August 2013 - openSUSE Security Announce

[security-announce] SUSE-SU-2013:1390-1: important: Security update for MySQL
by opensuse-security＠opensuse.org 29 Aug '13

29 Aug '13

SUSE Security Update: Security update for MySQL ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1390-1 Rating: important References: #734436 #768832 #780019 #789263 #791863 #803040 #830086 #834028 #834967 Cross-References: CVE-2013-1861 CVE-2013-3783 CVE-2013-3793 CVE-2013-3794 CVE-2013-3795 CVE-2013-3796 CVE-2013-3798 CVE-2013-3801 CVE-2013-3802 CVE-2013-3804 CVE-2013-3805 CVE-2013-3806 CVE-2013-3807 CVE-2013-3808 CVE-2013-3809 CVE-2013-3810 CVE-2013-3811 CVE-2013-3812 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. It includes one version update. Description: This version upgrade of mysql to 5.5.32 fixes multiple security issues: CVE-2013-1861, CVE-2013-3783, CVE-2013-3793, CVE-2013-3794, CVE-2013-3795, CVE-2013-3796, CVE-2013-3798, CVE-2013-3801, CVE-2013-3802, CVE-2013-3804, CVE-2013-3805, CVE-2013-3806, CVE-2013-3807, CVE-2013-3808, CVE-2013-3809, CVE-2013-3810, CVE-2013-3811, CVE-2013-3812 Additionally, it contains numerous bug fixes and improvements.: * making mysqldump work with MySQL 5.0 (bnc#768832) * fixed log rights (bnc#789263 and bnc#803040) * binlog disabled in default configuration (bnc#791863) * fixed dependencies for client package (bnc#780019) * minor polishing of spec/installation * avoiding file conflicts with mytop * better fix for hardcoded libdir issue * fix hardcoded plugin paths (bnc#834028) * Use chown --no-dereference instead of chown to improve security (bnc#834967) * Adjust to spell !includedir correctly in /etc/my.cnf (bnc#734436) Security Issue references: * CVE-2013-1861 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1861 > * CVE-2013-3783 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3783 > * CVE-2013-3793 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3793 > * CVE-2013-3794 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3794 > * CVE-2013-3795 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3795 > * CVE-2013-3796 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3796 > * CVE-2013-3798 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3798 > * CVE-2013-3801 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3801 > * CVE-2013-3802 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3802 > * CVE-2013-3804 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3804 > * CVE-2013-3805 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3805 > * CVE-2013-3806 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3806 > * CVE-2013-3807 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3807 > * CVE-2013-3808 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3808 > * CVE-2013-3809 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3809 > * CVE-2013-3810 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3810 > * CVE-2013-3811 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3811 > * CVE-2013-3812 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3812 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libmysql55client18-8217 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-libmysql55client18-8217 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-libmysql55client18-8217 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libmysql55client18-8217 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64): libmysql55client_r18-32bit-5.5.32-0.9.1 libmysqlclient_r15-32bit-5.0.96-0.6.9 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ia64): libmysql55client_r18-x86-5.5.32-0.9.1 libmysqlclient_r15-x86-5.0.96-0.6.9 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 5.5.32]: libmysql55client18-5.5.32-0.9.1 libmysql55client_r18-5.5.32-0.9.1 libmysqlclient15-5.0.96-0.6.9 libmysqlclient_r15-5.0.96-0.6.9 mysql-5.5.32-0.9.1 mysql-client-5.5.32-0.9.1 mysql-tools-5.5.32-0.9.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 5.5.32]: libmysql55client18-32bit-5.5.32-0.9.1 libmysqlclient15-32bit-5.0.96-0.6.9 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.5.32]: libmysql55client18-5.5.32-0.9.1 libmysql55client_r18-5.5.32-0.9.1 libmysqlclient15-5.0.96-0.6.9 libmysqlclient_r15-5.0.96-0.6.9 mysql-5.5.32-0.9.1 mysql-client-5.5.32-0.9.1 mysql-tools-5.5.32-0.9.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 5.5.32]: libmysql55client18-32bit-5.5.32-0.9.1 libmysqlclient15-32bit-5.0.96-0.6.9 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 5.5.32]: libmysql55client18-x86-5.5.32-0.9.1 libmysqlclient15-x86-5.0.96-0.6.9 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 5.5.32]: libmysql55client18-5.5.32-0.9.1 libmysql55client_r18-5.5.32-0.9.1 libmysqlclient15-5.0.96-0.6.9 libmysqlclient_r15-5.0.96-0.6.9 mysql-5.5.32-0.9.1 mysql-client-5.5.32-0.9.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 5.5.32]: libmysql55client18-32bit-5.5.32-0.9.1 libmysql55client_r18-32bit-5.5.32-0.9.1 libmysqlclient15-32bit-5.0.96-0.6.9 libmysqlclient_r15-32bit-5.0.96-0.6.9 References: http://support.novell.com/security/cve/CVE-2013-1861.html http://support.novell.com/security/cve/CVE-2013-3783.html http://support.novell.com/security/cve/CVE-2013-3793.html http://support.novell.com/security/cve/CVE-2013-3794.html http://support.novell.com/security/cve/CVE-2013-3795.html http://support.novell.com/security/cve/CVE-2013-3796.html http://support.novell.com/security/cve/CVE-2013-3798.html http://support.novell.com/security/cve/CVE-2013-3801.html http://support.novell.com/security/cve/CVE-2013-3802.html http://support.novell.com/security/cve/CVE-2013-3804.html http://support.novell.com/security/cve/CVE-2013-3805.html http://support.novell.com/security/cve/CVE-2013-3806.html http://support.novell.com/security/cve/CVE-2013-3807.html http://support.novell.com/security/cve/CVE-2013-3808.html http://support.novell.com/security/cve/CVE-2013-3809.html http://support.novell.com/security/cve/CVE-2013-3810.html http://support.novell.com/security/cve/CVE-2013-3811.html http://support.novell.com/security/cve/CVE-2013-3812.html https://bugzilla.novell.com/734436 https://bugzilla.novell.com/768832 https://bugzilla.novell.com/780019 https://bugzilla.novell.com/789263 https://bugzilla.novell.com/791863 https://bugzilla.novell.com/803040 https://bugzilla.novell.com/830086 https://bugzilla.novell.com/834028 https://bugzilla.novell.com/834967 http://download.novell.com/patch/finder/?keywords=ee1853a305dde831618306e6f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1382-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 27 Aug '13

27 Aug '13

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1382-1 Rating: important References: #833389 Cross-References: CVE-2013-1701 CVE-2013-1702 CVE-2013-1706 CVE-2013-1707 CVE-2013-1709 CVE-2013-1710 CVE-2013-1712 CVE-2013-1713 CVE-2013-1714 CVE-2013-1717 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. It includes one version update. Description: Update to Firefox 17.0.8esr (bnc#833389) to address: * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 (bmo#855331, bmo#844088, bmo#858060, bmo#870200, bmo#874974, bmo#861530, bmo#854157, bmo#893684, bmo#878703, bmo#862185, bmo#879139, bmo#888107, bmo#880734) Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8) * MFSA 2013-66/CVE-2013-1706/CVE-2013-1707 (bmo#888314, bmo#888361) Buffer overflow in Mozilla Maintenance Service and Mozilla Updater * MFSA 2013-68/CVE-2013-1709 (bmo#848253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-71/CVE-2013-1712 (bmo#859072) Further Privilege escalation through Mozilla Updater * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541) Local Java applets may read contents of local file system Security Issue references: * CVE-2013-1701 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1701 > * CVE-2013-1702 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1702 > * CVE-2013-1706 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1706 > * CVE-2013-1707 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1707 > * CVE-2013-1709 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1709 > * CVE-2013-1710 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1710 > * CVE-2013-1712 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1712 > * CVE-2013-1713 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1713 > * CVE-2013-1714 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1714 > * CVE-2013-1717 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1717 > Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.5.1 MozillaFirefox-translations-17.0.8esr-0.5.1 References: http://support.novell.com/security/cve/CVE-2013-1701.html http://support.novell.com/security/cve/CVE-2013-1702.html http://support.novell.com/security/cve/CVE-2013-1706.html http://support.novell.com/security/cve/CVE-2013-1707.html http://support.novell.com/security/cve/CVE-2013-1709.html http://support.novell.com/security/cve/CVE-2013-1710.html http://support.novell.com/security/cve/CVE-2013-1712.html http://support.novell.com/security/cve/CVE-2013-1713.html http://support.novell.com/security/cve/CVE-2013-1714.html http://support.novell.com/security/cve/CVE-2013-1717.html https://bugzilla.novell.com/833389 http://download.novell.com/patch/finder/?keywords=4ec72487a7980101b353c16bf… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1325-2: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 23 Aug '13

23 Aug '13

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1325-2 Rating: important References: #833389 Affected Products: SUSE Linux Enterprise Server 11 SP1 for VMware LTSS SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes four new package versions. Description: This update to Firefox 17.0.8esr (bnc#833389) addresses the following issues: * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 (bmo#855331, bmo#844088, bmo#858060, bmo#870200, bmo#874974, bmo#861530, bmo#854157, bmo#893684, bmo#878703, bmo#862185, bmo#879139, bmo#888107, bmo#880734) Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8) * MFSA 2013-66/CVE-2013-1706/CVE-2013-1707 (bmo#888314, bmo#888361) Buffer overflow in Mozilla Maintenance Service and Mozilla Updater * MFSA 2013-68/CVE-2013-1709 (bmo#848253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-71/CVE-2013-1712 (bmo#859072) Further Privilege escalation through Mozilla Updater * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541) Local Java applets may read contents of local file system Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS: zypper in -t patch slessp1-MozillaFirefox-8188 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-MozillaFirefox-8188 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS (i586 x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.4.2.1 MozillaFirefox-translations-17.0.8esr-0.4.2.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.4.2.1 MozillaFirefox-translations-17.0.8esr-0.4.2.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64) [New Version: 3.14.3 and 4.9.6]: mozilla-nspr-4.9.6-0.5.7 mozilla-nspr-devel-4.9.6-0.5.7 mozilla-nss-3.14.3-0.5.7 mozilla-nss-devel-3.14.3-0.5.7 mozilla-nss-tools-3.14.3-0.5.7 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64) [New Version: 3.14.3 and 4.9.6]: mozilla-nspr-32bit-4.9.6-0.5.7 mozilla-nss-32bit-3.14.3-0.5.7 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x) [New Version: 17.0.8esr and 7]: MozillaFirefox-17.0.8esr-0.5.3 MozillaFirefox-branding-SLED-7-0.10.34 MozillaFirefox-translations-17.0.8esr-0.5.3 References: https://bugzilla.novell.com/833389 http://download.novell.com/patch/finder/?keywords=27187876975cda4d472350efc… http://download.novell.com/patch/finder/?keywords=6795b3750d821e23eeba3d00c… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1370-1: critical: puppet: security fix for YAML support
by opensuse-security＠opensuse.org 22 Aug '13

22 Aug '13

openSUSE Security Update: puppet: security fix for YAML support ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1370-1 Rating: critical References: #825878 Cross-References: CVE-2013-3567 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A potential remote code execution via YAML was fixed in puppet. (CVE-2013-3567) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-661 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): puppet-3.0.2-2.9.1 puppet-server-3.0.2-2.9.1 References: http://support.novell.com/security/cve/CVE-2013-3567.html https://bugzilla.novell.com/825878 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1354-1: important: update for bind
by opensuse-security＠opensuse.org 19 Aug '13

19 Aug '13

openSUSE Security Update: update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1354-1 Rating: important References: #831899 Cross-References: CVE-2013-4854 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A specially crafted query with malicious rdata could have caused a crash (DoS) in named. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-126 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): bind-9.9.2P2-49.1 bind-chrootenv-9.9.2P2-49.1 bind-debuginfo-9.9.2P2-49.1 bind-debugsource-9.9.2P2-49.1 bind-devel-9.9.2P2-49.1 bind-libs-9.9.2P2-49.1 bind-libs-debuginfo-9.9.2P2-49.1 bind-lwresd-9.9.2P2-49.1 bind-lwresd-debuginfo-9.9.2P2-49.1 bind-utils-9.9.2P2-49.1 bind-utils-debuginfo-9.9.2P2-49.1 - openSUSE 11.4 (x86_64): bind-libs-32bit-9.9.2P2-49.1 bind-libs-debuginfo-32bit-9.9.2P2-49.1 - openSUSE 11.4 (noarch): bind-doc-9.9.2P2-49.1 - openSUSE 11.4 (ia64): bind-libs-debuginfo-x86-9.9.2P2-49.1 bind-libs-x86-9.9.2P2-49.1 References: http://support.novell.com/security/cve/CVE-2013-4854.html https://bugzilla.novell.com/831899 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1353-1: important: bind: 9.9.3P2 security and bugfix update
by opensuse-security＠opensuse.org 19 Aug '13

