References: #805759 Cross-References: CVE-2012-2695 CVE-2012-5664 CVE-2012-6109 CVE-2013-0155 CVE-2013-0156 CVE-2013-0183 CVE-2013-0184 Affected Products: SUSE Cloud 1.0 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: rubygem-merb-core has been updated to change the rack version dependency. Now any rack 1.1 version is accepted. This update needs to be installed in parallel with the 2.3.17 rails update. Security Issue references: * CVE-2013-0184 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0184 > * CVE-2012-6109 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6109 > * CVE-2013-0183 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0183 > * CVE-2012-5664 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5664 > * CVE-2012-2695 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2695 > * CVE-2013-0155 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0155 > * CVE-2013-0156 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0156 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Cloud 1.0: zypper in -t patch sleclo10sp2-rubygem-merb-core-7405 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Cloud 1.0 (x86_64): rubygem-merb-core-1.1.3-0.9.1 References: http://support.novell.com/security/cve/CVE-2012-2695.html http://support.novell.com/security/cve/CVE-2012-5664.html http://support.novell.com/security/cve/CVE-2012-6109.html http://support.novell.com/security/cve/CVE-2013-0155.html http://support.novell.com/security/cve/CVE-2013-0156.html http://support.novell.com/security/cve/CVE-2013-0183.html http://support.novell.com/security/cve/CVE-2013-0184.html https://bugzilla.novell.com/805759 http://download.novell.com/patch/finder/?keywords=fe3baf16da4284805596caf98… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0504-1: important: firebird: fix for remote stack overflow
by opensuse-security＠opensuse.org 20 Mar '13

20 Mar '13

openSUSE Security Update: firebird: fix for remote stack overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0504-1 Rating: important References: #808268 Cross-References: CVE-2013-2492 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a bug which allows an unauthenticated remote attacker to cause a stack overflow in server code, resulting in either server crash or even code execution as the user running firebird. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-43 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): firebird-2.1.3.18185.0-16.1 firebird-classic-2.1.3.18185.0-16.1 firebird-classic-debuginfo-2.1.3.18185.0-16.1 firebird-debuginfo-2.1.3.18185.0-16.1 firebird-debugsource-2.1.3.18185.0-16.1 firebird-devel-2.1.3.18185.0-16.1 firebird-devel-debuginfo-2.1.3.18185.0-16.1 firebird-doc-2.1.3.18185.0-16.1 firebird-filesystem-2.1.3.18185.0-16.1 firebird-superserver-2.1.3.18185.0-16.1 firebird-superserver-debuginfo-2.1.3.18185.0-16.1 libfbclient2-2.1.3.18185.0-16.1 libfbclient2-debuginfo-2.1.3.18185.0-16.1 libfbembed2-2.1.3.18185.0-16.1 libfbembed2-debuginfo-2.1.3.18185.0-16.1 References: http://support.novell.com/security/cve/CVE-2013-2492.html https://bugzilla.novell.com/808268 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0502-1: important: update for perl
by opensuse-security＠opensuse.org 20 Mar '13

20 Mar '13

openSUSE Security Update: update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0502-1 Rating: important References: #789994 #797060 #804415 Cross-References: CVE-2012-5526 CVE-2012-6329 CVE-2013-1667 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Perl was updated to fix 3 security issues: - fix rehash denial of service (compute time) [bnc#804415] [CVE-2013-1667] - improve CGI crlf escaping [bnc#789994] [CVE-2012-5526] - sanitize input in Maketext.pm to avoid code injection [bnc#797060] [CVE-2012-6329] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-46 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): perl-5.12.3-11.36.1 perl-base-5.12.3-11.36.1 perl-base-debuginfo-5.12.3-11.36.1 perl-debuginfo-5.12.3-11.36.1 perl-debugsource-5.12.3-11.36.1 - openSUSE 11.4 (x86_64): perl-32bit-5.12.3-11.36.1 perl-base-32bit-5.12.3-11.36.1 perl-base-debuginfo-32bit-5.12.3-11.36.1 perl-debuginfo-32bit-5.12.3-11.36.1 - openSUSE 11.4 (noarch): perl-doc-5.12.3-11.36.1 - openSUSE 11.4 (ia64): perl-base-debuginfo-x86-5.12.3-11.36.1 perl-base-x86-5.12.3-11.36.1 perl-debuginfo-x86-5.12.3-11.36.1 perl-x86-5.12.3-11.36.1 References: http://support.novell.com/security/cve/CVE-2012-5526.html http://support.novell.com/security/cve/CVE-2012-6329.html http://support.novell.com/security/cve/CVE-2013-1667.html https://bugzilla.novell.com/789994 https://bugzilla.novell.com/797060 https://bugzilla.novell.com/804415 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0497-1: important: update for perl
by opensuse-security＠opensuse.org 20 Mar '13

20 Mar '13

openSUSE Security Update: update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0497-1 Rating: important References: #755278 #789994 #797060 #804415 Cross-References: CVE-2012-5526 CVE-2012-6329 CVE-2013-1667 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: Perl was updated to fix 3 security issues: - fix rehash denial of service (compute time) [bnc#804415] [CVE-2013-1667] - improve CGI crlf escaping [bnc#789994] [CVE-2012-5526] - sanitize input in Maketext.pm to avoid code injection [bnc#797060] [CVE-2012-6329] In openSUSE 12.1 also the following non-security bug was fixed: - fix IPC::Open3 bug when '-' is used [bnc#755278] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-225 - openSUSE 12.2: zypper in -t patch openSUSE-2013-225 - openSUSE 12.1: zypper in -t patch openSUSE-2013-225 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): perl-5.16.2-2.5.1 perl-base-5.16.2-2.5.1 perl-base-debuginfo-5.16.2-2.5.1 perl-debuginfo-5.16.2-2.5.1 perl-debugsource-5.16.2-2.5.1 - openSUSE 12.3 (x86_64): perl-32bit-5.16.2-2.5.1 perl-base-32bit-5.16.2-2.5.1 perl-base-debuginfo-32bit-5.16.2-2.5.1 perl-debuginfo-32bit-5.16.2-2.5.1 - openSUSE 12.3 (noarch): perl-doc-5.16.2-2.5.1 - openSUSE 12.2 (i586 x86_64): perl-5.16.0-3.5.1 perl-base-5.16.0-3.5.1 perl-base-debuginfo-5.16.0-3.5.1 perl-debuginfo-5.16.0-3.5.1 perl-debugsource-5.16.0-3.5.1 - openSUSE 12.2 (x86_64): perl-32bit-5.16.0-3.5.1 perl-base-32bit-5.16.0-3.5.1 perl-base-debuginfo-32bit-5.16.0-3.5.1 perl-debuginfo-32bit-5.16.0-3.5.1 - openSUSE 12.2 (noarch): perl-doc-5.16.0-3.5.1 - openSUSE 12.1 (i586 x86_64): perl-5.14.2-9.1 perl-base-5.14.2-9.1 perl-base-debuginfo-5.14.2-9.1 perl-debuginfo-5.14.2-9.1 perl-debugsource-5.14.2-9.1 - openSUSE 12.1 (x86_64): perl-32bit-5.14.2-9.1 perl-base-32bit-5.14.2-9.1 perl-base-debuginfo-32bit-5.14.2-9.1 perl-debuginfo-32bit-5.14.2-9.1 - openSUSE 12.1 (noarch): perl-doc-5.14.2-9.1 - openSUSE 12.1 (ia64): perl-base-debuginfo-x86-5.14.2-9.1 perl-base-x86-5.14.2-9.1 perl-debuginfo-x86-5.14.2-9.1 perl-x86-5.14.2-9.1 References: http://support.novell.com/security/cve/CVE-2012-5526.html http://support.novell.com/security/cve/CVE-2012-6329.html http://support.novell.com/security/cve/CVE-2013-1667.html https://bugzilla.novell.com/755278 https://bugzilla.novell.com/789994 https://bugzilla.novell.com/797060 https://bugzilla.novell.com/804415 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0496-1: important: fix for remote stack overflow
by opensuse-security＠opensuse.org 20 Mar '13

20 Mar '13

openSUSE Security Update: fix for remote stack overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0496-1 Rating: important References: #808268 Cross-References: CVE-2013-2492 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a bug which allows an unauthenticated remote attacker to cause a stack overflow in server code, resulting in either server crash or even code execution as the user running firebird. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-222 - openSUSE 12.2: zypper in -t patch openSUSE-2013-222 - openSUSE 12.1: zypper in -t patch openSUSE-2013-222 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): firebird-2.5.2.26539-2.5.1 firebird-classic-2.5.2.26539-2.5.1 firebird-classic-debuginfo-2.5.2.26539-2.5.1 firebird-classic-debugsource-2.5.2.26539-2.5.1 firebird-debuginfo-2.5.2.26539-2.5.1 firebird-debugsource-2.5.2.26539-2.5.1 firebird-devel-2.5.2.26539-2.5.1 firebird-superserver-2.5.2.26539-2.5.1 firebird-superserver-debuginfo-2.5.2.26539-2.5.1 libfbclient2-2.5.2.26539-2.5.1 libfbclient2-debuginfo-2.5.2.26539-2.5.1 libfbclient2-devel-2.5.2.26539-2.5.1 libfbembed-devel-2.5.2.26539-2.5.1 libfbembed2_5-2.5.2.26539-2.5.1 libfbembed2_5-debuginfo-2.5.2.26539-2.5.1 - openSUSE 12.3 (x86_64): firebird-32bit-2.5.2.26539-2.5.1 firebird-debuginfo-32bit-2.5.2.26539-2.5.1 libfbclient2-32bit-2.5.2.26539-2.5.1 libfbclient2-debuginfo-32bit-2.5.2.26539-2.5.1 - openSUSE 12.3 (noarch): firebird-doc-2.5.2.26539-2.5.1 - openSUSE 12.2 (i586 x86_64): firebird-2.5.2.26539-2.8.1 firebird-classic-2.5.2.26539-2.8.1 firebird-classic-debuginfo-2.5.2.26539-2.8.1 firebird-classic-debugsource-2.5.2.26539-2.8.1 firebird-debuginfo-2.5.2.26539-2.8.1 firebird-debugsource-2.5.2.26539-2.8.1 firebird-devel-2.5.2.26539-2.8.1 firebird-superserver-2.5.2.26539-2.8.1 firebird-superserver-debuginfo-2.5.2.26539-2.8.1 libfbclient2-2.5.2.26539-2.8.1 libfbclient2-debuginfo-2.5.2.26539-2.8.1 libfbclient2-devel-2.5.2.26539-2.8.1 libfbembed-devel-2.5.2.26539-2.8.1 libfbembed2_5-2.5.2.26539-2.8.1 libfbembed2_5-debuginfo-2.5.2.26539-2.8.1 - openSUSE 12.2 (x86_64): firebird-32bit-2.5.2.26539-2.8.1 firebird-debuginfo-32bit-2.5.2.26539-2.8.1 libfbclient2-32bit-2.5.2.26539-2.8.1 libfbclient2-debuginfo-32bit-2.5.2.26539-2.8.1 - openSUSE 12.2 (noarch): firebird-doc-2.5.2.26539-2.8.1 - openSUSE 12.1 (i586 x86_64): firebird-2.1.3.18185.0-22.4.1 firebird-classic-2.1.3.18185.0-22.4.1 firebird-classic-debuginfo-2.1.3.18185.0-22.4.1 firebird-debuginfo-2.1.3.18185.0-22.4.1 firebird-debugsource-2.1.3.18185.0-22.4.1 firebird-devel-2.1.3.18185.0-22.4.1 firebird-devel-debuginfo-2.1.3.18185.0-22.4.1 firebird-doc-2.1.3.18185.0-22.4.1 firebird-filesystem-2.1.3.18185.0-22.4.1 firebird-superserver-2.1.3.18185.0-22.4.1 firebird-superserver-debuginfo-2.1.3.18185.0-22.4.1 libfbclient2-2.1.3.18185.0-22.4.1 libfbclient2-debuginfo-2.1.3.18185.0-22.4.1 libfbembed2-2.1.3.18185.0-22.4.1 libfbembed2-debuginfo-2.1.3.18185.0-22.4.1 - openSUSE 12.1 (x86_64): libfbclient2-32bit-2.1.3.18185.0-22.4.1 libfbclient2-debuginfo-32bit-2.1.3.18185.0-22.4.1 libfbembed2-32bit-2.1.3.18185.0-22.4.1 libfbembed2-debuginfo-32bit-2.1.3.18185.0-22.4.1 - openSUSE 12.1 (ia64): libfbclient2-debuginfo-x86-2.1.3.18185.0-22.4.1 libfbclient2-x86-2.1.3.18185.0-22.4.1 libfbembed2-debuginfo-x86-2.1.3.18185.0-22.4.1 libfbembed2-x86-2.1.3.18185.0-22.4.1 References: http://support.novell.com/security/cve/CVE-2013-2492.html https://bugzilla.novell.com/808268 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0486-1: important: Security update for Ruby On Rails
by opensuse-security＠opensuse.org 19 Mar '13

