March 2013 - openSUSE Security Announce

[security-announce] openSUSE-SU-2013:0438-1: important: java-1_6_0-openjdk: update to 1.12.4
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

openSUSE Security Update: java-1_6_0-openjdk: update to 1.12.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0438-1 Rating: important References: #807487 Cross-References: CVE-2013-0809 CVE-2013-1493 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_6_0-openjdk aka IcedTea was updated to 1.12.4 - S8007014, CVE-2013-0809: Improve image handling - S8007675, CVE-2013-1493: Improve color conversion Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-39 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-debuginfo-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-debugsource-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-demo-debuginfo-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-devel-debuginfo-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-src-1.6.0.0_b27.1.12.4-33.1 References: http://support.novell.com/security/cve/CVE-2013-0809.html http://support.novell.com/security/cve/CVE-2013-1493.html https://bugzilla.novell.com/807487 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0434-1: critical: Security update for Java
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

SUSE Security Update: Security update for Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0434-1 Rating: critical References: #807487 Cross-References: CVE-2013-0809 CVE-2013-1493 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This release of Icedtea6-1.12.4 fixes the following two issues that allowed a remote attacker to execute arbitrary code remotely by providing crafted images to the affected code. * CVE-2013-0809: CVSS v2 Base Score: 6.8 (critical) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Insufficient Information (CWE-noinfo) * CVE-2013-1493: CVSS v2 Base Score: 6.8 (critical) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119) Security Issue references: * CVE-2013-0809 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0809 > * CVE-2013-1493 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1493 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-java-1_6_0-openjdk-7457 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b27.1.12.4-0.2.1 java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.4-0.2.1 java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.4-0.2.1 References: http://support.novell.com/security/cve/CVE-2013-0809.html http://support.novell.com/security/cve/CVE-2013-1493.html https://bugzilla.novell.com/807487 http://download.novell.com/patch/finder/?keywords=b123f43a2f91b666216183687… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0431-1: important: Mozilla updates (FF 19.0.2, SM 2.16.1, TB 17.0.4)
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

openSUSE Security Update: Mozilla updates (FF 19.0.2, SM 2.16.1, TB 17.0.4) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0431-1 Rating: important References: #808243 Cross-References: CVE-2013-0787 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Update to - Firefox 19.0.2 - Seamonkey 2.16.1 - Thunderbird 17.0.4 which fix a use-after-free in HTML Editor which could allow for arbitrary code execution. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-38 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-19.0.2-65.1 MozillaFirefox-branding-upstream-19.0.2-65.1 MozillaFirefox-buildsymbols-19.0.2-65.1 MozillaFirefox-debuginfo-19.0.2-65.1 MozillaFirefox-debugsource-19.0.2-65.1 MozillaFirefox-devel-19.0.2-65.1 MozillaFirefox-translations-common-19.0.2-65.1 MozillaFirefox-translations-other-19.0.2-65.1 MozillaThunderbird-17.0.4-53.1 MozillaThunderbird-buildsymbols-17.0.4-53.1 MozillaThunderbird-debuginfo-17.0.4-53.1 MozillaThunderbird-debugsource-17.0.4-53.1 MozillaThunderbird-devel-17.0.4-53.1 MozillaThunderbird-devel-debuginfo-17.0.4-53.1 MozillaThunderbird-translations-common-17.0.4-53.1 MozillaThunderbird-translations-other-17.0.4-53.1 enigmail-1.5.1+17.0.4-53.1 enigmail-debuginfo-1.5.1+17.0.4-53.1 seamonkey-2.16.1-57.1 seamonkey-debuginfo-2.16.1-57.1 seamonkey-debugsource-2.16.1-57.1 seamonkey-dom-inspector-2.16.1-57.1 seamonkey-irc-2.16.1-57.1 seamonkey-translations-common-2.16.1-57.1 seamonkey-translations-other-2.16.1-57.1 seamonkey-venkman-2.16.1-57.1 References: http://support.novell.com/security/cve/CVE-2013-0787.html https://bugzilla.novell.com/808243 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0430-1: important: java-1_6_0-openjdk: update to 1.12.4
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