19 Aug '13

openSUSE Security Update: bind: 9.9.3P2 security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1353-1 Rating: important References: #831899 Cross-References: CVE-2013-4854 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The BIND nameserver was updated to 9.9.3P2 to fix a security issue where incorrect bounds checking on private type 'keydata' could lead to a remotely triggerable REQUIRE failure. (CVE-2013-4854, bnc#831899) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-654 - openSUSE 12.2: zypper in -t patch openSUSE-2013-654 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): bind-9.9.3P2-2.7.1 bind-chrootenv-9.9.3P2-2.7.1 bind-debuginfo-9.9.3P2-2.7.1 bind-debugsource-9.9.3P2-2.7.1 bind-devel-9.9.3P2-2.7.1 bind-libs-9.9.3P2-2.7.1 bind-libs-debuginfo-9.9.3P2-2.7.1 bind-lwresd-9.9.3P2-2.7.1 bind-lwresd-debuginfo-9.9.3P2-2.7.1 bind-utils-9.9.3P2-2.7.1 bind-utils-debuginfo-9.9.3P2-2.7.1 - openSUSE 12.3 (x86_64): bind-libs-32bit-9.9.3P2-2.7.1 bind-libs-debuginfo-32bit-9.9.3P2-2.7.1 - openSUSE 12.3 (noarch): bind-doc-9.9.3P2-2.7.1 - openSUSE 12.2 (i586 x86_64): bind-9.9.2P2-1.19.1 bind-chrootenv-9.9.2P2-1.19.1 bind-debuginfo-9.9.2P2-1.19.1 bind-debugsource-9.9.2P2-1.19.1 bind-devel-9.9.2P2-1.19.1 bind-libs-9.9.2P2-1.19.1 bind-libs-debuginfo-9.9.2P2-1.19.1 bind-lwresd-9.9.2P2-1.19.1 bind-lwresd-debuginfo-9.9.2P2-1.19.1 bind-utils-9.9.2P2-1.19.1 bind-utils-debuginfo-9.9.2P2-1.19.1 - openSUSE 12.2 (x86_64): bind-libs-32bit-9.9.2P2-1.19.1 bind-libs-debuginfo-32bit-9.9.2P2-1.19.1 - openSUSE 12.2 (noarch): bind-doc-9.9.2P2-1.19.1 References: http://support.novell.com/security/cve/CVE-2013-4854.html https://bugzilla.novell.com/831899 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1351-1: important: Security update for PHP5
by opensuse-security＠opensuse.org 16 Aug '13

16 Aug '13

SUSE Security Update: Security update for PHP5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1351-1 Rating: important References: #699711 #709549 #713652 #728671 #733590 #735613 #736169 #738221 #741520 #741859 #742273 #742806 #743308 #744966 #746661 #749111 #752030 #753778 #760536 #761631 #772580 #772582 #775852 #778003 #783239 #807707 #828020 #829207 Cross-References: CVE-2011-1072 CVE-2011-1398 CVE-2011-1466 CVE-2011-2202 CVE-2011-3182 CVE-2011-4153 CVE-2011-4388 CVE-2011-4566 CVE-2011-4885 CVE-2012-0057 CVE-2012-0781 CVE-2012-0788 CVE-2012-0789 CVE-2012-0807 CVE-2012-0830 CVE-2012-0831 CVE-2012-1172 CVE-2012-1823 CVE-2012-2311 CVE-2012-2335 CVE-2012-2336 CVE-2012-2688 CVE-2012-3365 CVE-2013-1635 CVE-2013-1643 CVE-2013-4113 CVE-2013-4635 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that solves 27 vulnerabilities and has one errata is now available. It includes one version update. Description: php5 has been updated to roll up all pending security fixes for Long Term Service Pack Support. The Following security issues have been fixed: * CVE-2013-4635: Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP allowed context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function. * CVE-2013-1635: ext/soap/soap.c in PHP did not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allowed remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory. * CVE-2013-1643: The SOAP parser in PHP allowed remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions. * CVE-2013-4113: ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allowed remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function. * CVE-2011-1398 / CVE-2012-4388: The sapi_header_op function in main/SAPI.c in PHP did not check for %0D sequences (aka carriage return characters), which allowed remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome. * CVE-2012-2688: An unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP had unknown impact and remote attack vectors, related to an "overflow." * CVE-2012-3365: The SQLite functionality in PHP before 5.3.15 allowed remote attackers to bypass the open_basedir protection mechanism via unspecified vectors. * CVE-2012-1823: sapi/cgi/cgi_main.c in PHP, when configured as a CGI script (aka php-cgi), did not properly handle query strings that lack an = (equals sign) character, which allowed remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. * CVE-2012-2335: php-wrapper.fcgi did not properly handle command-line arguments, which allowed remote attackers to bypass a protection mechanism in PHP and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence. * CVE-2012-2336: sapi/cgi/cgi_main.c in PHP, when configured as a CGI script (aka php-cgi), did not properly handle query strings that lack an = (equals sign) character, which allowed remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823. * CVE-2012-2311: sapi/cgi/cgi_main.c in PHP, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823. * CVE-2012-1172: The file-upload implementation in rfc1867.c in PHP did not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions. * CVE-2012-0830: The php_register_variable_ex function in php_variables.c in PHP allowed remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885. * CVE-2012-0807: Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might have allowed remote attackers to execute arbitrary code via a long string that is used in a Set-Cookie HTTP header. * CVE-2012-0057: PHP had improper libxslt security settings, which allowed remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension. * CVE-2012-0831: PHP did not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which made it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c. * CVE-2011-4153: PHP did not always check the return value of the zend_strndup function, which might have allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted string data, as demonstrated by the define function in zend_builtin_functions.c, and unspecified functions in ext/soap/php_sdl.c, ext/standard/syslog.c, ext/standard/browscap.c, ext/oci8/oci8.c, ext/com_dotnet/com_typeinfo.c, and main/php_open_temporary_file.c. * CVE-2012-0781: The tidy_diagnose function in PHP might have allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that attempts to perform Tidy::diagnose operations on invalid objects, a different vulnerability than CVE-2011-4153. * CVE-2012-0788: The PDORow implementation in PHP did not properly interact with the session feature, which allowed remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start function, as demonstrated by a crash of the Apache HTTP Server. * CVE-2012-0789: Memory leak in the timezone functionality in PHP allowed remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which were not properly handled by the php_date_parse_tzfile cache. * CVE-2011-4885: PHP computed hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allowed remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. We added a max_input_vars directive to prevent attacks based on hash collisions. * CVE-2011-4566: Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP allowed remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708. * CVE-2011-3182: PHP did not properly check the return values of the malloc, calloc, and realloc library functions, which allowed context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function. * CVE-2011-1466: Integer overflow in the SdnToJulian function in the Calendar extension in PHP allowed context-dependent attackers to cause a denial of service (application crash) via a large integer in the first argument to the cal_from_jd function. * CVE-2011-1072: The installer in PEAR allowed local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4) pear-build-download directories, a different vulnerability than CVE-2007-2519. * CVE-2011-2202: The rfc1867_post_handler function in main/rfc1867.c in PHP did not properly restrict filenames in multipart/form-data POST requests, which allowed remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability." Bugfixes: * fixed php bug #43200 (Interface implementation / inheritence not possible in abstract classes) [bnc#783239] * use FilesMatch with 'SetHandler' rather than 'AddHandler' [bnc#775852] * fixed unpredictable unpack()/pack() behaviour [bnc#753778] * memory corruption in parse_ini_string() [bnc#742806] * amend README.SUSE to discourage using apache module with apache2-worker [bnc#728671] * allow uploading files bigger than 2GB for 64bit systems [bnc#709549] Security Issue references: * CVE-2011-1072 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1072 > * CVE-2011-1398 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1398 > * CVE-2011-1466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1466 > * CVE-2011-2202 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2202 > * CVE-2011-3182 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3182 > * CVE-2011-4153 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4153 > * CVE-2011-4388 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4388 > * CVE-2011-4566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4566 > * CVE-2011-4885 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4885 > * CVE-2012-0057 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0057 > * CVE-2012-0781 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0781 > * CVE-2012-0788 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0788 > * CVE-2012-0789 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789 > * CVE-2012-0807 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0807 > * CVE-2012-0830 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0830 > * CVE-2012-0831 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0831 > * CVE-2012-1172 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1172 > * CVE-2012-1823 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1823 > * CVE-2012-2311 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2311 > * CVE-2012-2335 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2335 > * CVE-2012-2336 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2336 > * CVE-2012-2688 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2688 > * CVE-2012-3365 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365 > * CVE-2013-1635 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1635 > * CVE-2013-1643 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1643 > * CVE-2013-4113 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113 > * CVE-2013-4635 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4635 > Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64) [New Version: 5.2.14]: apache2-mod_php5-5.2.14-0.42.1 php5-5.2.14-0.42.1 php5-bcmath-5.2.14-0.42.1 php5-bz2-5.2.14-0.42.1 php5-calendar-5.2.14-0.42.1 php5-ctype-5.2.14-0.42.1 php5-curl-5.2.14-0.42.1 php5-dba-5.2.14-0.42.1 php5-dbase-5.2.14-0.42.1 php5-devel-5.2.14-0.42.1 php5-dom-5.2.14-0.42.1 php5-exif-5.2.14-0.42.1 php5-fastcgi-5.2.14-0.42.1 php5-ftp-5.2.14-0.42.1 php5-gd-5.2.14-0.42.1 php5-gettext-5.2.14-0.42.1 php5-gmp-5.2.14-0.42.1 php5-hash-5.2.14-0.42.1 php5-iconv-5.2.14-0.42.1 php5-imap-5.2.14-0.42.1 php5-json-5.2.14-0.42.1 php5-ldap-5.2.14-0.42.1 php5-mbstring-5.2.14-0.42.1 php5-mcrypt-5.2.14-0.42.1 php5-mhash-5.2.14-0.42.1 php5-mysql-5.2.14-0.42.1 php5-ncurses-5.2.14-0.42.1 php5-odbc-5.2.14-0.42.1 php5-openssl-5.2.14-0.42.1 php5-pcntl-5.2.14-0.42.1 php5-pdo-5.2.14-0.42.1 php5-pear-5.2.14-0.42.1 php5-pgsql-5.2.14-0.42.1 php5-posix-5.2.14-0.42.1 php5-pspell-5.2.14-0.42.1 php5-shmop-5.2.14-0.42.1 php5-snmp-5.2.14-0.42.1 php5-soap-5.2.14-0.42.1 php5-sockets-5.2.14-0.42.1 php5-sqlite-5.2.14-0.42.1 php5-suhosin-5.2.14-0.42.1 php5-sysvmsg-5.2.14-0.42.1 php5-sysvsem-5.2.14-0.42.1 php5-sysvshm-5.2.14-0.42.1 php5-tokenizer-5.2.14-0.42.1 php5-wddx-5.2.14-0.42.1 php5-xmlreader-5.2.14-0.42.1 php5-xmlrpc-5.2.14-0.42.1 php5-xsl-5.2.14-0.42.1 php5-zlib-5.2.14-0.42.1 References: http://support.novell.com/security/cve/CVE-2011-1072.html http://support.novell.com/security/cve/CVE-2011-1398.html http://support.novell.com/security/cve/CVE-2011-1466.html http://support.novell.com/security/cve/CVE-2011-2202.html http://support.novell.com/security/cve/CVE-2011-3182.html http://support.novell.com/security/cve/CVE-2011-4153.html http://support.novell.com/security/cve/CVE-2011-4388.html http://support.novell.com/security/cve/CVE-2011-4566.html http://support.novell.com/security/cve/CVE-2011-4885.html http://support.novell.com/security/cve/CVE-2012-0057.html http://support.novell.com/security/cve/CVE-2012-0781.html http://support.novell.com/security/cve/CVE-2012-0788.html http://support.novell.com/security/cve/CVE-2012-0789.html http://support.novell.com/security/cve/CVE-2012-0807.html http://support.novell.com/security/cve/CVE-2012-0830.html http://support.novell.com/security/cve/CVE-2012-0831.html http://support.novell.com/security/cve/CVE-2012-1172.html http://support.novell.com/security/cve/CVE-2012-1823.html http://support.novell.com/security/cve/CVE-2012-2311.html http://support.novell.com/security/cve/CVE-2012-2335.html http://support.novell.com/security/cve/CVE-2012-2336.html http://support.novell.com/security/cve/CVE-2012-2688.html http://support.novell.com/security/cve/CVE-2012-3365.html http://support.novell.com/security/cve/CVE-2013-1635.html http://support.novell.com/security/cve/CVE-2013-1643.html http://support.novell.com/security/cve/CVE-2013-4113.html http://support.novell.com/security/cve/CVE-2013-4635.html https://bugzilla.novell.com/699711 https://bugzilla.novell.com/709549 https://bugzilla.novell.com/713652 https://bugzilla.novell.com/728671 https://bugzilla.novell.com/733590 https://bugzilla.novell.com/735613 https://bugzilla.novell.com/736169 https://bugzilla.novell.com/738221 https://bugzilla.novell.com/741520 https://bugzilla.novell.com/741859 https://bugzilla.novell.com/742273 https://bugzilla.novell.com/742806 https://bugzilla.novell.com/743308 https://bugzilla.novell.com/744966 https://bugzilla.novell.com/746661 https://bugzilla.novell.com/749111 https://bugzilla.novell.com/752030 https://bugzilla.novell.com/753778 https://bugzilla.novell.com/760536 https://bugzilla.novell.com/761631 https://bugzilla.novell.com/772580 https://bugzilla.novell.com/772582 https://bugzilla.novell.com/775852 https://bugzilla.novell.com/778003 https://bugzilla.novell.com/783239 https://bugzilla.novell.com/807707 https://bugzilla.novell.com/828020 https://bugzilla.novell.com/829207 http://download.novell.com/patch/finder/?keywords=052a65bd8d851aef0dd6767bb… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1349-1: important: update for samba
by opensuse-security＠opensuse.org 16 Aug '13

