August 2013 - openSUSE Security Announce

[security-announce] openSUSE-SU-2013:1339-1: important: update for samba
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1339-1 Rating: important References: #765270 #798856 #806501 #812929 #817919 #820531 #823549 #824833 #829969 Cross-References: CVE-2013-4124 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has 8 fixes is now available. Description: This update of samba fixed the following issues: - The pam_winbind require_membership_of option allows for a list of SID, but currently only provides buffer space for ~20; (bnc#806501). - Samba 3.0.x to 4.0.7 are affected by a denial of service attack on authenticated or guest connections; CVE-2013-4124; (bnc#829969). - PIDL: fix parsing linemarkers in preprocessor output; (bso#9636). - build:autoconf: fix output of syslog-facility check; (bso#9983). - libreplace: add a missing "eval" to the AC_VERIFY_C_PROTOTYPE macro. - Remove ldapsmb from the main spec file. - Don't bzip2 the main tar ball, use the upstream gziped one instead. - Fix crash bug during Win8 sync; (bso#9822). - Check for system libtevent and link dbwrap_tool and dbwrap_torture against it; (bso#9881). - errno gets overwritten in call to check_parent_exists(); (bso#9927). - Fix a bug of drvupgrade of smbcontrol; (bso#9941). - Document idmap_ad rfc2307 attribute requirements; (bso#9880); (bnc#820531). - Don't install the tdb utilities man pages on post-12.1 systems; (bnc#823549). - Fix libreplace license ambiguity; (bso#8997); (bnc#765270). - Fix is_printer_published GUID retrieval; (bso#9900); (bnc#798856). - Fix 'map untrusted to domain' with NTLMv2; (bso#9817); (bnc#817919). - Don't modify the pidfile name when a custom config file path is used; (bnc#812929). - Add extra attributes for AD printer publishing; (bso#9378); (bnc#798856). - Fix vfs_catia module; (bso#9701); (bnc#824833). - Fix AD printer publishing; (bso#9378); (bnc#798856). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-644 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libnetapi-devel-3.6.7-48.24.1 libnetapi0-3.6.7-48.24.1 libnetapi0-debuginfo-3.6.7-48.24.1 libsmbclient-devel-3.6.7-48.24.1 libsmbclient0-3.6.7-48.24.1 libsmbclient0-debuginfo-3.6.7-48.24.1 libsmbsharemodes-devel-3.6.7-48.24.1 libsmbsharemodes0-3.6.7-48.24.1 libsmbsharemodes0-debuginfo-3.6.7-48.24.1 libwbclient-devel-3.6.7-48.24.1 libwbclient0-3.6.7-48.24.1 libwbclient0-debuginfo-3.6.7-48.24.1 samba-3.6.7-48.24.1 samba-client-3.6.7-48.24.1 samba-client-debuginfo-3.6.7-48.24.1 samba-debuginfo-3.6.7-48.24.1 samba-debugsource-3.6.7-48.24.1 samba-devel-3.6.7-48.24.1 samba-krb-printing-3.6.7-48.24.1 samba-krb-printing-debuginfo-3.6.7-48.24.1 samba-winbind-3.6.7-48.24.1 samba-winbind-debuginfo-3.6.7-48.24.1 - openSUSE 12.2 (x86_64): libsmbclient0-32bit-3.6.7-48.24.1 libsmbclient0-debuginfo-32bit-3.6.7-48.24.1 libwbclient0-32bit-3.6.7-48.24.1 libwbclient0-debuginfo-32bit-3.6.7-48.24.1 samba-32bit-3.6.7-48.24.1 samba-client-32bit-3.6.7-48.24.1 samba-client-debuginfo-32bit-3.6.7-48.24.1 samba-debuginfo-32bit-3.6.7-48.24.1 samba-winbind-32bit-3.6.7-48.24.1 samba-winbind-debuginfo-32bit-3.6.7-48.24.1 - openSUSE 12.2 (noarch): samba-doc-3.6.7-48.24.1 References: http://support.novell.com/security/cve/CVE-2013-4124.html https://bugzilla.novell.com/765270 https://bugzilla.novell.com/798856 https://bugzilla.novell.com/806501 https://bugzilla.novell.com/812929 https://bugzilla.novell.com/817919 https://bugzilla.novell.com/820531 https://bugzilla.novell.com/823549 https://bugzilla.novell.com/824833 https://bugzilla.novell.com/829969 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:1334-1: important: Mozilla updates August 2013
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: Mozilla updates August 2013 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1334-1 Rating: important References: #833389 Cross-References: CVE-2013-1701 CVE-2013-1702 CVE-2013-1704 CVE-2013-1705 CVE-2013-1708 CVE-2013-1709 CVE-2013-1710 CVE-2013-1711 CVE-2013-1713 CVE-2013-1714 CVE-2013-1717 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This patch contains updates for - Firefox to 23.0 - xulrunner to 17.0.8esr - Thunderbird to 17.0.8 - mozilla-nspr to 4.10 - mozilla-nss to 3.15,1 * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous memory safety hazards * MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free mutating DOM during SetBody * MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests * MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV audio file decoding * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of XrayWrappers using XBL Scopes * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-122 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-23.0-83.1 MozillaFirefox-branding-upstream-23.0-83.1 MozillaFirefox-buildsymbols-23.0-83.1 MozillaFirefox-debuginfo-23.0-83.1 MozillaFirefox-debugsource-23.0-83.1 MozillaFirefox-devel-23.0-83.1 MozillaFirefox-translations-common-23.0-83.1 MozillaFirefox-translations-other-23.0-83.1 MozillaThunderbird-17.0.8-69.2 MozillaThunderbird-buildsymbols-17.0.8-69.2 MozillaThunderbird-debuginfo-17.0.8-69.2 MozillaThunderbird-debugsource-17.0.8-69.2 MozillaThunderbird-devel-17.0.8-69.2 MozillaThunderbird-devel-debuginfo-17.0.8-69.2 MozillaThunderbird-translations-common-17.0.8-69.2 MozillaThunderbird-translations-other-17.0.8-69.2 enigmail-1.5.2+17.0.8-69.2 enigmail-debuginfo-1.5.2+17.0.8-69.2 libfreebl3-3.15.1-62.1 libfreebl3-debuginfo-3.15.1-62.1 libsoftokn3-3.15.1-62.1 libsoftokn3-debuginfo-3.15.1-62.1 mozilla-nspr-4.10-28.1 mozilla-nspr-debuginfo-4.10-28.1 mozilla-nspr-debugsource-4.10-28.1 mozilla-nspr-devel-4.10-28.1 mozilla-nss-3.15.1-62.1 mozilla-nss-certs-3.15.1-62.1 mozilla-nss-certs-debuginfo-3.15.1-62.1 mozilla-nss-debuginfo-3.15.1-62.1 mozilla-nss-debugsource-3.15.1-62.1 mozilla-nss-devel-3.15.1-62.1 mozilla-nss-sysinit-3.15.1-62.1 mozilla-nss-sysinit-debuginfo-3.15.1-62.1 mozilla-nss-tools-3.15.1-62.1 mozilla-nss-tools-debuginfo-3.15.1-62.1 seamonkey-2.20-73.1 seamonkey-debuginfo-2.20-73.1 seamonkey-debugsource-2.20-73.1 seamonkey-dom-inspector-2.20-73.1 seamonkey-irc-2.20-73.1 seamonkey-translations-common-2.20-73.1 seamonkey-translations-other-2.20-73.1 seamonkey-venkman-2.20-73.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.15.1-62.1 libfreebl3-debuginfo-32bit-3.15.1-62.1 libsoftokn3-32bit-3.15.1-62.1 libsoftokn3-debuginfo-32bit-3.15.1-62.1 mozilla-nspr-32bit-4.10-28.1 mozilla-nspr-debuginfo-32bit-4.10-28.1 mozilla-nss-32bit-3.15.1-62.1 mozilla-nss-certs-32bit-3.15.1-62.1 mozilla-nss-certs-debuginfo-32bit-3.15.1-62.1 mozilla-nss-debuginfo-32bit-3.15.1-62.1 mozilla-nss-sysinit-32bit-3.15.1-62.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.1-62.1 - openSUSE 11.4 (ia64): libfreebl3-debuginfo-x86-3.15.1-62.1 libfreebl3-x86-3.15.1-62.1 libsoftokn3-debuginfo-x86-3.15.1-62.1 libsoftokn3-x86-3.15.1-62.1 mozilla-nspr-debuginfo-x86-4.10-28.1 mozilla-nspr-x86-4.10-28.1 mozilla-nss-certs-debuginfo-x86-3.15.1-62.1 mozilla-nss-certs-x86-3.15.1-62.1 mozilla-nss-debuginfo-x86-3.15.1-62.1 mozilla-nss-sysinit-debuginfo-x86-3.15.1-62.1 mozilla-nss-sysinit-x86-3.15.1-62.1 mozilla-nss-x86-3.15.1-62.1 References: http://support.novell.com/security/cve/CVE-2013-1701.html http://support.novell.com/security/cve/CVE-2013-1702.html http://support.novell.com/security/cve/CVE-2013-1704.html http://support.novell.com/security/cve/CVE-2013-1705.html http://support.novell.com/security/cve/CVE-2013-1708.html http://support.novell.com/security/cve/CVE-2013-1709.html http://support.novell.com/security/cve/CVE-2013-1710.html http://support.novell.com/security/cve/CVE-2013-1711.html http://support.novell.com/security/cve/CVE-2013-1713.html http://support.novell.com/security/cve/CVE-2013-1714.html http://support.novell.com/security/cve/CVE-2013-1717.html https://bugzilla.novell.com/833389 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1325-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 13 Aug '13