19 Mar '13

SUSE Security Update: Security update for Ruby On Rails ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0486-1 Rating: important References: #796712 #797449 #797452 #800320 #803336 #803339 Cross-References: CVE-2012-5664 CVE-2013-0155 CVE-2013-0156 CVE-2013-0276 CVE-2013-0277 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Cloud 1.0 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. It includes one version update. Description: The Ruby on Rails stack has been updated to 2.3.17 to fix various security issues and bugs. The rails gems have been updated to fix: * Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0155) * Multiple vulnerabilities in parameter parsing in Action Pack (CVE-2013-0156) * activerecord: SQL Injection (CVE-2012-5664) * rails: Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 (CVE-2013-0333) * activerecord: Circumvention of attr_protected (CVE-2013-0276) * activerecord: Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0 (CVE-2013-0277) Security Issue references: * CVE-2012-5664 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5664 > * CVE-2013-0155 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0155 > * CVE-2013-0156 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0156 > * CVE-2013-0277 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0277 > * CVE-2013-0276 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0276 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-rubygem-actionmailer-2_3-7363 - SUSE Cloud 1.0: zypper in -t patch sleclo10sp2-rubygem-actionmailer-2_3-7363 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.3.17]: rubygem-actionmailer-2_3-2.3.17-0.9.1 rubygem-actionpack-2_3-2.3.17-0.9.1 rubygem-activerecord-2_3-2.3.17-0.9.1 rubygem-activeresource-2_3-2.3.17-0.9.1 rubygem-activesupport-2_3-2.3.17-0.9.1 rubygem-rails-2_3-2.3.17-0.9.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (noarch) [New Version: 2.3.17]: rubygem-rails-2.3.17-0.8.1 - SUSE Cloud 1.0 (x86_64) [New Version: 2.3.17]: rubygem-actionmailer-2_3-2.3.17-0.9.1 rubygem-actionpack-2_3-2.3.17-0.9.1 rubygem-activerecord-2_3-2.3.17-0.9.1 rubygem-activeresource-2_3-2.3.17-0.9.1 rubygem-activesupport-2_3-2.3.17-0.9.1 rubygem-rails-2_3-2.3.17-0.9.1 References: http://support.novell.com/security/cve/CVE-2012-5664.html http://support.novell.com/security/cve/CVE-2013-0155.html http://support.novell.com/security/cve/CVE-2013-0156.html http://support.novell.com/security/cve/CVE-2013-0276.html http://support.novell.com/security/cve/CVE-2013-0277.html https://bugzilla.novell.com/796712 https://bugzilla.novell.com/797449 https://bugzilla.novell.com/797452 https://bugzilla.novell.com/800320 https://bugzilla.novell.com/803336 https://bugzilla.novell.com/803339 http://download.novell.com/patch/finder/?keywords=262e345a7ecb482ffca687eed… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0478-1: important: Security update for IBM Java2 JRE and SDK
by opensuse-security＠opensuse.org 18 Mar '13

18 Mar '13

SUSE Security Update: Security update for IBM Java2 JRE and SDK ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0478-1 Rating: important References: #438695 #603353 #798535 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.4.2 has been updated to SR13-FP15 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1478, CVE-2013-1480, CVE-2013-1476, CVE-2013-0442, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-1481, CVE-2013-0432, CVE-2013-0434, CVE-2013-0424, CVE-2013-0440, CVE-2013-0443. Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): IBMJava2-JRE-1.4.2_sr13.15-0.4 IBMJava2-SDK-1.4.2_sr13.15-0.4 References: https://bugzilla.novell.com/438695 https://bugzilla.novell.com/603353 https://bugzilla.novell.com/798535 http://download.novell.com/patch/finder/?keywords=514bd0c17c6dce42bd680235a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0440-6: important: Security update for Java
by opensuse-security＠opensuse.org 18 Mar '13

18 Mar '13

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0440-6 Rating: important References: #798535 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 5 has been updated to SR16 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1486, CVE-2013-1478, CVE-2013-0445, CVE-2013-1480, CVE-2013-1476, CVE-2013-0442, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-1481, CVE-2013-0432, CVE-2013-0434, CVE-2013-0409, CVE-2013-0427, CVE-2013-0433, CVE-2013-0424, CVE-2013-0440, CVE-2013-0443. Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): java-1_5_0-ibm-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-devel-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-fonts-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): java-1_5_0-ibm-32bit-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (x86_64): java-1_5_0-ibm-alsa-32bit-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586): java-1_5_0-ibm-alsa-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-jdbc-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-plugin-1.5.0_sr16.0-0.6.1 References: https://bugzilla.novell.com/798535 http://download.novell.com/patch/finder/?keywords=5ea58c1fb829cad73b10e1234… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0440-5: important: Security update for IBM Java5 JRE and SDK
by opensuse-security＠opensuse.org 16 Mar '13

16 Mar '13

SUSE Security Update: Security update for IBM Java5 JRE and SDK ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0440-5 Rating: important References: #798535 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 5 has been updated to SR16 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1486, CVE-2013-1478, CVE-2013-0445, CVE-2013-1480, CVE-2013-1476, CVE-2013-0442, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-1481, CVE-2013-0432, CVE-2013-0434, CVE-2013-0409, CVE-2013-0427, CVE-2013-0433, CVE-2013-0424, CVE-2013-0440, CVE-2013-0443. Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): IBMJava5-JRE-1.5.0_sr16.0-0.4 IBMJava5-SDK-1.5.0_sr16.0-0.4 References: https://bugzilla.novell.com/798535 http://download.novell.com/patch/finder/?keywords=40a91b33dc9e5067426d661e5… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0456-4: important: Security update for Java
by opensuse-security＠opensuse.org 15 Mar '13

15 Mar '13

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0456-4 Rating: important References: #798535 #808625 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Java 11 SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 6 has been updated to SR13 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1487, CVE-2013-1486, CVE-2013-1478, CVE-2013-0445, CVE-2013-1480, CVE-2013-0441, CVE-2013-1476, CVE-2012-1541, CVE-2013-0446, CVE-2012-3342, CVE-2013-0442, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2012-3213, CVE-2013-1481, CVE-2013-0419, CVE-2013-0423, CVE-2013-0351, CVE-2013-0432, CVE-2013-1473, CVE-2013-0435, CVE-2013-0434, CVE-2013-0409, CVE-2013-0427, CVE-2013-0433, CVE-2013-0424, CVE-2013-0440, CVE-2013-0438, CVE-2013-0443. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-java-1_6_0-ibm-7481 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-java-1_6_0-ibm-7481 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-java-1_6_0-ibm-7481 - SUSE Linux Enterprise Java 11 SP2: zypper in -t patch slejsp2-java-1_6_0-ibm-7481 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-devel-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): java-1_6_0-ibm-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-fonts-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): java-1_6_0-ibm-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-fonts-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-jdbc-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-plugin-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586): java-1_6_0-ibm-alsa-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-fonts-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-jdbc-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Server 11 SP2 (i586): java-1_6_0-ibm-alsa-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Java 11 SP2 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-devel-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-fonts-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-jdbc-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Java 11 SP2 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Java 11 SP2 (i586): java-1_6_0-ibm-alsa-1.6.0_sr13.0-0.8.1 References: https://bugzilla.novell.com/798535 https://bugzilla.novell.com/808625 http://download.novell.com/patch/finder/?keywords=fe51aa0e7e0daa0213ed3b6dc… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0440-4: important: Security update for Java
by opensuse-security＠opensuse.org 15 Mar '13

15 Mar '13

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0440-4 Rating: important References: #798535 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 5 has been updated to SR16 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1486, CVE-2013-1478, CVE-2013-0445, CVE-2013-1480, CVE-2013-1476, CVE-2013-0442, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-1481, CVE-2013-0432, CVE-2013-0434, CVE-2013-0409, CVE-2013-0427, CVE-2013-0433, CVE-2013-0424, CVE-2013-0440, CVE-2013-0443. Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ppc s390x x86_64): java-1_5_0-ibm-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-devel-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-fonts-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): java-1_5_0-ibm-32bit-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc): java-1_5_0-ibm-jdbc-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-plugin-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Server 10 SP4 (x86_64): java-1_5_0-ibm-alsa-32bit-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_5_0-ibm-alsa-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): java-1_5_0-ibm-64bit-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ppc s390x x86_64): java-1_5_0-ibm-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-devel-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-fonts-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Java 10 SP4 (ppc): java-1_5_0-ibm-jdbc-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-plugin-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): java-1_5_0-ibm-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-demo-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-devel-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-fonts-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-src-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): java-1_5_0-ibm-32bit-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-alsa-32bit-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr16.0-0.6.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586): java-1_5_0-ibm-alsa-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-jdbc-1.5.0_sr16.0-0.6.1 java-1_5_0-ibm-plugin-1.5.0_sr16.0-0.6.1 References: https://bugzilla.novell.com/798535 http://download.novell.com/patch/finder/?keywords=f3e49a4d1f2884a3b859fbf98… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0471-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 15 Mar '13

15 Mar '13

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0471-1 Rating: important References: #804248 #808243 Cross-References: CVE-2013-0787 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. It includes four new package versions. Description: MozillaFirefox has been updated to the 17.0.4ESR release. Besides the major version update from the 10ESR stable release line to the 17ESR stable release line, this update brings critical security and bugfixes: * MFSA 2013-29 / CVE-2013-0787: VUPEN Security, via TippingPoint's Zero Day Initiative, reported a use-after-free within the HTML editor when content script is run by the document.execCommand() function while internal editor operations are occurring. This could allow for arbitrary code execution. The Firefox 17.0.3ESR release also contains lots of security fixes: * MFSA 2013-28: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a series of use-after-free, out of bounds read, and buffer overflow problems rated as low to critical security issues in shipped software. Some of these issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting four additional use-after-free and out of bounds write flaws introduced during Firefox development that were fixed before general release. The following issues have been fixed in Firefox 19 and ESR 17.0.3: * Heap-use-after-free in nsOverflowContinuationTracker::Finish, with -moz-columns (CVE-2013-0780) * Heap-buffer-overflow WRITE in nsSaveAsCharset::DoCharsetConversion (CVE-2013-0782) * MFSA 2013-27 / CVE-2013-0776: Google security researcher Michal Zalewski reported an issue where the browser displayed the content of a proxy's 407 response if a user canceled the proxy's authentication prompt. In this circumstance, the addressbar will continue to show the requested site's address, including HTTPS addresses that appear to be secure. This spoofing of addresses can be used for phishing attacks by fooling users into entering credentials, for example. * MFSA 2013-26 / CVE-2013-0775: Security researcher Nils reported a use-after-free in nsImageLoadingContent when content script is executed. This could allow for arbitrary code execution. * MFSA 2013-25 / CVE-2013-0774: Mozilla security researcher Frederik Braun discovered that since Firefox 15 the file system location of the active browser profile was available to JavaScript workers. While not dangerous by itself, this could potentially be combined with other vulnerabilities to target the profile in an attack. * MFSA 2013-24 / CVE-2013-0773: Mozilla developer Bobby Holley discovered that it was possible to bypass some protections in Chrome Object Wrappers (COW) and System Only Wrappers (SOW), making their prototypes mutable by web content. This could be used leak information from chrome objects and possibly allow for arbitrary code execution. * MFSA 2013-23 / CVE-2013-0765: Mozilla developer Boris Zbarsky reported that in some circumstances a wrapped WebIDL object can be wrapped multiple times, overwriting the existing wrapped state. This could lead to an exploitable condition in rare cases. * MFSA 2013-22 / CVE-2013-0772: Using the Address Sanitizer tool, security researcher Atte Kettunen from OUSPG found an out-of-bounds read while rendering GIF format images. This could cause a non-exploitable crash and could also attempt to render normally inaccesible data as part of the image. * MFSA 2013-21: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Olli Pettay, Christoph Diehl, Gary Kwong, Jesse Ruderman, Andrew McCreight, Joe Drew, and Wayne Mery reported memory safety problems and crashes that affect Firefox ESR 17, and Firefox 18. * Memory safety bugs fixed in Firefox ESR 17.0.3, and Firefox 19 (CVE-2013-0783) Security Issue references: * CVE-2013-0787 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0787 > Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 3.14.1 and 4.9.4]: mozilla-nspr-4.9.4-0.6.3 mozilla-nspr-devel-4.9.4-0.6.3 mozilla-nss-3.14.1-0.6.3 mozilla-nss-devel-3.14.1-0.6.3 mozilla-nss-tools-3.14.1-0.6.3 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x) [New Version: 17.0.4esr and 7]: MozillaFirefox-17.0.4esr-0.7.1 MozillaFirefox-branding-SLED-7-0.10.4 MozillaFirefox-translations-17.0.4esr-0.7.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64) [New Version: 3.14.1 and 4.9.4]: mozilla-nspr-32bit-4.9.4-0.6.3 mozilla-nss-32bit-3.14.1-0.6.3 - SUSE Linux Enterprise Server 10 SP4 (ia64) [New Version: 3.14.1 and 4.9.4]: mozilla-nspr-x86-4.9.4-0.6.3 mozilla-nss-x86-3.14.1-0.6.3 - SUSE Linux Enterprise Server 10 SP4 (ppc) [New Version: 3.14.1 and 4.9.4]: mozilla-nspr-64bit-4.9.4-0.6.3 mozilla-nss-64bit-3.14.1-0.6.3 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64) [New Version: 3.14.1 and 4.9.4]: mhtml-firefox-0.5-1.13.4 mozilla-nspr-4.9.4-0.6.3 mozilla-nspr-devel-4.9.4-0.6.3 mozilla-nss-3.14.1-0.6.3 mozilla-nss-devel-3.14.1-0.6.3 mozilla-nss-tools-3.14.1-0.6.3 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64) [New Version: 3.14.1 and 4.9.4]: mozilla-nspr-32bit-4.9.4-0.6.3 mozilla-nss-32bit-3.14.1-0.6.3 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 17.0.4esr and 7]: MozillaFirefox-17.0.4esr-0.7.1 MozillaFirefox-branding-SLED-7-0.10.4 MozillaFirefox-translations-17.0.4esr-0.7.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 3.14.1]: firefox3-python-base-2.6.8-0.9.1 mozilla-nss-tools-3.14.1-0.6.3 - SLE SDK 10 SP4 (i586 ia64 ppc s390x): MozillaFirefox-branding-upstream-17.0.4esr-0.7.1 References: http://support.novell.com/security/cve/CVE-2013-0787.html https://bugzilla.novell.com/804248 https://bugzilla.novell.com/808243 http://download.novell.com/patch/finder/?keywords=e8a17727b5ca4754a7c066ed4… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0470-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 15 Mar '13

