April 2013 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] SuseFirewall2: Strange masquerading rule for port forwarding rules when both FW_MASQ_NETS and FW_FORWARD_MASQ are defined
by Juan Luis Baptiste 14 May '13

14 May '13

Hi, I'm seeing something strange that I do not understand. According to iptables documentation[1], port forwarding rules are defined on the PREROUTING chain in the nat table, and masquerading rules are defined on the POSTROUTING chain also in the nat table (plus the needed additional rules in chain FORWARD in the filter table). I'm testing a simple escenario: An OpenSUSE 12.3 server with two interfaces, one connected to the 192.168.1.0/24 (external network) on eth0, and connected to 192.168.10.0/24 (internal network) on eth1: FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" If I define: FW_FORWARD_MASQ="192.168.1.102,192.168.10.111,tcp,2222,22" I will correctly see rule created on PREROUTING: Chain PREROUTING (policy ACCEPT 8 packets, 869 bytes) pkts bytes target prot opt in out source destination 1 60 DNAT tcp -- eth0 * 192.168.1.102 0.0.0.0/0 tcp dpt:2222 to:192.168.10.111:22 The same happens for masquerading for this rule: FW_MASQ_NETS="192.168.10.0/24,0/0" I will correctly see the rule created on POSTROUTING: Chain POSTROUTING (policy ACCEPT 1 packets, 60 bytes) pkts bytes target prot opt in out source destination 6 395 MASQUERADE all -- * eth0 192.168.10.0/24 0.0.0.0/0 BUT, if both variables are defined at the same time, an additional rule in the POSTROUTING chain will be created for the port forwarding rule defined in FW_FORWARD_MASQ. Look at this: Chain POSTROUTING (policy ACCEPT 1 packets, 60 bytes) pkts bytes target prot opt in out source destination 6 395 MASQUERADE all -- * eth0 192.168.10.0/24 0.0.0.0/0 0 0 MASQUERADE tcp -- * eth0 192.168.1.102 0.0.0.0/0 tcp dpt:22 Now there's an additional masquerading rule (the second one) for the external host 192.168.1.102. Note that that host is on the network connected to the firewall on eth0, and the output interface is also eth0, with the destination port of the port forwading rule in FW_FORWARD_MASQ. This doesn't make any sense to me, is this correct ? why that rule appears only when both FW_MASQ_NETS and FW_FORWARD_MASQ are defined and not when only the latter is defined ? both rules work ok, I'm just wondering why that extra rule that doesn't seem to have any use. [1] http://netfilter.org/documentation/HOWTO//NAT-HOWTO-6.html Cheers, -- JLB -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 1

[opensuse-security] SuSEfirewall2 behavior with multiple, not configured network interfaces
by Juan Luis Baptiste 30 Apr '13

30 Apr '13

Hi, There's another behavior with SuSEfirewall2 with multiple network interfaces that I would like to discuss. We're working with an appliance that has six network interfaces. We only need two of those six interfaces, so only two of them are configured, one with DHCP and the other is static. The other interfaces are present and detected by OpenSUSE but they're not configured so ifconfig output only shows those two interfaces (yast2 shows them as not configured). I have configured SuSEfirewall2 like this: FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.10.0/24" When I start the firewall I get this message: linux-test:~ # SuSEfirewall2 start SuSEfirewall2: Setting up rules from /etc/sysconfig/SuSEfirewall2 ... SuSEfirewall2: using default zone 'ext' for interface eth2 SuSEfirewall2: using default zone 'ext' for interface eth3 SuSEfirewall2: using default zone 'ext' for interface eth4 SuSEfirewall2: using default zone 'ext' for interface eth5 SuSEfirewall2: Firewall rules successfully set This means that for each rule specified for example in FW_MASQ_NETS or FW_FORWARD, five usless additional rules will be created, one for each of the not configured interfaces. Currently I don't have that appliance at hand so I'm testing on a VM with four interfaces and the previous configuration. With the previous configuration this is the output when starting the firewall: linux-w43c:~ # SuSEfirewall2 start SuSEfirewall2: Setting up rules from /etc/sysconfig/SuSEfirewall2 ... SuSEfirewall2: using default zone 'ext' for interface eth2 SuSEfirewall2: using default zone 'ext' for interface eth3 SuSEfirewall2: Firewall rules successfully set And the output of SuSEfirewall2 status here: http://pastebin.com/vDvTUYnM Why are there rules being created for the not configured interfaces, in other words, why are they being added by default to the external zone if those interfaces aren't being used, not even configured ? is there a way to avoid this ? Cheers, -- JLB -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