13 Aug '13

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1325-1 Rating: important References: #833389 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: This update to Firefox 17.0.8esr (bnc#833389) addresses: * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 (bmo#855331, bmo#844088, bmo#858060, bmo#870200, bmo#874974, bmo#861530, bmo#854157, bmo#893684, bmo#878703, bmo#862185, bmo#879139, bmo#888107, bmo#880734) Miscellaneous memory safety hazards have been fixed (rv:23.0 / rv:17.0.8): * MFSA 2013-66/CVE-2013-1706/CVE-2013-1707 (bmo#888314, bmo#888361) Buffer overflow in Mozilla Maintenance Service and Mozilla Updater * MFSA 2013-68/CVE-2013-1709 (bmo#848253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-71/CVE-2013-1712 (bmo#859072) Further Privilege escalation through Mozilla Updater * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541) Local Java applets may read contents of local file system Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-MozillaFirefox-8191 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-MozillaFirefox-8191 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-MozillaFirefox-8191 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-MozillaFirefox-8187 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-MozillaFirefox-8187 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-MozillaFirefox-8191 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-MozillaFirefox-8187 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-17.0.8esr-0.7.2 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.7.2 MozillaFirefox-translations-17.0.8esr-0.7.2 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.7.2 MozillaFirefox-translations-17.0.8esr-0.7.2 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.4.2.1 MozillaFirefox-translations-17.0.8esr-0.4.2.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.4.2.1 MozillaFirefox-translations-17.0.8esr-0.4.2.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.7.2 MozillaFirefox-translations-17.0.8esr-0.7.2 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 17.0.8esr]: MozillaFirefox-17.0.8esr-0.4.2.1 MozillaFirefox-translations-17.0.8esr-0.4.2.1 References: https://bugzilla.novell.com/833389 http://download.novell.com/patch/finder/?keywords=0cfcf5031e62c63bd50256728… http://download.novell.com/patch/finder/?keywords=5d16f58a1649e09775bbc4600… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1317-1: important: Security update for PHP5
by opensuse-security＠opensuse.org 09 Aug '13