16 Aug '13

openSUSE Security Update: update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1349-1 Rating: important References: #765270 #798856 #804822 #806501 #812929 #816647 #817919 #820531 #821889 #823549 #824833 #829969 Cross-References: CVE-2013-4124 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves one vulnerability and has 11 fixes is now available. Description: This update of samba fixed the following issues: - The pam_winbind require_membership_of option allows for a list of SID, but currently only provides buffer space for ~20; (bnc#806501). - Samba 3.0.x to 4.0.7 are affected by a denial of service attack on authenticated or guest connections; CVE-2013-4124; (bnc#829969). - PIDL: fix parsing linemarkers in preprocessor output; (bso#9636). - build:autoconf: fix output of syslog-facility check; (bso#9983). - libreplace: add a missing "eval" to the AC_VERIFY_C_PROTOTYPE macro. - Remove ldapsmb from the main spec file. - Don't bzip2 the main tar ball, use the upstream gziped one instead. - Fix crash bug during Win8 sync; (bso#9822). - Check for system libtevent and link dbwrap_tool and dbwrap_torture against it; (bso#9881). - errno gets overwritten in call to check_parent_exists(); (bso#9927). - Fix a bug of drvupgrade of smbcontrol; (bso#9941). - Document idmap_ad rfc2307 attribute requirements; (bso#9880); (bnc#820531). - Don't package the SWAT man page while its build is disabled; (bnc#816647). - Don't install the tdb utilities man pages on post-12.1 systems; (bnc#823549). - Fix libreplace license ambiguity; (bso#8997); (bnc#765270). - s3-docs: Remove "experimental" label on "max protocol=SMB2" parameter; (bso#9688). - Remove the compound_related_in_progress state from the smb2 global state; (bso#9722). - Makefile: Don't know how to make LIBNDR_PREG_OBJ; (bso#9868). - Fix is_printer_published GUID retrieval; (bso#9900); (bnc#798856). - Fix 'map untrusted to domain' with NTLMv2; (bso#9817); (bnc#817919). - Don't modify the pidfile name when a custom config file path is used; (bnc#812929). - Add extra attributes for AD printer publishing; (bso#9378); (bnc#798856). - Fix vfs_catia module; (bso#9701); (bnc#824833). systems; (bnc#804822); (bnc#821889). - Fix AD printer publishing; (bso#9378); (bnc#798856). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-651 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libnetapi-devel-3.6.12-59.9.1 libnetapi0-3.6.12-59.9.1 libnetapi0-debuginfo-3.6.12-59.9.1 libsmbclient-devel-3.6.12-59.9.1 libsmbclient0-3.6.12-59.9.1 libsmbclient0-debuginfo-3.6.12-59.9.1 libsmbsharemodes-devel-3.6.12-59.9.1 libsmbsharemodes0-3.6.12-59.9.1 libsmbsharemodes0-debuginfo-3.6.12-59.9.1 libwbclient-devel-3.6.12-59.9.1 libwbclient0-3.6.12-59.9.1 libwbclient0-debuginfo-3.6.12-59.9.1 samba-3.6.12-59.9.1 samba-client-3.6.12-59.9.1 samba-client-debuginfo-3.6.12-59.9.1 samba-debuginfo-3.6.12-59.9.1 samba-debugsource-3.6.12-59.9.1 samba-devel-3.6.12-59.9.1 samba-krb-printing-3.6.12-59.9.1 samba-krb-printing-debuginfo-3.6.12-59.9.1 samba-winbind-3.6.12-59.9.1 samba-winbind-debuginfo-3.6.12-59.9.1 - openSUSE 12.3 (x86_64): libsmbclient0-32bit-3.6.12-59.9.1 libsmbclient0-debuginfo-32bit-3.6.12-59.9.1 libwbclient0-32bit-3.6.12-59.9.1 libwbclient0-debuginfo-32bit-3.6.12-59.9.1 samba-32bit-3.6.12-59.9.1 samba-client-32bit-3.6.12-59.9.1 samba-client-debuginfo-32bit-3.6.12-59.9.1 samba-debuginfo-32bit-3.6.12-59.9.1 samba-winbind-32bit-3.6.12-59.9.1 samba-winbind-debuginfo-32bit-3.6.12-59.9.1 - openSUSE 12.3 (noarch): samba-doc-3.6.12-59.9.1 References: http://support.novell.com/security/cve/CVE-2013-4124.html https://bugzilla.novell.com/765270 https://bugzilla.novell.com/798856 https://bugzilla.novell.com/804822 https://bugzilla.novell.com/806501 https://bugzilla.novell.com/812929 https://bugzilla.novell.com/816647 https://bugzilla.novell.com/817919 https://bugzilla.novell.com/820531 https://bugzilla.novell.com/821889 https://bugzilla.novell.com/823549 https://bugzilla.novell.com/824833 https://bugzilla.novell.com/829969 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1348-1: important: update for MozillaFirefox, MozillaThunderbird, mozilla-nspr, mozilla-nss, seamonkey, xulrunner
by opensuse-security＠opensuse.org 16 Aug '13

