September 2014 - openSUSE Security Announce

[security-announce] SUSE-SU-2014:1128-1: important: Security update for glibc
by opensuse-security＠opensuse.org 15 Sep '14

15 Sep '14

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1128-1 Rating: important References: #779320 #801246 #824639 #834594 #839870 #842291 #860501 #882600 #892073 #894553 #894556 Cross-References: CVE-2012-4412 CVE-2013-0242 CVE-2013-4237 CVE-2013-4332 CVE-2014-4043 CVE-2014-5119 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that solves 6 vulnerabilities and has 5 fixes is now available. Description: This glibc update fixes a critical privilege escalation problem and the following security and non-security issues: * bnc#892073: An off-by-one error leading to a heap-based buffer overflow was found in __gconv_translit_find(). An exploit that targets the problem is publicly available. (CVE-2014-5119) * bnc#882600: Copy filename argument in posix_spawn_file_actions_addopen. (CVE-2014-4043) * bnc#860501: Use O_LARGEFILE for utmp file. * bnc#842291: Fix typo in glibc-2.5-dlopen-lookup-race.diff. * bnc#839870: Fix integer overflows in malloc. (CVE-2013-4332) * bnc#834594: Fix readdir_r with long file names. (CVE-2013-4237) * bnc#824639: Drop lock before calling malloc_printerr. * bnc#801246: Fix buffer overrun in regexp matcher. (CVE-2013-0242) * bnc#779320: Fix buffer overflow in strcoll. (CVE-2012-4412) * bnc#894556 / bnc#894553: Fix crashes on invalid input in IBM gconv modules. (CVE-2014-6040, CVE-2012-6656, bnc#894553, bnc#894556, BZ#17325, BZ#14134) Security Issues: * CVE-2014-5119 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119> * CVE-2014-4043 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043> * CVE-2013-4332 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332> * CVE-2013-4237 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237> * CVE-2013-0242 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0242> * CVE-2012-4412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412> Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 i686 s390x x86_64): glibc-2.4-31.77.112.1 glibc-devel-2.4-31.77.112.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): glibc-html-2.4-31.77.112.1 glibc-i18ndata-2.4-31.77.112.1 glibc-info-2.4-31.77.112.1 glibc-locale-2.4-31.77.112.1 glibc-profile-2.4-31.77.112.1 nscd-2.4-31.77.112.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): glibc-32bit-2.4-31.77.112.1 glibc-devel-32bit-2.4-31.77.112.1 glibc-locale-32bit-2.4-31.77.112.1 glibc-profile-32bit-2.4-31.77.112.1 References: http://support.novell.com/security/cve/CVE-2012-4412.html http://support.novell.com/security/cve/CVE-2013-0242.html http://support.novell.com/security/cve/CVE-2013-4237.html http://support.novell.com/security/cve/CVE-2013-4332.html http://support.novell.com/security/cve/CVE-2014-4043.html http://support.novell.com/security/cve/CVE-2014-5119.html https://bugzilla.novell.com/779320 https://bugzilla.novell.com/801246 https://bugzilla.novell.com/824639 https://bugzilla.novell.com/834594 https://bugzilla.novell.com/839870 https://bugzilla.novell.com/842291 https://bugzilla.novell.com/860501 https://bugzilla.novell.com/882600 https://bugzilla.novell.com/892073 https://bugzilla.novell.com/894553 https://bugzilla.novell.com/894556 http://download.suse.com/patch/finder/?keywords=190862be14e3ed91b361e0b0a66… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1126-1: important: LibreOffice: two security fixes
by opensuse-security＠opensuse.org 15 Sep '14