09 Aug '13

SUSE Security Update: Security update for PHP5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1317-1 Rating: important References: #783239 #807707 #828020 #829207 Cross-References: CVE-2013-1635 CVE-2013-1643 CVE-2013-4113 CVE-2013-4635 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: The following security issues have been fixed: * CVE-2013-4635 (bnc#828020): o Integer overflow in SdnToJewish() * CVE-2013-1635 and CVE-2013-1643 (bnc#807707): o reading system files via untrusted SOAP input o soap.wsdl_cache_dir function did not honour PHP open_basedir * CVE-2013-4113 (bnc#829207): o heap corruption due to badly formed xml Security Issues: * CVE-2013-4635 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4635 > * CVE-2013-4113 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113 > * CVE-2013-1635 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1635 > * CVE-2013-1643 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1643 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-apache2-mod_php5-8086 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-apache2-mod_php5-8086 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-apache2-mod_php5-8086 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): php5-devel-5.2.14-0.7.30.48.1 php5-imap-5.2.14-0.7.30.48.1 php5-ncurses-5.2.14-0.7.30.48.1 php5-posix-5.2.14-0.7.30.48.1 php5-readline-5.2.14-0.7.30.48.1 php5-sockets-5.2.14-0.7.30.48.1 php5-sqlite-5.2.14-0.7.30.48.1 php5-tidy-5.2.14-0.7.30.48.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): apache2-mod_php5-5.2.14-0.7.30.48.1 php5-5.2.14-0.7.30.48.1 php5-bcmath-5.2.14-0.7.30.48.1 php5-bz2-5.2.14-0.7.30.48.1 php5-calendar-5.2.14-0.7.30.48.1 php5-ctype-5.2.14-0.7.30.48.1 php5-curl-5.2.14-0.7.30.48.1 php5-dba-5.2.14-0.7.30.48.1 php5-dbase-5.2.14-0.7.30.48.1 php5-dom-5.2.14-0.7.30.48.1 php5-exif-5.2.14-0.7.30.48.1 php5-fastcgi-5.2.14-0.7.30.48.1 php5-ftp-5.2.14-0.7.30.48.1 php5-gd-5.2.14-0.7.30.48.1 php5-gettext-5.2.14-0.7.30.48.1 php5-gmp-5.2.14-0.7.30.48.1 php5-hash-5.2.14-0.7.30.48.1 php5-iconv-5.2.14-0.7.30.48.1 php5-json-5.2.14-0.7.30.48.1 php5-ldap-5.2.14-0.7.30.48.1 php5-mbstring-5.2.14-0.7.30.48.1 php5-mcrypt-5.2.14-0.7.30.48.1 php5-mysql-5.2.14-0.7.30.48.1 php5-odbc-5.2.14-0.7.30.48.1 php5-openssl-5.2.14-0.7.30.48.1 php5-pcntl-5.2.14-0.7.30.48.1 php5-pdo-5.2.14-0.7.30.48.1 php5-pear-5.2.14-0.7.30.48.1 php5-pgsql-5.2.14-0.7.30.48.1 php5-pspell-5.2.14-0.7.30.48.1 php5-shmop-5.2.14-0.7.30.48.1 php5-snmp-5.2.14-0.7.30.48.1 php5-soap-5.2.14-0.7.30.48.1 php5-suhosin-5.2.14-0.7.30.48.1 php5-sysvmsg-5.2.14-0.7.30.48.1 php5-sysvsem-5.2.14-0.7.30.48.1 php5-sysvshm-5.2.14-0.7.30.48.1 php5-tokenizer-5.2.14-0.7.30.48.1 php5-wddx-5.2.14-0.7.30.48.1 php5-xmlreader-5.2.14-0.7.30.48.1 php5-xmlrpc-5.2.14-0.7.30.48.1 php5-xmlwriter-5.2.14-0.7.30.48.1 php5-xsl-5.2.14-0.7.30.48.1 php5-zip-5.2.14-0.7.30.48.1 php5-zlib-5.2.14-0.7.30.48.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): apache2-mod_php5-5.2.14-0.7.30.48.1 php5-5.2.14-0.7.30.48.1 php5-bcmath-5.2.14-0.7.30.48.1 php5-bz2-5.2.14-0.7.30.48.1 php5-calendar-5.2.14-0.7.30.48.1 php5-ctype-5.2.14-0.7.30.48.1 php5-curl-5.2.14-0.7.30.48.1 php5-dba-5.2.14-0.7.30.48.1 php5-dbase-5.2.14-0.7.30.48.1 php5-dom-5.2.14-0.7.30.48.1 php5-exif-5.2.14-0.7.30.48.1 php5-fastcgi-5.2.14-0.7.30.48.1 php5-ftp-5.2.14-0.7.30.48.1 php5-gd-5.2.14-0.7.30.48.1 php5-gettext-5.2.14-0.7.30.48.1 php5-gmp-5.2.14-0.7.30.48.1 php5-hash-5.2.14-0.7.30.48.1 php5-iconv-5.2.14-0.7.30.48.1 php5-json-5.2.14-0.7.30.48.1 php5-ldap-5.2.14-0.7.30.48.1 php5-mbstring-5.2.14-0.7.30.48.1 php5-mcrypt-5.2.14-0.7.30.48.1 php5-mysql-5.2.14-0.7.30.48.1 php5-odbc-5.2.14-0.7.30.48.1 php5-openssl-5.2.14-0.7.30.48.1 php5-pcntl-5.2.14-0.7.30.48.1 php5-pdo-5.2.14-0.7.30.48.1 php5-pear-5.2.14-0.7.30.48.1 php5-pgsql-5.2.14-0.7.30.48.1 php5-pspell-5.2.14-0.7.30.48.1 php5-shmop-5.2.14-0.7.30.48.1 php5-snmp-5.2.14-0.7.30.48.1 php5-soap-5.2.14-0.7.30.48.1 php5-suhosin-5.2.14-0.7.30.48.1 php5-sysvmsg-5.2.14-0.7.30.48.1 php5-sysvsem-5.2.14-0.7.30.48.1 php5-sysvshm-5.2.14-0.7.30.48.1 php5-tokenizer-5.2.14-0.7.30.48.1 php5-wddx-5.2.14-0.7.30.48.1 php5-xmlreader-5.2.14-0.7.30.48.1 php5-xmlrpc-5.2.14-0.7.30.48.1 php5-xmlwriter-5.2.14-0.7.30.48.1 php5-xsl-5.2.14-0.7.30.48.1 php5-zip-5.2.14-0.7.30.48.1 php5-zlib-5.2.14-0.7.30.48.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php5-5.2.14-0.7.30.48.1 php5-5.2.14-0.7.30.48.1 php5-bcmath-5.2.14-0.7.30.48.1 php5-bz2-5.2.14-0.7.30.48.1 php5-calendar-5.2.14-0.7.30.48.1 php5-ctype-5.2.14-0.7.30.48.1 php5-curl-5.2.14-0.7.30.48.1 php5-dba-5.2.14-0.7.30.48.1 php5-dbase-5.2.14-0.7.30.48.1 php5-dom-5.2.14-0.7.30.48.1 php5-exif-5.2.14-0.7.30.48.1 php5-fastcgi-5.2.14-0.7.30.48.1 php5-ftp-5.2.14-0.7.30.48.1 php5-gd-5.2.14-0.7.30.48.1 php5-gettext-5.2.14-0.7.30.48.1 php5-gmp-5.2.14-0.7.30.48.1 php5-hash-5.2.14-0.7.30.48.1 php5-iconv-5.2.14-0.7.30.48.1 php5-json-5.2.14-0.7.30.48.1 php5-ldap-5.2.14-0.7.30.48.1 php5-mbstring-5.2.14-0.7.30.48.1 php5-mcrypt-5.2.14-0.7.30.48.1 php5-mysql-5.2.14-0.7.30.48.1 php5-odbc-5.2.14-0.7.30.48.1 php5-openssl-5.2.14-0.7.30.48.1 php5-pcntl-5.2.14-0.7.30.48.1 php5-pdo-5.2.14-0.7.30.48.1 php5-pear-5.2.14-0.7.30.48.1 php5-pgsql-5.2.14-0.7.30.48.1 php5-pspell-5.2.14-0.7.30.48.1 php5-shmop-5.2.14-0.7.30.48.1 php5-snmp-5.2.14-0.7.30.48.1 php5-soap-5.2.14-0.7.30.48.1 php5-suhosin-5.2.14-0.7.30.48.1 php5-sysvmsg-5.2.14-0.7.30.48.1 php5-sysvsem-5.2.14-0.7.30.48.1 php5-sysvshm-5.2.14-0.7.30.48.1 php5-tokenizer-5.2.14-0.7.30.48.1 php5-wddx-5.2.14-0.7.30.48.1 php5-xmlreader-5.2.14-0.7.30.48.1 php5-xmlrpc-5.2.14-0.7.30.48.1 php5-xmlwriter-5.2.14-0.7.30.48.1 php5-xsl-5.2.14-0.7.30.48.1 php5-zip-5.2.14-0.7.30.48.1 php5-zlib-5.2.14-0.7.30.48.1 References: http://support.novell.com/security/cve/CVE-2013-1635.html http://support.novell.com/security/cve/CVE-2013-1643.html http://support.novell.com/security/cve/CVE-2013-4113.html http://support.novell.com/security/cve/CVE-2013-4635.html https://bugzilla.novell.com/783239 https://bugzilla.novell.com/807707 https://bugzilla.novell.com/828020 https://bugzilla.novell.com/829207 http://download.novell.com/patch/finder/?keywords=983afe97da999c3ed9c81daa3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1285-2: important: Security update for PHP5
by opensuse-security＠opensuse.org 09 Aug '13