openSUSE Security Update: java-1_6_0-openjdk: update to 1.12.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0430-1 Rating: important References: #807487 Cross-References: CVE-2013-0809 CVE-2013-1493 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_6_0-openjdk aka IcedTea was updated to 1.12.4 (bnc#807487) - S8007014, CVE-2013-0809: Improve image handling - S8007675, CVE-2013-1493: Improve color conversion Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-198 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-debuginfo-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-debugsource-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-demo-debuginfo-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-devel-debuginfo-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b27.1.12.4-32.1 java-1_6_0-openjdk-src-1.6.0.0_b27.1.12.4-32.1 References: http://support.novell.com/security/cve/CVE-2013-0809.html http://support.novell.com/security/cve/CVE-2013-1493.html https://bugzilla.novell.com/807487 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0410-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 08 Mar '13

08 Mar '13

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0410-1 Rating: important References: #804248 #806669 Cross-References: CVE-2013-0765 CVE-2013-0772 CVE-2013-0773 CVE-2013-0774 CVE-2013-0775 CVE-2013-0776 CVE-2013-0780 CVE-2013-0782 CVE-2013-0783 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. It includes three new package versions. Description: MozillaFirefox has been updated to the 17.0.3ESR release. Important: due to compatibility issues, the Beagle plug-in for MozillaFirefox is temporarily disabled by this update. Besides the major version update from the 10ESR stable release line to the 17ESR stable release line, this update brings critical security and bugfixes: * MFSA 2013-28: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a series of use-after-free, out of bounds read, and buffer overflow problems rated as low to critical security issues in shipped software. Some of these issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting four additional use-after-free and out of bounds write flaws introduced during Firefox development that were fixed before general release. * The following issues have been fixed in Firefox 19 and ESR 17.0.3: o Heap-use-after-free in nsOverflowContinuationTracker::Finish, with -moz-columns (CVE-2013-0780) o Heap-buffer-overflow WRITE in nsSaveAsCharset::DoCharsetConversion (CVE-2013-0782) * MFSA 2013-27 / CVE-2013-0776: Google security researcher Michal Zalewski reported an issue where the browser displayed the content of a proxy's 407 response if a user canceled the proxy's authentication prompt. In this circumstance, the addressbar will continue to show the requested site's address, including HTTPS addresses that appear to be secure. This spoofing of addresses can be used for phishing attacks by fooling users into entering credentials, for example. * MFSA 2013-26 / CVE-2013-0775: Security researcher Nils reported a use-after-free in nsImageLoadingContent when content script is executed. This could allow for arbitrary code execution. * MFSA 2013-25 / CVE-2013-0774: Mozilla security researcher Frederik Braun discovered that since Firefox 15 the file system location of the active browser profile was available to JavaScript workers. While not dangerous by itself, this could potentially be combined with other vulnerabilities to target the profile in an attack. * MFSA 2013-24 / CVE-2013-0773: Mozilla developer Bobby Holley discovered that it was possible to bypass some protections in Chrome Object Wrappers (COW) and System Only Wrappers (SOW), making their prototypes mutable by web content. This could be used leak information from chrome objects and possibly allow for arbitrary code execution. * MFSA 2013-23 / CVE-2013-0765: Mozilla developer Boris Zbarsky reported that in some circumstances a wrapped WebIDL object can be wrapped multiple times, overwriting the existing wrapped state. This could lead to an exploitable condition in rare cases. * MFSA 2013-22 / CVE-2013-0772: Using the Address Sanitizer tool, security researcher Atte Kettunen from OUSPG found an out-of-bounds read while rendering GIF format images. This could cause a non-exploitable crash