15 Mar '13

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0470-1 Rating: important References: #808243 Cross-References: CVE-2013-0787 Affected Products: SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: MozillaFirefox has been updated to the 17.0.4ESR release which fixes one important security issue: * MFSA 2013-29 / CVE-2013-0787: VUPEN Security, via TippingPoint's Zero Day Initiative, reported a use-after-free within the HTML editor when content script is run by the document.execCommand() function while internal editor operations are occurring. This could allow for arbitrary code execution. Security Issue reference: * CVE-2013-0787 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0787 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-firefox-201303-7464 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-firefox-201303-7464 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-firefox-201303-7464 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 17.0.4esr]: MozillaFirefox-17.0.4esr-0.5.1 MozillaFirefox-translations-17.0.4esr-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 17.0.4esr]: MozillaFirefox-17.0.4esr-0.5.1 MozillaFirefox-translations-17.0.4esr-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 17.0.4esr]: MozillaFirefox-17.0.4esr-0.5.1 MozillaFirefox-translations-17.0.4esr-0.5.1 References: http://support.novell.com/security/cve/CVE-2013-0787.html https://bugzilla.novell.com/808243 http://download.novell.com/patch/finder/?keywords=80cb5f45bf32ac42965b90fa9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0456-3: important: Security update for Java
by opensuse-security＠opensuse.org 15 Mar '13

15 Mar '13

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0456-3 Rating: important References: #798535 #808625 Affected Products: SUSE Linux Enterprise Server 11 SP1 for VMware LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 6 has been updated to SR13 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1487, CVE-2013-1486, CVE-2013-1478, CVE-2013-0445, CVE-2013-1480, CVE-2013-0441, CVE-2013-1476, CVE-2012-1541, CVE-2013-0446, CVE-2012-3342, CVE-2013-0442, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2012-3213, CVE-2013-1481, CVE-2013-0419, CVE-2013-0423, CVE-2013-0351, CVE-2013-0432, CVE-2013-1473, CVE-2013-0435, CVE-2013-0434, CVE-2013-0409, CVE-2013-0427, CVE-2013-0433, CVE-2013-0424, CVE-2013-0440, CVE-2013-0438, CVE-2013-0443. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS: zypper in -t patch slessp1-java-1_6_0-ibm-7482 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-java-1_6_0-ibm-7482 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS (i586 x86_64): java-1_6_0-ibm-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-fonts-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-jdbc-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-plugin-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-fonts-1.6.0_sr13.0-0.8.1 java-1_6_0-ibm-jdbc-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr13.0-0.8.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr13.0-0.8.1 References: https://bugzilla.novell.com/798535 https://bugzilla.novell.com/808625 http://download.novell.com/patch/finder/?keywords=56a53806f2b9b8ace0893e899… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0468-1: important: seamonkey: update to 2.16.1
by opensuse-security＠opensuse.org 15 Mar '13

15 Mar '13

openSUSE Security Update: seamonkey: update to 2.16.1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0468-1 Rating: important References: #808243 Cross-References: CVE-2013-0787 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: seamonkey was updated to version 2.16.1 fixing a severe security issue. * MFSA 2013-29/CVE-2013-0787 (bmo#848644) Use-after-free in HTML Editor Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-208 - openSUSE 12.2: zypper in -t patch openSUSE-2013-208 - openSUSE 12.1: zypper in -t patch openSUSE-2013-208 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): seamonkey-2.16.1-1.4.1 seamonkey-debuginfo-2.16.1-1.4.1 seamonkey-debugsource-2.16.1-1.4.1 seamonkey-dom-inspector-2.16.1-1.4.1 seamonkey-irc-2.16.1-1.4.1 seamonkey-translations-common-2.16.1-1.4.1 seamonkey-translations-other-2.16.1-1.4.1 seamonkey-venkman-2.16.1-1.4.1 - openSUSE 12.2 (i586 x86_64): seamonkey-2.16.1-2.38.2 seamonkey-debuginfo-2.16.1-2.38.2 seamonkey-debugsource-2.16.1-2.38.2 seamonkey-dom-inspector-2.16.1-2.38.2 seamonkey-irc-2.16.1-2.38.2 seamonkey-translations-common-2.16.1-2.38.2 seamonkey-translations-other-2.16.1-2.38.2 seamonkey-venkman-2.16.1-2.38.2 - openSUSE 12.1 (i586 x86_64): seamonkey-2.16.1-2.57.1 seamonkey-debuginfo-2.16.1-2.57.1 seamonkey-debugsource-2.16.1-2.57.1 seamonkey-dom-inspector-2.16.1-2.57.1 seamonkey-irc-2.16.1-2.57.1 seamonkey-translations-common-2.16.1-2.57.1 seamonkey-translations-other-2.16.1-2.57.1 seamonkey-venkman-2.16.1-2.57.1 References: http://support.novell.com/security/cve/CVE-2013-0787.html https://bugzilla.novell.com/808243 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0467-1: important: MozillaFirefox: Updated to 19.0.2
by opensuse-security＠opensuse.org 15 Mar '13

15 Mar '13

openSUSE Security Update: MozillaFirefox: Updated to 19.0.2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0467-1 Rating: important References: #808243 Cross-References: CVE-2013-0787 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Mozilla Firefox was updated to 19.0.2 (bnc#808243) fixing: * MFSA 2013-29/CVE-2013-0787 (bmo#848644) Use-after-free in HTML Editor could be used for code execution * blocklist updates Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-206 - openSUSE 12.2: zypper in -t patch openSUSE-2013-206 - openSUSE 12.1: zypper in -t patch openSUSE-2013-206 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): MozillaFirefox-19.0.2-1.4.1 MozillaFirefox-branding-upstream-19.0.2-1.4.1 MozillaFirefox-buildsymbols-19.0.2-1.4.1 MozillaFirefox-debuginfo-19.0.2-1.4.1 MozillaFirefox-debugsource-19.0.2-1.4.1 MozillaFirefox-devel-19.0.2-1.4.1 MozillaFirefox-translations-common-19.0.2-1.4.1 MozillaFirefox-translations-other-19.0.2-1.4.1 - openSUSE 12.2 (i586 x86_64): MozillaFirefox-19.0.2-2.37.2 MozillaFirefox-branding-upstream-19.0.2-2.37.2 MozillaFirefox-buildsymbols-19.0.2-2.37.2 MozillaFirefox-debuginfo-19.0.2-2.37.2 MozillaFirefox-debugsource-19.0.2-2.37.2 MozillaFirefox-devel-19.0.2-2.37.2 MozillaFirefox-translations-common-19.0.2-2.37.2 MozillaFirefox-translations-other-19.0.2-2.37.2 - openSUSE 12.1 (i586 x86_64): MozillaFirefox-19.0.2-2.66.1 MozillaFirefox-branding-upstream-19.0.2-2.66.1 MozillaFirefox-buildsymbols-19.0.2-2.66.1 MozillaFirefox-debuginfo-19.0.2-2.66.1 MozillaFirefox-debugsource-19.0.2-2.66.1 MozillaFirefox-devel-19.0.2-2.66.1 MozillaFirefox-translations-common-19.0.2-2.66.1 MozillaFirefox-translations-other-19.0.2-2.66.1 References: http://support.novell.com/security/cve/CVE-2013-0787.html https://bugzilla.novell.com/808243 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0466-1: important: xulrunner to 17.0.4esr
by opensuse-security＠opensuse.org 15 Mar '13

15 Mar '13

openSUSE Security Update: xulrunner to 17.0.4esr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0466-1 Rating: important References: #808243 Cross-References: CVE-2013-0787 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: xulrunner was updated to 17.0.4esr (bnc#808243) to fix a important security issue: * MFSA 2013-29/CVE-2013-0787 (bmo#848644) Use-after-free in HTML Editor Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-209 - openSUSE 12.2: zypper in -t patch openSUSE-2013-209 - openSUSE 12.1: zypper in -t patch openSUSE-2013-209 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): mozilla-js-17.0.4-1.4.2 mozilla-js-debuginfo-17.0.4-1.4.2 xulrunner-17.0.4-1.4.2 xulrunner-buildsymbols-17.0.4-1.4.2 xulrunner-debuginfo-17.0.4-1.4.2 xulrunner-debugsource-17.0.4-1.4.2 xulrunner-devel-17.0.4-1.4.2 xulrunner-devel-debuginfo-17.0.4-1.4.2 - openSUSE 12.3 (x86_64): mozilla-js-32bit-17.0.4-1.4.2 mozilla-js-debuginfo-32bit-17.0.4-1.4.2 xulrunner-32bit-17.0.4-1.4.2 xulrunner-debuginfo-32bit-17.0.4-1.4.2 - openSUSE 12.2 (i586 x86_64): mozilla-js-17.0.4-2.34.1 mozilla-js-debuginfo-17.0.4-2.34.1 xulrunner-17.0.4-2.34.1 xulrunner-buildsymbols-17.0.4-2.34.1 xulrunner-debuginfo-17.0.4-2.34.1 xulrunner-debugsource-17.0.4-2.34.1 xulrunner-devel-17.0.4-2.34.1 xulrunner-devel-debuginfo-17.0.4-2.34.1 - openSUSE 12.2 (x86_64): mozilla-js-32bit-17.0.4-2.34.1 mozilla-js-debuginfo-32bit-17.0.4-2.34.1 xulrunner-32bit-17.0.4-2.34.1 xulrunner-debuginfo-32bit-17.0.4-2.34.1 - openSUSE 12.1 (i586 x86_64): mozilla-js-17.0.4-2.61.1 mozilla-js-debuginfo-17.0.4-2.61.1 xulrunner-17.0.4-2.61.1 xulrunner-buildsymbols-17.0.4-2.61.1 xulrunner-debuginfo-17.0.4-2.61.1 xulrunner-debugsource-17.0.4-2.61.1 xulrunner-devel-17.0.4-2.61.1 xulrunner-devel-debuginfo-17.0.4-2.61.1 - openSUSE 12.1 (x86_64): mozilla-js-32bit-17.0.4-2.61.1 mozilla-js-debuginfo-32bit-17.0.4-2.61.1 xulrunner-32bit-17.0.4-2.61.1 xulrunner-debuginfo-32bit-17.0.4-2.61.1 - openSUSE 12.1 (ia64): mozilla-js-debuginfo-x86-17.0.4-2.61.1 mozilla-js-x86-17.0.4-2.61.1 xulrunner-debuginfo-x86-17.0.4-2.61.1 xulrunner-x86-17.0.4-2.61.1 References: http://support.novell.com/security/cve/CVE-2013-0787.html https://bugzilla.novell.com/808243 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0465-1: important: MozillaThunderbird: 17.0.4 release
by opensuse-security＠opensuse.org 15 Mar '13