09 Aug '13

SUSE Security Update: Security update for PHP5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1285-2 Rating: important References: #807707 #828020 #829207 Cross-References: CVE-2013-1635 CVE-2013-1643 CVE-2013-4113 CVE-2013-4635 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: The following security issues have been fixed: * CVE-2013-4635 (bnc#828020): o Integer overflow in SdnToJewish() * CVE-2013-1635 and CVE-2013-1643 (bnc#807707): o reading system files via untrusted SOAP input o soap.wsdl_cache_dir function did not honour PHP open_basedir * CVE-2013-4113 (bnc#829207): o heap corruption due to badly formed xml Security Issue references: * CVE-2013-4113 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113 > * CVE-2013-4635 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4635 > * CVE-2013-1635 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1635 > * CVE-2013-1643 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1643 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-apache2-mod_php53-8087 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-apache2-mod_php53-8087 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-apache2-mod_php53-8087 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): php53-devel-5.3.8-0.41.1 php53-imap-5.3.8-0.41.1 php53-posix-5.3.8-0.41.1 php53-readline-5.3.8-0.41.1 php53-sockets-5.3.8-0.41.1 php53-sqlite-5.3.8-0.41.1 php53-tidy-5.3.8-0.41.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): apache2-mod_php53-5.3.8-0.41.1 php53-5.3.8-0.41.1 php53-bcmath-5.3.8-0.41.1 php53-bz2-5.3.8-0.41.1 php53-calendar-5.3.8-0.41.1 php53-ctype-5.3.8-0.41.1 php53-curl-5.3.8-0.41.1 php53-dba-5.3.8-0.41.1 php53-dom-5.3.8-0.41.1 php53-exif-5.3.8-0.41.1 php53-fastcgi-5.3.8-0.41.1 php53-fileinfo-5.3.8-0.41.1 php53-ftp-5.3.8-0.41.1 php53-gd-5.3.8-0.41.1 php53-gettext-5.3.8-0.41.1 php53-gmp-5.3.8-0.41.1 php53-iconv-5.3.8-0.41.1 php53-intl-5.3.8-0.41.1 php53-json-5.3.8-0.41.1 php53-ldap-5.3.8-0.41.1 php53-mbstring-5.3.8-0.41.1 php53-mcrypt-5.3.8-0.41.1 php53-mysql-5.3.8-0.41.1 php53-odbc-5.3.8-0.41.1 php53-openssl-5.3.8-0.41.1 php53-pcntl-5.3.8-0.41.1 php53-pdo-5.3.8-0.41.1 php53-pear-5.3.8-0.41.1 php53-pgsql-5.3.8-0.41.1 php53-pspell-5.3.8-0.41.1 php53-shmop-5.3.8-0.41.1 php53-snmp-5.3.8-0.41.1 php53-soap-5.3.8-0.41.1 php53-suhosin-5.3.8-0.41.1 php53-sysvmsg-5.3.8-0.41.1 php53-sysvsem-5.3.8-0.41.1 php53-sysvshm-5.3.8-0.41.1 php53-tokenizer-5.3.8-0.41.1 php53-wddx-5.3.8-0.41.1 php53-xmlreader-5.3.8-0.41.1 php53-xmlrpc-5.3.8-0.41.1 php53-xmlwriter-5.3.8-0.41.1 php53-xsl-5.3.8-0.41.1 php53-zip-5.3.8-0.41.1 php53-zlib-5.3.8-0.41.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php53-5.3.8-0.41.1 php53-5.3.8-0.41.1 php53-bcmath-5.3.8-0.41.1 php53-bz2-5.3.8-0.41.1 php53-calendar-5.3.8-0.41.1 php53-ctype-5.3.8-0.41.1 php53-curl-5.3.8-0.41.1 php53-dba-5.3.8-0.41.1 php53-dom-5.3.8-0.41.1 php53-exif-5.3.8-0.41.1 php53-fastcgi-5.3.8-0.41.1 php53-fileinfo-5.3.8-0.41.1 php53-ftp-5.3.8-0.41.1 php53-gd-5.3.8-0.41.1 php53-gettext-5.3.8-0.41.1 php53-gmp-5.3.8-0.41.1 php53-iconv-5.3.8-0.41.1 php53-intl-5.3.8-0.41.1 php53-json-5.3.8-0.41.1 php53-ldap-5.3.8-0.41.1 php53-mbstring-5.3.8-0.41.1 php53-mcrypt-5.3.8-0.41.1 php53-mysql-5.3.8-0.41.1 php53-odbc-5.3.8-0.41.1 php53-openssl-5.3.8-0.41.1 php53-pcntl-5.3.8-0.41.1 php53-pdo-5.3.8-0.41.1 php53-pear-5.3.8-0.41.1 php53-pgsql-5.3.8-0.41.1 php53-pspell-5.3.8-0.41.1 php53-shmop-5.3.8-0.41.1 php53-snmp-5.3.8-0.41.1 php53-soap-5.3.8-0.41.1 php53-suhosin-5.3.8-0.41.1 php53-sysvmsg-5.3.8-0.41.1 php53-sysvsem-5.3.8-0.41.1 php53-sysvshm-5.3.8-0.41.1 php53-tokenizer-5.3.8-0.41.1 php53-wddx-5.3.8-0.41.1 php53-xmlreader-5.3.8-0.41.1 php53-xmlrpc-5.3.8-0.41.1 php53-xmlwriter-5.3.8-0.41.1 php53-xsl-5.3.8-0.41.1 php53-zip-5.3.8-0.41.1 php53-zlib-5.3.8-0.41.1 References: http://support.novell.com/security/cve/CVE-2013-1635.html http://support.novell.com/security/cve/CVE-2013-1643.html http://support.novell.com/security/cve/CVE-2013-4113.html http://support.novell.com/security/cve/CVE-2013-4635.html https://bugzilla.novell.com/807707 https://bugzilla.novell.com/828020 https://bugzilla.novell.com/829207 http://download.novell.com/patch/finder/?keywords=ad593aac1cfc93b29edc0ea5b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1316-1: important: Security update for PHP5
by opensuse-security＠opensuse.org 09 Aug '13