3 5

Re: [opensuse-security] Re: FW_MASQUERADE default behavior ?
by Juan Luis Baptiste 25 Apr '13

25 Apr '13

On Thu, Apr 25, 2013 at 1:39 AM, Markus Abt <abt(a)comet.de> wrote: > > I suppose that this is the firewall status output with FW_MASQ_NETS="". Yes, to test the weird behavior I'm seeing. > It looks like a bug/changed functionality to me, too. > In Chain forward_int, this line should not be there: > > ACCEPT all -- eth1 eth0 0.0.0.0/0 0.0.0.0/0 ctstate NEW,RELATED,ESTABLISHED > Exactly, that's the one that is opening the access to the untrusted network by default, and in contradiction to what the documentation says. So should I open a bug report on https://bugzilla.novell.com/ ? Cheers, -- JLB -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 2

[opensuse-security] FW_MASQUERADE default behavior ?
by Juan Luis Baptiste 24 Apr '13

24 Apr '13

Hi, I'm trying to enable masquerading on a server to allow some internal hosts to access the internet. From reading the included EXAMPLES file and the documentation of SuSEfirewall2 I have setup the following variables: FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.10.0/24" But just setting FW_MASQUERADE="yes" will open up access to the internet to all of the internal network. For what I have read, this shouldn't be the correct behavior because then FW_MASQ_NETS wouldn't have much sense. For now, to be able to block access to the internet to the entire network I have to do it like this: FW_MASQ_NETS="!0/0 192.168.10.0/24" Then it works, access to all subnets is disallowed and then I allow the subnet I want. AFAIK this shouldn't be necessary, access to the internet shouldn't be allowed by default. I'm missing something ? this is on opensuse 12.1. Cheers, -- JLB -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

3 6

[opensuse-security] Re: [security-announce] SUSE-SU-2013:0609-1: important: Security update for rubygem-json_pure
by Wojciech Lisiewicz 06 Apr '13

06 Apr '13

Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 03.04.2013 um 20:08 schrieb opensuse-security(a)opensuse.org: > SUSE Security Update: Security update for rubygem-json_pure > ______________________________________________________________________________ > > Announcement ID: SUSE-SU-2013:0609-1 > Rating: important > References: #803342 > Cross-References: CVE-2013-0269 > Affected Products: > WebYaST 1.2 > SUSE Studio Standard Edition 1.2 > SUSE Studio Extension for System z 1.2 > ______________________________________________________________________________ > > An update that fixes one vulnerability is now available. > > Description: > > > The json_pure Ruby Gem has been updated to fix a Denial of > Service and Unsafe Object Creation vulnerability in JSON > (CVE-2013-0269) > > Additional fixes: > > * Entity expansion DoS vulnerability in REXML (XML bomb) > > Security Issue reference: > > * CVE-2013-0269 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0269 > > > > Patch Instructions: > > To install this SUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - WebYaST 1.2: > > zypper in -t patch slewyst12-rubygem-json_pure-7486 > > - SUSE Studio Standard Edition 1.2: > > zypper in -t patch sleslms12-rubygem-json_pure-7486 > > - SUSE Studio Extension for System z 1.2: > > zypper in -t patch slestso12-rubygem-json_pure-7486 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - WebYaST 1.2 (i586 ia64 ppc64 s390x x86_64): > > rubygem-json_pure-1.2.0-0.4.1 > > - SUSE Studio Standard Edition 1.2 (x86_64): > > rubygem-json_pure-1.2.0-0.4.1 > > - SUSE Studio Extension for System z 1.2 (s390x): > > rubygem-json_pure-1.2.0-0.4.1 > > > References: > > http://support.novell.com/security/cve/CVE-2013-0269.html > https://bugzilla.novell.com/803342 > http://download.novell.com/patch/finder/?keywords=231bb11d5d47466d339ecd1ec… > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org >

5 8

[opensuse-security] Re: [security-announce] SUSE-SU-2013:0633-1: important: Security update for PostgreSQL
by Wojciech Lisiewicz 05 Apr '13