15 Mar '13

openSUSE Security Update: MozillaThunderbird: 17.0.4 release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0465-1 Rating: important References: #808243 Cross-References: CVE-2013-0787 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: MozillaThunderbird was updated to 17.0.4 (bnc#808243) * MFSA 2013-29/CVE-2013-0787 (bmo#848644) Use-after-free in HTML Editor Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-207 - openSUSE 12.2: zypper in -t patch openSUSE-2013-207 - openSUSE 12.1: zypper in -t patch openSUSE-2013-207 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): MozillaThunderbird-17.0.4-61.5.1 MozillaThunderbird-buildsymbols-17.0.4-61.5.1 MozillaThunderbird-debuginfo-17.0.4-61.5.1 MozillaThunderbird-debugsource-17.0.4-61.5.1 MozillaThunderbird-devel-17.0.4-61.5.1 MozillaThunderbird-devel-debuginfo-17.0.4-61.5.1 MozillaThunderbird-translations-common-17.0.4-61.5.1 MozillaThunderbird-translations-other-17.0.4-61.5.1 enigmail-1.5.1+17.0.4-61.5.1 enigmail-debuginfo-1.5.1+17.0.4-61.5.1 - openSUSE 12.2 (i586 x86_64): MozillaThunderbird-17.0.4-49.35.1 MozillaThunderbird-buildsymbols-17.0.4-49.35.1 MozillaThunderbird-debuginfo-17.0.4-49.35.1 MozillaThunderbird-debugsource-17.0.4-49.35.1 MozillaThunderbird-devel-17.0.4-49.35.1 MozillaThunderbird-devel-debuginfo-17.0.4-49.35.1 MozillaThunderbird-translations-common-17.0.4-49.35.1 MozillaThunderbird-translations-other-17.0.4-49.35.1 enigmail-1.5.1+17.0.4-49.35.1 enigmail-debuginfo-1.5.1+17.0.4-49.35.1 - openSUSE 12.1 (i586 x86_64): MozillaThunderbird-17.0.4-33.55.1 MozillaThunderbird-buildsymbols-17.0.4-33.55.1 MozillaThunderbird-debuginfo-17.0.4-33.55.1 MozillaThunderbird-debugsource-17.0.4-33.55.1 MozillaThunderbird-devel-17.0.4-33.55.1 MozillaThunderbird-devel-debuginfo-17.0.4-33.55.1 MozillaThunderbird-translations-common-17.0.4-33.55.1 MozillaThunderbird-translations-other-17.0.4-33.55.1 enigmail-1.5.1+17.0.4-33.55.1 enigmail-debuginfo-1.5.1+17.0.4-33.55.1 References: http://support.novell.com/security/cve/CVE-2013-0787.html https://bugzilla.novell.com/808243 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0440-3: important: Security update for Java
by opensuse-security＠opensuse.org 14 Mar '13

14 Mar '13

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0440-3 Rating: important References: #798535 Affected Products: SUSE Linux Enterprise Server 11 SP1 for VMware LTSS SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.4.2 has been updated to SR13-FP15 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1478, CVE-2013-1480, CVE-2013-1476, CVE-2013-0442, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-1481, CVE-2013-0432, CVE-2013-0434, CVE-2013-0424, CVE-2013-0440, CVE-2013-0443. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS: zypper in -t patch slessp1-java-1_4_2-ibm-7479 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-java-1_4_2-ibm-7479 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS (i586 x86_64): java-1_4_2-ibm-1.4.2_sr13.15-0.3.1 - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.15-0.3.1 java-1_4_2-ibm-plugin-1.4.2_sr13.15-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.15-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.15-0.3.1 java-1_4_2-ibm-plugin-1.4.2_sr13.15-0.3.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.15-0.6.1 java-1_4_2-ibm-devel-1.4.2_sr13.15-0.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.15-0.6.1 java-1_4_2-ibm-plugin-1.4.2_sr13.15-0.6.1 References: https://bugzilla.novell.com/798535 http://download.novell.com/patch/finder/?keywords=7014ea77ffe5c5f4f2e593888… http://download.novell.com/patch/finder/?keywords=fc8b17df6be0cc8370eff53d8… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0464-1: critical: flash-player: update to version 11.2.202.275
by opensuse-security＠opensuse.org 14 Mar '13

14 Mar '13

openSUSE Security Update: flash-player: update to version 11.2.202.275 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0464-1 Rating: critical References: #808973 Cross-References: CVE-2013-0646 CVE-2013-0650 CVE-2013-1371 CVE-2013-1375 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.275: (bnc#808973) * APSB13-09, CVE-2013-0646, CVE-2013-0650, CVE-2013-1371, CVE-2013-1375 More information can be found on: http://www.adobe.com/support/security/bulletins/apsb13-09.ht ml Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-41 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.275-55.1 flash-player-gnome-11.2.202.275-55.1 flash-player-kde4-11.2.202.275-55.1 References: http://support.novell.com/security/cve/CVE-2013-0646.html http://support.novell.com/security/cve/CVE-2013-0650.html http://support.novell.com/security/cve/CVE-2013-1371.html http://support.novell.com/security/cve/CVE-2013-1375.html https://bugzilla.novell.com/808973 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0456-2: important: Security update for Java
by opensuse-security＠opensuse.org 14 Mar '13

14 Mar '13

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0456-2 Rating: important References: #798535 #808625 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 6 has been updated to SR13 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1487, CVE-2013-1486, CVE-2013-1478, CVE-2013-0445, CVE-2013-1480, CVE-2013-0441, CVE-2013-1476, CVE-2012-1541, CVE-2013-0446, CVE-2012-3342, CVE-2013-0442, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2012-3213, CVE-2013-1481, CVE-2013-0419, CVE-2013-0423, CVE-2013-0351, CVE-2013-0432, CVE-2013-1473, CVE-2013-0435, CVE-2013-0434, CVE-2013-0409, CVE-2013-0427, CVE-2013-0433, CVE-2013-0424, CVE-2013-0440, CVE-2013-0438, CVE-2013-0443. Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr13.0-0.7.7.1 java-1_6_0-ibm-devel-1.6.0_sr13.0-0.7.7.1 java-1_6_0-ibm-fonts-1.6.0_sr13.0-0.7.7.1 java-1_6_0-ibm-jdbc-1.6.0_sr13.0-0.7.7.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr13.0-0.7.7.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr13.0-0.7.7.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr13.0-0.7.7.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr13.0-0.7.7.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr13.0-0.7.7.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr13.0-0.7.7.1 References: https://bugzilla.novell.com/798535 https://bugzilla.novell.com/808625 http://download.novell.com/patch/finder/?keywords=219c5ead437be21a7209a3563… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0459-1: critical: flash-player: update to version 11.2.202.275
by opensuse-security＠opensuse.org 14 Mar '13

14 Mar '13

openSUSE Security Update: flash-player: update to version 11.2.202.275 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0459-1 Rating: critical References: #808973 Cross-References: CVE-2013-0646 CVE-2013-0650 CVE-2013-1371 CVE-2013-1375 Affected Products: openSUSE 12.3:NonFree openSUSE 12.2:NonFree openSUSE 12.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.275: (bnc#808973) * APSB13-09, CVE-2013-0646, CVE-2013-0650, CVE-2013-1371, CVE-2013-1375 More information can be found on: http://www.adobe.com/support/security/bulletins/apsb13-09.ht ml Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2013-205 - openSUSE 12.2:NonFree: zypper in -t patch openSUSE-2013-205 - openSUSE 12.1: zypper in -t patch openSUSE-2013-205 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.275-2.12.1 flash-player-gnome-11.2.202.275-2.12.1 flash-player-kde4-11.2.202.275-2.12.1 - openSUSE 12.2:NonFree (i586 x86_64): flash-player-11.2.202.275-1.34.1 flash-player-gnome-11.2.202.275-1.34.1 flash-player-kde4-11.2.202.275-1.34.1 - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.275-58.1 flash-player-gnome-11.2.202.275-58.1 flash-player-kde4-11.2.202.275-58.1 References: http://support.novell.com/security/cve/CVE-2013-0646.html http://support.novell.com/security/cve/CVE-2013-0650.html http://support.novell.com/security/cve/CVE-2013-1371.html http://support.novell.com/security/cve/CVE-2013-1375.html https://bugzilla.novell.com/808973 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0458-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 14 Mar '13

14 Mar '13

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0458-1 Rating: critical References: #808973 Cross-References: CVE-2013-0646 CVE-2013-0650 CVE-2013-1371 CVE-2013-1375 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: Adobe Flash Player has been updated to security release 11.2.202.275 (APSB13-09), fixing severe security issues. (CVE-2013-0646, CVE-2013-0650, CVE-2013-1371, CVE-2013-1375) More information can be found on: http://www.adobe.com/support/security/bulletins/apsb13-09.ht ml <http://www.adobe.com/support/security/bulletins/apsb13-09.h tml> Security Issue references: * CVE-2013-0646 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0646 > * CVE-2013-0650 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0650 > * CVE-2013-1371 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1371 > * CVE-2013-1375 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1375 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-flash-player-7491 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 11.2.202.275]: flash-player-11.2.202.275-0.3.1 flash-player-gnome-11.2.202.275-0.3.1 flash-player-kde4-11.2.202.275-0.3.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 11.2.202.275]: flash-player-11.2.202.275-0.5.1 References: http://support.novell.com/security/cve/CVE-2013-0646.html http://support.novell.com/security/cve/CVE-2013-0650.html http://support.novell.com/security/cve/CVE-2013-1371.html http://support.novell.com/security/cve/CVE-2013-1375.html https://bugzilla.novell.com/808973 http://download.novell.com/patch/finder/?keywords=a590b251093353c9a532d47fa… http://download.novell.com/patch/finder/?keywords=ced16d4be49bc3ca3c262247f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0456-1: important: Security update for Java
by opensuse-security＠opensuse.org 14 Mar '13

14 Mar '13

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0456-1 Rating: important References: #798535 #808625 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 6 has been updated to SR13 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1487, CVE-2013-1486, CVE-2013-1478, CVE-2013-0445, CVE-2013-1480, CVE-2013-0441, CVE-2013-1476, CVE-2012-1541, CVE-2013-0446, CVE-2012-3342, CVE-2013-0442, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2012-3213, CVE-2013-1481, CVE-2013-0419, CVE-2013-0423, CVE-2013-0351, CVE-2013-0432, CVE-2013-1473, CVE-2013-0435, CVE-2013-0434, CVE-2013-0409, CVE-2013-0427, CVE-2013-0433, CVE-2013-0424, CVE-2013-0440, CVE-2013-0438, CVE-2013-0443. Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ppc s390x x86_64): java-1_6_0-ibm-1.6.0_sr13.0-0.13.3 java-1_6_0-ibm-devel-1.6.0_sr13.0-0.13.3 java-1_6_0-ibm-fonts-1.6.0_sr13.0-0.13.3 java-1_6_0-ibm-jdbc-1.6.0_sr13.0-0.13.3 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc x86_64): java-1_6_0-ibm-plugin-1.6.0_sr13.0-0.13.3 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr13.0-0.13.3 java-1_6_0-ibm-devel-32bit-1.6.0_sr13.0-0.13.3 - SUSE Linux Enterprise Server 10 SP4 (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr13.0-0.13.3 java-1_6_0-ibm-plugin-32bit-1.6.0_sr13.0-0.13.3 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_6_0-ibm-alsa-1.6.0_sr13.0-0.13.3 - SUSE Linux Enterprise Server 10 SP4 (ppc): java-1_6_0-ibm-64bit-1.6.0_sr13.0-0.13.3 - SUSE Linux Enterprise Java 10 SP4 (x86_64): java-1_6_0-ibm-1.6.0_sr13.0-0.13.3 java-1_6_0-ibm-devel-1.6.0_sr13.0-0.13.3 java-1_6_0-ibm-fonts-1.6.0_sr13.0-0.13.3 java-1_6_0-ibm-jdbc-1.6.0_sr13.0-0.13.3 java-1_6_0-ibm-plugin-1.6.0_sr13.0-0.13.3 References: https://bugzilla.novell.com/798535 https://bugzilla.novell.com/808625 http://download.novell.com/patch/finder/?keywords=78075f3faaadfb1d4a70cc040… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0440-2: important: Security update for Java
by opensuse-security＠opensuse.org 13 Mar '13