09 Aug '13

SUSE Security Update: Security update for PHP5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1316-1 Rating: important References: #828020 #829207 Cross-References: CVE-2013-4113 CVE-2013-4635 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The following security issues have been fixed: * CVE-2013-4635 (bnc#828020): o Integer overflow in SdnToJewish() * CVE-2013-4113 (bnc#829207): o heap corruption due to badly formed xml Security Issues: * CVE-2013-4113 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113 > * CVE-2013-4635 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4635 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-apache2-mod_php53-8088 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-apache2-mod_php53-8088 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-apache2-mod_php53-8088 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): php53-devel-5.3.17-0.15.1 php53-imap-5.3.17-0.15.1 php53-posix-5.3.17-0.15.1 php53-readline-5.3.17-0.15.1 php53-sockets-5.3.17-0.15.1 php53-sqlite-5.3.17-0.15.1 php53-tidy-5.3.17-0.15.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): apache2-mod_php53-5.3.17-0.15.1 php53-5.3.17-0.15.1 php53-bcmath-5.3.17-0.15.1 php53-bz2-5.3.17-0.15.1 php53-calendar-5.3.17-0.15.1 php53-ctype-5.3.17-0.15.1 php53-curl-5.3.17-0.15.1 php53-dba-5.3.17-0.15.1 php53-dom-5.3.17-0.15.1 php53-exif-5.3.17-0.15.1 php53-fastcgi-5.3.17-0.15.1 php53-fileinfo-5.3.17-0.15.1 php53-ftp-5.3.17-0.15.1 php53-gd-5.3.17-0.15.1 php53-gettext-5.3.17-0.15.1 php53-gmp-5.3.17-0.15.1 php53-iconv-5.3.17-0.15.1 php53-intl-5.3.17-0.15.1 php53-json-5.3.17-0.15.1 php53-ldap-5.3.17-0.15.1 php53-mbstring-5.3.17-0.15.1 php53-mcrypt-5.3.17-0.15.1 php53-mysql-5.3.17-0.15.1 php53-odbc-5.3.17-0.15.1 php53-openssl-5.3.17-0.15.1 php53-pcntl-5.3.17-0.15.1 php53-pdo-5.3.17-0.15.1 php53-pear-5.3.17-0.15.1 php53-pgsql-5.3.17-0.15.1 php53-pspell-5.3.17-0.15.1 php53-shmop-5.3.17-0.15.1 php53-snmp-5.3.17-0.15.1 php53-soap-5.3.17-0.15.1 php53-suhosin-5.3.17-0.15.1 php53-sysvmsg-5.3.17-0.15.1 php53-sysvsem-5.3.17-0.15.1 php53-sysvshm-5.3.17-0.15.1 php53-tokenizer-5.3.17-0.15.1 php53-wddx-5.3.17-0.15.1 php53-xmlreader-5.3.17-0.15.1 php53-xmlrpc-5.3.17-0.15.1 php53-xmlwriter-5.3.17-0.15.1 php53-xsl-5.3.17-0.15.1 php53-zip-5.3.17-0.15.1 php53-zlib-5.3.17-0.15.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php53-5.3.17-0.15.1 php53-5.3.17-0.15.1 php53-bcmath-5.3.17-0.15.1 php53-bz2-5.3.17-0.15.1 php53-calendar-5.3.17-0.15.1 php53-ctype-5.3.17-0.15.1 php53-curl-5.3.17-0.15.1 php53-dba-5.3.17-0.15.1 php53-dom-5.3.17-0.15.1 php53-exif-5.3.17-0.15.1 php53-fastcgi-5.3.17-0.15.1 php53-fileinfo-5.3.17-0.15.1 php53-ftp-5.3.17-0.15.1 php53-gd-5.3.17-0.15.1 php53-gettext-5.3.17-0.15.1 php53-gmp-5.3.17-0.15.1 php53-iconv-5.3.17-0.15.1 php53-intl-5.3.17-0.15.1 php53-json-5.3.17-0.15.1 php53-ldap-5.3.17-0.15.1 php53-mbstring-5.3.17-0.15.1 php53-mcrypt-5.3.17-0.15.1 php53-mysql-5.3.17-0.15.1 php53-odbc-5.3.17-0.15.1 php53-openssl-5.3.17-0.15.1 php53-pcntl-5.3.17-0.15.1 php53-pdo-5.3.17-0.15.1 php53-pear-5.3.17-0.15.1 php53-pgsql-5.3.17-0.15.1 php53-pspell-5.3.17-0.15.1 php53-shmop-5.3.17-0.15.1 php53-snmp-5.3.17-0.15.1 php53-soap-5.3.17-0.15.1 php53-suhosin-5.3.17-0.15.1 php53-sysvmsg-5.3.17-0.15.1 php53-sysvsem-5.3.17-0.15.1 php53-sysvshm-5.3.17-0.15.1 php53-tokenizer-5.3.17-0.15.1 php53-wddx-5.3.17-0.15.1 php53-xmlreader-5.3.17-0.15.1 php53-xmlrpc-5.3.17-0.15.1 php53-xmlwriter-5.3.17-0.15.1 php53-xsl-5.3.17-0.15.1 php53-zip-5.3.17-0.15.1 php53-zlib-5.3.17-0.15.1 References: http://support.novell.com/security/cve/CVE-2013-4113.html http://support.novell.com/security/cve/CVE-2013-4635.html https://bugzilla.novell.com/828020 https://bugzilla.novell.com/829207 http://download.novell.com/patch/finder/?keywords=b35f4744a67f955b03d2752b1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1315-1: important: Security update for PHP5
by opensuse-security＠opensuse.org 09 Aug '13