05 Apr '13

Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 05.04.2013 um 19:06 schrieb opensuse-security(a)opensuse.org: > SUSE Security Update: Security update for PostgreSQL > ______________________________________________________________________________ > > Announcement ID: SUSE-SU-2013:0633-1 > Rating: important > References: #812525 > Cross-References: CVE-2013-1899 CVE-2013-1900 CVE-2013-1901 > > Affected Products: > SUSE Studio Onsite 1.3 > SUSE Linux Enterprise Software Development Kit 11 SP2 > SUSE Linux Enterprise Server 11 SP2 for VMware > SUSE Linux Enterprise Server 11 SP2 > SUSE Linux Enterprise Desktop 11 SP2 > ______________________________________________________________________________ > > An update that fixes three vulnerabilities is now > available. It includes one version update. > > Description: > > > This update to version 9.1.9 fixes: > > * CVE-2013-1899: Fix insecure parsing of server > command-line switches. > * CVE-2013-1900: Reset OpenSSL randomness state in each > postmaster child process. > * CVE-2013-1901: Make REPLICATION privilege checks test > current user not authenticated user. > > Security Issue references: > > * CVE-2013-1899 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899 > > * CVE-2013-1900 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900 > > * CVE-2013-1901 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901 > > > > Patch Instructions: > > To install this SUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - SUSE Studio Onsite 1.3: > > zypper in -t patch slestso13-libecpg6-7585 > > - SUSE Linux Enterprise Software Development Kit 11 SP2: > > zypper in -t patch sdksp2-libecpg6-7585 > > - SUSE Linux Enterprise Server 11 SP2 for VMware: > > zypper in -t patch slessp2-libecpg6-7585 > > - SUSE Linux Enterprise Server 11 SP2: > > zypper in -t patch slessp2-libecpg6-7585 > > - SUSE Linux Enterprise Desktop 11 SP2: > > zypper in -t patch sledsp2-libecpg6-7585 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - SUSE Studio Onsite 1.3 (x86_64): > > libecpg6-9.1.9-0.3.1 > postgresql91-devel-9.1.9-0.3.1 > > - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.1.9]: > > postgresql91-devel-9.1.9-0.3.1 > > - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 9.1.9]: > > libecpg6-9.1.9-0.3.1 > libpq5-9.1.9-0.3.1 > postgresql91-9.1.9-0.3.1 > postgresql91-contrib-9.1.9-0.3.1 > postgresql91-docs-9.1.9-0.3.1 > postgresql91-server-9.1.9-0.3.1 > > - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 9.1.9]: > > libpq5-32bit-9.1.9-0.3.1 > > - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.1.9]: > > libecpg6-9.1.9-0.3.1 > libpq5-9.1.9-0.3.1 > postgresql91-9.1.9-0.3.1 > postgresql91-contrib-9.1.9-0.3.1 > postgresql91-docs-9.1.9-0.3.1 > postgresql91-server-9.1.9-0.3.1 > > - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 9.1.9]: > > libpq5-32bit-9.1.9-0.3.1 > > - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 9.1.9]: > > libpq5-x86-9.1.9-0.3.1 > > - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 9.1.9]: > > libecpg6-9.1.9-0.3.1 > libpq5-9.1.9-0.3.1 > postgresql91-9.1.9-0.3.1 > > - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 9.1.9]: > > libpq5-32bit-9.1.9-0.3.1 > > > References: > > http://support.novell.com/security/cve/CVE-2013-1899.html > http://support.novell.com/security/cve/CVE-2013-1900.html > http://support.novell.com/security/cve/CVE-2013-1901.html > https://bugzilla.novell.com/812525 > http://download.novell.com/patch/finder/?keywords=0b64ee73ca3435028350ef022… > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org >

1 0

[opensuse-security] Re: [security-announce] openSUSE-SU-2013:0631-1: important: Mozilla Firefox and others: Update to 20.0/17.0.5 releases
by Wojciech Lisiewicz 05 Apr '13