13 Mar '13

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0440-2 Rating: important References: #798535 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 11 SP2 SUSE Linux Enterprise Java 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.4.2 has been updated to SR13-FP15 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1478, CVE-2013-1480, CVE-2013-1476, CVE-2013-0442, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2013-1481, CVE-2013-0432, CVE-2013-0434, CVE-2013-0424, CVE-2013-0440, CVE-2013-0443. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-java-1_4_2-ibm-7450 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-java-1_4_2-ibm-7450 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-java-1_4_2-ibm-7450 - SUSE Linux Enterprise Java 11 SP2: zypper in -t patch slejsp2-java-1_4_2-ibm-7450 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): java-1_4_2-ibm-devel-1.4.2_sr13.15-0.3.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): java-1_4_2-ibm-1.4.2_sr13.15-0.3.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): java-1_4_2-ibm-1.4.2_sr13.15-0.3.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.15-0.3.1 java-1_4_2-ibm-plugin-1.4.2_sr13.15-0.3.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.15-0.3.1 - SUSE Linux Enterprise Server 11 SP2 (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.15-0.3.1 java-1_4_2-ibm-plugin-1.4.2_sr13.15-0.3.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.15-0.6.1 java-1_4_2-ibm-devel-1.4.2_sr13.15-0.6.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc): java-1_4_2-ibm-jdbc-1.4.2_sr13.15-0.6.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_4_2-ibm-plugin-1.4.2_sr13.15-0.6.1 - SUSE Linux Enterprise Java 11 SP2 (i586 ppc64 s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.15-0.3.1 - SUSE Linux Enterprise Java 11 SP2 (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.15-0.3.1 java-1_4_2-ibm-plugin-1.4.2_sr13.15-0.3.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ia64 ppc s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.15-0.6.1 java-1_4_2-ibm-devel-1.4.2_sr13.15-0.6.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ppc): java-1_4_2-ibm-jdbc-1.4.2_sr13.15-0.6.1 - SUSE Linux Enterprise Java 10 SP4 (i586): java-1_4_2-ibm-plugin-1.4.2_sr13.15-0.6.1 References: https://bugzilla.novell.com/798535 http://download.novell.com/patch/finder/?keywords=93cb6121fadaf694135bd63c1… http://download.novell.com/patch/finder/?keywords=ec9d22c393a1ca0adfb36328a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0442-1: important: Security update for Perl
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

SUSE Security Update: Security update for Perl ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0442-1 Rating: important References: #788388 #789994 #796014 #797060 #804415 Cross-References: CVE-2013-1667 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: This update of Perl 5 fixes the following security issues: * fix rehash DoS [bnc#804415] [CVE-2013-1667] * improve CGI crlf escaping [bnc#789994] [CVE-2012-5526] * fix glob denial of service [bnc#796014] [CVE-2011-2728] * sanitize input in Maketext.pm [bnc#797060] [CVE-2012-6329] * make getgrent work with long group entries [bnc#788388] Security Issue reference: * CVE-2013-1667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1667 > Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): perl-5.8.8-14.21.3 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): perl-32bit-5.8.8-14.21.3 - SUSE Linux Enterprise Server 10 SP4 (ia64): perl-x86-5.8.8-14.21.3 - SUSE Linux Enterprise Server 10 SP4 (ppc): perl-64bit-5.8.8-14.21.3 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): perl-5.8.8-14.21.3 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): perl-32bit-5.8.8-14.21.3 References: http://support.novell.com/security/cve/CVE-2013-1667.html https://bugzilla.novell.com/788388 https://bugzilla.novell.com/789994 https://bugzilla.novell.com/796014 https://bugzilla.novell.com/797060 https://bugzilla.novell.com/804415 http://download.novell.com/patch/finder/?keywords=ed1929d51b82752f08399dada… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0441-1: important: Security update for Perl
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

SUSE Security Update: Security update for Perl ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0441-1 Rating: important References: #789994 #796014 #797060 #804415 Cross-References: CVE-2013-1667 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update of Perl 5 fixes the following security issues: * fix rehash DoS [bnc#804415] [CVE-2013-1667] * improve CGI crlf escaping [bnc#789994] [CVE-2012-5526] * fix glob denial of service [bnc#796014] [CVE-2011-2728] * sanitize input in Maketext.pm [bnc#797060] [CVE-2012-6329] Security Issue references: * CVE-2013-1667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1667 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-perl-7439 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-perl-7439 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-perl-7439 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-perl-7439 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (ppc64 s390x x86_64): perl-base-32bit-5.10.0-64.61.61.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (ia64): perl-base-x86-5.10.0-64.61.61.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): perl-5.10.0-64.61.61.1 perl-base-5.10.0-64.61.61.1 perl-doc-5.10.0-64.61.61.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64): perl-32bit-5.10.0-64.61.61.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): perl-5.10.0-64.61.61.1 perl-base-5.10.0-64.61.61.1 perl-doc-5.10.0-64.61.61.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64): perl-32bit-5.10.0-64.61.61.1 - SUSE Linux Enterprise Server 11 SP2 (ia64): perl-x86-5.10.0-64.61.61.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): perl-5.10.0-64.61.61.1 perl-base-5.10.0-64.61.61.1 perl-doc-5.10.0-64.61.61.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64): perl-32bit-5.10.0-64.61.61.1 References: http://support.novell.com/security/cve/CVE-2013-1667.html https://bugzilla.novell.com/789994 https://bugzilla.novell.com/796014 https://bugzilla.novell.com/797060 https://bugzilla.novell.com/804415 http://download.novell.com/patch/finder/?keywords=3663b3a5fb6a8f33323d36be1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0440-1: important: Security update for Java
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0440-1 Rating: important References: #798535 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Java 11 SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 7 was updated to SR4, fixing various critical security issues and bugs. Please see the IBM JDK Alert page for more information: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security issues fixed: CVE-2013-1487, CVE-2013-1486, CVE-2013-1478, CVE-2013-0445, CVE-2013-1480, CVE-2013-0441, CVE-2013-1476, CVE-2012-1541, CVE-2013-0446, CVE-2012-3342, CVE-2013-0442, CVE-2013-0450, CVE-2013-0425, CVE-2013-0426, CVE-2013-0428, CVE-2012-3213, CVE-2013-0419, CVE-2013-0423, CVE-2013-0351, CVE-2013-0432, CVE-2013-1473, CVE-2013-0435, CVE-2013-0434, CVE-2013-0409, CVE-2013-0427, CVE-2013-0433, CVE-2013-0424, CVE-2013-0440, CVE-2013-0438, CVE-2013-0443, CVE-2013-1484, CVE-2013-1485, CVE-2013-0437, CVE-2013-0444, CVE-2013-0449, CVE-2013-0431, CVE-2013-0422, CVE-2012-3174. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-java-1_7_0-ibm-7454 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-java-1_7_0-ibm-7454 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-java-1_7_0-ibm-7454 - SUSE Linux Enterprise Java 11 SP2: zypper in -t patch slejsp2-java-1_7_0-ibm-7454 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-devel-1.7.0_sr4.0-0.6.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): java-1_7_0-ibm-1.7.0_sr4.0-0.6.1 java-1_7_0-ibm-jdbc-1.7.0_sr4.0-0.6.1 java-1_7_0-ibm-plugin-1.7.0_sr4.0-0.6.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586): java-1_7_0-ibm-alsa-1.7.0_sr4.0-0.6.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-1.7.0_sr4.0-0.6.1 java-1_7_0-ibm-jdbc-1.7.0_sr4.0-0.6.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64): java-1_7_0-ibm-plugin-1.7.0_sr4.0-0.6.1 - SUSE Linux Enterprise Server 11 SP2 (i586): java-1_7_0-ibm-alsa-1.7.0_sr4.0-0.6.1 - SUSE Linux Enterprise Java 11 SP2 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-1.7.0_sr4.0-0.6.1 java-1_7_0-ibm-devel-1.7.0_sr4.0-0.6.1 java-1_7_0-ibm-jdbc-1.7.0_sr4.0-0.6.1 - SUSE Linux Enterprise Java 11 SP2 (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr4.0-0.6.1 java-1_7_0-ibm-plugin-1.7.0_sr4.0-0.6.1 References: https://bugzilla.novell.com/798535 http://download.novell.com/patch/finder/?keywords=ec2cc97511073c725601f4d83… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0438-1: important: java-1_6_0-openjdk: update to 1.12.4
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

openSUSE Security Update: java-1_6_0-openjdk: update to 1.12.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0438-1 Rating: important References: #807487 Cross-References: CVE-2013-0809 CVE-2013-1493 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_6_0-openjdk aka IcedTea was updated to 1.12.4 - S8007014, CVE-2013-0809: Improve image handling - S8007675, CVE-2013-1493: Improve color conversion Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-39 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-debuginfo-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-debugsource-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-demo-debuginfo-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-devel-debuginfo-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-src-1.6.0.0_b27.1.12.4-33.1 References: http://support.novell.com/security/cve/CVE-2013-0809.html http://support.novell.com/security/cve/CVE-2013-1493.html https://bugzilla.novell.com/807487 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0434-1: critical: Security update for Java
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0434-1 Rating: critical References: #807487 Cross-References: CVE-2013-0809 CVE-2013-1493 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This release of Icedtea6-1.12.4 fixes the following two issues that allowed a remote attacker to execute arbitrary code remotely by providing crafted images to the affected code. * CVE-2013-0809: CVSS v2 Base Score: 6.8 (critical) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Insufficient Information (CWE-noinfo) * CVE-2013-1493: CVSS v2 Base Score: 6.8 (critical) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119) Security Issue references: * CVE-2013-0809 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0809 > * CVE-2013-1493 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1493 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-java-1_6_0-openjdk-7457 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b27.1.12.4-0.2.1 java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.4-0.2.1 java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.4-0.2.1 References: http://support.novell.com/security/cve/CVE-2013-0809.html http://support.novell.com/security/cve/CVE-2013-1493.html https://bugzilla.novell.com/807487 http://download.novell.com/patch/finder/?keywords=b123f43a2f91b666216183687… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0431-1: important: Mozilla updates (FF 19.0.2, SM 2.16.1, TB 17.0.4)
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

openSUSE Security Update: Mozilla updates (FF 19.0.2, SM 2.16.1, TB 17.0.4) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0431-1 Rating: important References: #808243 Cross-References: CVE-2013-0787 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Update to - Firefox 19.0.2 - Seamonkey 2.16.1 - Thunderbird 17.0.4 which fix a use-after-free in HTML Editor which could allow for arbitrary code execution. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-38 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-19.0.2-65.1 MozillaFirefox-branding-upstream-19.0.2-65.1 MozillaFirefox-buildsymbols-19.0.2-65.1 MozillaFirefox-debuginfo-19.0.2-65.1 MozillaFirefox-debugsource-19.0.2-65.1 MozillaFirefox-devel-19.0.2-65.1 MozillaFirefox-translations-common-19.0.2-65.1 MozillaFirefox-translations-other-19.0.2-65.1 MozillaThunderbird-17.0.4-53.1 MozillaThunderbird-buildsymbols-17.0.4-53.1 MozillaThunderbird-debuginfo-17.0.4-53.1 MozillaThunderbird-debugsource-17.0.4-53.1 MozillaThunderbird-devel-17.0.4-53.1 MozillaThunderbird-devel-debuginfo-17.0.4-53.1 MozillaThunderbird-translations-common-17.0.4-53.1 MozillaThunderbird-translations-other-17.0.4-53.1 enigmail-1.5.1+17.0.4-53.1 enigmail-debuginfo-1.5.1+17.0.4-53.1 seamonkey-2.16.1-57.1 seamonkey-debuginfo-2.16.1-57.1 seamonkey-debugsource-2.16.1-57.1 seamonkey-dom-inspector-2.16.1-57.1 seamonkey-irc-2.16.1-57.1 seamonkey-translations-common-2.16.1-57.1 seamonkey-translations-other-2.16.1-57.1 seamonkey-venkman-2.16.1-57.1 References: http://support.novell.com/security/cve/CVE-2013-0787.html https://bugzilla.novell.com/808243 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0430-1: important: java-1_6_0-openjdk: update to 1.12.4
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

openSUSE Security Update: java-1_6_0-openjdk: update to 1.12.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0430-1 Rating: important References: #807487 Cross-References: CVE-2013-0809 CVE-2013-1493 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_6_0-openjdk aka IcedTea was updated to 1.12.4 (bnc#807487) - S8007014, CVE-2013-0809: Improve image handling - S8007675, CVE-2013-1493: Improve color conversion Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-198 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-debuginfo-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-debugsource-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-demo-debuginfo-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-devel-debuginfo-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-src-1.6.0.0_b27.1.12.4-32.1 References: http://support.novell.com/security/cve/CVE-2013-0809.html http://support.novell.com/security/cve/CVE-2013-1493.html https://bugzilla.novell.com/807487 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0410-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 08 Mar '13