16 Aug '13

openSUSE Security Update: update for MozillaFirefox, MozillaThunderbird, mozilla-nspr, mozilla-nss, seamonkey, xulrunner ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1348-1 Rating: important References: #833389 Cross-References: CVE-2013-1701 CVE-2013-1702 CVE-2013-1704 CVE-2013-1705 CVE-2013-1708 CVE-2013-1709 CVE-2013-1710 CVE-2013-1711 CVE-2013-1713 CVE-2013-1714 CVE-2013-1717 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: Changes in seamonkey: - update to SeaMonkey 2.20 (bnc#833389) * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous memory safety hazards * MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free mutating DOM during SetBody * MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests * MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV audio file decoding * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of XrayWrappers using XBL Scopes * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system - requires NSPR 4.10 and NSS 3.15 - removed obsolete seamonkey-shared-nss-db.patch Changes in seamonkey: - update to SeaMonkey 2.20 (bnc#833389) * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous memory safety hazards * MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free mutating DOM during SetBody * MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests * MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV audio file decoding * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of XrayWrappers using XBL Scopes * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system - requires NSPR 4.10 and NSS 3.15 - removed obsolete seamonkey-shared-nss-db.patch Changes in xulrunner: - update to 17.0.8esr (bnc#833389) * MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety hazards * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system Changes in xulrunner: - update to 17.0.8esr (bnc#833389) * MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety hazards * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system Changes in MozillaThunderbird: - update to Thunderbird 17.0.8 (bnc#833389) * MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety hazards * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system - update Enigmail to 1.5.2 * bugfix release Changes in MozillaThunderbird: - update to Thunderbird 17.0.8 (bnc#833389) * MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety hazards * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system - update Enigmail to 1.5.2 * bugfix release Changes in mozilla-nss: - fix 32bit requirement, it's without () actually - update to 3.15.1 * TLS 1.2 (RFC 5246) is supported. HMAC-SHA256 cipher suites (RFC 5246 and RFC 5289) are supported, allowing TLS to be used without MD5 and SHA-1. Note the following limitations: The hash function used in the signature for TLS 1.2 client authentication must be the hash function of the TLS 1.2 PRF, which is always SHA-256 in NSS 3.15.1. AES GCM cipher suites are not yet supported. * some bugfixes and improvements - require libnssckbi instead of mozilla-nss-certs so p11-kit can conflict with the latter (fate#314991) - update to 3.15 * Packaging + removed obsolete patches * nss-disable-expired-testcerts.patch * bug-834091.patch * New Functionality + Support for OCSP Stapling (RFC 6066, Certificate Status Request) has been added for both client and server sockets. TLS client applications may enable this via a call to SSL_OptionSetDefault(SSL_ENABLE_OCSP_STAPLING, PR_TRUE); + Added function SECITEM_ReallocItemV2. It replaces function SECITEM_ReallocItem, which is now declared as obsolete. + Support for single-operation (eg: not multi-part) symmetric key encryption and decryption, via PK11_Encrypt and PK11_Decrypt. + certutil has been updated to support creating name constraints extensions. * New Functions in ssl.h SSL_PeerStapledOCSPResponse - Returns the server's stapled OCSP response, when used with a TLS client socket that negotiated the status_request extension. SSL_SetStapledOCSPResponses - Set's a stapled OCSP response for a TLS server socket to return when clients send the status_request extension. in ocsp.h CERT_PostOCSPRequest - Primarily intended for testing, permits the sending and receiving of raw OCSP request/responses. in secpkcs7.h SEC_PKCS7VerifyDetachedSignatureAtTime - Verifies a PKCS#7 signature at a specific time other than the present time. in xconst.h CERT_EncodeNameConstraintsExtension - Matching function for CERT_DecodeNameConstraintsExtension, added in NSS 3.10. in secitem.h SECITEM_AllocArray SECITEM_DupArray SECITEM_FreeArray SECITEM_ZfreeArray - Utility functions to handle the allocation and deallocation of SECItemArrays SECITEM_ReallocItemV2 - Replaces SECITEM_ReallocItem, which is now obsolete. SECITEM_ReallocItemV2 better matches caller expectations, in that it updates item->len on allocation. For more details of the issues with SECITEM_ReallocItem, see Bug 298649 and Bug 298938. in pk11pub.h PK11_Decrypt - Performs decryption as a single PKCS#11 operation (eg: not multi-part). This is necessary for AES-GCM. PK11_Encrypt - Performs encryption as a single PKCS#11 operation (eg: not multi-part). This is necessary for AES-GCM. * New Types in secitem.h SECItemArray - Represents a variable-length array of SECItems. * New Macros in ssl.h SSL_ENABLE_OCSP_STAPLING - Used with SSL_OptionSet to configure TLS client sockets to request the certificate_status extension (eg: OCSP stapling) when set to PR_TRUE * Notable changes + SECITEM_ReallocItem is now deprecated. Please consider using SECITEM_ReallocItemV2 in all future code. + The list of root CA certificates in the nssckbi module has been updated. + The default implementation of SSL_AuthCertificate has been updated to add certificate status responses stapled by the TLS server to the OCSP cache. * a lot of bugfixes - Add Source URL, see https://en.opensuse.org/SourceUrls Changes in mozilla-nss: - fix 32bit requirement, it's without () actually - update to 3.15.1 * TLS 1.2 (RFC 5246) is supported. HMAC-SHA256 cipher suites (RFC 5246 and RFC 5289) are supported, allowing TLS to be used without MD5 and SHA-1. Note the following limitations: The hash function used in the signature for TLS 1.2 client authentication must be the hash function of the TLS 1.2 PRF, which is always SHA-256 in NSS 3.15.1. AES GCM cipher suites are not yet supported. * some bugfixes and improvements - require libnssckbi instead of mozilla-nss-certs so p11-kit can conflict with the latter (fate#314991) - update to 3.15 * Packaging + removed obsolete patches * nss-disable-expired-testcerts.patch * bug-834091.patch * New Functionality + Support for OCSP Stapling (RFC 6066, Certificate Status Request) has been added for both client and server sockets. TLS client applications may enable this via a call to SSL_OptionSetDefault(SSL_ENABLE_OCSP_STAPLING, PR_TRUE); + Added function SECITEM_ReallocItemV2. It replaces function SECITEM_ReallocItem, which is now declared as obsolete. + Support for single-operation (eg: not multi-part) symmetric key encryption and decryption, via PK11_Encrypt and PK11_Decrypt. + certutil has been updated to support creating name constraints extensions. * New Functions in ssl.h SSL_PeerStapledOCSPResponse - Returns the server's stapled OCSP response, when used with a TLS client socket that negotiated the status_request extension. SSL_SetStapledOCSPResponses - Set's a stapled OCSP response for a TLS server socket to return when clients send the status_request extension. in ocsp.h CERT_PostOCSPRequest - Primarily intended for testing, permits the sending and receiving of raw OCSP request/responses. in secpkcs7.h SEC_PKCS7VerifyDetachedSignatureAtTime - Verifies a PKCS#7 signature at a specific time other than the present time. in xconst.h CERT_EncodeNameConstraintsExtension - Matching function for CERT_DecodeNameConstraintsExtension, added in NSS 3.10. in secitem.h SECITEM_AllocArray SECITEM_DupArray SECITEM_FreeArray SECITEM_ZfreeArray - Utility functions to handle the allocation and deallocation of SECItemArrays SECITEM_ReallocItemV2 - Replaces SECITEM_ReallocItem, which is now obsolete. SECITEM_ReallocItemV2 better matches caller expectations, in that it updates item->len on allocation. For more details of the issues with SECITEM_ReallocItem, see Bug 298649 and Bug 298938. in pk11pub.h PK11_Decrypt - Performs decryption as a single PKCS#11 operation (eg: not multi-part). This is necessary for AES-GCM. PK11_Encrypt - Performs encryption as a single PKCS#11 operation (eg: not multi-part). This is necessary for AES-GCM. * New Types in secitem.h SECItemArray - Represents a variable-length array of SECItems. * New Macros in ssl.h SSL_ENABLE_OCSP_STAPLING - Used with SSL_OptionSet to configure TLS client sockets to request the certificate_status extension (eg: OCSP stapling) when set to PR_TRUE * Notable changes + SECITEM_ReallocItem is now deprecated. Please consider using SECITEM_ReallocItemV2 in all future code. + The list of root CA certificates in the nssckbi module has been updated. + The default implementation of SSL_AuthCertificate has been updated to add certificate status responses stapled by the TLS server to the OCSP cache. * a lot of bugfixes - Add Source URL, see https://en.opensuse.org/SourceUrls Changes in mozilla-nspr: - update to version 4.10 * bmo#844513: Add AddressSanitizer (ASan) memory check annotations to PLArena. * bmo#849089: Simple changes to make NSPR's configure.in work with the current version of autoconf. * bmo#856196: Fix compiler warnings and clean up code in NSPR 4.10. * bmo#859066: Fix warning in nsprpub/pr/src/misc/prnetdb.c. * bmo#859830: Deprecate ANDROID_VERSION in favor of android/api-level.h. * bmo#861434: Make PR_SetThreadPriority() change priorities relatively to the main process instead of using absolute values on Linux. * bmo#871064L: _PR_InitThreads() should not call PR_SetThreadPriority. Changes in mozilla-nspr: - update to version 4.10 * bmo#844513: Add AddressSanitizer (ASan) memory check annotations to PLArena. * bmo#849089: Simple changes to make NSPR's configure.in work with the current version of autoconf. * bmo#856196: Fix compiler warnings and clean up code in NSPR 4.10. * bmo#859066: Fix warning in nsprpub/pr/src/misc/prnetdb.c. * bmo#859830: Deprecate ANDROID_VERSION in favor of android/api-level.h. * bmo#861434: Make PR_SetThreadPriority() change priorities relatively to the main process instead of using absolute values on Linux. * bmo#871064L: _PR_InitThreads() should not call PR_SetThreadPriority. Changes in MozillaFirefox: - update to Firefox 23.0 (bnc#833389) * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous memory safety hazards * MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free mutating DOM during SetBody * MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests * MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV audio file decoding * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of XrayWrappers using XBL Scopes * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system - requires NSPR 4.10 and NSS 3.15 - fix build on ARM (/-g/ matches /-grecord-switches/) Changes in MozillaFirefox: - update to Firefox 23.0 (bnc#833389) * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous memory safety hazards * MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free mutating DOM during SetBody * MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests * MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV audio file decoding * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of XrayWrappers using XBL Scopes * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system - requires NSPR 4.10 and NSS 3.15 - fix build on ARM (/-g/ matches /-grecord-switches/) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-652 - openSUSE 12.2: zypper in -t patch openSUSE-2013-652 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): MozillaFirefox-23.0-1.29.1 MozillaFirefox-branding-upstream-23.0-1.29.1 MozillaFirefox-buildsymbols-23.0-1.29.1 MozillaFirefox-debuginfo-23.0-1.29.1 MozillaFirefox-debugsource-23.0-1.29.1 MozillaFirefox-devel-23.0-1.29.1 MozillaFirefox-translations-common-23.0-1.29.1 MozillaFirefox-translations-other-23.0-1.29.1 MozillaThunderbird-17.0.8-61.21.2 MozillaThunderbird-buildsymbols-17.0.8-61.21.2 MozillaThunderbird-debuginfo-17.0.8-61.21.2 MozillaThunderbird-debugsource-17.0.8-61.21.2 MozillaThunderbird-devel-17.0.8-61.21.2 MozillaThunderbird-devel-debuginfo-17.0.8-61.21.2 MozillaThunderbird-translations-common-17.0.8-61.21.2 MozillaThunderbird-translations-other-17.0.8-61.21.2 enigmail-1.5.2+17.0.8-61.21.2 enigmail-debuginfo-1.5.2+17.0.8-61.21.2 libfreebl3-3.15.1-1.12.1 libfreebl3-debuginfo-3.15.1-1.12.1 libsoftokn3-3.15.1-1.12.1 libsoftokn3-debuginfo-3.15.1-1.12.1 mozilla-js-17.0.8-1.24.1 mozilla-js-debuginfo-17.0.8-1.24.1 mozilla-nspr-4.10-1.14.1 mozilla-nspr-debuginfo-4.10-1.14.1 mozilla-nspr-debugsource-4.10-1.14.1 mozilla-nspr-devel-4.10-1.14.1 mozilla-nss-3.15.1-1.12.1 mozilla-nss-certs-3.15.1-1.12.1 mozilla-nss-certs-debuginfo-3.15.1-1.12.1 mozilla-nss-debuginfo-3.15.1-1.12.1 mozilla-nss-debugsource-3.15.1-1.12.1 mozilla-nss-devel-3.15.1-1.12.1 mozilla-nss-sysinit-3.15.1-1.12.1 mozilla-nss-sysinit-debuginfo-3.15.1-1.12.1 mozilla-nss-tools-3.15.1-1.12.1 mozilla-nss-tools-debuginfo-3.15.1-1.12.1 seamonkey-2.20-1.16.1 seamonkey-debuginfo-2.20-1.16.1 seamonkey-debugsource-2.20-1.16.1 seamonkey-dom-inspector-2.20-1.16.1 seamonkey-irc-2.20-1.16.1 seamonkey-translations-common-2.20-1.16.1 seamonkey-translations-other-2.20-1.16.1 seamonkey-venkman-2.20-1.16.1 xulrunner-17.0.8-1.24.1 xulrunner-buildsymbols-17.0.8-1.24.1 xulrunner-debuginfo-17.0.8-1.24.1 xulrunner-debugsource-17.0.8-1.24.1 xulrunner-devel-17.0.8-1.24.1 xulrunner-devel-debuginfo-17.0.8-1.24.1 - openSUSE 12.3 (x86_64): libfreebl3-32bit-3.15.1-1.12.1 libfreebl3-debuginfo-32bit-3.15.1-1.12.1 libsoftokn3-32bit-3.15.1-1.12.1 libsoftokn3-debuginfo-32bit-3.15.1-1.12.1 mozilla-js-32bit-17.0.8-1.24.1 mozilla-js-debuginfo-32bit-17.0.8-1.24.1 mozilla-nspr-32bit-4.10-1.14.1 mozilla-nspr-debuginfo-32bit-4.10-1.14.1 mozilla-nss-32bit-3.15.1-1.12.1 mozilla-nss-certs-32bit-3.15.1-1.12.1 mozilla-nss-certs-debuginfo-32bit-3.15.1-1.12.1 mozilla-nss-debuginfo-32bit-3.15.1-1.12.1 mozilla-nss-sysinit-32bit-3.15.1-1.12.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.1-1.12.1 xulrunner-32bit-17.0.8-1.24.1 xulrunner-debuginfo-32bit-17.0.8-1.24.1 - openSUSE 12.2 (i586 x86_64): MozillaFirefox-23.0-2.55.1 MozillaFirefox-branding-upstream-23.0-2.55.1 MozillaFirefox-buildsymbols-23.0-2.55.1 MozillaFirefox-debuginfo-23.0-2.55.1 MozillaFirefox-debugsource-23.0-2.55.1 MozillaFirefox-devel-23.0-2.55.1 MozillaFirefox-translations-common-23.0-2.55.1 MozillaFirefox-translations-other-23.0-2.55.1 MozillaThunderbird-17.0.8-49.51.2 MozillaThunderbird-buildsymbols-17.0.8-49.51.2 MozillaThunderbird-debuginfo-17.0.8-49.51.2 MozillaThunderbird-debugsource-17.0.8-49.51.2 MozillaThunderbird-devel-17.0.8-49.51.2 MozillaThunderbird-devel-debuginfo-17.0.8-49.51.2 MozillaThunderbird-translations-common-17.0.8-49.51.2 MozillaThunderbird-translations-other-17.0.8-49.51.2 enigmail-1.5.2+17.0.8-49.51.2 enigmail-debuginfo-1.5.2+17.0.8-49.51.2 libfreebl3-3.15.1-2.23.1 libfreebl3-debuginfo-3.15.1-2.23.1 libsoftokn3-3.15.1-2.23.1 libsoftokn3-debuginfo-3.15.1-2.23.1 mozilla-js-17.0.8-2.50.1 mozilla-js-debuginfo-17.0.8-2.50.1 mozilla-nspr-4.10-1.16.1 mozilla-nspr-debuginfo-4.10-1.16.1 mozilla-nspr-debugsource-4.10-1.16.1 mozilla-nspr-devel-4.10-1.16.1 mozilla-nss-3.15.1-2.23.1 mozilla-nss-certs-3.15.1-2.23.1 mozilla-nss-certs-debuginfo-3.15.1-2.23.1 mozilla-nss-debuginfo-3.15.1-2.23.1 mozilla-nss-debugsource-3.15.1-2.23.1 mozilla-nss-devel-3.15.1-2.23.1 mozilla-nss-sysinit-3.15.1-2.23.1 mozilla-nss-sysinit-debuginfo-3.15.1-2.23.1 mozilla-nss-tools-3.15.1-2.23.1 mozilla-nss-tools-debuginfo-3.15.1-2.23.1 seamonkey-2.20-2.46.1 seamonkey-debuginfo-2.20-2.46.1 seamonkey-debugsource-2.20-2.46.1 seamonkey-dom-inspector-2.20-2.46.1 seamonkey-irc-2.20-2.46.1 seamonkey-translations-common-2.20-2.46.1 seamonkey-translations-other-2.20-2.46.1 seamonkey-venkman-2.20-2.46.1 xulrunner-17.0.8-2.50.1 xulrunner-buildsymbols-17.0.8-2.50.1 xulrunner-debuginfo-17.0.8-2.50.1 xulrunner-debugsource-17.0.8-2.50.1 xulrunner-devel-17.0.8-2.50.1 xulrunner-devel-debuginfo-17.0.8-2.50.1 - openSUSE 12.2 (x86_64): libfreebl3-32bit-3.15.1-2.23.1 libfreebl3-debuginfo-32bit-3.15.1-2.23.1 libsoftokn3-32bit-3.15.1-2.23.1 libsoftokn3-debuginfo-32bit-3.15.1-2.23.1 mozilla-js-32bit-17.0.8-2.50.1 mozilla-js-debuginfo-32bit-17.0.8-2.50.1 mozilla-nspr-32bit-4.10-1.16.1 mozilla-nspr-debuginfo-32bit-4.10-1.16.1 mozilla-nss-32bit-3.15.1-2.23.1 mozilla-nss-certs-32bit-3.15.1-2.23.1 mozilla-nss-certs-debuginfo-32bit-3.15.1-2.23.1 mozilla-nss-debuginfo-32bit-3.15.1-2.23.1 mozilla-nss-sysinit-32bit-3.15.1-2.23.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.1-2.23.1 xulrunner-32bit-17.0.8-2.50.1 xulrunner-debuginfo-32bit-17.0.8-2.50.1 References: http://support.novell.com/security/cve/CVE-2013-1701.html http://support.novell.com/security/cve/CVE-2013-1702.html http://support.novell.com/security/cve/CVE-2013-1704.html http://support.novell.com/security/cve/CVE-2013-1705.html http://support.novell.com/security/cve/CVE-2013-1708.html http://support.novell.com/security/cve/CVE-2013-1709.html http://support.novell.com/security/cve/CVE-2013-1710.html http://support.novell.com/security/cve/CVE-2013-1711.html http://support.novell.com/security/cve/CVE-2013-1713.html http://support.novell.com/security/cve/CVE-2013-1714.html http://support.novell.com/security/cve/CVE-2013-1717.html https://bugzilla.novell.com/833389 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1343-1: important: update for phpMyAdmin
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1343-1 Rating: important References: #831896 #833731 Cross-References: CVE-2013-5029 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This version upgrade of phpMyAdmin fixed various security issues (SQL injection, XSS, full path disclosure, Clickjacking) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-647 - openSUSE 12.2: zypper in -t patch openSUSE-2013-647 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): phpMyAdmin-4.0.5-1.8.1 - openSUSE 12.2 (noarch): phpMyAdmin-4.0.5-1.16.1 References: http://support.novell.com/security/cve/CVE-2013-5029.html https://bugzilla.novell.com/831896 https://bugzilla.novell.com/833731 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1339-1: important: update for samba
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1339-1 Rating: important References: #765270 #798856 #806501 #812929 #817919 #820531 #823549 #824833 #829969 Cross-References: CVE-2013-4124 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has 8 fixes is now available. Description: This update of samba fixed the following issues: - The pam_winbind require_membership_of option allows for a list of SID, but currently only provides buffer space for ~20; (bnc#806501). - Samba 3.0.x to 4.0.7 are affected by a denial of service attack on authenticated or guest connections; CVE-2013-4124; (bnc#829969). - PIDL: fix parsing linemarkers in preprocessor output; (bso#9636). - build:autoconf: fix output of syslog-facility check; (bso#9983). - libreplace: add a missing "eval" to the AC_VERIFY_C_PROTOTYPE macro. - Remove ldapsmb from the main spec file. - Don't bzip2 the main tar ball, use the upstream gziped one instead. - Fix crash bug during Win8 sync; (bso#9822). - Check for system libtevent and link dbwrap_tool and dbwrap_torture against it; (bso#9881). - errno gets overwritten in call to check_parent_exists(); (bso#9927). - Fix a bug of drvupgrade of smbcontrol; (bso#9941). - Document idmap_ad rfc2307 attribute requirements; (bso#9880); (bnc#820531). - Don't install the tdb utilities man pages on post-12.1 systems; (bnc#823549). - Fix libreplace license ambiguity; (bso#8997); (bnc#765270). - Fix is_printer_published GUID retrieval; (bso#9900); (bnc#798856). - Fix 'map untrusted to domain' with NTLMv2; (bso#9817); (bnc#817919). - Don't modify the pidfile name when a custom config file path is used; (bnc#812929). - Add extra attributes for AD printer publishing; (bso#9378); (bnc#798856). - Fix vfs_catia module; (bso#9701); (bnc#824833). - Fix AD printer publishing; (bso#9378); (bnc#798856). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-644 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libnetapi-devel-3.6.7-48.24.1 libnetapi0-3.6.7-48.24.1 libnetapi0-debuginfo-3.6.7-48.24.1 libsmbclient-devel-3.6.7-48.24.1 libsmbclient0-3.6.7-48.24.1 libsmbclient0-debuginfo-3.6.7-48.24.1 libsmbsharemodes-devel-3.6.7-48.24.1 libsmbsharemodes0-3.6.7-48.24.1 libsmbsharemodes0-debuginfo-3.6.7-48.24.1 libwbclient-devel-3.6.7-48.24.1 libwbclient0-3.6.7-48.24.1 libwbclient0-debuginfo-3.6.7-48.24.1 samba-3.6.7-48.24.1 samba-client-3.6.7-48.24.1 samba-client-debuginfo-3.6.7-48.24.1 samba-debuginfo-3.6.7-48.24.1 samba-debugsource-3.6.7-48.24.1 samba-devel-3.6.7-48.24.1 samba-krb-printing-3.6.7-48.24.1 samba-krb-printing-debuginfo-3.6.7-48.24.1 samba-winbind-3.6.7-48.24.1 samba-winbind-debuginfo-3.6.7-48.24.1 - openSUSE 12.2 (x86_64): libsmbclient0-32bit-3.6.7-48.24.1 libsmbclient0-debuginfo-32bit-3.6.7-48.24.1 libwbclient0-32bit-3.6.7-48.24.1 libwbclient0-debuginfo-32bit-3.6.7-48.24.1 samba-32bit-3.6.7-48.24.1 samba-client-32bit-3.6.7-48.24.1 samba-client-debuginfo-32bit-3.6.7-48.24.1 samba-debuginfo-32bit-3.6.7-48.24.1 samba-winbind-32bit-3.6.7-48.24.1 samba-winbind-debuginfo-32bit-3.6.7-48.24.1 - openSUSE 12.2 (noarch): samba-doc-3.6.7-48.24.1 References: http://support.novell.com/security/cve/CVE-2013-4124.html https://bugzilla.novell.com/765270 https://bugzilla.novell.com/798856 https://bugzilla.novell.com/806501 https://bugzilla.novell.com/812929 https://bugzilla.novell.com/817919 https://bugzilla.novell.com/820531 https://bugzilla.novell.com/823549 https://bugzilla.novell.com/824833 https://bugzilla.novell.com/829969 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1334-1: important: Mozilla updates August 2013
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: Mozilla updates August 2013 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1334-1 Rating: important References: #833389 Cross-References: CVE-2013-1701 CVE-2013-1702 CVE-2013-1704 CVE-2013-1705 CVE-2013-1708 CVE-2013-1709 CVE-2013-1710 CVE-2013-1711 CVE-2013-1713 CVE-2013-1714 CVE-2013-1717 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This patch contains updates for - Firefox to 23.0 - xulrunner to 17.0.8esr - Thunderbird to 17.0.8 - mozilla-nspr to 4.10 - mozilla-nss to 3.15,1 * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous memory safety hazards * MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free mutating DOM during SetBody * MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests * MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV audio file decoding * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of XrayWrappers using XBL Scopes * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-122 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-23.0-83.1 MozillaFirefox-branding-upstream-23.0-83.1 MozillaFirefox-buildsymbols-23.0-83.1 MozillaFirefox-debuginfo-23.0-83.1 MozillaFirefox-debugsource-23.0-83.1 MozillaFirefox-devel-23.0-83.1 MozillaFirefox-translations-common-23.0-83.1 MozillaFirefox-translations-other-23.0-83.1 MozillaThunderbird-17.0.8-69.2 MozillaThunderbird-buildsymbols-17.0.8-69.2 MozillaThunderbird-debuginfo-17.0.8-69.2 MozillaThunderbird-debugsource-17.0.8-69.2 MozillaThunderbird-devel-17.0.8-69.2 MozillaThunderbird-devel-debuginfo-17.0.8-69.2 MozillaThunderbird-translations-common-17.0.8-69.2 MozillaThunderbird-translations-other-17.0.8-69.2 enigmail-1.5.2+17.0.8-69.2 enigmail-debuginfo-1.5.2+17.0.8-69.2 libfreebl3-3.15.1-62.1 libfreebl3-debuginfo-3.15.1-62.1 libsoftokn3-3.15.1-62.1 libsoftokn3-debuginfo-3.15.1-62.1 mozilla-nspr-4.10-28.1 mozilla-nspr-debuginfo-4.10-28.1 mozilla-nspr-debugsource-4.10-28.1 mozilla-nspr-devel-4.10-28.1 mozilla-nss-3.15.1-62.1 mozilla-nss-certs-3.15.1-62.1 mozilla-nss-certs-debuginfo-3.15.1-62.1 mozilla-nss-debuginfo-3.15.1-62.1 mozilla-nss-debugsource-3.15.1-62.1 mozilla-nss-devel-3.15.1-62.1 mozilla-nss-sysinit-3.15.1-62.1 mozilla-nss-sysinit-debuginfo-3.15.1-62.1 mozilla-nss-tools-3.15.1-62.1 mozilla-nss-tools-debuginfo-3.15.1-62.1 seamonkey-2.20-73.1 seamonkey-debuginfo-2.20-73.1 seamonkey-debugsource-2.20-73.1 seamonkey-dom-inspector-2.20-73.1 seamonkey-irc-2.20-73.1 seamonkey-translations-common-2.20-73.1 seamonkey-translations-other-2.20-73.1 seamonkey-venkman-2.20-73.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.15.1-62.1 libfreebl3-debuginfo-32bit-3.15.1-62.1 libsoftokn3-32bit-3.15.1-62.1 libsoftokn3-debuginfo-32bit-3.15.1-62.1 mozilla-nspr-32bit-4.10-28.1 mozilla-nspr-debuginfo-32bit-4.10-28.1 mozilla-nss-32bit-3.15.1-62.1 mozilla-nss-certs-32bit-3.15.1-62.1 mozilla-nss-certs-debuginfo-32bit-3.15.1-62.1 mozilla-nss-debuginfo-32bit-3.15.1-62.1 mozilla-nss-sysinit-32bit-3.15.1-62.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.1-62.1 - openSUSE 11.4 (ia64): libfreebl3-debuginfo-x86-3.15.1-62.1 libfreebl3-x86-3.15.1-62.1 libsoftokn3-debuginfo-x86-3.15.1-62.1 libsoftokn3-x86-3.15.1-62.1 mozilla-nspr-debuginfo-x86-4.10-28.1 mozilla-nspr-x86-4.10-28.1 mozilla-nss-certs-debuginfo-x86-3.15.1-62.1 mozilla-nss-certs-x86-3.15.1-62.1 mozilla-nss-debuginfo-x86-3.15.1-62.1 mozilla-nss-sysinit-debuginfo-x86-3.15.1-62.1 mozilla-nss-sysinit-x86-3.15.1-62.1 mozilla-nss-x86-3.15.1-62.1 References: http://support.novell.com/security/cve/CVE-2013-1701.html http://support.novell.com/security/cve/CVE-2013-1702.html http://support.novell.com/security/cve/CVE-2013-1704.html http://support.novell.com/security/cve/CVE-2013-1705.html http://support.novell.com/security/cve/CVE-2013-1708.html http://support.novell.com/security/cve/CVE-2013-1709.html http://support.novell.com/security/cve/CVE-2013-1710.html http://support.novell.com/security/cve/CVE-2013-1711.html http://support.novell.com/security/cve/CVE-2013-1713.html http://support.novell.com/security/cve/CVE-2013-1714.html http://support.novell.com/security/cve/CVE-2013-1717.html https://bugzilla.novell.com/833389 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1325-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 13 Aug '13