15 Sep '14

openSUSE Security Update: LibreOffice: two security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1126-1 Rating: important References: #831578 #893141 Cross-References: CVE-2013-4156 CVE-2014-3575 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes memory corruption vulnerability in DOCM import and data exposure using crafted OLE objects. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-540 - openSUSE 12.3: zypper in -t patch openSUSE-2014-540 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libreoffice-4.1.6.2-25.1 libreoffice-base-4.1.6.2-25.1 libreoffice-base-debuginfo-4.1.6.2-25.1 libreoffice-base-drivers-mysql-4.1.6.2-25.1 libreoffice-base-drivers-mysql-debuginfo-4.1.6.2-25.1 libreoffice-base-drivers-postgresql-4.1.6.2-25.1 libreoffice-base-drivers-postgresql-debuginfo-4.1.6.2-25.1 libreoffice-base-extensions-4.1.6.2-25.1 libreoffice-calc-4.1.6.2-25.1 libreoffice-calc-debuginfo-4.1.6.2-25.1 libreoffice-calc-extensions-4.1.6.2-25.1 libreoffice-debuginfo-4.1.6.2-25.1 libreoffice-debugsource-4.1.6.2-25.1 libreoffice-draw-4.1.6.2-25.1 libreoffice-draw-debuginfo-4.1.6.2-25.1 libreoffice-draw-extensions-4.1.6.2-25.1 libreoffice-filters-optional-4.1.6.2-25.1 libreoffice-gnome-4.1.6.2-25.1 libreoffice-gnome-debuginfo-4.1.6.2-25.1 libreoffice-icon-themes-prebuilt-4.1.6.2-25.1 libreoffice-impress-4.1.6.2-25.1 libreoffice-impress-debuginfo-4.1.6.2-25.1 libreoffice-impress-extensions-4.1.6.2-25.1 libreoffice-impress-extensions-debuginfo-4.1.6.2-25.1 libreoffice-kde-4.1.6.2-25.1 libreoffice-kde-debuginfo-4.1.6.2-25.1 libreoffice-kde4-4.1.6.2-25.1 libreoffice-kde4-debuginfo-4.1.6.2-25.1 libreoffice-l10n-prebuilt-4.1.6.2-25.1 libreoffice-mailmerge-4.1.6.2-25.1 libreoffice-math-4.1.6.2-25.1 libreoffice-math-debuginfo-4.1.6.2-25.1 libreoffice-officebean-4.1.6.2-25.1 libreoffice-officebean-debuginfo-4.1.6.2-25.1 libreoffice-pyuno-4.1.6.2-25.1 libreoffice-pyuno-debuginfo-4.1.6.2-25.1 libreoffice-sdk-4.1.6.2-25.1 libreoffice-sdk-debuginfo-4.1.6.2-25.1 libreoffice-sdk-doc-4.1.6.2-25.1 libreoffice-writer-4.1.6.2-25.1 libreoffice-writer-debuginfo-4.1.6.2-25.1 libreoffice-writer-extensions-4.1.6.2-25.1 - openSUSE 13.1 (noarch): libreoffice-branding-upstream-4.1.6.2-25.1 libreoffice-help-ast-4.1.6.2-25.1 libreoffice-help-bg-4.1.6.2-25.1 libreoffice-help-ca-4.1.6.2-25.1 libreoffice-help-cs-4.1.6.2-25.1 libreoffice-help-da-4.1.6.2-25.1 libreoffice-help-de-4.1.6.2-25.1 libreoffice-help-el-4.1.6.2-25.1 libreoffice-help-en-GB-4.1.6.2-25.1 libreoffice-help-en-US-4.1.6.2-25.1 libreoffice-help-en-ZA-4.1.6.2-25.1 libreoffice-help-es-4.1.6.2-25.1 libreoffice-help-et-4.1.6.2-25.1 libreoffice-help-eu-4.1.6.2-25.1 libreoffice-help-fi-4.1.6.2-25.1 libreoffice-help-fr-4.1.6.2-25.1 libreoffice-help-gl-4.1.6.2-25.1 libreoffice-help-gu-IN-4.1.6.2-25.1 libreoffice-help-hi-IN-4.1.6.2-25.1 libreoffice-help-hu-4.1.6.2-25.1 libreoffice-help-it-4.1.6.2-25.1 libreoffice-help-ja-4.1.6.2-25.1 libreoffice-help-km-4.1.6.2-25.1 libreoffice-help-ko-4.1.6.2-25.1 libreoffice-help-mk-4.1.6.2-25.1 libreoffice-help-nb-4.1.6.2-25.1 libreoffice-help-nl-4.1.6.2-25.1 libreoffice-help-pl-4.1.6.2-25.1 libreoffice-help-pt-4.1.6.2-25.1 libreoffice-help-pt-BR-4.1.6.2-25.1 libreoffice-help-ru-4.1.6.2-25.1 libreoffice-help-sk-4.1.6.2-25.1 libreoffice-help-sl-4.1.6.2-25.1 libreoffice-help-sv-4.1.6.2-25.1 libreoffice-help-tr-4.1.6.2-25.1 libreoffice-help-vi-4.1.6.2-25.1 libreoffice-help-zh-CN-4.1.6.2-25.1 libreoffice-help-zh-TW-4.1.6.2-25.1 libreoffice-icon-theme-crystal-4.1.6.2-25.1 libreoffice-icon-theme-galaxy-4.1.6.2-25.1 libreoffice-icon-theme-hicontrast-4.1.6.2-25.1 libreoffice-icon-theme-oxygen-4.1.6.2-25.1 libreoffice-icon-theme-tango-4.1.6.2-25.1 libreoffice-l10n-af-4.1.6.2-25.2 libreoffice-l10n-am-4.1.6.2-25.2 libreoffice-l10n-ar-4.1.6.2-25.2 libreoffice-l10n-as-4.1.6.2-25.2 libreoffice-l10n-ast-4.1.6.2-25.2 libreoffice-l10n-be-BY-4.1.6.2-25.2 libreoffice-l10n-bg-4.1.6.2-25.2 libreoffice-l10n-br-4.1.6.2-25.2 libreoffice-l10n-ca-4.1.6.2-25.2 libreoffice-l10n-cs-4.1.6.2-25.2 libreoffice-l10n-cy-4.1.6.2-25.2 libreoffice-l10n-da-4.1.6.2-25.2 libreoffice-l10n-de-4.1.6.2-25.2 libreoffice-l10n-el-4.1.6.2-25.2 libreoffice-l10n-en-GB-4.1.6.2-25.2 libreoffice-l10n-en-ZA-4.1.6.2-25.2 libreoffice-l10n-eo-4.1.6.2-25.2 libreoffice-l10n-es-4.1.6.2-25.2 libreoffice-l10n-et-4.1.6.2-25.2 libreoffice-l10n-eu-4.1.6.2-25.2 libreoffice-l10n-fi-4.1.6.2-25.2 libreoffice-l10n-fr-4.1.6.2-25.2 libreoffice-l10n-ga-4.1.6.2-25.2 libreoffice-l10n-gd-4.1.6.2-25.2 libreoffice-l10n-gl-4.1.6.2-25.2 libreoffice-l10n-gu-IN-4.1.6.2-25.2 libreoffice-l10n-he-4.1.6.2-25.2 libreoffice-l10n-hi-IN-4.1.6.2-25.2 libreoffice-l10n-hr-4.1.6.2-25.2 libreoffice-l10n-hu-4.1.6.2-25.2 libreoffice-l10n-id-4.1.6.2-25.2 libreoffice-l10n-is-4.1.6.2-25.2 libreoffice-l10n-it-4.1.6.2-25.2 libreoffice-l10n-ja-4.1.6.2-25.2 libreoffice-l10n-ka-4.1.6.2-25.2 libreoffice-l10n-km-4.1.6.2-25.2 libreoffice-l10n-kn-4.1.6.2-25.2 libreoffice-l10n-ko-4.1.6.2-25.2 libreoffice-l10n-lt-4.1.6.2-25.2 libreoffice-l10n-mk-4.1.6.2-25.2 libreoffice-l10n-ml-4.1.6.2-25.2 libreoffice-l10n-mr-4.1.6.2-25.2 libreoffice-l10n-nb-4.1.6.2-25.2 libreoffice-l10n-nl-4.1.6.2-25.2 libreoffice-l10n-nn-4.1.6.2-25.2 libreoffice-l10n-nr-4.1.6.2-25.2 libreoffice-l10n-om-4.1.6.2-25.2 libreoffice-l10n-or-4.1.6.2-25.2 libreoffice-l10n-pa-IN-4.1.6.2-25.2 libreoffice-l10n-pl-4.1.6.2-25.2 libreoffice-l10n-pt-4.1.6.2-25.2 libreoffice-l10n-pt-BR-4.1.6.2-25.2 libreoffice-l10n-ro-4.1.6.2-25.2 libreoffice-l10n-ru-4.1.6.2-25.2 libreoffice-l10n-rw-4.1.6.2-25.2 libreoffice-l10n-sh-4.1.6.2-25.2 libreoffice-l10n-sk-4.1.6.2-25.2 libreoffice-l10n-sl-4.1.6.2-25.2 libreoffice-l10n-sr-4.1.6.2-25.2 libreoffice-l10n-ss-4.1.6.2-25.2 libreoffice-l10n-st-4.1.6.2-25.2 libreoffice-l10n-sv-4.1.6.2-25.2 libreoffice-l10n-ta-4.1.6.2-25.2 libreoffice-l10n-te-4.1.6.2-25.2 libreoffice-l10n-tg-4.1.6.2-25.2 libreoffice-l10n-th-4.1.6.2-25.2 libreoffice-l10n-tr-4.1.6.2-25.2 libreoffice-l10n-ts-4.1.6.2-25.2 libreoffice-l10n-ug-4.1.6.2-25.2 libreoffice-l10n-uk-4.1.6.2-25.2 libreoffice-l10n-ve-4.1.6.2-25.2 libreoffice-l10n-vi-4.1.6.2-25.2 libreoffice-l10n-xh-4.1.6.2-25.2 libreoffice-l10n-zh-CN-4.1.6.2-25.2 libreoffice-l10n-zh-TW-4.1.6.2-25.2 libreoffice-l10n-zu-4.1.6.2-25.2 - openSUSE 12.3 (i586 x86_64): libreoffice-3.6.3.2.4-2.9.1 libreoffice-base-3.6.3.2.4-2.9.1 libreoffice-base-debuginfo-3.6.3.2.4-2.9.1 libreoffice-base-drivers-mysql-3.6.3.2.4-2.9.1 