08 Mar '13

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0410-1 Rating: important References: #804248 #806669 Cross-References: CVE-2013-0765 CVE-2013-0772 CVE-2013-0773 CVE-2013-0774 CVE-2013-0775 CVE-2013-0776 CVE-2013-0780 CVE-2013-0782 CVE-2013-0783 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. It includes three new package versions. Description: MozillaFirefox has been updated to the 17.0.3ESR release. Important: due to compatibility issues, the Beagle plug-in for MozillaFirefox is temporarily disabled by this update. Besides the major version update from the 10ESR stable release line to the 17ESR stable release line, this update brings critical security and bugfixes: * MFSA 2013-28: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a series of use-after-free, out of bounds read, and buffer overflow problems rated as low to critical security issues in shipped software. Some of these issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting four additional use-after-free and out of bounds write flaws introduced during Firefox development that were fixed before general release. * The following issues have been fixed in Firefox 19 and ESR 17.0.3: o Heap-use-after-free in nsOverflowContinuationTracker::Finish, with -moz-columns (CVE-2013-0780) o Heap-buffer-overflow WRITE in nsSaveAsCharset::DoCharsetConversion (CVE-2013-0782) * MFSA 2013-27 / CVE-2013-0776: Google security researcher Michal Zalewski reported an issue where the browser displayed the content of a proxy's 407 response if a user canceled the proxy's authentication prompt. In this circumstance, the addressbar will continue to show the requested site's address, including HTTPS addresses that appear to be secure. This spoofing of addresses can be used for phishing attacks by fooling users into entering credentials, for example. * MFSA 2013-26 / CVE-2013-0775: Security researcher Nils reported a use-after-free in nsImageLoadingContent when content script is executed. This could allow for arbitrary code execution. * MFSA 2013-25 / CVE-2013-0774: Mozilla security researcher Frederik Braun discovered that since Firefox 15 the file system location of the active browser profile was available to JavaScript workers. While not dangerous by itself, this could potentially be combined with other vulnerabilities to target the profile in an attack. * MFSA 2013-24 / CVE-2013-0773: Mozilla developer Bobby Holley discovered that it was possible to bypass some protections in Chrome Object Wrappers (COW) and System Only Wrappers (SOW), making their prototypes mutable by web content. This could be used leak information from chrome objects and possibly allow for arbitrary code execution. * MFSA 2013-23 / CVE-2013-0765: Mozilla developer Boris Zbarsky reported that in some circumstances a wrapped WebIDL object can be wrapped multiple times, overwriting the existing wrapped state. This could lead to an exploitable condition in rare cases. * MFSA 2013-22 / CVE-2013-0772: Using the Address Sanitizer tool, security researcher Atte Kettunen from OUSPG found an out-of-bounds read while rendering GIF format images. This could cause a non-exploitable crash and could also attempt to render normally inaccesible data as part of the image. * MFSA 2013-21: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Olli Pettay, Christoph Diehl, Gary Kwong, Jesse Ruderman, Andrew McCreight, Joe Drew, and Wayne Mery reported memory safety problems and crashes that affect Firefox ESR 17, and Firefox 18. * Memory safety bugs fixed in Firefox ESR 17.0.3, and Firefox 19 (CVE-2013-0783). Security Issue references: * CVE-2013-0780 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0780 > * CVE-2013-0782 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0782 > * CVE-2013-0776 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0776 > * CVE-2013-0775 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0775 > * CVE-2013-0774 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0774 > * CVE-2013-0773 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0773 > * CVE-2013-0765 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0765 > * CVE-2013-0772 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0772 > * CVE-2013-0783 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0783 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-firefox-201303-7447 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-firefox-201303-7447 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-firefox-201303-7447 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-firefox-201303-7447 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.14.2 and 4.9.5]: mozilla-nspr-devel-4.9.5-0.3.2 mozilla-nss-devel-3.14.2-0.4.3.2 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 s390x x86_64): beagle-0.3.8-56.51.1 beagle-lang-0.3.8-56.44.45.129 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): beagle-devel-0.3.8-56.51.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 17.0.3esr,3.14.2 and 4.9.5]: MozillaFirefox-17.0.3esr-0.4.4.1 MozillaFirefox-translations-17.0.3esr-0.4.4.1 libfreebl3-3.14.2-0.4.3.2 mozilla-nspr-4.9.5-0.3.2 mozilla-nss-3.14.2-0.4.3.2 mozilla-nss-tools-3.14.2-0.4.3.2 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 3.14.2 and 4.9.5]: libfreebl3-32bit-3.14.2-0.4.3.2 mozilla-nspr-32bit-4.9.5-0.3.2 mozilla-nss-32bit-3.14.2-0.4.3.2 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 17.0.3esr,3.14.2 and 4.9.5]: MozillaFirefox-17.0.3esr-0.4.4.1 MozillaFirefox-branding-SLED-7-0.6.9.5 MozillaFirefox-translations-17.0.3esr-0.4.4.1 libfreebl3-3.14.2-0.4.3.2 mozilla-nspr-4.9.5-0.3.2 mozilla-nss-3.14.2-0.4.3.2 mozilla-nss-tools-3.14.2-0.4.3.2 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 3.14.2 and 4.9.5]: libfreebl3-32bit-3.14.2-0.4.3.2 mozilla-nspr-32bit-4.9.5-0.3.2 mozilla-nss-32bit-3.14.2-0.4.3.2 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 3.14.2 and 4.9.5]: libfreebl3-x86-3.14.2-0.4.3.2 mozilla-nspr-x86-4.9.5-0.3.2 mozilla-nss-x86-3.14.2-0.4.3.2 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 17.0.3esr,3.14.2 and 4.9.5]: MozillaFirefox-17.0.3esr-0.4.4.1 MozillaFirefox-branding-SLED-7-0.6.9.5 MozillaFirefox-translations-17.0.3esr-0.4.4.1 beagle-0.3.8-56.51.1 beagle-evolution-0.3.8-56.51.1 beagle-firefox-0.3.8-56.51.1 beagle-gui-0.3.8-56.51.1 beagle-lang-0.3.8-56.51.1 libfreebl3-3.14.2-0.4.3.2 mhtml-firefox-0.5-1.47.51.5 mozilla-nspr-4.9.5-0.3.2 mozilla-nss-3.14.2-0.4.3.2 mozilla-nss-tools-3.14.2-0.4.3.2 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 3.14.2 and 4.9.5]: libfreebl3-32bit-3.14.2-0.4.3.2 mozilla-nspr-32bit-4.9.5-0.3.2 mozilla-nss-32bit-3.14.2-0.4.3.2 References: http://support.novell.com/security/cve/CVE-2013-0765.html http://support.novell.com/security/cve/CVE-2013-0772.html http://support.novell.com/security/cve/CVE-2013-0773.html http://support.novell.com/security/cve/CVE-2013-0774.html http://support.novell.com/security/cve/CVE-2013-0775.html http://support.novell.com/security/cve/CVE-2013-0776.html http://support.novell.com/security/cve/CVE-2013-0780.html http://support.novell.com/security/cve/CVE-2013-0782.html http://support.novell.com/security/cve/CVE-2013-0783.html https://bugzilla.novell.com/804248 https://bugzilla.novell.com/806669 http://download.novell.com/patch/finder/?keywords=8807d796dff1dcb5ceabc4ae6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0407-1: important: pidgin: various security fixes
by opensuse-security＠opensuse.org 07 Mar '13

07 Mar '13

openSUSE Security Update: pidgin: various security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0407-1 Rating: important References: #804742 Cross-References: CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: pidgin was updated to fix security issues: - Fix a crash when receiving UPnP responses with abnormally long values. (CVE-2013-0274) - Fix a crash in Sametime when a malicious server sends us an abnormally long user ID. (CVE-2013-0273) - Fix a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution.(CVE-2013-0272) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-35 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): finch-2.7.10-4.53.1 finch-debuginfo-2.7.10-4.53.1 finch-devel-2.7.10-4.53.1 libpurple-2.7.10-4.53.1 libpurple-debuginfo-2.7.10-4.53.1 libpurple-devel-2.7.10-4.53.1 libpurple-meanwhile-2.7.10-4.53.1 libpurple-meanwhile-debuginfo-2.7.10-4.53.1 libpurple-tcl-2.7.10-4.53.1 libpurple-tcl-debuginfo-2.7.10-4.53.1 pidgin-2.7.10-4.53.1 pidgin-debuginfo-2.7.10-4.53.1 pidgin-debugsource-2.7.10-4.53.1 pidgin-devel-2.7.10-4.53.1 pidgin-evolution-2.7.10-4.53.1 pidgin-evolution-debuginfo-2.7.10-4.53.1 - openSUSE 11.4 (noarch): libpurple-lang-2.7.10-4.53.1 References: http://support.novell.com/security/cve/CVE-2013-0272.html http://support.novell.com/security/cve/CVE-2013-0273.html http://support.novell.com/security/cve/CVE-2013-0274.html https://bugzilla.novell.com/804742 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0405-1: important: pidgin: various security fixes
by opensuse-security＠opensuse.org 07 Mar '13

07 Mar '13

openSUSE Security Update: pidgin: various security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0405-1 Rating: important References: #804742 Cross-References: CVE-2013-0271 CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: pidgin was updated to fix security issues: - Fix a crash when receiving UPnP responses with abnormally long values. (CVE-2013-0274) - Fix a crash in Sametime when a malicious server sends us an abnormally long user ID. (CVE-2013-0273) - Fix a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution.(CVE-2013-0272) - Fix a bug where a remote MXit user could possibly specify a local file path to be written to. (CVE-2013-0271) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-177 - openSUSE 12.1: zypper in -t patch openSUSE-2013-177 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): finch-2.10.6-1.4.1 finch-debuginfo-2.10.6-1.4.1 finch-devel-2.10.6-1.4.1 libpurple-2.10.6-1.4.1 libpurple-debuginfo-2.10.6-1.4.1 libpurple-devel-2.10.6-1.4.1 libpurple-meanwhile-2.10.6-1.4.1 libpurple-meanwhile-debuginfo-2.10.6-1.4.1 libpurple-tcl-2.10.6-1.4.1 libpurple-tcl-debuginfo-2.10.6-1.4.1 pidgin-2.10.6-1.4.1 pidgin-debuginfo-2.10.6-1.4.1 pidgin-debugsource-2.10.6-1.4.1 pidgin-devel-2.10.6-1.4.1 pidgin-evolution-2.10.6-1.4.1 pidgin-evolution-debuginfo-2.10.6-1.4.1 - openSUSE 12.2 (noarch): libpurple-branding-upstream-2.10.6-1.4.1 libpurple-lang-2.10.6-1.4.1 - openSUSE 12.1 (i586 x86_64): finch-2.10.1-8.18.1 finch-debuginfo-2.10.1-8.18.1 finch-devel-2.10.1-8.18.1 libpurple-2.10.1-8.18.1 libpurple-debuginfo-2.10.1-8.18.1 libpurple-devel-2.10.1-8.18.1 libpurple-meanwhile-2.10.1-8.18.1 libpurple-meanwhile-debuginfo-2.10.1-8.18.1 libpurple-tcl-2.10.1-8.18.1 libpurple-tcl-debuginfo-2.10.1-8.18.1 pidgin-2.10.1-8.18.1 pidgin-debuginfo-2.10.1-8.18.1 pidgin-debugsource-2.10.1-8.18.1 pidgin-devel-2.10.1-8.18.1 pidgin-evolution-2.10.1-8.18.1 pidgin-evolution-debuginfo-2.10.1-8.18.1 - openSUSE 12.1 (noarch): libpurple-branding-upstream-2.10.1-8.18.1 libpurple-lang-2.10.1-8.18.1 References: http://support.novell.com/security/cve/CVE-2013-0271.html http://support.novell.com/security/cve/CVE-2013-0272.html http://support.novell.com/security/cve/CVE-2013-0273.html http://support.novell.com/security/cve/CVE-2013-0274.html https://bugzilla.novell.com/804742 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0396-1: important: kernel: security and bugfix update
by opensuse-security＠opensuse.org 05 Mar '13