13 Aug '13

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1325-1 Rating: important References: #833389 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: This update to Firefox 17.0.8esr (bnc#833389) addresses: * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 (bmo#855331, bmo#844088, bmo#858060, bmo#870200, bmo#874974, bmo#861530, bmo#854157, bmo#893684, bmo#878703, bmo#862185, bmo#879139, bmo#888107, bmo#880734) Miscellaneous memory safety hazards have been fixed (rv:23.0 / rv:17.0.8): * MFSA 2013-66/CVE-2013-1706/CVE-2013-1707 (bmo#888314, bmo#888361) Buffer overflow in Mozilla Maintenance Service and Mozilla Updater * MFSA 2013-68/CVE-2013-1709 (bmo#848253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-71/CVE-2013-1712 (bmo#859072) Further Privilege escalation through Mozilla Updater * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541) Local Java applets may read contents of local file system Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-MozillaFirefox-8191 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-MozillaFirefox-8191 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-MozillaFirefox-8191 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-MozillaFirefox-8187 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-MozillaFirefox-8187 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-MozillaFirefox-8191 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-MozillaFirefox-8187 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-17.0.8esr-0.7.2 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.7.2 MozillaFirefox-translations-17.0.8esr-0.7.2 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.7.2 MozillaFirefox-translations-17.0.8esr-0.7.2 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.4.2.1 MozillaFirefox-translations-17.0.8esr-0.4.2.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.4.2.1 MozillaFirefox-translations-17.0.8esr-0.4.2.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.7.2 MozillaFirefox-translations-17.0.8esr-0.7.2 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.4.2.1 MozillaFirefox-translations-17.0.8esr-0.4.2.1 References: https://bugzilla.novell.com/833389 http://download.novell.com/patch/finder/?keywords=0cfcf5031e62c63bd50256728… http://download.novell.com/patch/finder/?keywords=5d16f58a1649e09775bbc4600… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1317-1: important: Security update for PHP5
by opensuse-security＠opensuse.org 09 Aug '13