and could also attempt to render normally inaccesible data as part of the image. * MFSA 2013-21: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Olli Pettay, Christoph Diehl, Gary Kwong, Jesse Ruderman, Andrew McCreight, Joe Drew, and Wayne Mery reported memory safety problems and crashes that affect Firefox ESR 17, and Firefox 18. * Memory safety bugs fixed in Firefox ESR 17.0.3, and Firefox 19 (CVE-2013-0783). Security Issue references: * CVE-2013-0780 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0780 > * CVE-2013-0782 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0782 > * CVE-2013-0776 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0776 > * CVE-2013-0775 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0775 > * CVE-2013-0774 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0774 > * CVE-2013-0773 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0773 > * CVE-2013-0765 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0765 > * CVE-2013-0772 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0772 > * CVE-2013-0783 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0783 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-firefox-201303-7447 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-firefox-201303-7447 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-firefox-201303-7447 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-firefox-201303-7447 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.14.2 and 4.9.5]: mozilla-nspr-devel-4.9.5-0.3.2 mozilla-nss-devel-3.14.2-0.4.3.2 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 s390x x86_64): beagle-0.3.8-56.51.1 beagle-lang-0.3.8-56.44.45.129 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): beagle-devel-0.3.8-56.51.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 17.0.3esr,3.14.2 and 4.9.5]: MozillaFirefox-17.0.3esr-0.4.4.1 MozillaFirefox-translations-17.0.3esr-0.4.4.1 libfreebl3-3.14.2-0.4.3.2 mozilla-nspr-4.9.5-0.3.2 mozilla-nss-3.14.2-0.4.3.2 mozilla-nss-tools-3.14.2-0.4.3.2 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 3.14.2 and 4.9.5]: libfreebl3-32bit-3.14.2-0.4.3.2 mozilla-nspr-32bit-4.9.5-0.3.2 mozilla-nss-32bit-3.14.2-0.4.3.2 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 17.0.3esr,3.14.2 and 4.9.5]: MozillaFirefox-17.0.3esr-0.4.4.1 MozillaFirefox-branding-SLED-7-0.6.9.5 MozillaFirefox-translations-17.0.3esr-0.4.4.1 libfreebl3-3.14.2-0.4.3.2 mozilla-nspr-4.9.5-0.3.2 mozilla-nss-3.14.2-0.4.3.2 mozilla-nss-tools-3.14.2-0.4.3.2 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 3.14.2 and 4.9.5]: libfreebl3-32bit-3.14.2-0.4.3.2 mozilla-nspr-32bit-4.9.5-0.3.2 mozilla-nss-32bit-3.14.2-0.4.3.2 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 3.14.2 and 4.9.5]: libfreebl3-x86-3.14.2-0.4.3.2 mozilla-nspr-x86-4.9.5-0.3.2 mozilla-nss-x86-3.14.2-0.4.3.2 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 17.0.3esr,3.14.2 and 4.9.5]: MozillaFirefox-17.0.3esr-0.4.4.1 MozillaFirefox-branding-SLED-7-0.6.9.5 MozillaFirefox-translations-17.0.3esr-0.4.4.1 beagle-0.3.8-56.51.1 beagle-evolution-0.3.8-56.51.1 beagle-firefox-0.3.8-56.51.1 beagle-gui-0.3.8-56.51.1 beagle-lang-0.3.8-56.51.1 libfreebl3-3.14.2-0.4.3.2 mhtml-firefox-0.5-1.47.51.5 mozilla-nspr-4.9.5-0.3.2 mozilla-nss-3.14.2-0.4.3.2 mozilla-nss-tools-3.14.2-0.4.3.2 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 3.14.2 and 4.9.5]: libfreebl3-32bit-3.14.2-0.4.3.2 mozilla-nspr-32bit-4.9.5-0.3.2 mozilla-nss-32bit-3.14.2-0.4.3.2 References: http://support.novell.com/security/cve/CVE-2013-0765.html http://support.novell.com/security/cve/CVE-2013-0772.html http://support.novell.com/security/cve/CVE-2013-0773.html http://support.novell.com/security/cve/CVE-2013-0774.html http://support.novell.com/security/cve/CVE-2013-0775.html http://support.novell.com/security/cve/CVE-2013-0776.html http://support.novell.com/security/cve/CVE-2013-0780.html http://support.novell.com/security/cve/CVE-2013-0782.html http://support.novell.com/security/cve/CVE-2013-0783.html https://bugzilla.novell.com/804248 https://bugzilla.novell.com/806669 http://download.novell.com/patch/finder/?keywords=8807d796dff1dcb5ceabc4ae6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0407-1: important: pidgin: various security fixes
by opensuse-security＠opensuse.org 07 Mar '13