05 Mar '13

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0396-1 Rating: important References: #714906 #720226 #733148 #755546 #762693 #765524 #768506 #769784 #769896 #770695 #773406 #773831 #774285 #774523 #774859 #776144 #778630 #779432 #781134 #783515 #784192 #786013 #787168 #792500 #793671 #797175 #799209 #800280 #801178 #801782 #802153 #802642 #804154 #804652 #804738 Cross-References: CVE-2012-0957 CVE-2012-2745 CVE-2012-3412 CVE-2012-4530 CVE-2013-0160 CVE-2013-0216 CVE-2013-0231 CVE-2013-0268 CVE-2013-0309 CVE-2013-0871 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has 25 fixes is now available. Description: The Linux kernel was updated to fix various bugs and security issues: CVE-2013-0871: Race condition in the ptrace functionality in the Linux kernel allowed local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death. CVE-2013-0160: Avoid a side channel attack on /dev/ptmx (keyboard input timing). CVE-2012-5374: Fixed a local denial of service in the BTRFS hashing code. CVE-2013-0309: arch/x86/include/asm/pgtable.h in the Linux kernel, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application. CVE-2013-0268: The msr_open function in arch/x86/kernel/msr.c in the Linux kernel allowed local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c. CVE-2012-0957: The override_release function in kernel/sys.c in the Linux kernel allowed local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality. CVE-2013-0216: The Xen netback functionality in the Linux kernel allowed guest OS users to cause a denial of service (loop) by triggering ring pointer corruption. CVE-2013-0231: The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel allowed guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. NOTE: some of these details are obtained from third party information. CVE-2012-4530: The load_script function in fs/binfmt_script.c in the Linux kernel did not properly handle recursion, which allowed local users to obtain sensitive information from kernel stack memory via a crafted application. CVE-2012-4508: Race condition in fs/ext4/extents.c in the Linux kernel allowed local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized. CVE-2012-3412: The sfc (aka Solarflare Solarstorm) driver in the Linux kernel allowed remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value. CVE-2012-2745: The copy_creds function in kernel/cred.c in the Linux kernel provided an invalid replacement session keyring to a child process, which allowed local users to cause a denial of service (panic) via a crafted application that uses the fork system call. CVE-2012-3375: The epoll_ctl system call in fs/eventpoll.c in the Linux kernel did not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allowed local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel allowed remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-176 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): kernel-debug-3.1.10-1.19.1 kernel-debug-base-3.1.10-1.19.1 kernel-debug-base-debuginfo-3.1.10-1.19.1 kernel-debug-debuginfo-3.1.10-1.19.1 kernel-debug-debugsource-3.1.10-1.19.1 kernel-debug-devel-3.1.10-1.19.1 kernel-debug-devel-debuginfo-3.1.10-1.19.1 kernel-default-3.1.10-1.19.1 kernel-default-base-3.1.10-1.19.1 kernel-default-base-debuginfo-3.1.10-1.19.1 kernel-default-debuginfo-3.1.10-1.19.1 kernel-default-debugsource-3.1.10-1.19.1 kernel-default-devel-3.1.10-1.19.1 kernel-default-devel-debuginfo-3.1.10-1.19.1 kernel-desktop-3.1.10-1.19.1 kernel-desktop-base-3.1.10-1.19.1 kernel-desktop-base-debuginfo-3.1.10-1.19.1 kernel-desktop-debuginfo-3.1.10-1.19.1 kernel-desktop-debugsource-3.1.10-1.19.1 kernel-desktop-devel-3.1.10-1.19.1 kernel-desktop-devel-debuginfo-3.1.10-1.19.1 kernel-ec2-3.1.10-1.19.1 kernel-ec2-base-3.1.10-1.19.1 kernel-ec2-base-debuginfo-3.1.10-1.19.1 kernel-ec2-debuginfo-3.1.10-1.19.1 kernel-ec2-debugsource-3.1.10-1.19.1 kernel-ec2-devel-3.1.10-1.19.1 kernel-ec2-devel-debuginfo-3.1.10-1.19.1 kernel-ec2-extra-3.1.10-1.19.1 kernel-ec2-extra-debuginfo-3.1.10-1.19.1 kernel-syms-3.1.10-1.19.1 kernel-trace-3.1.10-1.19.1 kernel-trace-base-3.1.10-1.19.1 kernel-trace-base-debuginfo-3.1.10-1.19.1 kernel-trace-debuginfo-3.1.10-1.19.1 kernel-trace-debugsource-3.1.10-1.19.1 kernel-trace-devel-3.1.10-1.19.1 kernel-trace-devel-debuginfo-3.1.10-1.19.1 kernel-vanilla-3.1.10-1.19.1 kernel-vanilla-base-3.1.10-1.19.1 kernel-vanilla-base-debuginfo-3.1.10-1.19.1 kernel-vanilla-debuginfo-3.1.10-1.19.1 kernel-vanilla-debugsource-3.1.10-1.19.1 kernel-vanilla-devel-3.1.10-1.19.1 kernel-vanilla-devel-debuginfo-3.1.10-1.19.1 kernel-xen-3.1.10-1.19.1 kernel-xen-base-3.1.10-1.19.1 kernel-xen-base-debuginfo-3.1.10-1.19.1 kernel-xen-debuginfo-3.1.10-1.19.1 kernel-xen-debugsource-3.1.10-1.19.1 kernel-xen-devel-3.1.10-1.19.1 kernel-xen-devel-debuginfo-3.1.10-1.19.1 - openSUSE 12.1 (noarch): kernel-devel-3.1.10-1.19.1 kernel-docs-3.1.10-1.19.2 kernel-source-3.1.10-1.19.1 kernel-source-vanilla-3.1.10-1.19.1 - openSUSE 12.1 (i586): kernel-pae-3.1.10-1.19.1 kernel-pae-base-3.1.10-1.19.1 kernel-pae-base-debuginfo-3.1.10-1.19.1 kernel-pae-debuginfo-3.1.10-1.19.1 kernel-pae-debugsource-3.1.10-1.19.1 kernel-pae-devel-3.1.10-1.19.1 kernel-pae-devel-debuginfo-3.1.10-1.19.1 References: http://support.novell.com/security/cve/CVE-2012-0957.html http://support.novell.com/security/cve/CVE-2012-2745.html http://support.novell.com/security/cve/CVE-2012-3412.html http://support.novell.com/security/cve/CVE-2012-4530.html http://support.novell.com/security/cve/CVE-2013-0160.html http://support.novell.com/security/cve/CVE-2013-0216.html http://support.novell.com/security/cve/CVE-2013-0231.html http://support.novell.com/security/cve/CVE-2013-0268.html http://support.novell.com/security/cve/CVE-2013-0309.html http://support.novell.com/security/cve/CVE-2013-0871.html https://bugzilla.novell.com/714906 https://bugzilla.novell.com/720226 https://bugzilla.novell.com/733148 https://bugzilla.novell.com/755546 https://bugzilla.novell.com/762693 https://bugzilla.novell.com/765524 https://bugzilla.novell.com/768506 https://bugzilla.novell.com/769784 https://bugzilla.novell.com/769896 https://bugzilla.novell.com/770695 https://bugzilla.novell.com/773406 https://bugzilla.novell.com/773831 https://bugzilla.novell.com/774285 https://bugzilla.novell.com/774523 https://bugzilla.novell.com/774859 https://bugzilla.novell.com/776144 https://bugzilla.novell.com/778630 https://bugzilla.novell.com/779432 https://bugzilla.novell.com/781134 https://bugzilla.novell.com/783515 https://bugzilla.novell.com/784192 https://bugzilla.novell.com/786013 https://bugzilla.novell.com/787168 https://bugzilla.novell.com/792500 https://bugzilla.novell.com/793671 https://bugzilla.novell.com/797175 https://bugzilla.novell.com/799209 https://bugzilla.novell.com/800280 https://bugzilla.novell.com/801178 https://bugzilla.novell.com/801782 https://bugzilla.novell.com/802153 https://bugzilla.novell.com/802642 https://bugzilla.novell.com/804154 https://bugzilla.novell.com/804652 https://bugzilla.novell.com/804738 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0395-1: important: kernel: fixed local privilege escalation
by opensuse-security＠opensuse.org 05 Mar '13

05 Mar '13

openSUSE Security Update: kernel: fixed local privilege escalation ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0395-1 Rating: important References: #797175 #799209 #800280 #801178 #801782 #802153 #804738 #805633 Cross-References: CVE-2012-5374 CVE-2013-0160 CVE-2013-0216 CVE-2013-0231 CVE-2013-1763 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: The Linux kernel was updated to 3.4.33 and to fix a local root privilege escalation and various other security and non-security bugs. CVE-2013-1763: A out of bounds access in sock_diag could be used by local attackers to execute code in kernel context and so become root. CVE-2013-0160: The atime of /dev/ptmx is no longer updated, avoiding side channel attacks via user typing speed. CVE-2012-5374: Denial of service via btrfs hashes could have been used by local attackers to cause a compute denial of service. CVE-2013-0216: Fixed a problem in XEN netback: shutdown the ring if it contains garbage. CVE-2013-0231: Fixed a problem in XEN pciback: rate limit error messages from xen_pcibk_enable_msi(x). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-175 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): kernel-default-3.4.33-2.24.1 kernel-default-base-3.4.33-2.24.1 kernel-default-base-debuginfo-3.4.33-2.24.1 kernel-default-debuginfo-3.4.33-2.24.1 kernel-default-debugsource-3.4.33-2.24.1 kernel-default-devel-3.4.33-2.24.1 kernel-default-devel-debuginfo-3.4.33-2.24.1 kernel-syms-3.4.33-2.24.1 - openSUSE 12.2 (i686 x86_64): kernel-debug-3.4.33-2.24.1 kernel-debug-base-3.4.33-2.24.1 kernel-debug-base-debuginfo-3.4.33-2.24.1 kernel-debug-debuginfo-3.4.33-2.24.1 kernel-debug-debugsource-3.4.33-2.24.1 kernel-debug-devel-3.4.33-2.24.1 kernel-debug-devel-debuginfo-3.4.33-2.24.1 kernel-desktop-3.4.33-2.24.1 kernel-desktop-base-3.4.33-2.24.1 kernel-desktop-base-debuginfo-3.4.33-2.24.1 kernel-desktop-debuginfo-3.4.33-2.24.1 kernel-desktop-debugsource-3.4.33-2.24.1 kernel-desktop-devel-3.4.33-2.24.1 kernel-desktop-devel-debuginfo-3.4.33-2.24.1 kernel-ec2-3.4.33-2.24.1 kernel-ec2-base-3.4.33-2.24.1 kernel-ec2-base-debuginfo-3.4.33-2.24.1 kernel-ec2-debuginfo-3.4.33-2.24.1 kernel-ec2-debugsource-3.4.33-2.24.1 kernel-ec2-devel-3.4.33-2.24.1 kernel-ec2-devel-debuginfo-3.4.33-2.24.1 kernel-ec2-extra-3.4.33-2.24.1 kernel-ec2-extra-debuginfo-3.4.33-2.24.1 kernel-trace-3.4.33-2.24.1 kernel-trace-base-3.4.33-2.24.1 kernel-trace-base-debuginfo-3.4.33-2.24.1 kernel-trace-debuginfo-3.4.33-2.24.1 kernel-trace-debugsource-3.4.33-2.24.1 kernel-trace-devel-3.4.33-2.24.1 kernel-trace-devel-debuginfo-3.4.33-2.24.1 kernel-vanilla-3.4.33-2.24.1 kernel-vanilla-debuginfo-3.4.33-2.24.1 kernel-vanilla-debugsource-3.4.33-2.24.1 kernel-vanilla-devel-3.4.33-2.24.1 kernel-vanilla-devel-debuginfo-3.4.33-2.24.1 kernel-xen-3.4.33-2.24.1 kernel-xen-base-3.4.33-2.24.1 kernel-xen-base-debuginfo-3.4.33-2.24.1 kernel-xen-debuginfo-3.4.33-2.24.1 kernel-xen-debugsource-3.4.33-2.24.1 kernel-xen-devel-3.4.33-2.24.1 kernel-xen-devel-debuginfo-3.4.33-2.24.1 - openSUSE 12.2 (noarch): kernel-devel-3.4.33-2.24.1 kernel-docs-3.4.33-2.24.2 kernel-source-3.4.33-2.24.1 kernel-source-vanilla-3.4.33-2.24.1 - openSUSE 12.2 (i686): kernel-pae-3.4.33-2.24.1 kernel-pae-base-3.4.33-2.24.1 kernel-pae-base-debuginfo-3.4.33-2.24.1 kernel-pae-debuginfo-3.4.33-2.24.1 kernel-pae-debugsource-3.4.33-2.24.1 kernel-pae-devel-3.4.33-2.24.1 kernel-pae-devel-debuginfo-3.4.33-2.24.1 References: http://support.novell.com/security/cve/CVE-2012-5374.html http://support.novell.com/security/cve/CVE-2013-0160.html http://support.novell.com/security/cve/CVE-2013-0216.html http://support.novell.com/security/cve/CVE-2013-0231.html http://support.novell.com/security/cve/CVE-2013-1763.html https://bugzilla.novell.com/797175 https://bugzilla.novell.com/799209 https://bugzilla.novell.com/800280 https://bugzilla.novell.com/801178 https://bugzilla.novell.com/801782 https://bugzilla.novell.com/802153 https://bugzilla.novell.com/804738 https://bugzilla.novell.com/805633 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0388-1: important: Security update for pidgin
by opensuse-security＠opensuse.org 04 Mar '13

04 Mar '13

SUSE Security Update: Security update for pidgin ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0388-1 Rating: important References: #804742 Cross-References: CVE-2013-0271 CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: pidgin was updated to fix 4 security issues: * Fixed a crash when receiving UPnP responses with abnormally long values. (CVE-2013-0274, bnc#804742) * Fixed a crash in Sametime protocol when a malicious server sends us an abnormally long user ID. (CVE-2013-0273, bnc#804742) * Fixed a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution.(CVE-2013-0272, bnc#804742) * Fixed a bug where a remote MXit user could possibly specify a local file path to be written to. (CVE-2013-0271, bnc#804742) Security Issue references: * CVE-2013-0271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0271 > * CVE-2013-0272 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0272 > * CVE-2013-0273 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0273 > * CVE-2013-0274 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0274 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-finch-7429 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-finch-7429 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): finch-2.6.6-0.19.1 finch-devel-2.6.6-0.19.1 libpurple-2.6.6-0.19.1 libpurple-devel-2.6.6-0.19.1 libpurple-lang-2.6.6-0.19.1 pidgin-2.6.6-0.19.1 pidgin-devel-2.6.6-0.19.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): finch-2.6.6-0.19.1 libpurple-2.6.6-0.19.1 libpurple-lang-2.6.6-0.19.1 libpurple-meanwhile-2.6.6-0.19.1 libpurple-tcl-2.6.6-0.19.1 pidgin-2.6.6-0.19.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): finch-2.6.6-0.20.1 libpurple-2.6.6-0.20.1 pidgin-2.6.6-0.20.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): finch-2.6.6-0.20.1 finch-devel-2.6.6-0.20.1 libpurple-2.6.6-0.20.1 libpurple-devel-2.6.6-0.20.1 pidgin-2.6.6-0.20.1 pidgin-devel-2.6.6-0.20.1 References: http://support.novell.com/security/cve/CVE-2013-0271.html http://support.novell.com/security/cve/CVE-2013-0272.html http://support.novell.com/security/cve/CVE-2013-0273.html http://support.novell.com/security/cve/CVE-2013-0274.html https://bugzilla.novell.com/804742 http://download.novell.com/patch/finder/?keywords=18e124b7db8b5f6aa5744f916… http://download.novell.com/patch/finder/?keywords=51b5f7c142afdeafafca33c1a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0378-1: important: java-1_6_0-openjdk: update to icedtea 1.12.3
by opensuse-security＠opensuse.org 01 Mar '13