09 Aug '13

SUSE Security Update: Security update for PHP5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1317-1 Rating: important References: #783239 #807707 #828020 #829207 Cross-References: CVE-2013-1635 CVE-2013-1643 CVE-2013-4113 CVE-2013-4635 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: The following security issues have been fixed: * CVE-2013-4635 (bnc#828020): o Integer overflow in SdnToJewish() * CVE-2013-1635 and CVE-2013-1643 (bnc#807707): o reading system files via untrusted SOAP input o soap.wsdl_cache_dir function did not honour PHP open_basedir * CVE-2013-4113 (bnc#829207): o heap corruption due to badly formed xml Security Issues: * CVE-2013-4635 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4635 > * CVE-2013-4113 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113 > * CVE-2013-1635 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1635 > * CVE-2013-1643 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1643 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-apache2-mod_php5-8086 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-apache2-mod_php5-8086 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-apache2-mod_php5-8086 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): php5-devel-5.2.14-0.7.30.48.1 php5-imap-5.2.14-0.7.30.48.1 php5-ncurses-5.2.14-0.7.30.48.1 php5-posix-5.2.14-0.7.30.48.1 php5-readline-5.2.14-0.7.30.48.1 php5-sockets-5.2.14-0.7.30.48.1 php5-sqlite-5.2.14-0.7.30.48.1 php5-tidy-5.2.14-0.7.30.48.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): apache2-mod_php5-5.2.14-0.7.30.48.1 php5-5.2.14-0.7.30.48.1 php5-bcmath-5.2.14-0.7.30.48.1 php5-bz2-5.2.14-0.7.30.48.1 php5-calendar-5.2.14-0.7.30.48.1 php5-ctype-5.2.14-0.7.30.48.1 php5-curl-5.2.14-0.7.30.48.1 php5-dba-5.2.14-0.7.30.48.1 php5-dbase-5.2.14-0.7.30.48.1 php5-dom-5.2.14-0.7.30.48.1 php5-exif-5.2.14-0.7.30.48.1 php5-fastcgi-5.2.14-0.7.30.48.1 php5-ftp-5.2.14-0.7.30.48.1 php5-gd-5.2.14-0.7.30.48.1 php5-gettext-5.2.14-0.7.30.48.1 php5-gmp-5.2.14-0.7.30.48.1 php5-hash-5.2.14-0.7.30.48.1 php5-iconv-5.2.14-0.7.30.48.1 php5-json-5.2.14-0.7.30.48.1 php5-ldap-5.2.14-0.7.30.48.1 php5-mbstring-5.2.14-0.7.30.48.1 php5-mcrypt-5.2.14-0.7.30.48.1 php5-mysql-5.2.14-0.7.30.48.1 php5-odbc-5.2.14-0.7.30.48.1 php5-openssl-5.2.14-0.7.30.48.1 php5-pcntl-5.2.14-0.7.30.48.1 php5-pdo-5.2.14-0.7.30.48.1 php5-pear-5.2.14-0.7.30.48.1 php5-pgsql-5.2.14-0.7.30.48.1 php5-pspell-5.2.14-0.7.30.48.1 php5-shmop-5.2.14-0.7.30.48.1 php5-snmp-5.2.14-0.7.30.48.1 php5-soap-5.2.14-0.7.30.48.1 php5-suhosin-5.2.14-0.7.30.48.1 php5-sysvmsg-5.2.14-0.7.30.48.1 php5-sysvsem-5.2.14-0.7.30.48.1 php5-sysvshm-5.2.14-0.7.30.48.1 php5-tokenizer-5.2.14-0.7.30.48.1 php5-wddx-5.2.14-0.7.30.48.1 php5-xmlreader-5.2.14-0.7.30.48.1 php5-xmlrpc-5.2.14-0.7.30.48.1 php5-xmlwriter-5.2.14-0.7.30.48.1 php5-xsl-5.2.14-0.7.30.48.1 php5-zip-5.2.14-0.7.30.48.1 php5-zlib-5.2.14-0.7.30.48.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): apache2-mod_php5-5.2.14-0.7.30.48.1 php5-5.2.14-0.7.30.48.1 php5-bcmath-5.2.14-0.7.30.48.1 php5-bz2-5.2.14-0.7.30.48.1 php5-calendar-5.2.14-0.7.30.48.1 php5-ctype-5.2.14-0.7.30.48.1 php5-curl-5.2.14-0.7.30.48.1 php5-dba-5.2.14-0.7.30.48.1 php5-dbase-5.2.14-0.7.30.48.1 php5-dom-5.2.14-0.7.30.48.1 php5-exif-5.2.14-0.7.30.48.1 php5-fastcgi-5.2.14-0.7.30.48.1 php5-ftp-5.2.14-0.7.30.48.1 php5-gd-5.2.14-0.7.30.48.1 php5-gettext-5.2.14-0.7.30.48.1 php5-gmp-5.2.14-0.7.30.48.1 php5-hash-5.2.14-0.7.30.48.1 php5-iconv-5.2.14-0.7.30.48.1 php5-json-5.2.14-0.7.30.48.1 php5-ldap-5.2.14-0.7.30.48.1 php5-mbstring-5.2.14-0.7.30.48.1 php5-mcrypt-5.2.14-0.7.30.48.1 php5-mysql-5.2.14-0.7.30.48.1 php5-odbc-5.2.14-0.7.30.48.1 php5-openssl-5.2.14-0.7.30.48.1 php5-pcntl-5.2.14-0.7.30.48.1 php5-pdo-5.2.14-0.7.30.48.1 php5-pear-5.2.14-0.7.30.48.1 php5-pgsql-5.2.14-0.7.30.48.1 php5-pspell-5.2.14-0.7.30.48.1 php5-shmop-5.2.14-0.7.30.48.1 php5-snmp-5.2.14-0.7.30.48.1 php5-soap-5.2.14-0.7.30.48.1 php5-suhosin-5.2.14-0.7.30.48.1 php5-sysvmsg-5.2.14-0.7.30.48.1 php5-sysvsem-5.2.14-0.7.30.48.1 php5-sysvshm-5.2.14-0.7.30.48.1 php5-tokenizer-5.2.14-0.7.30.48.1 php5-wddx-5.2.14-0.7.30.48.1 php5-xmlreader-5.2.14-0.7.30.48.1 php5-xmlrpc-5.2.14-0.7.30.48.1 php5-xmlwriter-5.2.14-0.7.30.48.1 php5-xsl-5.2.14-0.7.30.48.1 php5-zip-5.2.14-0.7.30.48.1 php5-zlib-5.2.14-0.7.30.48.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php5-5.2.14-0.7.30.48.1 php5-5.2.14-0.7.30.48.1 php5-bcmath-5.2.14-0.7.30.48.1 php5-bz2-5.2.14-0.7.30.48.1 php5-calendar-5.2.14-0.7.30.48.1 php5-ctype-5.2.14-0.7.30.48.1 php5-curl-5.2.14-0.7.30.48.1 php5-dba-5.2.14-0.7.30.48.1 php5-dbase-5.2.14-0.7.30.48.1 php5-dom-5.2.14-0.7.30.48.1 php5-exif-5.2.14-0.7.30.48.1 php5-fastcgi-5.2.14-0.7.30.48.1 php5-ftp-5.2.14-0.7.30.48.1 php5-gd-5.2.14-0.7.30.48.1 php5-gettext-5.2.14-0.7.30.48.1 php5-gmp-5.2.14-0.7.30.48.1 php5-hash-5.2.14-0.7.30.48.1 php5-iconv-5.2.14-0.7.30.48.1 php5-json-5.2.14-0.7.30.48.1 php5-ldap-5.2.14-0.7.30.48.1 php5-mbstring-5.2.14-0.7.30.48.1 php5-mcrypt-5.2.14-0.7.30.48.1 php5-mysql-5.2.14-0.7.30.48.1 php5-odbc-5.2.14-0.7.30.48.1 php5-openssl-5.2.14-0.7.30.48.1 php5-pcntl-5.2.14-0.7.30.48.1 php5-pdo-5.2.14-0.7.30.48.1 php5-pear-5.2.14-0.7.30.48.1 php5-pgsql-5.2.14-0.7.30.48.1 php5-pspell-5.2.14-0.7.30.48.1 php5-shmop-5.2.14-0.7.30.48.1 php5-snmp-5.2.14-0.7.30.48.1 php5-soap-5.2.14-0.7.30.48.1 php5-suhosin-5.2.14-0.7.30.48.1 php5-sysvmsg-5.2.14-0.7.30.48.1 php5-sysvsem-5.2.14-0.7.30.48.1 php5-sysvshm-5.2.14-0.7.30.48.1 php5-tokenizer-5.2.14-0.7.30.48.1 php5-wddx-5.2.14-0.7.30.48.1 php5-xmlreader-5.2.14-0.7.30.48.1 php5-xmlrpc-5.2.14-0.7.30.48.1 php5-xmlwriter-5.2.14-0.7.30.48.1 php5-xsl-5.2.14-0.7.30.48.1 php5-zip-5.2.14-0.7.30.48.1 php5-zlib-5.2.14-0.7.30.48.1 References: http://support.novell.com/security/cve/CVE-2013-1635.html http://support.novell.com/security/cve/CVE-2013-1643.html http://support.novell.com/security/cve/CVE-2013-4113.html http://support.novell.com/security/cve/CVE-2013-4635.html https://bugzilla.novell.com/783239 https://bugzilla.novell.com/807707 https://bugzilla.novell.com/828020 https://bugzilla.novell.com/829207 http://download.novell.com/patch/finder/?keywords=983afe97da999c3ed9c81daa3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1285-2: important: Security update for PHP5
by opensuse-security＠opensuse.org 09 Aug '13

09 Aug '13

SUSE Security Update: Security update for PHP5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1285-2 Rating: important References: #807707 #828020 #829207 Cross-References: CVE-2013-1635 CVE-2013-1643 CVE-2013-4113 CVE-2013-4635 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: The following security issues have been fixed: * CVE-2013-4635 (bnc#828020): o Integer overflow in SdnToJewish() * CVE-2013-1635 and CVE-2013-1643 (bnc#807707): o reading system files via untrusted SOAP input o soap.wsdl_cache_dir function did not honour PHP open_basedir * CVE-2013-4113 (bnc#829207): o heap corruption due to badly formed xml Security Issue references: * CVE-2013-4113 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113 > * CVE-2013-4635 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4635 > * CVE-2013-1635 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1635 > * CVE-2013-1643 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1643 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-apache2-mod_php53-8087 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-apache2-mod_php53-8087 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-apache2-mod_php53-8087 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): php53-devel-5.3.8-0.41.1 php53-imap-5.3.8-0.41.1 php53-posix-5.3.8-0.41.1 php53-readline-5.3.8-0.41.1 php53-sockets-5.3.8-0.41.1 php53-sqlite-5.3.8-0.41.1 php53-tidy-5.3.8-0.41.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): apache2-mod_php53-5.3.8-0.41.1 php53-5.3.8-0.41.1 php53-bcmath-5.3.8-0.41.1 php53-bz2-5.3.8-0.41.1 php53-calendar-5.3.8-0.41.1 php53-ctype-5.3.8-0.41.1 php53-curl-5.3.8-0.41.1 php53-dba-5.3.8-0.41.1 php53-dom-5.3.8-0.41.1 php53-exif-5.3.8-0.41.1 php53-fastcgi-5.3.8-0.41.1 php53-fileinfo-5.3.8-0.41.1 php53-ftp-5.3.8-0.41.1 php53-gd-5.3.8-0.41.1 php53-gettext-5.3.8-0.41.1 php53-gmp-5.3.8-0.41.1 php53-iconv-5.3.8-0.41.1 php53-intl-5.3.8-0.41.1 php53-json-5.3.8-0.41.1 php53-ldap-5.3.8-0.41.1 php53-mbstring-5.3.8-0.41.1 php53-mcrypt-5.3.8-0.41.1 php53-mysql-5.3.8-0.41.1 php53-odbc-5.3.8-0.41.1 php53-openssl-5.3.8-0.41.1 php53-pcntl-5.3.8-0.41.1 php53-pdo-5.3.8-0.41.1 php53-pear-5.3.8-0.41.1 php53-pgsql-5.3.8-0.41.1 php53-pspell-5.3.8-0.41.1 php53-shmop-5.3.8-0.41.1 php53-snmp-5.3.8-0.41.1 php53-soap-5.3.8-0.41.1 php53-suhosin-5.3.8-0.41.1 php53-sysvmsg-5.3.8-0.41.1 php53-sysvsem-5.3.8-0.41.1 php53-sysvshm-5.3.8-0.41.1 php53-tokenizer-5.3.8-0.41.1 php53-wddx-5.3.8-0.41.1 php53-xmlreader-5.3.8-0.41.1 php53-xmlrpc-5.3.8-0.41.1 php53-xmlwriter-5.3.8-0.41.1 php53-xsl-5.3.8-0.41.1 php53-zip-5.3.8-0.41.1 php53-zlib-5.3.8-0.41.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php53-5.3.8-0.41.1 php53-5.3.8-0.41.1 php53-bcmath-5.3.8-0.41.1 php53-bz2-5.3.8-0.41.1 php53-calendar-5.3.8-0.41.1 php53-ctype-5.3.8-0.41.1 php53-curl-5.3.8-0.41.1 php53-dba-5.3.8-0.41.1 php53-dom-5.3.8-0.41.1 php53-exif-5.3.8-0.41.1 php53-fastcgi-5.3.8-0.41.1 php53-fileinfo-5.3.8-0.41.1 php53-ftp-5.3.8-0.41.1 php53-gd-5.3.8-0.41.1 php53-gettext-5.3.8-0.41.1 php53-gmp-5.3.8-0.41.1 php53-iconv-5.3.8-0.41.1 php53-intl-5.3.8-0.41.1 php53-json-5.3.8-0.41.1 php53-ldap-5.3.8-0.41.1 php53-mbstring-5.3.8-0.41.1 php53-mcrypt-5.3.8-0.41.1 php53-mysql-5.3.8-0.41.1 php53-odbc-5.3.8-0.41.1 php53-openssl-5.3.8-0.41.1 php53-pcntl-5.3.8-0.41.1 php53-pdo-5.3.8-0.41.1 php53-pear-5.3.8-0.41.1 php53-pgsql-5.3.8-0.41.1 php53-pspell-5.3.8-0.41.1 php53-shmop-5.3.8-0.41.1 php53-snmp-5.3.8-0.41.1 php53-soap-5.3.8-0.41.1 php53-suhosin-5.3.8-0.41.1 php53-sysvmsg-5.3.8-0.41.1 php53-sysvsem-5.3.8-0.41.1 php53-sysvshm-5.3.8-0.41.1 php53-tokenizer-5.3.8-0.41.1 php53-wddx-5.3.8-0.41.1 php53-xmlreader-5.3.8-0.41.1 php53-xmlrpc-5.3.8-0.41.1 php53-xmlwriter-5.3.8-0.41.1 php53-xsl-5.3.8-0.41.1 php53-zip-5.3.8-0.41.1 php53-zlib-5.3.8-0.41.1 References: http://support.novell.com/security/cve/CVE-2013-1635.html http://support.novell.com/security/cve/CVE-2013-1643.html http://support.novell.com/security/cve/CVE-2013-4113.html http://support.novell.com/security/cve/CVE-2013-4635.html https://bugzilla.novell.com/807707 https://bugzilla.novell.com/828020 https://bugzilla.novell.com/829207 http://download.novell.com/patch/finder/?keywords=ad593aac1cfc93b29edc0ea5b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1316-1: important: Security update for PHP5
by opensuse-security＠opensuse.org 09 Aug '13