libreoffice-base-drivers-mysql-debuginfo-3.6.3.2.4-2.9.1 libreoffice-base-drivers-postgresql-3.6.3.2.4-2.9.1 libreoffice-base-drivers-postgresql-debuginfo-3.6.3.2.4-2.9.1 libreoffice-base-extensions-3.6.3.2.4-2.9.1 libreoffice-calc-3.6.3.2.4-2.9.1 libreoffice-calc-debuginfo-3.6.3.2.4-2.9.1 libreoffice-calc-extensions-3.6.3.2.4-2.9.1 libreoffice-debuginfo-3.6.3.2.4-2.9.1 libreoffice-debugsource-3.6.3.2.4-2.9.1 libreoffice-draw-3.6.3.2.4-2.9.1 libreoffice-draw-extensions-3.6.3.2.4-2.9.1 libreoffice-draw-extensions-debuginfo-3.6.3.2.4-2.9.1 libreoffice-filters-optional-3.6.3.2.4-2.9.1 libreoffice-filters-optional-debuginfo-3.6.3.2.4-2.9.1 libreoffice-gnome-3.6.3.2.4-2.9.1 libreoffice-gnome-debuginfo-3.6.3.2.4-2.9.1 libreoffice-icon-themes-prebuilt-3.6.3.2.4-2.9.1 libreoffice-impress-3.6.3.2.4-2.9.1 libreoffice-impress-debuginfo-3.6.3.2.4-2.9.1 libreoffice-impress-extensions-3.6.3.2.4-2.9.1 libreoffice-impress-extensions-debuginfo-3.6.3.2.4-2.9.1 libreoffice-kde-3.6.3.2.4-2.9.1 libreoffice-kde-debuginfo-3.6.3.2.4-2.9.1 libreoffice-kde4-3.6.3.2.4-2.9.1 libreoffice-kde4-debuginfo-3.6.3.2.4-2.9.1 libreoffice-l10n-prebuilt-3.6.3.2.4-2.9.1 libreoffice-mailmerge-3.6.3.2.4-2.9.1 libreoffice-math-3.6.3.2.4-2.9.1 libreoffice-math-debuginfo-3.6.3.2.4-2.9.1 libreoffice-officebean-3.6.3.2.4-2.9.1 libreoffice-officebean-debuginfo-3.6.3.2.4-2.9.1 libreoffice-pyuno-3.6.3.2.4-2.9.1 libreoffice-pyuno-debuginfo-3.6.3.2.4-2.9.1 libreoffice-sdk-3.6.3.2.4-2.9.1 libreoffice-sdk-debuginfo-3.6.3.2.4-2.9.1 libreoffice-sdk-doc-3.6.3.2.4-2.9.1 libreoffice-writer-3.6.3.2.4-2.9.1 libreoffice-writer-debuginfo-3.6.3.2.4-2.9.1 libreoffice-writer-extensions-3.6.3.2.4-2.9.1 - openSUSE 12.3 (noarch): libreoffice-branding-upstream-3.6.3.2.4-2.9.1 libreoffice-help-ast-3.6.3.2.4-2.9.1 libreoffice-help-bg-3.6.3.2.4-2.9.1 libreoffice-help-ca-3.6.3.2.4-2.9.1 libreoffice-help-cs-3.6.3.2.4-2.9.1 libreoffice-help-da-3.6.3.2.4-2.9.1 libreoffice-help-de-3.6.3.2.4-2.9.1 libreoffice-help-el-3.6.3.2.4-2.9.1 libreoffice-help-en-GB-3.6.3.2.4-2.9.1 libreoffice-help-en-US-3.6.3.2.4-2.9.1 libreoffice-help-en-ZA-3.6.3.2.4-2.9.1 libreoffice-help-es-3.6.3.2.4-2.9.1 libreoffice-help-et-3.6.3.2.4-2.9.1 libreoffice-help-eu-3.6.3.2.4-2.9.1 libreoffice-help-fi-3.6.3.2.4-2.9.1 libreoffice-help-fr-3.6.3.2.4-2.9.1 libreoffice-help-gl-3.6.3.2.4-2.9.1 libreoffice-help-gu-IN-3.6.3.2.4-2.9.1 libreoffice-help-hi-IN-3.6.3.2.4-2.9.1 libreoffice-help-hu-3.6.3.2.4-2.9.1 libreoffice-help-it-3.6.3.2.4-2.9.1 libreoffice-help-ja-3.6.3.2.4-2.9.1 libreoffice-help-km-3.6.3.2.4-2.9.1 libreoffice-help-ko-3.6.3.2.4-2.9.1 libreoffice-help-mk-3.6.3.2.4-2.9.1 libreoffice-help-nb-3.6.3.2.4-2.9.1 libreoffice-help-nl-3.6.3.2.4-2.9.1 libreoffice-help-pl-3.6.3.2.4-2.9.1 libreoffice-help-pt-3.6.3.2.4-2.9.1 libreoffice-help-pt-BR-3.6.3.2.4-2.9.1 libreoffice-help-ru-3.6.3.2.4-2.9.1 libreoffice-help-sk-3.6.3.2.4-2.9.1 libreoffice-help-sl-3.6.3.2.4-2.9.1 libreoffice-help-sv-3.6.3.2.4-2.9.1 libreoffice-help-tr-3.6.3.2.4-2.9.1 libreoffice-help-vi-3.6.3.2.4-2.9.1 libreoffice-help-zh-CN-3.6.3.2.4-2.9.1 libreoffice-help-zh-TW-3.6.3.2.4-2.9.1 libreoffice-icon-theme-crystal-3.6.3.2.4-2.9.1 libreoffice-icon-theme-galaxy-3.6.3.2.4-2.9.1 libreoffice-icon-theme-hicontrast-3.6.3.2.4-2.9.1 libreoffice-icon-theme-oxygen-3.6.3.2.4-2.9.1 libreoffice-icon-theme-tango-3.6.3.2.4-2.9.1 libreoffice-l10n-af-3.6.3.2.4-2.9.3 libreoffice-l10n-am-3.6.3.2.4-2.9.3 libreoffice-l10n-ar-3.6.3.2.4-2.9.3 libreoffice-l10n-as-3.6.3.2.4-2.9.3 libreoffice-l10n-ast-3.6.3.2.4-2.9.3 libreoffice-l10n-be-BY-3.6.3.2.4-2.9.3 libreoffice-l10n-bg-3.6.3.2.4-2.9.3 libreoffice-l10n-br-3.6.3.2.4-2.9.3 libreoffice-l10n-ca-3.6.3.2.4-2.9.3 libreoffice-l10n-cs-3.6.3.2.4-2.9.3 libreoffice-l10n-cy-3.6.3.2.4-2.9.3 libreoffice-l10n-da-3.6.3.2.4-2.9.3 libreoffice-l10n-de-3.6.3.2.4-2.9.3 libreoffice-l10n-el-3.6.3.2.4-2.9.3 libreoffice-l10n-en-GB-3.6.3.2.4-2.9.3 libreoffice-l10n-en-ZA-3.6.3.2.4-2.9.3 libreoffice-l10n-eo-3.6.3.2.4-2.9.3 libreoffice-l10n-es-3.6.3.2.4-2.9.3 libreoffice-l10n-et-3.6.3.2.4-2.9.3 libreoffice-l10n-eu-3.6.3.2.4-2.9.3 libreoffice-l10n-fi-3.6.3.2.4-2.9.3 libreoffice-l10n-fr-3.6.3.2.4-2.9.3 libreoffice-l10n-ga-3.6.3.2.4-2.9.3 libreoffice-l10n-gd-3.6.3.2.4-2.9.3 libreoffice-l10n-gl-3.6.3.2.4-2.9.3 libreoffice-l10n-gu-IN-3.6.3.2.4-2.9.3 libreoffice-l10n-he-3.6.3.2.4-2.9.3 libreoffice-l10n-hi-IN-3.6.3.2.4-2.9.3 libreoffice-l10n-hr-3.6.3.2.4-2.9.3 libreoffice-l10n-hu-3.6.3.2.4-2.9.3 libreoffice-l10n-id-3.6.3.2.4-2.9.3 libreoffice-l10n-is-3.6.3.2.4-2.9.3 libreoffice-l10n-it-3.6.3.2.4-2.9.3 libreoffice-l10n-ja-3.6.3.2.4-2.9.3 libreoffice-l10n-ka-3.6.3.2.4-2.9.3 libreoffice-l10n-km-3.6.3.2.4-2.9.3 libreoffice-l10n-kn-3.6.3.2.4-2.9.3 libreoffice-l10n-ko-3.6.3.2.4-2.9.3 libreoffice-l10n-lt-3.6.3.2.4-2.9.3 libreoffice-l10n-mk-3.6.3.2.4-2.9.3 libreoffice-l10n-ml-3.6.3.2.4-2.9.3 libreoffice-l10n-mr-3.6.3.2.4-2.9.3 libreoffice-l10n-nb-3.6.3.2.4-2.9.3 libreoffice-l10n-nl-3.6.3.2.4-2.9.3 libreoffice-l10n-nn-3.6.3.2.4-2.9.3 libreoffice-l10n-nr-3.6.3.2.4-2.9.3 libreoffice-l10n-om-3.6.3.2.4-2.9.3 libreoffice-l10n-or-3.6.3.2.4-2.9.3 libreoffice-l10n-pa-IN-3.6.3.2.4-2.9.3 libreoffice-l10n-pl-3.6.3.2.4-2.9.3 libreoffice-l10n-pt-3.6.3.2.4-2.9.3 libreoffice-l10n-pt-BR-3.6.3.2.4-2.9.3 libreoffice-l10n-ro-3.6.3.2.4-2.9.3 libreoffice-l10n-ru-3.6.3.2.4-2.9.3 libreoffice-l10n-rw-3.6.3.2.4-2.9.3 libreoffice-l10n-sh-3.6.3.2.4-2.9.3 libreoffice-l10n-sk-3.6.3.2.4-2.9.3 libreoffice-l10n-sl-3.6.3.2.4-2.9.3 libreoffice-l10n-sr-3.6.3.2.4-2.9.3 libreoffice-l10n-ss-3.6.3.2.4-2.9.3 libreoffice-l10n-st-3.6.3.2.4-2.9.3 libreoffice-l10n-sv-3.6.3.2.4-2.9.3 libreoffice-l10n-ta-3.6.3.2.4-2.9.3 libreoffice-l10n-te-3.6.3.2.4-2.9.3 libreoffice-l10n-tg-3.6.3.2.4-2.9.3 libreoffice-l10n-th-3.6.3.2.4-2.9.3 libreoffice-l10n-tr-3.6.3.2.4-2.9.3 libreoffice-l10n-ts-3.6.3.2.4-2.9.3 libreoffice-l10n-ug-3.6.3.2.4-2.9.3 libreoffice-l10n-uk-3.6.3.2.4-2.9.3 libreoffice-l10n-ve-3.6.3.2.4-2.9.3 libreoffice-l10n-vi-3.6.3.2.4-2.9.3 libreoffice-l10n-xh-3.6.3.2.4-2.9.3 libreoffice-l10n-zh-CN-3.6.3.2.4-2.9.3 libreoffice-l10n-zh-TW-3.6.3.2.4-2.9.3 libreoffice-l10n-zu-3.6.3.2.4-2.9.3 References: http://support.novell.com/security/cve/CVE-2013-4156.html http://support.novell.com/security/cve/CVE-2014-3575.html https://bugzilla.novell.com/831578 https://bugzilla.novell.com/893141 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1125-1: important: Security update for glibc
by opensuse-security＠opensuse.org 13 Sep '14