07 Mar '13

openSUSE Security Update: pidgin: various security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0407-1 Rating: important References: #804742 Cross-References: CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: pidgin was updated to fix security issues: - Fix a crash when receiving UPnP responses with abnormally long values. (CVE-2013-0274) - Fix a crash in Sametime when a malicious server sends us an abnormally long user ID. (CVE-2013-0273) - Fix a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution.(CVE-2013-0272) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-35 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): finch-2.7.10-4.53.1 finch-debuginfo-2.7.10-4.53.1 finch-devel-2.7.10-4.53.1 libpurple-2.7.10-4.53.1 libpurple-debuginfo-2.7.10-4.53.1 libpurple-devel-2.7.10-4.53.1 libpurple-meanwhile-2.7.10-4.53.1 libpurple-meanwhile-debuginfo-2.7.10-4.53.1 libpurple-tcl-2.7.10-4.53.1 libpurple-tcl-debuginfo-2.7.10-4.53.1 pidgin-2.7.10-4.53.1 pidgin-debuginfo-2.7.10-4.53.1 pidgin-debugsource-2.7.10-4.53.1 pidgin-devel-2.7.10-4.53.1 pidgin-evolution-2.7.10-4.53.1 pidgin-evolution-debuginfo-2.7.10-4.53.1 - openSUSE 11.4 (noarch): libpurple-lang-2.7.10-4.53.1 References: http://support.novell.com/security/cve/CVE-2013-0272.html http://support.novell.com/security/cve/CVE-2013-0273.html http://support.novell.com/security/cve/CVE-2013-0274.html https://bugzilla.novell.com/804742 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0405-1: important: pidgin: various security fixes
by opensuse-security＠opensuse.org 07 Mar '13

07 Mar '13

openSUSE Security Update: pidgin: various security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0405-1 Rating: important References: #804742 Cross-References: CVE-2013-0271 CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: pidgin was updated to fix security issues: - Fix a crash when receiving UPnP responses with abnormally long values. (CVE-2013-0274) - Fix a crash in Sametime when a malicious server sends us an abnormally long user ID. (CVE-2013-0273) - Fix a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution.(CVE-2013-0272) - Fix a bug where a remote MXit user could possibly specify a local file path to be written to. (CVE-2013-0271) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-177 - openSUSE 12.1: zypper in -t patch openSUSE-2013-177 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): finch-2.10.6-1.4.1 finch-debuginfo-2.10.6-1.4.1 finch-devel-2.10.6-1.4.1 libpurple-2.10.6-1.4.1 libpurple-debuginfo-2.10.6-1.4.1 libpurple-devel-2.10.6-1.4.1 libpurple-meanwhile-2.10.6-1.4.1 libpurple-meanwhile-debuginfo-2.10.6-1.4.1 libpurple-tcl-2.10.6-1.4.1 libpurple-tcl-debuginfo-2.10.6-1.4.1 pidgin-2.10.6-1.4.1 pidgin-debuginfo-2.10.6-1.4.1 pidgin-debugsource-2.10.6-1.4.1 pidgin-devel-2.10.6-1.4.1 pidgin-evolution-2.10.6-1.4.1 pidgin-evolution-debuginfo-2.10.6-1.4.1 - openSUSE 12.2 (noarch): libpurple-branding-upstream-2.10.6-1.4.1 libpurple-lang-2.10.6-1.4.1 - openSUSE 12.1 (i586 x86_64): finch-2.10.1-8.18.1 finch-debuginfo-2.10.1-8.18.1 finch-devel-2.10.1-8.18.1 libpurple-2.10.1-8.18.1 libpurple-debuginfo-2.10.1-8.18.1 libpurple-devel-2.10.1-8.18.1 libpurple-meanwhile-2.10.1-8.18.1 libpurple-meanwhile-debuginfo-2.10.1-8.18.1 libpurple-tcl-2.10.1-8.18.1 libpurple-tcl-debuginfo-2.10.1-8.18.1 pidgin-2.10.1-8.18.1 pidgin-debuginfo-2.10.1-8.18.1 pidgin-debugsource-2.10.1-8.18.1 pidgin-devel-2.10.1-8.18.1 pidgin-evolution-2.10.1-8.18.1 pidgin-evolution-debuginfo-2.10.1-8.18.1 - openSUSE 12.1 (noarch): libpurple-branding-upstream-2.10.1-8.18.1 libpurple-lang-2.10.1-8.18.1 References: http://support.novell.com/security/cve/CVE-2013-0271.html http://support.novell.com/security/cve/CVE-2013-0272.html http://support.novell.com/security/cve/CVE-2013-0273.html http://support.novell.com/security/cve/CVE-2013-0274.html https://bugzilla.novell.com/804742 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0396-1: important: kernel: security and bugfix update
by opensuse-security＠opensuse.org 05 Mar '13