09 Aug '13

SUSE Security Update: Security update for PHP5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1315-1 Rating: important References: #775852 #778003 #783239 #807707 #828020 #829207 Cross-References: CVE-2013-4113 Affected Products: SUSE Linux Enterprise Server 11 SP1 for VMware LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. It includes one version update. Description: The following security issues have been fixed in PHP5: * CVE-2013-4635: Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP allowed context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function. * CVE-2013-1635: ext/soap/soap.c in PHP did not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allowed remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory. * CVE-2013-1643: The SOAP parser in PHP allowed remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions. * CVE-2013-4113: ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function. * CVE-2011-1398 / CVE-2012-4388: The sapi_header_op function in main/SAPI.c in PHP did not check for %0D sequences (aka carriage return characters), which allowed remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome. A hardening measure has been implemented without CVE: * use FilesMatch with 'SetHandler' rather than 'AddHandler' [bnc#775852] * fixed php bug #43200 (Interface implementation / inheritence not possible in abstract classes) [bnc#783239] Security Issue reference: * CVE-2013-4113 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4113 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS: zypper in -t patch slessp1-apache2-mod_php5-8112 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-apache2-mod_php5-8112 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS (i586 x86_64) [New Version: 5.2.14]: apache2-mod_php5-5.2.14-0.7.30.48.1 php5-5.2.14-0.7.30.48.1 php5-bcmath-5.2.14-0.7.30.48.1 php5-bz2-5.2.14-0.7.30.48.1 php5-calendar-5.2.14-0.7.30.48.1 php5-ctype-5.2.14-0.7.30.48.1 php5-curl-5.2.14-0.7.30.48.1 php5-dba-5.2.14-0.7.30.48.1 php5-dbase-5.2.14-0.7.30.48.1 php5-dom-5.2.14-0.7.30.48.1 php5-exif-5.2.14-0.7.30.48.1 php5-fastcgi-5.2.14-0.7.30.48.1 php5-ftp-5.2.14-0.7.30.48.1 php5-gd-5.2.14-0.7.30.48.1 php5-gettext-5.2.14-0.7.30.48.1 php5-gmp-5.2.14-0.7.30.48.1 php5-hash-5.2.14-0.7.30.48.1 php5-iconv-5.2.14-0.7.30.48.1 php5-json-5.2.14-0.7.30.48.1 php5-ldap-5.2.14-0.7.30.48.1 php5-mbstring-5.2.14-0.7.30.48.1 php5-mcrypt-5.2.14-0.7.30.48.1 php5-mysql-5.2.14-0.7.30.48.1 php5-odbc-5.2.14-0.7.30.48.1 php5-openssl-5.2.14-0.7.30.48.1 php5-pcntl-5.2.14-0.7.30.48.1 php5-pdo-5.2.14-0.7.30.48.1 php5-pear-5.2.14-0.7.30.48.1 php5-pgsql-5.2.14-0.7.30.48.1 php5-pspell-5.2.14-0.7.30.48.1 php5-shmop-5.2.14-0.7.30.48.1 php5-snmp-5.2.14-0.7.30.48.1 php5-soap-5.2.14-0.7.30.48.1 php5-suhosin-5.2.14-0.7.30.48.1 php5-sysvmsg-5.2.14-0.7.30.48.1 php5-sysvsem-5.2.14-0.7.30.48.1 php5-sysvshm-5.2.14-0.7.30.48.1 php5-tokenizer-5.2.14-0.7.30.48.1 php5-wddx-5.2.14-0.7.30.48.1 php5-xmlreader-5.2.14-0.7.30.48.1 php5-xmlrpc-5.2.14-0.7.30.48.1 php5-xmlwriter-5.2.14-0.7.30.48.1 php5-xsl-5.2.14-0.7.30.48.1 php5-zip-5.2.14-0.7.30.48.1 php5-zlib-5.2.14-0.7.30.48.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 5.2.14]: apache2-mod_php5-5.2.14-0.7.30.48.1 php5-5.2.14-0.7.30.48.1 php5-bcmath-5.2.14-0.7.30.48.1 php5-bz2-5.2.14-0.7.30.48.1 php5-calendar-5.2.14-0.7.30.48.1 php5-ctype-5.2.14-0.7.30.48.1 php5-curl-5.2.14-0.7.30.48.1 php5-dba-5.2.14-0.7.30.48.1 php5-dbase-5.2.14-0.7.30.48.1 php5-dom-5.2.14-0.7.30.48.1 php5-exif-5.2.14-0.7.30.48.1 php5-fastcgi-5.2.14-0.7.30.48.1 php5-ftp-5.2.14-0.7.30.48.1 php5-gd-5.2.14-0.7.30.48.1 php5-gettext-5.2.14-0.7.30.48.1 php5-gmp-5.2.14-0.7.30.48.1 php5-hash-5.2.14-0.7.30.48.1 php5-iconv-5.2.14-0.7.30.48.1 php5-json-5.2.14-0.7.30.48.1 php5-ldap-5.2.14-0.7.30.48.1 php5-mbstring-5.2.14-0.7.30.48.1 php5-mcrypt-5.2.14-0.7.30.48.1 php5-mysql-5.2.14-0.7.30.48.1 php5-odbc-5.2.14-0.7.30.48.1 php5-openssl-5.2.14-0.7.30.48.1 php5-pcntl-5.2.14-0.7.30.48.1 php5-pdo-5.2.14-0.7.30.48.1 php5-pear-5.2.14-0.7.30.48.1 php5-pgsql-5.2.14-0.7.30.48.1 php5-pspell-5.2.14-0.7.30.48.1 php5-shmop-5.2.14-0.7.30.48.1 php5-snmp-5.2.14-0.7.30.48.1 php5-soap-5.2.14-0.7.30.48.1 php5-suhosin-5.2.14-0.7.30.48.1 php5-sysvmsg-5.2.14-0.7.30.48.1 php5-sysvsem-5.2.14-0.7.30.48.1 php5-sysvshm-5.2.14-0.7.30.48.1 php5-tokenizer-5.2.14-0.7.30.48.1 php5-wddx-5.2.14-0.7.30.48.1 php5-xmlreader-5.2.14-0.7.30.48.1 php5-xmlrpc-5.2.14-0.7.30.48.1 php5-xmlwriter-5.2.14-0.7.30.48.1 php5-xsl-5.2.14-0.7.30.48.1 php5-zip-5.2.14-0.7.30.48.1 php5-zlib-5.2.14-0.7.30.48.1 References: http://support.novell.com/security/cve/CVE-2013-4113.html https://bugzilla.novell.com/775852 https://bugzilla.novell.com/778003 https://bugzilla.novell.com/783239 https://bugzilla.novell.com/807707 https://bugzilla.novell.com/828020 https://bugzilla.novell.com/829207 http://download.novell.com/patch/finder/?keywords=2ab3ed25399f2e9a36f4f4b0d… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1314-1: important: Security update for Xen
by opensuse-security＠opensuse.org 09 Aug '13