13 Sep '14

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1125-1 Rating: important References: #888347 #892065 #892073 Cross-References: CVE-2014-5119 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This glibc update fixes a critical privilege escalation problem and two non-security issues: * bnc#892073: An off-by-one error leading to a heap-based buffer overflow was found in __gconv_translit_find(). An exploit that targets the problem is publicly available. (CVE-2014-5119) * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv. * bnc#888347: printf-multibyte-format.patch: Don't parse %s format argument as multi-byte string. Security Issues: * CVE-2014-5119 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-glibc-9669 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-glibc-9669 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-glibc-9669 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-glibc-9669 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): glibc-html-2.11.3-17.72.14 glibc-info-2.11.3-17.72.14 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): glibc-2.11.3-17.72.14 glibc-devel-2.11.3-17.72.14 glibc-html-2.11.3-17.72.14 glibc-i18ndata-2.11.3-17.72.14 glibc-info-2.11.3-17.72.14 glibc-locale-2.11.3-17.72.14 glibc-profile-2.11.3-17.72.14 nscd-2.11.3-17.72.14 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): glibc-32bit-2.11.3-17.72.14 glibc-devel-32bit-2.11.3-17.72.14 glibc-locale-32bit-2.11.3-17.72.14 glibc-profile-32bit-2.11.3-17.72.14 - SUSE Linux Enterprise Server 11 SP3 (i586 i686 ia64 ppc64 s390x x86_64): glibc-2.11.3-17.72.14 glibc-devel-2.11.3-17.72.14 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): glibc-html-2.11.3-17.72.14 glibc-i18ndata-2.11.3-17.72.14 glibc-info-2.11.3-17.72.14 glibc-locale-2.11.3-17.72.14 glibc-profile-2.11.3-17.72.14 nscd-2.11.3-17.72.14 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): glibc-32bit-2.11.3-17.72.14 glibc-devel-32bit-2.11.3-17.72.14 glibc-locale-32bit-2.11.3-17.72.14 glibc-profile-32bit-2.11.3-17.72.14 - SUSE Linux Enterprise Server 11 SP3 (ia64): glibc-locale-x86-2.11.3-17.72.14 glibc-profile-x86-2.11.3-17.72.14 glibc-x86-2.11.3-17.72.14 - SUSE Linux Enterprise Desktop 11 SP3 (i586 i686 x86_64): glibc-2.11.3-17.72.14 glibc-devel-2.11.3-17.72.14 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): glibc-i18ndata-2.11.3-17.72.14 glibc-locale-2.11.3-17.72.14 nscd-2.11.3-17.72.14 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): glibc-32bit-2.11.3-17.72.14 glibc-devel-32bit-2.11.3-17.72.14 glibc-locale-32bit-2.11.3-17.72.14 References: http://support.novell.com/security/cve/CVE-2014-5119.html https://bugzilla.novell.com/888347 https://bugzilla.novell.com/892065 https://bugzilla.novell.com/892073 http://download.suse.com/patch/finder/?keywords=b84219db4b55e263e5f4c158906… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1124-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 12 Sep '14