05 Mar '13

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0396-1 Rating: important References: #714906 #720226 #733148 #755546 #762693 #765524 #768506 #769784 #769896 #770695 #773406 #773831 #774285 #774523 #774859 #776144 #778630 #779432 #781134 #783515 #784192 #786013 #787168 #792500 #793671 #797175 #799209 #800280 #801178 #801782 #802153 #802642 #804154 #804652 #804738 Cross-References: CVE-2012-0957 CVE-2012-2745 CVE-2012-3412 CVE-2012-4530 CVE-2013-0160 CVE-2013-0216 CVE-2013-0231 CVE-2013-0268 CVE-2013-0309 CVE-2013-0871 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has 25 fixes is now available. Description: The Linux kernel was updated to fix various bugs and security issues: CVE-2013-0871: Race condition in the ptrace functionality in the Linux kernel allowed local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death. CVE-2013-0160: Avoid a side channel attack on /dev/ptmx (keyboard input timing). CVE-2012-5374: Fixed a local denial of service in the BTRFS hashing code. CVE-2013-0309: arch/x86/include/asm/pgtable.h in the Linux kernel, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application. CVE-2013-0268: The msr_open function in arch/x86/kernel/msr.c in the Linux kernel allowed local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c. CVE-2012-0957: The override_release function in kernel/sys.c in the Linux kernel allowed local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality. CVE-2013-0216: The Xen netback functionality in the Linux kernel allowed guest OS users to cause a denial of service (loop) by triggering ring pointer corruption. CVE-2013-0231: The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel allowed guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. NOTE: some of these details are obtained from third party information. CVE-2012-4530: The load_script function in fs/binfmt_script.c in the Linux kernel did not properly handle recursion, which allowed local users to obtain sensitive information from kernel stack memory via a crafted application. CVE-2012-4508: Race condition in fs/ext4/extents.c in the Linux kernel allowed local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized. CVE-2012-3412: The sfc (aka Solarflare Solarstorm) driver in the Linux kernel allowed remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value. CVE-2012-2745: The copy_creds function in kernel/cred.c in the Linux kernel provided an invalid replacement session keyring to a child process, which allowed local users to cause a denial of service (panic) via a crafted application that uses the fork system call. CVE-2012-3375: The epoll_ctl system call in fs/eventpoll.c in the Linux kernel did not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allowed local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel allowed remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-176 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): kernel-debug-3.1.10-1.19.1 kernel-debug-base-3.1.10-1.19.1 kernel-debug-base-debuginfo-3.1.10-1.19.1 kernel-debug-debuginfo-3.1.10-1.19.1 kernel-debug-debugsource-3.1.10-1.19.1 kernel-debug-devel-3.1.10-1.19.1 kernel-debug-devel-debuginfo-3.1.10-1.19.1 kernel-default-3.1.10-1.19.1 kernel-default-base-3.1.10-1.19.1 kernel-default-base-debuginfo-3.1.10-1.19.1 kernel-default-debuginfo-3.1.10-1.19.1 kernel-default-debugsource-3.1.10-1.19.1 kernel-default-devel-3.1.10-1.19.1 kernel-default-devel-debuginfo-3.1.10-1.19.1 kernel-desktop-3.1.10-1.19.1 kernel-desktop-base-3.1.10-1.19.1 kernel-desktop-base-debuginfo-3.1.10-1.19.1 kernel-desktop-debuginfo-3.1.10-1.19.1 