09 Aug '13

SUSE Security Update: Security update for PHP5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1316-1 Rating: important References: #828020 #829207 Cross-References: CVE-2013-4113 CVE-2013-4635 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The following security issues have been fixed: * CVE-2013-4635 (bnc#828020): o Integer overflow in SdnToJewish() * CVE-2013-4113 (bnc#829207): o heap corruption due to badly formed xml Security Issues: * CVE-2013-4113 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113 > * CVE-2013-4635 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4635 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-apache2-mod_php53-8088 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-apache2-mod_php53-8088 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-apache2-mod_php53-8088 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): php53-devel-5.3.17-0.15.1 php53-imap-5.3.17-0.15.1 php53-posix-5.3.17-0.15.1 php53-readline-5.3.17-0.15.1 php53-sockets-5.3.17-0.15.1 php53-sqlite-5.3.17-0.15.1 php53-tidy-5.3.17-0.15.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): apache2-mod_php53-5.3.17-0.15.1 php53-5.3.17-0.15.1 php53-bcmath-5.3.17-0.15.1 php53-bz2-5.3.17-0.15.1 php53-calendar-5.3.17-0.15.1 php53-ctype-5.3.17-0.15.1 php53-curl-5.3.17-0.15.1 php53-dba-5.3.17-0.15.1 php53-dom-5.3.17-0.15.1 php53-exif-5.3.17-0.15.1 php53-fastcgi-5.3.17-0.15.1 php53-fileinfo-5.3.17-0.15.1 php53-ftp-5.3.17-0.15.1 php53-gd-5.3.17-0.15.1 php53-gettext-5.3.17-0.15.1 php53-gmp-5.3.17-0.15.1 php53-iconv-5.3.17-0.15.1 php53-intl-5.3.17-0.15.1 php53-json-5.3.17-0.15.1 php53-ldap-5.3.17-0.15.1 php53-mbstring-5.3.17-0.15.1 php53-mcrypt-5.3.17-0.15.1 php53-mysql-5.3.17-0.15.1 php53-odbc-5.3.17-0.15.1 php53-openssl-5.3.17-0.15.1 php53-pcntl-5.3.17-0.15.1 php53-pdo-5.3.17-0.15.1 php53-pear-5.3.17-0.15.1 php53-pgsql-5.3.17-0.15.1 php53-pspell-5.3.17-0.15.1 php53-shmop-5.3.17-0.15.1 php53-snmp-5.3.17-0.15.1 php53-soap-5.3.17-0.15.1 php53-suhosin-5.3.17-0.15.1 php53-sysvmsg-5.3.17-0.15.1 php53-sysvsem-5.3.17-0.15.1 php53-sysvshm-5.3.17-0.15.1 php53-tokenizer-5.3.17-0.15.1 php53-wddx-5.3.17-0.15.1 php53-xmlreader-5.3.17-0.15.1 php53-xmlrpc-5.3.17-0.15.1 php53-xmlwriter-5.3.17-0.15.1 php53-xsl-5.3.17-0.15.1 php53-zip-5.3.17-0.15.1 php53-zlib-5.3.17-0.15.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php53-5.3.17-0.15.1 php53-5.3.17-0.15.1 php53-bcmath-5.3.17-0.15.1 php53-bz2-5.3.17-0.15.1 php53-calendar-5.3.17-0.15.1 php53-ctype-5.3.17-0.15.1 php53-curl-5.3.17-0.15.1 php53-dba-5.3.17-0.15.1 php53-dom-5.3.17-0.15.1 php53-exif-5.3.17-0.15.1 php53-fastcgi-5.3.17-0.15.1 php53-fileinfo-5.3.17-0.15.1 php53-ftp-5.3.17-0.15.1 php53-gd-5.3.17-0.15.1 php53-gettext-5.3.17-0.15.1 php53-gmp-5.3.17-0.15.1 php53-iconv-5.3.17-0.15.1 php53-intl-5.3.17-0.15.1 php53-json-5.3.17-0.15.1 php53-ldap-5.3.17-0.15.1 php53-mbstring-5.3.17-0.15.1 php53-mcrypt-5.3.17-0.15.1 php53-mysql-5.3.17-0.15.1 php53-odbc-5.3.17-0.15.1 php53-openssl-5.3.17-0.15.1 php53-pcntl-5.3.17-0.15.1 php53-pdo-5.3.17-0.15.1 php53-pear-5.3.17-0.15.1 php53-pgsql-5.3.17-0.15.1 php53-pspell-5.3.17-0.15.1 php53-shmop-5.3.17-0.15.1 php53-snmp-5.3.17-0.15.1 php53-soap-5.3.17-0.15.1 php53-suhosin-5.3.17-0.15.1 php53-sysvmsg-5.3.17-0.15.1 php53-sysvsem-5.3.17-0.15.1 php53-sysvshm-5.3.17-0.15.1 php53-tokenizer-5.3.17-0.15.1 php53-wddx-5.3.17-0.15.1 php53-xmlreader-5.3.17-0.15.1 php53-xmlrpc-5.3.17-0.15.1 php53-xmlwriter-5.3.17-0.15.1 php53-xsl-5.3.17-0.15.1 php53-zip-5.3.17-0.15.1 php53-zlib-5.3.17-0.15.1 References: http://support.novell.com/security/cve/CVE-2013-4113.html http://support.novell.com/security/cve/CVE-2013-4635.html https://bugzilla.novell.com/828020 https://bugzilla.novell.com/829207 http://download.novell.com/patch/finder/?keywords=b35f4744a67f955b03d2752b1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1315-1: important: Security update for PHP5
by opensuse-security＠opensuse.org 09 Aug '13

09 Aug '13

SUSE Security Update: Security update for PHP5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1315-1 Rating: important References: #775852 #778003 #783239 #807707 #828020 #829207 Cross-References: CVE-2013-4113 Affected Products: SUSE Linux Enterprise Server 11 SP1 for VMware LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. It includes one version update. Description: The following security issues have been fixed in PHP5: * CVE-2013-4635: Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP allowed context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function. * CVE-2013-1635: ext/soap/soap.c in PHP did not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allowed remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory. * CVE-2013-1643: The SOAP parser in PHP allowed remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions. * CVE-2013-4113: ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function. * CVE-2011-1398 / CVE-2012-4388: The sapi_header_op function in main/SAPI.c in PHP did not check for %0D sequences (aka carriage return characters), which allowed remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome. A hardening measure has been implemented without CVE: * use FilesMatch with 'SetHandler' rather than 'AddHandler' [bnc#775852] * fixed php bug #43200 (Interface implementation / inheritence not possible in abstract classes) [bnc#783239] Security Issue reference: * CVE-2013-4113 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS: zypper in -t patch slessp1-apache2-mod_php5-8112 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-apache2-mod_php5-8112 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS (i586 x86_64) [New Version: 5.2.14]: apache2-mod_php5-5.2.14-0.7.30.48.1 php5-5.2.14-0.7.30.48.1 php5-bcmath-5.2.14-0.7.30.48.1 php5-bz2-5.2.14-0.7.30.48.1 php5-calendar-5.2.14-0.7.30.48.1 php5-ctype-5.2.14-0.7.30.48.1 php5-curl-5.2.14-0.7.30.48.1 php5-dba-5.2.14-0.7.30.48.1 php5-dbase-5.2.14-0.7.30.48.1 php5-dom-5.2.14-0.7.30.48.1 php5-exif-5.2.14-0.7.30.48.1 php5-fastcgi-5.2.14-0.7.30.48.1 php5-ftp-5.2.14-0.7.30.48.1 php5-gd-5.2.14-0.7.30.48.1 php5-gettext-5.2.14-0.7.30.48.1 php5-gmp-5.2.14-0.7.30.48.1 php5-hash-5.2.14-0.7.30.48.1 php5-iconv-5.2.14-0.7.30.48.1 php5-json-5.2.14-0.7.30.48.1 php5-ldap-5.2.14-0.7.30.48.1 php5-mbstring-5.2.14-0.7.30.48.1 php5-mcrypt-5.2.14-0.7.30.48.1 php5-mysql-5.2.14-0.7.30.48.1 php5-odbc-5.2.14-0.7.30.48.1 php5-openssl-5.2.14-0.7.30.48.1 php5-pcntl-5.2.14-0.7.30.48.1 php5-pdo-5.2.14-0.7.30.48.1 php5-pear-5.2.14-0.7.30.48.1 php5-pgsql-5.2.14-0.7.30.48.1 php5-pspell-5.2.14-0.7.30.48.1 php5-shmop-5.2.14-0.7.30.48.1 php5-snmp-5.2.14-0.7.30.48.1 php5-soap-5.2.14-0.7.30.48.1 php5-suhosin-5.2.14-0.7.30.48.1 php5-sysvmsg-5.2.14-0.7.30.48.1 php5-sysvsem-5.2.14-0.7.30.48.1 php5-sysvshm-5.2.14-0.7.30.48.1 php5-tokenizer-5.2.14-0.7.30.48.1 php5-wddx-5.2.14-0.7.30.48.1 php5-xmlreader-5.2.14-0.7.30.48.1 php5-xmlrpc-5.2.14-0.7.30.48.1 php5-xmlwriter-5.2.14-0.7.30.48.1 php5-xsl-5.2.14-0.7.30.48.1 php5-zip-5.2.14-0.7.30.48.1 php5-zlib-5.2.14-0.7.30.48.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 5.2.14]: apache2-mod_php5-5.2.14-0.7.30.48.1 php5-5.2.14-0.7.30.48.1 php5-bcmath-5.2.14-0.7.30.48.1 php5-bz2-5.2.14-0.7.30.48.1 php5-calendar-5.2.14-0.7.30.48.1 php5-ctype-5.2.14-0.7.30.48.1 php5-curl-5.2.14-0.7.30.48.1 php5-dba-5.2.14-0.7.30.48.1 php5-dbase-5.2.14-0.7.30.48.1 php5-dom-5.2.14-0.7.30.48.1 php5-exif-5.2.14-0.7.30.48.1 php5-fastcgi-5.2.14-0.7.30.48.1 php5-ftp-5.2.14-0.7.30.48.1 php5-gd-5.2.14-0.7.30.48.1 php5-gettext-5.2.14-0.7.30.48.1 php5-gmp-5.2.14-0.7.30.48.1 php5-hash-5.2.14-0.7.30.48.1 php5-iconv-5.2.14-0.7.30.48.1 php5-json-5.2.14-0.7.30.48.1 php5-ldap-5.2.14-0.7.30.48.1 php5-mbstring-5.2.14-0.7.30.48.1 php5-mcrypt-5.2.14-0.7.30.48.1 php5-mysql-5.2.14-0.7.30.48.1 php5-odbc-5.2.14-0.7.30.48.1 php5-openssl-5.2.14-0.7.30.48.1 php5-pcntl-5.2.14-0.7.30.48.1 php5-pdo-5.2.14-0.7.30.48.1 php5-pear-5.2.14-0.7.30.48.1 php5-pgsql-5.2.14-0.7.30.48.1 php5-pspell-5.2.14-0.7.30.48.1 php5-shmop-5.2.14-0.7.30.48.1 php5-snmp-5.2.14-0.7.30.48.1 php5-soap-5.2.14-0.7.30.48.1 php5-suhosin-5.2.14-0.7.30.48.1 php5-sysvmsg-5.2.14-0.7.30.48.1 php5-sysvsem-5.2.14-0.7.30.48.1 php5-sysvshm-5.2.14-0.7.30.48.1 php5-tokenizer-5.2.14-0.7.30.48.1 php5-wddx-5.2.14-0.7.30.48.1 php5-xmlreader-5.2.14-0.7.30.48.1 php5-xmlrpc-5.2.14-0.7.30.48.1 php5-xmlwriter-5.2.14-0.7.30.48.1 php5-xsl-5.2.14-0.7.30.48.1 php5-zip-5.2.14-0.7.30.48.1 php5-zlib-5.2.14-0.7.30.48.1 References: http://support.novell.com/security/cve/CVE-2013-4113.html https://bugzilla.novell.com/775852 https://bugzilla.novell.com/778003 https://bugzilla.novell.com/783239 https://bugzilla.novell.com/807707 https://bugzilla.novell.com/828020 https://bugzilla.novell.com/829207 http://download.novell.com/patch/finder/?keywords=2ab3ed25399f2e9a36f4f4b0d… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1314-1: important: Security update for Xen
by opensuse-security＠opensuse.org 09 Aug '13

09 Aug '13

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1314-1 Rating: important References: #801663 #808085 #808269 #817210 #820917 #820919 #820920 #823011 #823608 Cross-References: CVE-2013-2194 CVE-2013-2195 CVE-2013-2196 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves three vulnerabilities and has 6 fixes is now available. Description: The Xen hypervisor and toolset has been updated to 4.2.2_06 to fix various bugs and security issues: The following security issues have been addressed: * CVE-2013-2194: Various integer overflows in the ELF loader were fixed. (XSA-55) * CVE-2013-2195: Various pointer dereferences issues in the ELF loader were fixed. (XSA-55) * CVE-2013-2196: Various other problems in the ELF loader were fixed. (XSA-55) * CVE-2013-2078: A Hypervisor crash due to missing exception recovery on XSETBV was fixed. (XSA-54) * CVE-2013-2077: A Hypervisor crash due to missing exception recovery on XRSTOR was fixed. (XSA-53) * CVE-2013-2211: libxl allowed guest write access to sensitive console related xenstore keys. (XSA-57) * CVE-2013-2076: An information leak on XSAVE/XRSTOR capable AMD CPUs (XSA-52) was fixed, where parts of this state could leak to other VMs. Also the following bugs have been fixed: * performance issues in mirror lvm (bnc#801663) * aacraid driver panics mapping INT A when booting kernel-xen (bnc#808085) * Fully Virtualized Windows VM install failed on Ivy Bridge platforms with Xen kernel (bnc#808269) * Did not boot with i915 graphics controller with VT-d enabled (bnc#817210) Security Issue references: * CVE-2013-2194 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2194 > * CVE-2013-2195 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2195 > * CVE-2013-2196 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2196 > Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-xen-201307-8063 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-xen-201307-8063 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-xen-201307-8063 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): xen-devel-4.2.2_06-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): xen-kmp-default-4.2.2_06_3.0.82_0.7-0.7.1 xen-libs-4.2.2_06-0.7.1 xen-tools-domU-4.2.2_06-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (x86_64): xen-4.2.2_06-0.7.1 xen-doc-html-4.2.2_06-0.7.1 xen-doc-pdf-4.2.2_06-0.7.1 xen-libs-32bit-4.2.2_06-0.7.1 xen-tools-4.2.2_06-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586): xen-kmp-pae-4.2.2_06_3.0.82_0.7-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): xen-kmp-default-4.2.2_06_3.0.82_0.7-0.7.1 xen-libs-4.2.2_06-0.7.1 xen-tools-domU-4.2.2_06-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): xen-4.2.2_06-0.7.1 xen-doc-html-4.2.2_06-0.7.1 xen-doc-pdf-4.2.2_06-0.7.1 xen-libs-32bit-4.2.2_06-0.7.1 xen-tools-4.2.2_06-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586): xen-kmp-pae-4.2.2_06_3.0.82_0.7-0.7.1 References: http://support.novell.com/security/cve/CVE-2013-2194.html http://support.novell.com/security/cve/CVE-2013-2195.html http://support.novell.com/security/cve/CVE-2013-2196.html https://bugzilla.novell.com/801663 https://bugzilla.novell.com/808085 https://bugzilla.novell.com/808269 https://bugzilla.novell.com/817210 https://bugzilla.novell.com/820917 https://bugzilla.novell.com/820919 https://bugzilla.novell.com/820920 https://bugzilla.novell.com/823011 https://bugzilla.novell.com/823608 http://download.novell.com/patch/finder/?keywords=6f245c857571421a6701c20d0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1310-1: important: Security update for bind
by opensuse-security＠opensuse.org 07 Aug '13