12 Sep '14

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1124-1 Rating: important References: #895856 Cross-References: CVE-2014-0547 CVE-2014-0548 CVE-2014-0549 CVE-2014-0550 CVE-2014-0551 CVE-2014-0552 CVE-2014-0553 CVE-2014-0554 CVE-2014-0555 CVE-2014-0556 CVE-2014-0557 CVE-2014-0559 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. It includes one version update. Description: Adobe Flash Player has been updated to 11.2.202.406 which fixes various security issues. These updates: * resolve a memory leakage vulnerability that could have been used to bypass memory address randomization (CVE-2014-0557). * resolve a security bypass vulnerability (CVE-2014-0554). * resolve a use-after-free vulnerability that could have lead to code execution (CVE-2014-0553). * resolve memory corruption vulnerabilities that could have lead to code execution (CVE-2014-0547, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, CVE-2014-0555). * resolve a vulnerability that could have been used to bypass the same origin policy (CVE-2014-0548). * resolve a heap buffer overflow vulnerability that could have lead to code execution (CVE-2014-0556, CVE-2014-0559). More information can be found on http://helpx.adobe.com/security/products/flash-player/apsb14-21.html <http://helpx.adobe.com/security/products/flash-player/apsb14-21.html> Security Issues: * CVE-2014-0547 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0547> * CVE-2014-0548 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0548> * CVE-2014-0549 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0549> * CVE-2014-0550 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0550> * CVE-2014-0551 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0551> * CVE-2014-0552 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0552> * CVE-2014-0553 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0553> * CVE-2014-0554 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0554> * CVE-2014-0555 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0555> * CVE-2014-0556 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0556> * CVE-2014-0557 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0557> * CVE-2014-0559 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0559> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-9704 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.406]: flash-player-11.2.202.406-0.3.1 flash-player-gnome-11.2.202.406-0.3.1 flash-player-kde4-11.2.202.406-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-0547.html http://support.novell.com/security/cve/CVE-2014-0548.html http://support.novell.com/security/cve/CVE-2014-0549.html http://support.novell.com/security/cve/CVE-2014-0550.html http://support.novell.com/security/cve/CVE-2014-0551.html http://support.novell.com/security/cve/CVE-2014-0552.html http://support.novell.com/security/cve/CVE-2014-0553.html http://support.novell.com/security/cve/CVE-2014-0554.html http://support.novell.com/security/cve/CVE-2014-0555.html http://support.novell.com/security/cve/CVE-2014-0556.html http://support.novell.com/security/cve/CVE-2014-0557.html http://support.novell.com/security/cve/CVE-2014-0559.html https://bugzilla.novell.com/895856 http://download.suse.com/patch/finder/?keywords=3bb66ba5895adc6dc1e2753dafc… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1112-2: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 12 Sep '14

12 Sep '14

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1112-2 Rating: important References: #894370 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes three new package versions. Description: Mozilla Firefox was updated to the 24.8.0ESR release, fixing security issues and bugs. Only some of the published security advisories affect the Mozilla Firefox 24ESR codestream: * MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution. * MFSA 2014-67: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * Jan de Mooij reported a memory safety problem that affects Firefox ESR 24.7, ESR 31 and Firefox 31. (CVE-2014-1562) More information is referenced on: https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues: * CVE-2014-1562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562> * CVE-2014-1567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-firefox-201409-9681 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 24.8.0esr,3.16.4 and 4.10.7]: MozillaFirefox-24.8.0esr-0.3.1 MozillaFirefox-translations-24.8.0esr-0.3.1 libfreebl3-3.16.4-0.3.1 mozilla-nspr-4.10.7-0.3.1 mozilla-nss-3.16.4-0.3.1 mozilla-nss-tools-3.16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 3.16.4 and 4.10.7]: libfreebl3-32bit-3.16.4-0.3.1 mozilla-nspr-32bit-4.10.7-0.3.1 mozilla-nss-32bit-3.16.4-0.3.1 References: https://bugzilla.novell.com/894370 http://download.suse.com/patch/finder/?keywords=163464dc8eaa4994ed25dd8ac41… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1120-2: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 12 Sep '14

12 Sep '14

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1120-2 Rating: important References: #882881 #894370 Cross-References: CVE-2014-1562 CVE-2014-1567 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes two new package versions. Description: Mozilla Firefox was updated to the 24.8.0ESR release, fixing security issues and bugs. Only some of the published security advisories affect the Mozilla Firefox 24ESR codestream: * MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution. * MFSA 2014-67: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * Jan de Mooij reported a memory safety problem that affects Firefox ESR 24.7, ESR 31 and Firefox 31. (CVE-2014-1562) More information is referenced on: https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues: * CVE-2014-1567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567> * CVE-2014-1562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64) [New Version: 3.16.4 and 4.10.7]: firefox-gtk2-2.18.9-0.11.1 firefox-gtk2-lang-2.18.9-0.11.1 mozilla-nspr-4.10.7-0.5.1 mozilla-nspr-devel-4.10.7-0.5.1 mozilla-nss-3.16.4-0.5.2 mozilla-nss-devel-3.16.4-0.5.2 mozilla-nss-tools-3.16.4-0.5.2 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64) [New Version: 3.16.4 and 4.10.7]: firefox-gtk2-32bit-2.18.9-0.11.1 mozilla-nspr-32bit-4.10.7-0.5.1 mozilla-nss-32bit-3.16.4-0.5.2 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x): MozillaFirefox-24.8.0esr-0.5.1 MozillaFirefox-translations-24.8.0esr-0.5.1 References: http://support.novell.com/security/cve/CVE-2014-1562.html http://support.novell.com/security/cve/CVE-2014-1567.html https://bugzilla.novell.com/882881 https://bugzilla.novell.com/894370 http://download.suse.com/patch/finder/?keywords=24d0f20857a99b68fbd08945af7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1122-1: important: Security update for glibc
by opensuse-security＠opensuse.org 12 Sep '14

12 Sep '14

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1122-1 Rating: important References: #750741 #779320 #801246 #830268 #834594 #836746 #839870 #843735 #864081 #882600 #883022 #886416 #892073 Cross-References: CVE-2012-4412 CVE-2013-0242 CVE-2013-4237 CVE-2013-4332 CVE-2013-4788 CVE-2014-4043 CVE-2014-5119 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that solves 7 vulnerabilities and has 6 fixes is now available. Description: This glibc update fixes a critical privilege escalation vulnerability and the following security and non-security issues: * bnc#892073: An off-by-one error leading to a heap-based buffer overflow was found in __gconv_translit_find(). An exploit that targets the problem is publicly available. (CVE-2014-5119) * bnc#886416: Avoid redundant shift character in iconv output at block boundary. * bnc#883022: Initialize errcode in sysdeps/unix/opendir.c. * bnc#882600: Copy filename argument in posix_spawn_file_actions_addopen. (CVE-2014-4043) * bnc#864081: Take lock in pthread_cond_wait cleanup handler only when needed. * bnc#843735: Don't crash on unresolved weak symbol reference. * bnc#839870: Fix integer overflows in malloc. (CVE-2013-4332) * bnc#836746: Avoid race between {,__de}allocate_stack and __reclaim_stacks during fork. * bnc#834594: Fix readdir_r with long file names. (CVE-2013-4237) * bnc#830268: Initialize pointer guard also in static executables. (CVE-2013-4788) * bnc#801246: Fix buffer overrun in regexp matcher. (CVE-2013-0242) * bnc#779320: Fix buffer overflow in strcoll. (CVE-2012-4412) * bnc#750741: Use absolute timeout in x86 pthread_cond_timedwait. Security Issues: * CVE-2014-5119 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119> * CVE-2014-4043 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043> * CVE-2012-4412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412> * CVE-2013-0242 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0242> * CVE-2013-4788 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4788> * CVE-2013-4237 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237> * CVE-2013-4332 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-glibc-9664 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 i686 s390x x86_64): glibc-2.11.1-0.58.1 glibc-devel-2.11.1-0.58.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): glibc-html-2.11.1-0.58.1 glibc-i18ndata-2.11.1-0.58.1 glibc-info-2.11.1-0.58.1 glibc-locale-2.11.1-0.58.1 glibc-profile-2.11.1-0.58.1 nscd-2.11.1-0.58.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64): glibc-32bit-2.11.1-0.58.1 glibc-devel-32bit-2.11.1-0.58.1 glibc-locale-32bit-2.11.1-0.58.1 glibc-profile-32bit-2.11.1-0.58.1 References: http://support.novell.com/security/cve/CVE-2012-4412.html http://support.novell.com/security/cve/CVE-2013-0242.html http://support.novell.com/security/cve/CVE-2013-4237.html http://support.novell.com/security/cve/CVE-2013-4332.html http://support.novell.com/security/cve/CVE-2013-4788.html http://support.novell.com/security/cve/CVE-2014-4043.html http://support.novell.com/security/cve/CVE-2014-5119.html https://bugzilla.novell.com/750741 https://bugzilla.novell.com/779320 https://bugzilla.novell.com/801246 https://bugzilla.novell.com/830268 https://bugzilla.novell.com/834594 https://bugzilla.novell.com/836746 https://bugzilla.novell.com/839870 https://bugzilla.novell.com/843735 https://bugzilla.novell.com/864081 https://bugzilla.novell.com/882600 https://bugzilla.novell.com/883022 https://bugzilla.novell.com/886416 https://bugzilla.novell.com/892073 http://download.suse.com/patch/finder/?keywords=8ba147c0ad19c1883fe7425b33e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1120-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 12 Sep '14