kernel-desktop-debugsource-3.1.10-1.19.1 kernel-desktop-devel-3.1.10-1.19.1 kernel-desktop-devel-debuginfo-3.1.10-1.19.1 kernel-ec2-3.1.10-1.19.1 kernel-ec2-base-3.1.10-1.19.1 kernel-ec2-base-debuginfo-3.1.10-1.19.1 kernel-ec2-debuginfo-3.1.10-1.19.1 kernel-ec2-debugsource-3.1.10-1.19.1 kernel-ec2-devel-3.1.10-1.19.1 kernel-ec2-devel-debuginfo-3.1.10-1.19.1 kernel-ec2-extra-3.1.10-1.19.1 kernel-ec2-extra-debuginfo-3.1.10-1.19.1 kernel-syms-3.1.10-1.19.1 kernel-trace-3.1.10-1.19.1 kernel-trace-base-3.1.10-1.19.1 kernel-trace-base-debuginfo-3.1.10-1.19.1 kernel-trace-debuginfo-3.1.10-1.19.1 kernel-trace-debugsource-3.1.10-1.19.1 kernel-trace-devel-3.1.10-1.19.1 kernel-trace-devel-debuginfo-3.1.10-1.19.1 kernel-vanilla-3.1.10-1.19.1 kernel-vanilla-base-3.1.10-1.19.1 kernel-vanilla-base-debuginfo-3.1.10-1.19.1 kernel-vanilla-debuginfo-3.1.10-1.19.1 kernel-vanilla-debugsource-3.1.10-1.19.1 kernel-vanilla-devel-3.1.10-1.19.1 kernel-vanilla-devel-debuginfo-3.1.10-1.19.1 kernel-xen-3.1.10-1.19.1 kernel-xen-base-3.1.10-1.19.1 kernel-xen-base-debuginfo-3.1.10-1.19.1 kernel-xen-debuginfo-3.1.10-1.19.1 kernel-xen-debugsource-3.1.10-1.19.1 kernel-xen-devel-3.1.10-1.19.1 kernel-xen-devel-debuginfo-3.1.10-1.19.1 - openSUSE 12.1 (noarch): kernel-devel-3.1.10-1.19.1 kernel-docs-3.1.10-1.19.2 kernel-source-3.1.10-1.19.1 kernel-source-vanilla-3.1.10-1.19.1 - openSUSE 12.1 (i586): kernel-pae-3.1.10-1.19.1 kernel-pae-base-3.1.10-1.19.1 kernel-pae-base-debuginfo-3.1.10-1.19.1 kernel-pae-debuginfo-3.1.10-1.19.1 kernel-pae-debugsource-3.1.10-1.19.1 kernel-pae-devel-3.1.10-1.19.1 kernel-pae-devel-debuginfo-3.1.10-1.19.1 References: http://support.novell.com/security/cve/CVE-2012-0957.html http://support.novell.com/security/cve/CVE-2012-2745.html http://support.novell.com/security/cve/CVE-2012-3412.html http://support.novell.com/security/cve/CVE-2012-4530.html http://support.novell.com/security/cve/CVE-2013-0160.html http://support.novell.com/security/cve/CVE-2013-0216.html http://support.novell.com/security/cve/CVE-2013-0231.html http://support.novell.com/security/cve/CVE-2013-0268.html http://support.novell.com/security/cve/CVE-2013-0309.html http://support.novell.com/security/cve/CVE-2013-0871.html https://bugzilla.novell.com/714906 https://bugzilla.novell.com/720226 https://bugzilla.novell.com/733148 https://bugzilla.novell.com/755546 https://bugzilla.novell.com/762693 https://bugzilla.novell.com/765524 https://bugzilla.novell.com/768506 https://bugzilla.novell.com/769784 https://bugzilla.novell.com/769896 https://bugzilla.novell.com/770695 https://bugzilla.novell.com/773406 https://bugzilla.novell.com/773831 https://bugzilla.novell.com/774285 https://bugzilla.novell.com/774523 https://bugzilla.novell.com/774859 https://bugzilla.novell.com/776144 https://bugzilla.novell.com/778630 https://bugzilla.novell.com/779432 https://bugzilla.novell.com/781134 https://bugzilla.novell.com/783515 https://bugzilla.novell.com/784192 https://bugzilla.novell.com/786013 https://bugzilla.novell.com/787168 https://bugzilla.novell.com/792500 https://bugzilla.novell.com/793671 https://bugzilla.novell.com/797175 https://bugzilla.novell.com/799209 https://bugzilla.novell.com/800280 https://bugzilla.novell.com/801178 https://bugzilla.novell.com/801782 https://bugzilla.novell.com/802153 https://bugzilla.novell.com/802642 https://bugzilla.novell.com/804154 https://bugzilla.novell.com/804652 https://bugzilla.novell.com/804738 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0395-1: important: kernel: fixed local privilege escalation
by opensuse-security＠opensuse.org 05 Mar '13