07 Aug '13

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1310-1 Rating: important References: #831899 Cross-References: CVE-2013-4854 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: A specially crafted query with malicious rdata could have caused a crash (DoS) in named. Security Issue reference: * CVE-2013-4854 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4854 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-bind-8161 - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-bind-8160 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-bind-8161 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-bind-8161 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-bind-8160 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-bind-8160 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-bind-8161 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-bind-8160 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.9.3P2]: bind-devel-9.9.3P2-0.5.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64) [New Version: 9.9.3P2]: bind-devel-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.9.3P2]: bind-devel-9.9.3P2-0.5.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (ppc64) [New Version: 9.9.3P2]: bind-devel-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 9.9.3P2]: bind-9.9.3P2-0.5.1 bind-chrootenv-9.9.3P2-0.5.1 bind-doc-9.9.3P2-0.5.1 bind-libs-9.9.3P2-0.5.1 bind-utils-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 9.9.3P2]: bind-libs-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.9.3P2]: bind-9.9.3P2-0.5.1 bind-chrootenv-9.9.3P2-0.5.1 bind-doc-9.9.3P2-0.5.1 bind-libs-9.9.3P2-0.5.1 bind-utils-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 9.9.3P2]: bind-libs-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 9.9.3P2]: bind-libs-x86-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 9.9.3P2]: bind-9.9.3P2-0.5.1 bind-chrootenv-9.9.3P2-0.5.1 bind-doc-9.9.3P2-0.5.1 bind-libs-9.9.3P2-0.5.1 bind-utils-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 9.9.3P2]: bind-libs-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.9.3P2]: bind-9.9.3P2-0.5.1 bind-chrootenv-9.9.3P2-0.5.1 bind-doc-9.9.3P2-0.5.1 bind-libs-9.9.3P2-0.5.1 bind-utils-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 9.9.3P2]: bind-libs-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 9.9.3P2]: bind-libs-x86-9.9.3P2-0.5.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 9.9.3P2]: bind-libs-9.9.3P2-0.5.1 bind-utils-9.9.3P2-0.5.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 9.9.3P2]: bind-libs-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 9.9.3P2]: bind-libs-9.9.3P2-0.5.1 bind-utils-9.9.3P2-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 9.9.3P2]: bind-libs-32bit-9.9.3P2-0.5.1 References: http://support.novell.com/security/cve/CVE-2013-4854.html https://bugzilla.novell.com/831899 http://download.novell.com/patch/finder/?keywords=6b7570508ab209647dc76ea23… http://download.novell.com/patch/finder/?keywords=b60df9afc37de4b5115de94bd… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1305-1: important: Security update for IBM Java 1.6.0
by opensuse-security＠opensuse.org 06 Aug '13

06 Aug '13

SUSE Security Update: Security update for IBM Java 1.6.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1305-1 Rating: important References: #817062 #823034 #829212 #831936 Cross-References: CVE-2013-1500 CVE-2013-1571 CVE-2013-2407 CVE-2013-2412 CVE-2013-2437 CVE-2013-2442 CVE-2013-2443 CVE-2013-2444 CVE-2013-2446 CVE-2013-2447 CVE-2013-2448 CVE-2013-2450 CVE-2013-2451 CVE-2013-2452 CVE-2013-2453 CVE-2013-2454 CVE-2013-2455 CVE-2013-2456 CVE-2013-2457 CVE-2013-2459 CVE-2013-2463 CVE-2013-2464 CVE-2013-2465 CVE-2013-2466 CVE-2013-2468 CVE-2013-2469 CVE-2013-2470 CVE-2013-2471 CVE-2013-2472 CVE-2013-2473 CVE-2013-3009 CVE-2013-3011 CVE-2013-3012 CVE-2013-3743 CVE-2013-4002 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes 35 vulnerabilities is now available. Description: IBM Java 1.6.0 has been updated to SR14 to fix bugs and security issues. Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Also the following bugs have been fixed: * add Europe/Busingen to tzmappings (bnc#817062) * mark files in jre/bin and bin/ as executable (bnc#823034) * check if installed qa_filelist is not empty (bnc#831936) Security Issue references: * CVE-2013-3009 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3009 > * CVE-2013-3011 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3011 > * CVE-2013-3012 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3012 > * CVE-2013-4002 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4002 > * CVE-2013-2468 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2468 > * CVE-2013-2469 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2469 > * CVE-2013-2465 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2465 > * CVE-2013-2464 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2464 > * CVE-2013-2463 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2463 > * CVE-2013-2473 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2473 > * CVE-2013-2472 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2472 > * CVE-2013-2471 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2471 > * CVE-2013-2470 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2470 > * CVE-2013-2459 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2459 > * CVE-2013-2466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2466 > * CVE-2013-3743 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3743 > * CVE-2013-2448 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2448 > * CVE-2013-2442 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2442 > * CVE-2013-2407 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2407 > * CVE-2013-2454 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2454 > * CVE-2013-2456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2456 > * CVE-2013-2453 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2453 > * CVE-2013-2457 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2457 > * CVE-2013-2455 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2455 > * CVE-2013-2412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2412 > * CVE-2013-2443 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2443 > * CVE-2013-2447 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2447 > * CVE-2013-2437 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2437 > * CVE-2013-2444 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2444 > * CVE-2013-2452 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2452 > * CVE-2013-2446 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2446 > * CVE-2013-2450 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2450 > * CVE-2013-1571 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1571 > * CVE-2013-2451 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2451 > * CVE-2013-1500 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1500 > Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr14.0-0.6.6.1 java-1_6_0-ibm-devel-1.6.0_sr14.0-0.6.6.1 java-1_6_0-ibm-fonts-1.6.0_sr14.0-0.6.6.1 java-1_6_0-ibm-jdbc-1.6.0_sr14.0-0.6.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr14.0-0.6.6.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr14.0-0.6.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr14.0-0.6.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr14.0-0.6.6.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr14.0-0.6.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr14.0-0.6.6.1 References: http://support.novell.com/security/cve/CVE-2013-1500.html http://support.novell.com/security/cve/CVE-2013-1571.html http://support.novell.com/security/cve/CVE-2013-2407.html http://support.novell.com/security/cve/CVE-2013-2412.html http://support.novell.com/security/cve/CVE-2013-2437.html http://support.novell.com/security/cve/CVE-2013-2442.html http://support.novell.com/security/cve/CVE-2013-2443.html http://support.novell.com/security/cve/CVE-2013-2444.html http://support.novell.com/security/cve/CVE-2013-2446.html http://support.novell.com/security/cve/CVE-2013-2447.html http://support.novell.com/security/cve/CVE-2013-2448.html http://support.novell.com/security/cve/CVE-2013-2450.html http://support.novell.com/security/cve/CVE-2013-2451.html http://support.novell.com/security/cve/CVE-2013-2452.html http://support.novell.com/security/cve/CVE-2013-2453.html http://support.novell.com/security/cve/CVE-2013-2454.html http://support.novell.com/security/cve/CVE-2013-2455.html http://support.novell.com/security/cve/CVE-2013-2456.html http://support.novell.com/security/cve/CVE-2013-2457.html http://support.novell.com/security/cve/CVE-2013-2459.html http://support.novell.com/security/cve/CVE-2013-2463.html http://support.novell.com/security/cve/CVE-2013-2464.html http://support.novell.com/security/cve/CVE-2013-2465.html http://support.novell.com/security/cve/CVE-2013-2466.html http://support.novell.com/security/cve/CVE-2013-2468.html http://support.novell.com/security/cve/CVE-2013-2469.html http://support.novell.com/security/cve/CVE-2013-2470.html http://support.novell.com/security/cve/CVE-2013-2471.html http://support.novell.com/security/cve/CVE-2013-2472.html http://support.novell.com/security/cve/CVE-2013-2473.html http://support.novell.com/security/cve/CVE-2013-3009.html http://support.novell.com/security/cve/CVE-2013-3011.html http://support.novell.com/security/cve/CVE-2013-3012.html http://support.novell.com/security/cve/CVE-2013-3743.html http://support.novell.com/security/cve/CVE-2013-4002.html https://bugzilla.novell.com/817062 https://bugzilla.novell.com/823034 https://bugzilla.novell.com/829212 https://bugzilla.novell.com/831936 http://download.novell.com/patch/finder/?keywords=83286d2f8367035fc1294114a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1304-1: critical: Security update for puppet
by opensuse-security＠opensuse.org 06 Aug '13

06 Aug '13

SUSE Security Update: Security update for puppet ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1304-1 Rating: critical References: #825878 Cross-References: CVE-2013-3567 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This puppet update fixes a remote code execution issue: * Unauthenticated Remote Code Execution Vulnerability with YAML and REST API calls (bug#825878, CVE-2013-3567) Security Issue reference: * CVE-2013-3567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3567 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-puppet-8132 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-puppet-8132 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-puppet-8131 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-puppet-8131 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-puppet-8132 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-puppet-8131 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): puppet-2.6.18-0.6.1 puppet-server-2.6.18-0.6.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): puppet-2.6.18-0.6.1 puppet-server-2.6.18-0.6.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 2.6.18]: puppet-2.6.18-0.6.1 puppet-server-2.6.18-0.6.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.6.18]: puppet-2.6.18-0.6.1 puppet-server-2.6.18-0.6.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): puppet-2.6.18-0.6.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 2.6.18]: puppet-2.6.18-0.6.1 References: http://support.novell.com/security/cve/CVE-2013-3567.html https://bugzilla.novell.com/825878 http://download.novell.com/patch/finder/?keywords=257dd8125d8a1d0ff79cfbc99… http://download.novell.com/patch/finder/?keywords=3cee502500023425010c6abfb… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1293-2: important: Security update for IBM Java 1.4.2
by opensuse-security＠opensuse.org 05 Aug '13

05 Aug '13

SUSE Security Update: Security update for IBM Java 1.4.2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1293-2 Rating: important References: #823034 #829212 Affected Products: SUSE Linux Enterprise Server 11 SP1 for VMware LTSS SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.4.2 has been updated to SR13-FP18 to fix bugs and security issues: CVE-2013-3009, CVE-2013-3011, CVE-2013-3012, CVE-2013-2469, CVE-2013-2465, CVE-2013-2464, CVE-2013-2463, CVE-2013-2473, CVE-2013-2472, CVE-2013-2471, CVE-2013-2470, CVE-2013-2459, CVE-2013-2456, CVE-2013-2447, CVE-2013-2452, CVE-2013-2446, CVE-2013-2450, CVE-2013-1500 Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Also following bug has been fixed: * mark files in jre/bin and bin/ as executable (bnc#823034) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS: zypper in -t patch slessp1-java-1_4_2-ibm-8113 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-java-1_4_2-ibm-8113 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS (i586 x86_64): java-1_4_2-ibm-1.4.2_sr13.18-0.4.1 - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.18-0.4.1 java-1_4_2-ibm-plugin-1.4.2_sr13.18-0.4.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.18-0.4.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.18-0.4.1 java-1_4_2-ibm-plugin-1.4.2_sr13.18-0.4.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.18-0.7.1 java-1_4_2-ibm-devel-1.4.2_sr13.18-0.7.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.18-0.7.1 java-1_4_2-ibm-plugin-1.4.2_sr13.18-0.7.1 References: https://bugzilla.novell.com/823034 https://bugzilla.novell.com/829212 http://download.novell.com/patch/finder/?keywords=218af645ef5f0082097200b5e… http://download.novell.com/patch/finder/?keywords=76ae3ed7fc780d986eebf8b71… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1293-1: important: Security update for IBMJava5 JRE and IBMJava5 SDK
by opensuse-security＠opensuse.org 02 Aug '13

02 Aug '13

SUSE Security Update: Security update for IBMJava5 JRE and IBMJava5 SDK ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1293-1 Rating: important References: #823034 #829212 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.5.0 was updated to SR16-FP3 to fix bugs and security issues: CVE-2013-3009, CVE-2013-3011, CVE-2013-3012, CVE-2013-4002 CVE-2013-2469, CVE-2013-2465, CVE-2013-2464, CVE-2013-2463, CVE-2013-2473, CVE-2013-2472, CVE-2013-2471, CVE-2013-2470, CVE-2013-2459, CVE-2013-3743, CVE-2013-2448, CVE-2013-2454, CVE-2013-2456 CVE-2013-2457, CVE-2013-2455, CVE-2013-2443, CVE-2013-2447 CVE-2013-2444, CVE-2013-2452, CVE-2013-2446, CVE-2013-2450, CVE-2013-1571, CVE-2013-1500 Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Also the following bugs have been fixed: * add Europe/Busingen to tzmappings (bnc#817062) * mark files in jre/bin and bin/ as executable (bnc#823034) Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): IBMJava2-JRE-1.4.2_sr13.18-0.4 IBMJava2-SDK-1.4.2_sr13.18-0.4 IBMJava5-JRE-1.5.0_sr16.3-0.4 IBMJava5-SDK-1.5.0_sr16.3-0.4 References: https://bugzilla.novell.com/823034 https://bugzilla.novell.com/829212 http://download.novell.com/patch/finder/?keywords=7680f8140c62f26ce31740243… http://download.novell.com/patch/finder/?keywords=bf6c59989a94daa5af11dc7d5… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0