12 Sep '14

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1120-1 Rating: important References: #882881 #894370 Cross-References: CVE-2014-1562 CVE-2014-1567 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes two new package versions. Description: Mozilla Firefox was updated to the 24.8.0ESR release, fixing security issues and bugs. Only some of the published security advisories affect the Mozilla Firefox 24ESR codestream: * MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution. * MFSA 2014-67: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * Jan de Mooij reported a memory safety problem that affects Firefox ESR 24.7, ESR 31 and Firefox 31. (CVE-2014-1562) More information is referenced on: https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues: * CVE-2014-1567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567> * CVE-2014-1562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562> Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64) [New Version: 3.16.4 and 4.10.7]: firefox-gtk2-2.18.9-0.11.1 firefox-gtk2-lang-2.18.9-0.11.1 mozilla-nspr-4.10.7-0.5.1 mozilla-nspr-devel-4.10.7-0.5.1 mozilla-nss-3.16.4-0.5.2 mozilla-nss-devel-3.16.4-0.5.2 mozilla-nss-tools-3.16.4-0.5.2 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64) [New Version: 3.16.4 and 4.10.7]: firefox-gtk2-32bit-2.18.9-0.11.1 mozilla-nspr-32bit-4.10.7-0.5.1 mozilla-nss-32bit-3.16.4-0.5.2 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x): MozillaFirefox-24.8.0esr-0.5.1 MozillaFirefox-translations-24.8.0esr-0.5.1 References: http://support.novell.com/security/cve/CVE-2014-1562.html http://support.novell.com/security/cve/CVE-2014-1567.html https://bugzilla.novell.com/882881 https://bugzilla.novell.com/894370 http://download.suse.com/patch/finder/?keywords=401ac4583a90138bdc8c41d347a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1119-1: important: Security update for glibc
by opensuse-security＠opensuse.org 12 Sep '14

12 Sep '14

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1119-1 Rating: important References: #772242 #779320 #818630 #828235 #828637 #834594 #892073 Cross-References: CVE-2012-4412 CVE-2013-4237 CVE-2014-5119 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that solves three vulnerabilities and has four fixes is now available. Description: This glibc update fixes a critical privilege escalation problem and the following security and non security issues: * bnc#892073: An off-by-one error leading to a heap-based buffer overflow was found in __gconv_translit_find(). An exploit that targets the problem is publicly available. (CVE-2014-5119) * bnc#772242: Replace scope handing with master state * bnc#779320: Fix buffer overflow in strcoll (CVE-2012-4412) * bnc#818630: Fall back to localhost if no nameserver defined * bnc#828235: Fix missing character in IBM-943 charset * bnc#828637: Fix use of alloca in gaih_inet * bnc#834594: Fix readdir_r with long file names (CVE-2013-4237) Security Issues: * CVE-2014-5119 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119> * CVE-2013-4237 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237> * CVE-2012-4412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 i686 s390x x86_64): glibc-2.4-31.111.1 glibc-devel-2.4-31.111.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): glibc-html-2.4-31.111.1 glibc-i18ndata-2.4-31.111.1 glibc-info-2.4-31.111.1 glibc-locale-2.4-31.111.1 glibc-profile-2.4-31.111.1 nscd-2.4-31.111.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): glibc-32bit-2.4-31.111.1 glibc-devel-32bit-2.4-31.111.1 glibc-locale-32bit-2.4-31.111.1 glibc-profile-32bit-2.4-31.111.1 References: http://support.novell.com/security/cve/CVE-2012-4412.html http://support.novell.com/security/cve/CVE-2013-4237.html http://support.novell.com/security/cve/CVE-2014-5119.html https://bugzilla.novell.com/772242 https://bugzilla.novell.com/779320 https://bugzilla.novell.com/818630 https://bugzilla.novell.com/828235 https://bugzilla.novell.com/828637 https://bugzilla.novell.com/834594 https://bugzilla.novell.com/892073 http://download.suse.com/patch/finder/?keywords=767429925ce018c15cbe14c33d6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1116-1: important: Security update for LibreOffice
by opensuse-security＠opensuse.org 11 Sep '14