09 Aug '13

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1314-1 Rating: important References: #801663 #808085 #808269 #817210 #820917 #820919 #820920 #823011 #823608 Cross-References: CVE-2013-2194 CVE-2013-2195 CVE-2013-2196 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves three vulnerabilities and has 6 fixes is now available. Description: The Xen hypervisor and toolset has been updated to 4.2.2_06 to fix various bugs and security issues: The following security issues have been addressed: * CVE-2013-2194: Various integer overflows in the ELF loader were fixed. (XSA-55) * CVE-2013-2195: Various pointer dereferences issues in the ELF loader were fixed. (XSA-55) * CVE-2013-2196: Various other problems in the ELF loader were fixed. (XSA-55) * CVE-2013-2078: A Hypervisor crash due to missing exception recovery on XSETBV was fixed. (XSA-54) * CVE-2013-2077: A Hypervisor crash due to missing exception recovery on XRSTOR was fixed. (XSA-53) * CVE-2013-2211: libxl allowed guest write access to sensitive console related xenstore keys. (XSA-57) * CVE-2013-2076: An information leak on XSAVE/XRSTOR capable AMD CPUs (XSA-52) was fixed, where parts of this state could leak to other VMs. Also the following bugs have been fixed: * performance issues in mirror lvm (bnc#801663) * aacraid driver panics mapping INT A when booting kernel-xen (bnc#808085) * Fully Virtualized Windows VM install failed on Ivy Bridge platforms with Xen kernel (bnc#808269) * Did not boot with i915 graphics controller with VT-d enabled (bnc#817210) Security Issue references: * CVE-2013-2194 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2194 > * CVE-2013-2195 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2195 > * CVE-2013-2196 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2196 > Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-xen-201307-8063 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-xen-201307-8063 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-xen-201307-8063 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): xen-devel-4.2.2_06-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): xen-kmp-default-4.2.2_06_3.0.82_0.7-0.7.1 xen-libs-4.2.2_06-0.7.1 xen-tools-domU-4.2.2_06-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (x86_64): xen-4.2.2_06-0.7.1 xen-doc-html-4.2.2_06-0.7.1 xen-doc-pdf-4.2.2_06-0.7.1 xen-libs-32bit-4.2.2_06-0.7.1 xen-tools-4.2.2_06-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586): xen-kmp-pae-4.2.2_06_3.0.82_0.7-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): xen-kmp-default-4.2.2_06_3.0.82_0.7-0.7.1 xen-libs-4.2.2_06-0.7.1 xen-tools-domU-4.2.2_06-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): xen-4.2.2_06-0.7.1 xen-doc-html-4.2.2_06-0.7.1 xen-doc-pdf-4.2.2_06-0.7.1 xen-libs-32bit-4.2.2_06-0.7.1 xen-tools-4.2.2_06-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586): xen-kmp-pae-4.2.2_06_3.0.82_0.7-0.7.1 References: http://support.novell.com/security/cve/CVE-2013-2194.html http://support.novell.com/security/cve/CVE-2013-2195.html http://support.novell.com/security/cve/CVE-2013-2196.html https://bugzilla.novell.com/801663 https://bugzilla.novell.com/808085 https://bugzilla.novell.com/808269 https://bugzilla.novell.com/817210 https://bugzilla.novell.com/820917 https://bugzilla.novell.com/820919 https://bugzilla.novell.com/820920 https://bugzilla.novell.com/823011 https://bugzilla.novell.com/823608 http://download.novell.com/patch/finder/?keywords=6f245c857571421a6701c20d0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1310-1: important: Security update for bind
by opensuse-security＠opensuse.org 07 Aug '13

07 Aug '13

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1310-1 Rating: important References: #831899 Cross-References: CVE-2013-4854 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: A specially crafted query with malicious rdata could have caused a crash (DoS) in named. Security Issue reference: * CVE-2013-4854 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4854 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-bind-8161 - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-bind-8160 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-bind-8161 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-bind-8161 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-bind-8160 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-bind-8160 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-bind-8161 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-bind-8160 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.9.3P2]: bind-devel-9.9.3P2-0.5.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64) [New Version: 9.9.3P2]: bind-devel-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.9.3P2]: bind-devel-9.9.3P2-0.5.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (ppc64) [New Version: 9.9.3P2]: bind-devel-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 9.9.3P2]: bind-9.9.3P2-0.5.1 bind-chrootenv-9.9.3P2-0.5.1 bind-doc-9.9.3P2-0.5.1 bind-libs-9.9.3P2-0.5.1 bind-utils-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 9.9.3P2]: bind-libs-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.9.3P2]: bind-9.9.3P2-0.5.1 bind-chrootenv-9.9.3P2-0.5.1 bind-doc-9.9.3P2-0.5.1 bind-libs-9.9.3P2-0.5.1 bind-utils-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 9.9.3P2]: bind-libs-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 9.9.3P2]: bind-libs-x86-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 9.9.3P2]: bind-9.9.3P2-0.5.1 bind-chrootenv-9.9.3P2-0.5.1 bind-doc-9.9.3P2-0.5.1 bind-libs-9.9.3P2-0.5.1 bind-utils-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 9.9.3P2]: bind-libs-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.9.3P2]: bind-9.9.3P2-0.5.1 bind-chrootenv-9.9.3P2-0.5.1 bind-doc-9.9.3P2-0.5.1 bind-libs-9.9.3P2-0.5.1 bind-utils-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 9.9.3P2]: bind-libs-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 9.9.3P2]: bind-libs-x86-9.9.3P2-0.5.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 9.9.3P2]: bind-libs-9.9.3P2-0.5.1 bind-utils-9.9.3P2-0.5.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 9.9.3P2]: bind-libs-32bit-9.9.3P2-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 9.9.3P2]: bind-libs-9.9.3P2-0.5.1 bind-utils-9.9.3P2-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 9.9.3P2]: bind-libs-32bit-9.9.3P2-0.5.1 References: http://support.novell.com/security/cve/CVE-2013-4854.html https://bugzilla.novell.com/831899 http://download.novell.com/patch/finder/?keywords=6b7570508ab209647dc76ea23… http://download.novell.com/patch/finder/?keywords=b60df9afc37de4b5115de94bd… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:1305-1: important: Security update for IBM Java 1.6.0
by opensuse-security＠opensuse.org 06 Aug '13