05 Mar '13

openSUSE Security Update: kernel: fixed local privilege escalation ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0395-1 Rating: important References: #797175 #799209 #800280 #801178 #801782 #802153 #804738 #805633 Cross-References: CVE-2012-5374 CVE-2013-0160 CVE-2013-0216 CVE-2013-0231 CVE-2013-1763 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: The Linux kernel was updated to 3.4.33 and to fix a local root privilege escalation and various other security and non-security bugs. CVE-2013-1763: A out of bounds access in sock_diag could be used by local attackers to execute code in kernel context and so become root. CVE-2013-0160: The atime of /dev/ptmx is no longer updated, avoiding side channel attacks via user typing speed. CVE-2012-5374: Denial of service via btrfs hashes could have been used by local attackers to cause a compute denial of service. CVE-2013-0216: Fixed a problem in XEN netback: shutdown the ring if it contains garbage. CVE-2013-0231: Fixed a problem in XEN pciback: rate limit error messages from xen_pcibk_enable_msi(x). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-175 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): kernel-default-3.4.33-2.24.1 kernel-default-base-3.4.33-2.24.1 kernel-default-base-debuginfo-3.4.33-2.24.1 kernel-default-debuginfo-3.4.33-2.24.1 kernel-default-debugsource-3.4.33-2.24.1 kernel-default-devel-3.4.33-2.24.1 kernel-default-devel-debuginfo-3.4.33-2.24.1 kernel-syms-3.4.33-2.24.1 - openSUSE 12.2 (i686 x86_64): kernel-debug-3.4.33-2.24.1 kernel-debug-base-3.4.33-2.24.1 kernel-debug-base-debuginfo-3.4.33-2.24.1 kernel-debug-debuginfo-3.4.33-2.24.1 kernel-debug-debugsource-3.4.33-2.24.1 kernel-debug-devel-3.4.33-2.24.1 kernel-debug-devel-debuginfo-3.4.33-2.24.1 kernel-desktop-3.4.33-2.24.1 kernel-desktop-base-3.4.33-2.24.1 kernel-desktop-base-debuginfo-3.4.33-2.24.1 kernel-desktop-debuginfo-3.4.33-2.24.1 kernel-desktop-debugsource-3.4.33-2.24.1 kernel-desktop-devel-3.4.33-2.24.1 kernel-desktop-devel-debuginfo-3.4.33-2.24.1 kernel-ec2-3.4.33-2.24.1 kernel-ec2-base-3.4.33-2.24.1 kernel-ec2-base-debuginfo-3.4.33-2.24.1 kernel-ec2-debuginfo-3.4.33-2.24.1 kernel-ec2-debugsource-3.4.33-2.24.1 kernel-ec2-devel-3.4.33-2.24.1 kernel-ec2-devel-debuginfo-3.4.33-2.24.1 kernel-ec2-extra-3.4.33-2.24.1 kernel-ec2-extra-debuginfo-3.4.33-2.24.1 kernel-trace-3.4.33-2.24.1 kernel-trace-base-3.4.33-2.24.1 kernel-trace-base-debuginfo-3.4.33-2.24.1 kernel-trace-debuginfo-3.4.33-2.24.1 kernel-trace-debugsource-3.4.33-2.24.1 kernel-trace-devel-3.4.33-2.24.1 kernel-trace-devel-debuginfo-3.4.33-2.24.1 kernel-vanilla-3.4.33-2.24.1 kernel-vanilla-debuginfo-3.4.33-2.24.1 kernel-vanilla-debugsource-3.4.33-2.24.1 kernel-vanilla-devel-3.4.33-2.24.1 kernel-vanilla-devel-debuginfo-3.4.33-2.24.1 kernel-xen-3.4.33-2.24.1 kernel-xen-base-3.4.33-2.24.1 kernel-xen-base-debuginfo-3.4.33-2.24.1 kernel-xen-debuginfo-3.4.33-2.24.1 kernel-xen-debugsource-3.4.33-2.24.1 kernel-xen-devel-3.4.33-2.24.1 kernel-xen-devel-debuginfo-3.4.33-2.24.1 - openSUSE 12.2 (noarch): kernel-devel-3.4.33-2.24.1 kernel-docs-3.4.33-2.24.2 kernel-source-3.4.33-2.24.1 kernel-source-vanilla-3.4.33-2.24.1 - openSUSE 12.2 (i686): kernel-pae-3.4.33-2.24.1 kernel-pae-base-3.4.33-2.24.1 kernel-pae-base-debuginfo-3.4.33-2.24.1 kernel-pae-debuginfo-3.4.33-2.24.1 kernel-pae-debugsource-3.4.33-2.24.1 kernel-pae-devel-3.4.33-2.24.1 kernel-pae-devel-debuginfo-3.4.33-2.24.1 References: http://support.novell.com/security/cve/CVE-2012-5374.html http://support.novell.com/security/cve/CVE-2013-0160.html http://support.novell.com/security/cve/CVE-2013-0216.html http://support.novell.com/security/cve/CVE-2013-0231.html http://support.novell.com/security/cve/CVE-2013-1763.html https://bugzilla.novell.com/797175 https://bugzilla.novell.com/799209 https://bugzilla.novell.com/800280 https://bugzilla.novell.com/801178 https://bugzilla.novell.com/801782 https://bugzilla.novell.com/802153 https://bugzilla.novell.com/804738 https://bugzilla.novell.com/805633 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0388-1: important: Security update for pidgin
by opensuse-security＠opensuse.org 04 Mar '13