11 Sep '14

SUSE Security Update: Security update for LibreOffice ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1116-1 Rating: important References: #382137 #593612 #654230 #753460 #757432 #779620 #779642 #780044 #783433 #802888 #816593 #817956 #819614 #819822 #819865 #820077 #820273 #820503 #820504 #820509 #820788 #820800 #820819 #820836 #821567 #821795 #822908 #823626 #823651 #823655 #823675 #823935 #825305 #825891 #825976 #828390 #828598 #829017 #830205 #831457 #831578 #834035 #834705 #834720 #834722 #835985 #837302 #839727 #862510 #863021 #864396 #870234 #878854 #893141 Cross-References: CVE-2013-4156 CVE-2014-3575 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 52 fixes is now available. It includes one version update. Description: LibreOffice was updated to version 4.0.3.3.26. (SUSE 4.0-patch26, tag suse-4.0-26, based on upstream 4.0.3.3). Two security issues have been fixed: * DOCM memory corruption vulnerability. (CVE-2013-4156, bnc#831578) * Data exposure using crafted OLE objects. (CVE-2014-3575, bnc#893141) The following non-security issues have been fixed: * chart shown flipped (bnc#834722) * chart missing dataset (bnc#839727) * import new line in text (bnc#828390) * lines running off screens (bnc#819614) * add set-all language menu (bnc#863021) * text rotation (bnc#783433, bnc#862510) * page border shadow testcase (bnc#817956) * one more clickable field fix (bnc#802888) * multilevel labels are rotated (bnc#820273) * incorrect nested table margins (bnc#816593) * use BitmapURL only if its valid (bnc#821567) * import gradfill for text colors (bnc#870234) * fix undo of paragraph attributes (bnc#828598) * stop-gap solution to avoid crash (bnc#830205) * import images with duotone filter (bnc#820077) * missing drop downs for autofilter (bnc#834705) * typos in first page style creation (bnc#820836) * labels wrongly interpreted as dates (bnc#834720) * RTF import of fFilled shape property (bnc#825305) * placeholders text size is not correct (bnc#831457) * cells value formatted with wrong output (bnc#821795) * RTF import of freeform shape coordinates (bnc#823655) * styles (rename &) copy to different decks (bnc#757432) * XLSX Chart import with internal data table (bnc#819822) * handle M.d.yyyy date format in DOCX import (bnc#820509) * paragraph style in empty first page header (bnc#823651) * copying slides having same master page name (bnc#753460) * printing handouts using the default, 'Order' (bnc#835985) * wrap polygon was based on dest size of picture (bnc#820800) * added common flags support for SEQ field import (bnc#825976) * hyperlinks of illustration index in DOCX export (bnc#834035) * allow insertion of redlines with an empty author (bnc#837302) * handle drawinglayer rectangle inset in VML import (bnc#779642) * don't apply complex font size to non-complex font (bnc#820819) * issue with negative seeks in win32 shell extension (bnc#829017) * slide appears quite garbled when imported from PPTX (bnc#593612) * initial MCE support in writerfilter ooxml tokenizer (bnc#820503) * MSWord uses \xb for linebreaks in DB fields, take 2 (bnc#878854) * try harder to convert floating tables to text frames (bnc#779620) * itemstate in parent style incorrectly reported as set (bnc#819865) * default color hidden by Default style in writerfilter (bnc#820504) * DOCX document crashes when using internal OOXML filter (bnc#382137) * ugly workaround for external leading with symbol fonts (bnc#823626) * followup fix for exported xlsx causes errors for mso2007 (bnc#823935) * we only support simple labels in the InternalDataProvider (bnc#864396) * RTF import: fix import of numbering bullet associated font (bnc#823675) * page specific footer extended to every pages in DOCX export (bnc#654230) * v:textbox mso-fit-shape-to-text style property in VML import (bnc#820788) * w:spacing in a paragraph should also apply to as-char objects (bnc#780044) * compatibility setting for MS Word wrapping text in less space (bnc#822908) * fix SwWrtShell::SelAll() to work with empty table at doc start (bnc#825891) Security Issues: * CVE-2014-3575 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3575> * CVE-2013-4156 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4156> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libreoffice-201409-9677 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libreoffice-201409-9677 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64) [New Version: 4.0.3.3.26]: libreoffice-4.0.3.3.26-0.6.2 libreoffice-base-4.0.3.3.26-0.6.2 libreoffice-base-drivers-postgresql-4.0.3.3.26-0.6.2 libreoffice-base-extensions-4.0.3.3.26-0.6.2 libreoffice-calc-4.0.3.3.26-0.6.2 libreoffice-calc-extensions-4.0.3.3.26-0.6.2 libreoffice-draw-4.0.3.3.26-0.6.2 libreoffice-draw-extensions-4.0.3.3.26-0.6.2 libreoffice-filters-optional-4.0.3.3.26-0.6.2 libreoffice-gnome-4.0.3.3.26-0.6.2 libreoffice-impress-4.0.3.3.26-0.6.2 libreoffice-impress-extensions-4.0.3.3.26-0.6.2 libreoffice-kde-4.0.3.3.26-0.6.2 libreoffice-kde4-4.0.3.3.26-0.6.2 libreoffice-l10n-prebuilt-4.0.3.3.26-0.6.2 libreoffice-mailmerge-4.0.3.3.26-0.6.2 libreoffice-math-4.0.3.3.26-0.6.2 libreoffice-mono-4.0.3.3.26-0.6.2 libreoffice-officebean-4.0.3.3.26-0.6.2 libreoffice-pyuno-4.0.3.3.26-0.6.2 libreoffice-sdk-4.0.3.3.26-0.6.2 libreoffice-writer-4.0.3.3.26-0.6.2 libreoffice-writer-extensions-4.0.3.3.26-0.6.2 - SUSE Linux Enterprise Software Development Kit 11 SP3 (noarch) [New Version: 4.0.3.3.26]: libreoffice-branding-upstream-4.0.3.3.26-0.6.1 libreoffice-help-cs-4.0.3.3.26-0.6.1 libreoffice-help-da-4.0.3.3.26-0.6.1 libreoffice-help-de-4.0.3.3.26-0.6.1 libreoffice-help-en-GB-4.0.3.3.26-0.6.1 libreoffice-help-en-US-4.0.3.3.26-0.6.1 libreoffice-help-es-4.0.3.3.26-0.6.1 libreoffice-help-fr-4.0.3.3.26-0.6.1 libreoffice-help-gu-IN-4.0.3.3.26-0.6.1 libreoffice-help-hi-IN-4.0.3.3.26-0.6.1 libreoffice-help-hu-4.0.3.3.26-0.6.1 libreoffice-help-it-4.0.3.3.26-0.6.1 libreoffice-help-ja-4.0.3.3.26-0.6.1 libreoffice-help-ko-4.0.3.3.26-0.6.1 libreoffice-help-nl-4.0.3.3.26-0.6.1 libreoffice-help-pl-4.0.3.3.26-0.6.1 libreoffice-help-pt-4.0.3.3.26-0.6.1 libreoffice-help-pt-BR-4.0.3.3.26-0.6.1 libreoffice-help-ru-4.0.3.3.26-0.6.1 libreoffice-help-sv-4.0.3.3.26-0.6.1 libreoffice-help-zh-CN-4.0.3.3.26-0.6.1 