06 Aug '13

SUSE Security Update: Security update for IBM Java 1.6.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:1305-1 Rating: important References: #817062 #823034 #829212 #831936 Cross-References: CVE-2013-1500 CVE-2013-1571 CVE-2013-2407 CVE-2013-2412 CVE-2013-2437 CVE-2013-2442 CVE-2013-2443 CVE-2013-2444 CVE-2013-2446 CVE-2013-2447 CVE-2013-2448 CVE-2013-2450 CVE-2013-2451 CVE-2013-2452 CVE-2013-2453 CVE-2013-2454 CVE-2013-2455 CVE-2013-2456 CVE-2013-2457 CVE-2013-2459 CVE-2013-2463 CVE-2013-2464 CVE-2013-2465 CVE-2013-2466 CVE-2013-2468 CVE-2013-2469 CVE-2013-2470 CVE-2013-2471 CVE-2013-2472 CVE-2013-2473 CVE-2013-3009 CVE-2013-3011 CVE-2013-3012 CVE-2013-3743 CVE-2013-4002 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes 35 vulnerabilities is now available. Description: IBM Java 1.6.0 has been updated to SR14 to fix bugs and security issues. Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Also the following bugs have been fixed: * add Europe/Busingen to tzmappings (bnc#817062) * mark files in jre/bin and bin/ as executable (bnc#823034) * check if installed qa_filelist is not empty (bnc#831936) Security Issue references: * CVE-2013-3009 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3009 > * CVE-2013-3011 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3011 > * CVE-2013-3012 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3012 > * CVE-2013-4002 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4002 > * CVE-2013-2468 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2468 > * CVE-2013-2469 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2469 > * CVE-2013-2465 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2465 > * CVE-2013-2464 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2464 > * CVE-2013-2463 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2463 > * CVE-2013-2473 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2473 > * CVE-2013-2472 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2472 > * CVE-2013-2471 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2471 > * CVE-2013-2470 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2470 > * CVE-2013-2459 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2459 > * CVE-2013-2466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2466 > * CVE-2013-3743 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3743 > * CVE-2013-2448 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2448 > * CVE-2013-2442 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2442 > * CVE-2013-2407 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2407 > * CVE-2013-2454 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2454 > * CVE-2013-2456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2456 > * CVE-2013-2453 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2453 > * CVE-2013-2457 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2457 > * CVE-2013-2455 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2455 > * CVE-2013-2412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2412 > * CVE-2013-2443 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2443 > * CVE-2013-2447 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2447 > * CVE-2013-2437 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2437 > * CVE-2013-2444 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2444 > * CVE-2013-2452 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2452 > * CVE-2013-2446 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2446 > * CVE-2013-2450 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2450 > * CVE-2013-1571 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1571 > * CVE-2013-2451 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2451 > * CVE-2013-1500 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1500 > Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr14.0-0.6.6.1 java-1_6_0-ibm-devel-1.6.0_sr14.0-0.6.6.1 java-1_6_0-ibm-fonts-1.6.0_sr14.0-0.6.6.1 java-1_6_0-ibm-jdbc-1.6.0_sr14.0-0.6.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr14.0-0.6.6.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr14.0-0.6.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr14.0-0.6.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr14.0-0.6.6.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr14.0-0.6.6.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr14.0-0.6.6.1 References: http://support.novell.com/security/cve/CVE-2013-1500.html http://support.novell.com/security/cve/CVE-2013-1571.html http://support.novell.com/security/cve/CVE-2013-2407.html http://support.novell.com/security/cve/CVE-2013-2412.html http://support.novell.com/security/cve/CVE-2013-2437.html http://support.novell.com/security/cve/CVE-2013-2442.html http://support.novell.com/security/cve/CVE-2013-2443.html http://support.novell.com/security/cve/CVE-2013-2444.html http://support.novell.com/security/cve/CVE-2013-2446.html http://support.novell.com/security/cve/CVE-2013-2447.html http://support.novell.com/security/cve/CVE-2013-2448.html http://support.novell.com/security/cve/CVE-2013-2450.html http://support.novell.com/security/cve/CVE-2013-2451.html http://support.novell.com/security/cve/CVE-2013-2452.html http://support.novell.com/security/cve/CVE-2013-2453.html http://support.novell.com/security/cve/CVE-2013-2454.html http://support.novell.com/security/cve/CVE-2013-2455.html http://support.novell.com/security/cve/CVE-2013-2456.html http://support.novell.com/security/cve/CVE-2013-2457.html http://support.novell.com/security/cve/CVE-2013-2459.html http://support.novell.com/security/cve/CVE-2013-2463.html http://support.novell.com/security/cve/CVE-2013-2464.html http://support.novell.com/security/cve/CVE-2013-2465.html http://support.novell.com/security/cve/CVE-2013-2466.html http://support.novell.com/security/cve/CVE-2013-2468.html http://support.novell.com/security/cve/CVE-2013-2469.html http://support.novell.com/security/cve/CVE-2013-2470.html http://support.novell.com/security/cve/CVE-2013-2471.html http://support.novell.com/security/cve/CVE-2013-2472.html http://support.novell.com/security/cve/CVE-2013-2473.html http://support.novell.com/security/cve/CVE-2013-3009.html http://support.novell.com/security/cve/CVE-2013-3011.html http://support.novell.com/security/cve/CVE-2013-3012.html http://support.novell.com/security/cve/CVE-2013-3743.html http://support.novell.com/security/cve/CVE-2013-4002.html https://bugzilla.novell.com/817062 https://bugzilla.novell.com/823034 https://bugzilla.novell.com/829212 https://bugzilla.novell.com/831936 http://download.novell.com/patch/finder/?keywords=83286d2f8367035fc1294114a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0