01 Mar '13

openSUSE Security Update: java-1_6_0-openjdk: update to icedtea 1.12.3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0378-1 Rating: important References: #801972 #804654 Cross-References: CVE-2013-0169 CVE-2013-1486 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_6_0-openjdk was updated to IcedTea 1.12.3 (bnc#804654) containing security and bugfixes: * Security fixes - S8006446: Restrict MBeanServer access (CVE-2013-1486) - S8006777: Improve TLS handling of invalid messages Lucky 13 (CVE-2013-0169) - S8007688: Blacklist known bad certificate (issued by DigiCert) * Backports - S8007393: Possible race condition after JDK-6664509 - S8007611: logging behavior in applet changed * Bug fixes - PR1319: Support GIF lib v5. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-33 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-debuginfo-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-debugsource-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-demo-debuginfo-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-devel-debuginfo-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-src-1.6.0.0_b27.1.12.3-29.1 References: http://support.novell.com/security/cve/CVE-2013-0169.html http://support.novell.com/security/cve/CVE-2013-1486.html https://bugzilla.novell.com/801972 https://bugzilla.novell.com/804654 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0377-1: critical: java-1_7_0-openjdk: update to 2.3.6
by opensuse-security＠opensuse.org 01 Mar '13

01 Mar '13

openSUSE Security Update: java-1_7_0-openjdk: update to 2.3.6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0377-1 Rating: critical References: #803379 Cross-References: CVE-2013-0424 CVE-2013-0425 CVE-2013-0426 CVE-2013-0427 CVE-2013-0428 CVE-2013-0429 CVE-2013-0431 CVE-2013-0432 CVE-2013-0433 CVE-2013-0434 CVE-2013-0435 CVE-2013-0440 CVE-2013-0441 CVE-2013-0442 CVE-2013-0443 CVE-2013-0444 CVE-2013-0450 CVE-2013-1475 CVE-2013-1476 CVE-2013-1478 CVE-2013-1480 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: java-1_7_0-openjdk was updated to icedtea-2.3.6 (bnc#803379) containing various security and bugfixes: * Security fixes - S6563318, CVE-2013-0424: RMI data sanitization - S6664509, CVE-2013-0425: Add logging context - S6664528, CVE-2013-0426: Find log level matching its name or value given at construction time - S6776941: CVE-2013-0427: Improve thread pool shutdown - S7141694, CVE-2013-0429: Improving CORBA internals - S7173145: Improve in-memory representation of splashscreens - S7186945: Unpack200 improvement - S7186946: Refine unpacker resource usage - S7186948: Improve Swing data validation - S7186952, CVE-2013-0432: Improve clipboard access - S7186954: Improve connection performance - S7186957: Improve Pack200 data validation - S7192392, CVE-2013-0443: Better validation of client keys - S7192393, CVE-2013-0440: Better Checking of order of TLS Messages - S7192977, CVE-2013-0442: Issue in toolkit thread - S7197546, CVE-2013-0428: (proxy) Reflect about creating reflective proxies - S7200491: Tighten up JTable layout code - S7200493, CVE-2013-0444: Improve cache handling - S7200499: Better data validation for options - S7200500: Launcher better input validation - S7201064: Better dialogue checking - S7201066, CVE-2013-0441: Change modifiers on unused fields - S7201068, CVE-2013-0435: Better handling of UI elements - S7201070: Serialization to conform to protocol - S7201071, CVE-2013-0433: InetSocketAddress serialization issue - S8000210: Improve JarFile code quality - S8000537, CVE-2013-0450: Contextualize RequiredModelMBean class - S8000539, CVE-2013-0431: Introspect JMX data handling - S8000540, CVE-2013-1475: Improve IIOP type reuse management - S8000631, CVE-2013-1476: Restrict access to class constructor - S8001235, CVE-2013-0434: Improve JAXP HTTP handling - S8001242: Improve RMI HTTP conformance - S8001307: Modify ACC_SUPER behavior - S8001972, CVE-2013-1478: Improve image processing - S8002325, CVE-2013-1480: Improve management of images * Backports - S7057320: test/java/util/concurrent/Executors/AutoShutdown.java failing intermittently - S7083664: TEST_BUG: test hard code of using c:/temp but this dir might not exist - S7107613: scalability blocker in javax.crypto.CryptoPermissions - S7107616: scalability blocker in javax.crypto.JceSecurityManager - S7146424: Wildcard expansion for single entry classpath - S7160609: [macosx] JDK crash in libjvm.dylib ( C [GeForceGLDriver+0x675a] gldAttachDrawable+0x941) - S7160951: [macosx] ActionListener called twice for JMenuItem using ScreenMenuBar - S7162488: VM not printing unknown -XX options - S7169395: Exception throws due to the changes in JDK 7 object tranversal and break backward compatibility - S7175616: Port fix for TimeZone from JDK 8 to JDK 7 - S7176485: (bf) Allow temporary buffer cache to grow to IOV_MAX - S7179908: Fork hs23.3 hsx from hs22.2 for jdk7u7 and reinitialize build number - S7184326: TEST_BUG: java/awt/Frame/7024749/bug7024749.java has a typo - S7185245: Licensee source bundle tries to compile JFR - S7185471: Avoid key expansion when AES cipher is re-init w/ the same key - S7186371: [macosx] Main menu shortcuts not displayed (7u6 regression) - S7187834: [macosx] Usage of private API in macosx 2d implementation causes Apple Store rejection - S7188114: (launcher) need an alternate command line parser for Windows - S7189136: Fork hs23.5 hsx from hs23.4 for jdk7u9 and reinitialize build number - S7189350: Fix failed for CR 7162144 - S7190550: REGRESSION: Some closed/com/oracle/jfr/api tests fail to compile becuse of fix 7185245 - S7193219: JComboBox serialization fails in JDK 1.7 - S7193977: REGRESSION:Java 7's JavaBeans persistence ignoring the "transient" flag on properties - S7195106: REGRESSION : There is no way to get Icon inf, once Softreference is released - S7195301: XML Signature DOM implementation should not use instanceof to determine type of Node - S7195931: UnsatisfiedLinkError on PKCS11.C_GetOperationState while using NSS from jre7u6+ - S7197071: Makefiles for various security providers aren't including the default manifest. - S7197652: Impossible to run any signed JNLP applications or applets, OCSP off by default - S7198146: Another new regression test does not compile on windows-amd64 - S7198570: (tz) Support tzdata2012f - S7198640: new hotspot build - hs23.6-b04 - S7199488: [TEST] runtime/7158800/InternTest.java failed due to false-positive on PID match. - S7199645: Increment build # of hs23.5 to b02 - S7199669: Update tags in .hgtags file for CPU release rename - S7200720: crash in net.dll during NTLM authentication - S7200742: (se) Selector.select does not block when starting Coherence (sol11u1) - S7200762: [macosx] Stuck in sun.java2d.opengl.CGLGraphicsConfig.getMaxTextureSize(Native Method) - S8000285: Deadlock between PostEventQueue.noEvents, EventQueue.isDispatchThread and SwingUtilities.invokeLater - S8000286: [macosx] Views keep scrolling back to the drag position after DnD - S8000297: REGRESSION: closed/java/awt/EventQueue/PostEventOrderingTest.java fails - S8000307: Jre7cert: focusgained does not get called for all focus req when do alt + tab - S8000822: Fork hs23.7 hsx from hs23.6 for jdk7u11 and reinitialize build number - S8001124: jdk7u ProblemList.txt updates (10/2012) - S8001242: Improve RMI HTTP conformance - S8001808: Create a test for 8000327 - S8001876: Create regtest for 8000283 - S8002068: Build broken: corba code changes unable to use new JDK 7 classes - S8002091: tools/launcher/ToolsOpts.java test started to fail since 7u11 b01 on Windows - S8002114: fix failed for JDK-7160951: [macosx] ActionListener called twice for JMenuItem using ScreenMenuBar - S8002225: (tz) Support tzdata2012i - S8003402: (dc) test/java/nio/channels/DatagramChannel/SendToUnresovled.java failing after 7u11 cleanup issues - S8003403: Test ShortRSAKeyWithinTLS and ClientJSSEServerJSSE failing after 7u11 cleanup - S8003948: NTLM/Negotiate authentication problem - S8004175: Restricted packages added in java.security are missing in java.security-{macosx, solaris, windows} - S8004302: javax/xml/soap/Test7013971.java fails since jdk6u39b01 - S8004341: Two JCK tests fails with 7u11 b06 - S8005615: Java Logger fails to load tomcat logger implementation (JULI) * Bug fixes - Fix build using Zero's HotSpot so all patches apply again. - PR1295: jamvm parallel unpack failure * removed icedtea-2.3.2-fix-extract-jamvm-dependency.patch - removed icedtea-2.3.3-refresh-6924259-string_offset.patch - few missing /openjdk/%{origin}/ changes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-165 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.6-3.26.1 java-1_7_0-openjdk-debuginfo-1.7.0.6-3.26.1 java-1_7_0-openjdk-debugsource-1.7.0.6-3.26.1 java-1_7_0-openjdk-demo-1.7.0.6-3.26.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.6-3.26.1 java-1_7_0-openjdk-devel-1.7.0.6-3.26.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.6-3.26.1 java-1_7_0-openjdk-javadoc-1.7.0.6-3.26.1 java-1_7_0-openjdk-src-1.7.0.6-3.26.1 References: http://support.novell.com/security/cve/CVE-2013-0424.html http://support.novell.com/security/cve/CVE-2013-0425.html http://support.novell.com/security/cve/CVE-2013-0426.html http://support.novell.com/security/cve/CVE-2013-0427.html http://support.novell.com/security/cve/CVE-2013-0428.html http://support.novell.com/security/cve/CVE-2013-0429.html http://support.novell.com/security/cve/CVE-2013-0431.html http://support.novell.com/security/cve/CVE-2013-0432.html http://support.novell.com/security/cve/CVE-2013-0433.html http://support.novell.com/security/cve/CVE-2013-0434.html http://support.novell.com/security/cve/CVE-2013-0435.html http://support.novell.com/security/cve/CVE-2013-0440.html http://support.novell.com/security/cve/CVE-2013-0441.html http://support.novell.com/security/cve/CVE-2013-0442.html http://support.novell.com/security/cve/CVE-2013-0443.html http://support.novell.com/security/cve/CVE-2013-0444.html http://support.novell.com/security/cve/CVE-2013-0450.html http://support.novell.com/security/cve/CVE-2013-1475.html http://support.novell.com/security/cve/CVE-2013-1476.html http://support.novell.com/security/cve/CVE-2013-1478.html http://support.novell.com/security/cve/CVE-2013-1480.html https://bugzilla.novell.com/803379 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0375-1: important: java-1_6_0-openjdk: update to icedtea 1.12.3
by opensuse-security＠opensuse.org 01 Mar '13

01 Mar '13

openSUSE Security Update: java-1_6_0-openjdk: update to icedtea 1.12.3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0375-1 Rating: important References: #804654 Cross-References: CVE-2013-0169 CVE-2013-1486 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_6_0-openjdk was updated to IcedTea 1.12.3 (bnc#804654) containing security and bugfixes: * Security fixes - S8006446: Restrict MBeanServer access (CVE-2013-1486) - S8006777: Improve TLS handling of invalid messages Lucky 13 (CVE-2013-0169) - S8007688: Blacklist known bad certificate (issued by DigiCert) * Backports - S8007393: Possible race condition after JDK-6664509 - S8007611: logging behavior in applet changed * Bug fixes - PR1319: Support GIF lib v5. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-164 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-debuginfo-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-debugsource-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-demo-debuginfo-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-devel-debuginfo-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-src-1.6.0.0_b27.1.12.3-28.1 References: http://support.novell.com/security/cve/CVE-2013-0169.html http://support.novell.com/security/cve/CVE-2013-1486.html https://bugzilla.novell.com/804654 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0