libreoffice-help-zh-TW-4.0.3.3.26-0.6.1 libreoffice-icon-themes-4.0.3.3.26-0.6.2 libreoffice-l10n-af-4.0.3.3.26-0.6.2 libreoffice-l10n-ar-4.0.3.3.26-0.6.2 libreoffice-l10n-ca-4.0.3.3.26-0.6.2 libreoffice-l10n-cs-4.0.3.3.26-0.6.2 libreoffice-l10n-da-4.0.3.3.26-0.6.2 libreoffice-l10n-de-4.0.3.3.26-0.6.2 libreoffice-l10n-el-4.0.3.3.26-0.6.2 libreoffice-l10n-en-GB-4.0.3.3.26-0.6.2 libreoffice-l10n-es-4.0.3.3.26-0.6.2 libreoffice-l10n-fi-4.0.3.3.26-0.6.2 libreoffice-l10n-fr-4.0.3.3.26-0.6.2 libreoffice-l10n-gu-IN-4.0.3.3.26-0.6.2 libreoffice-l10n-hi-IN-4.0.3.3.26-0.6.2 libreoffice-l10n-hu-4.0.3.3.26-0.6.2 libreoffice-l10n-it-4.0.3.3.26-0.6.2 libreoffice-l10n-ja-4.0.3.3.26-0.6.2 libreoffice-l10n-ko-4.0.3.3.26-0.6.2 libreoffice-l10n-nb-4.0.3.3.26-0.6.2 libreoffice-l10n-nl-4.0.3.3.26-0.6.2 libreoffice-l10n-nn-4.0.3.3.26-0.6.2 libreoffice-l10n-pl-4.0.3.3.26-0.6.2 libreoffice-l10n-pt-4.0.3.3.26-0.6.2 libreoffice-l10n-pt-BR-4.0.3.3.26-0.6.2 libreoffice-l10n-ru-4.0.3.3.26-0.6.2 libreoffice-l10n-sk-4.0.3.3.26-0.6.2 libreoffice-l10n-sv-4.0.3.3.26-0.6.2 libreoffice-l10n-xh-4.0.3.3.26-0.6.2 libreoffice-l10n-zh-CN-4.0.3.3.26-0.6.2 libreoffice-l10n-zh-TW-4.0.3.3.26-0.6.2 libreoffice-l10n-zu-4.0.3.3.26-0.6.2 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 4.0.3.3.26]: libreoffice-4.0.3.3.26-0.6.2 libreoffice-base-4.0.3.3.26-0.6.2 libreoffice-base-drivers-postgresql-4.0.3.3.26-0.6.2 libreoffice-base-extensions-4.0.3.3.26-0.6.2 libreoffice-calc-4.0.3.3.26-0.6.2 libreoffice-calc-extensions-4.0.3.3.26-0.6.2 libreoffice-draw-4.0.3.3.26-0.6.2 libreoffice-draw-extensions-4.0.3.3.26-0.6.2 libreoffice-filters-optional-4.0.3.3.26-0.6.2 libreoffice-gnome-4.0.3.3.26-0.6.2 libreoffice-impress-4.0.3.3.26-0.6.2 libreoffice-impress-extensions-4.0.3.3.26-0.6.2 libreoffice-kde-4.0.3.3.26-0.6.2 libreoffice-kde4-4.0.3.3.26-0.6.2 libreoffice-mailmerge-4.0.3.3.26-0.6.2 libreoffice-math-4.0.3.3.26-0.6.2 libreoffice-mono-4.0.3.3.26-0.6.2 libreoffice-officebean-4.0.3.3.26-0.6.2 libreoffice-pyuno-4.0.3.3.26-0.6.2 libreoffice-writer-4.0.3.3.26-0.6.2 libreoffice-writer-extensions-4.0.3.3.26-0.6.2 - SUSE Linux Enterprise Desktop 11 SP3 (noarch) [New Version: 4.0.3.3.26]: libreoffice-help-cs-4.0.3.3.26-0.6.1 libreoffice-help-da-4.0.3.3.26-0.6.1 libreoffice-help-de-4.0.3.3.26-0.6.1 libreoffice-help-en-GB-4.0.3.3.26-0.6.1 libreoffice-help-en-US-4.0.3.3.26-0.6.1 libreoffice-help-es-4.0.3.3.26-0.6.1 libreoffice-help-fr-4.0.3.3.26-0.6.1 libreoffice-help-gu-IN-4.0.3.3.26-0.6.1 libreoffice-help-hi-IN-4.0.3.3.26-0.6.1 libreoffice-help-hu-4.0.3.3.26-0.6.1 libreoffice-help-it-4.0.3.3.26-0.6.1 libreoffice-help-ja-4.0.3.3.26-0.6.1 libreoffice-help-ko-4.0.3.3.26-0.6.1 libreoffice-help-nl-4.0.3.3.26-0.6.1 libreoffice-help-pl-4.0.3.3.26-0.6.1 libreoffice-help-pt-4.0.3.3.26-0.6.1 libreoffice-help-pt-BR-4.0.3.3.26-0.6.1 libreoffice-help-ru-4.0.3.3.26-0.6.1 libreoffice-help-sv-4.0.3.3.26-0.6.1 libreoffice-help-zh-CN-4.0.3.3.26-0.6.1 libreoffice-help-zh-TW-4.0.3.3.26-0.6.1 libreoffice-icon-themes-4.0.3.3.26-0.6.2 libreoffice-l10n-af-4.0.3.3.26-0.6.2 libreoffice-l10n-ar-4.0.3.3.26-0.6.2 libreoffice-l10n-ca-4.0.3.3.26-0.6.2 libreoffice-l10n-cs-4.0.3.3.26-0.6.2 libreoffice-l10n-da-4.0.3.3.26-0.6.2 libreoffice-l10n-de-4.0.3.3.26-0.6.2 libreoffice-l10n-en-GB-4.0.3.3.26-0.6.2 libreoffice-l10n-es-4.0.3.3.26-0.6.2 libreoffice-l10n-fi-4.0.3.3.26-0.6.2 libreoffice-l10n-fr-4.0.3.3.26-0.6.2 libreoffice-l10n-gu-IN-4.0.3.3.26-0.6.2 libreoffice-l10n-hi-IN-4.0.3.3.26-0.6.2 libreoffice-l10n-hu-4.0.3.3.26-0.6.2 libreoffice-l10n-it-4.0.3.3.26-0.6.2 libreoffice-l10n-ja-4.0.3.3.26-0.6.2 libreoffice-l10n-ko-4.0.3.3.26-0.6.2 libreoffice-l10n-nb-4.0.3.3.26-0.6.2 libreoffice-l10n-nl-4.0.3.3.26-0.6.2 libreoffice-l10n-nn-4.0.3.3.26-0.6.2 libreoffice-l10n-pl-4.0.3.3.26-0.6.2 libreoffice-l10n-pt-4.0.3.3.26-0.6.2 libreoffice-l10n-pt-BR-4.0.3.3.26-0.6.2 libreoffice-l10n-ru-4.0.3.3.26-0.6.2 libreoffice-l10n-sk-4.0.3.3.26-0.6.2 libreoffice-l10n-sv-4.0.3.3.26-0.6.2 libreoffice-l10n-xh-4.0.3.3.26-0.6.2 libreoffice-l10n-zh-CN-4.0.3.3.26-0.6.2 libreoffice-l10n-zh-TW-4.0.3.3.26-0.6.2 libreoffice-l10n-zu-4.0.3.3.26-0.6.2 References: http://support.novell.com/security/cve/CVE-2013-4156.html http://support.novell.com/security/cve/CVE-2014-3575.html https://bugzilla.novell.com/382137 https://bugzilla.novell.com/593612 https://bugzilla.novell.com/654230 https://bugzilla.novell.com/753460 https://bugzilla.novell.com/757432 https://bugzilla.novell.com/779620 https://bugzilla.novell.com/779642 https://bugzilla.novell.com/780044 https://bugzilla.novell.com/783433 https://bugzilla.novell.com/802888 https://bugzilla.novell.com/816593 https://bugzilla.novell.com/817956 https://bugzilla.novell.com/819614 https://bugzilla.novell.com/819822 https://bugzilla.novell.com/819865 https://bugzilla.novell.com/820077 https://bugzilla.novell.com/820273 https://bugzilla.novell.com/820503 https://bugzilla.novell.com/820504 https://bugzilla.novell.com/820509 https://bugzilla.novell.com/820788 https://bugzilla.novell.com/820800 https://bugzilla.novell.com/820819 https://bugzilla.novell.com/820836 https://bugzilla.novell.com/821567 https://bugzilla.novell.com/821795 https://bugzilla.novell.com/822908 https://bugzilla.novell.com/823626 https://bugzilla.novell.com/823651 https://bugzilla.novell.com/823655 https://bugzilla.novell.com/823675 https://bugzilla.novell.com/823935 https://bugzilla.novell.com/825305 https://bugzilla.novell.com/825891 https://bugzilla.novell.com/825976 https://bugzilla.novell.com/828390 https://bugzilla.novell.com/828598 https://bugzilla.novell.com/829017 https://bugzilla.novell.com/830205 https://bugzilla.novell.com/831457 https://bugzilla.novell.com/831578 https://bugzilla.novell.com/834035 https://bugzilla.novell.com/834705 https://bugzilla.novell.com/834720 https://bugzilla.novell.com/834722 https://bugzilla.novell.com/835985 https://bugzilla.novell.com/837302 https://bugzilla.novell.com/839727 https://bugzilla.novell.com/862510 https://bugzilla.novell.com/863021 https://bugzilla.novell.com/864396 https://bugzilla.novell.com/870234 https://bugzilla.novell.com/878854 https://bugzilla.novell.com/893141 http://download.suse.com/patch/finder/?keywords=d2e2531d51923f3c40bbd114b7e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0