04 Mar '13

SUSE Security Update: Security update for pidgin ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0388-1 Rating: important References: #804742 Cross-References: CVE-2013-0271 CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: pidgin was updated to fix 4 security issues: * Fixed a crash when receiving UPnP responses with abnormally long values. (CVE-2013-0274, bnc#804742) * Fixed a crash in Sametime protocol when a malicious server sends us an abnormally long user ID. (CVE-2013-0273, bnc#804742) * Fixed a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution.(CVE-2013-0272, bnc#804742) * Fixed a bug where a remote MXit user could possibly specify a local file path to be written to. (CVE-2013-0271, bnc#804742) Security Issue references: * CVE-2013-0271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0271 > * CVE-2013-0272 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0272 > * CVE-2013-0273 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0273 > * CVE-2013-0274 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0274 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-finch-7429 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-finch-7429 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): finch-2.6.6-0.19.1 finch-devel-2.6.6-0.19.1 libpurple-2.6.6-0.19.1 libpurple-devel-2.6.6-0.19.1 libpurple-lang-2.6.6-0.19.1 pidgin-2.6.6-0.19.1 pidgin-devel-2.6.6-0.19.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): finch-2.6.6-0.19.1 libpurple-2.6.6-0.19.1 libpurple-lang-2.6.6-0.19.1 libpurple-meanwhile-2.6.6-0.19.1 libpurple-tcl-2.6.6-0.19.1 pidgin-2.6.6-0.19.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): finch-2.6.6-0.20.1 libpurple-2.6.6-0.20.1 pidgin-2.6.6-0.20.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): finch-2.6.6-0.20.1 finch-devel-2.6.6-0.20.1 libpurple-2.6.6-0.20.1 libpurple-devel-2.6.6-0.20.1 pidgin-2.6.6-0.20.1 pidgin-devel-2.6.6-0.20.1 References: http://support.novell.com/security/cve/CVE-2013-0271.html http://support.novell.com/security/cve/CVE-2013-0272.html http://support.novell.com/security/cve/CVE-2013-0273.html http://support.novell.com/security/cve/CVE-2013-0274.html https://bugzilla.novell.com/804742 http://download.novell.com/patch/finder/?keywords=18e124b7db8b5f6aa5744f916… http://download.novell.com/patch/finder/?keywords=51b5f7c142afdeafafca33c1a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0