05 Apr '13

Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 05.04.2013 um 18:06 schrieb opensuse-security(a)opensuse.org: > openSUSE Security Update: Mozilla Firefox and others: Update to 20.0/17.0.5 releases > ______________________________________________________________________________ > > Announcement ID: openSUSE-SU-2013:0631-1 > Rating: important > References: #813026 > Cross-References: CVE-2013-0788 CVE-2013-0789 CVE-2013-0792 > CVE-2013-0793 CVE-2013-0794 CVE-2013-0795 > CVE-2013-0796 CVE-2013-0800 > Affected Products: > openSUSE 11.4 > ______________________________________________________________________________ > > An update that fixes 8 vulnerabilities is now available. > > Description: > > The Mozilla suite received security and bugfix updates: > > Firefox was updated to version 20.0. Thunderbird was > updated to version 17.0.5. Seamonkey was updated to version > 2.17 mozilla-nss was updated to version 3.14.3. > mozilla-nspr was updated to version 4.9.6. > > mozilla-nspr was updated to version 4.9.6: > * aarch64 support > * added PL_SizeOfArenaPoolExcludingPool function > (bmo#807883) > * Auto detect android api version for x86 (bmo#782214) > * Initialize Windows CRITICAL_SECTIONs without debug info > and with nonzero spin count (bmo#812085) Previous update > to version 4.9.5 > * bmo#634793: define NSPR's exact-width integer types > PRInt{N} and PRUint{N} types to match the <stdint.h> > exact-width integer types int{N}_t and uint{N}_t. > * bmo#782815: passing 'int *' to parameter of type > 'unsigned int *' in setsockopt(). > * bmo#822932: Port bmo#802527 (NDK r8b support for x86) to > NSPR. > * bmo#824742: NSPR shouldn't require librt on Android. > * bmo#831793: data race on lib->refCount in > PR_UnloadLibrary. > > mozilla-nss was updated to version 3.14.3: > * disable tests with expired certificates > * add SEC_PKCS7VerifyDetachedSignatureAtTime using patch > from mozilla tree to fulfill Firefox 21 requirements > > * No new major functionality is introduced in this release. > This release is a patch release to address CVE-2013-1620 > (bmo#822365) > * "certutil -a" was not correctly producing ASCII output as > requested. (bmo#840714) > * NSS 3.14.2 broke compilation with older versions of > sqlite that lacked the SQLITE_FCNTL_TEMPFILENAME file > control. NSS 3.14.3 now properly compiles when used with > older versions of sqlite (bmo#837799) - remove > system-sqlite.patch > * add aarch64 support > > * added system-sqlite.patch (bmo#837799) > * do not depend on latest sqlite just for a #define > * enable system sqlite usage again > > * update to 3.14.2 > * required for Firefox >= 20 > * removed obsolete nssckbi update patch > * MFSA 2013-40/CVE-2013-0791 (bmo#629816) Out-of-bounds > array read in CERT_DecodeCertPackage > * disable system sqlite usage since we depend on 3.7.15 > which is not provided in any openSUSE distribution > * add nss-sqlitename.patch to avoid any name clash > > Changes in MozillaFirefox: > - update to Firefox 20.0 (bnc#813026) > * requires NSPR 4.9.5 and NSS 3.14.3 > * MFSA 2013-30/CVE-2013-0788/CVE-2013-0789 Miscellaneous > memory safety hazards > * MFSA 2013-31/CVE-2013-0800 (bmo#825721) Out-of-bounds > write in Cairo library > * MFSA 2013-35/CVE-2013-0796 (bmo#827106) WebGL crash > with Mesa graphics driver on Linux > * MFSA 2013-36/CVE-2013-0795 (bmo#825697) Bypass of SOW > protections allows cloning of protected nodes > * MFSA 2013-37/CVE-2013-0794 (bmo#626775) Bypass of > tab-modal dialog origin disclosure > * MFSA 2013-38/CVE-2013-0793 (bmo#803870) Cross-site > scripting (XSS) using timed history navigations > * MFSA 2013-39/CVE-2013-0792 (bmo#722831) Memory > corruption while rendering grayscale PNG images > - use GStreamer 1.0 starting with 12.3 > (mozilla-gstreamer-1.patch) > - build fixes for armv7hl: > * disable debug build as armv7hl does not have enough > memory > * disable webrtc on armv7hl as it is non-compiling > > Changes in MozillaThunderbird: > - update to Thunderbird 17.0.5 (bnc#813026) > * requires NSPR 4.9.5 and NSS 3.14.3 > * MFSA 2013-30/CVE-2013-0788/CVE-2013-0789 Miscellaneous > memory safety hazards > * MFSA 2013-31/CVE-2013-0800 (bmo#825721) Out-of-bounds > write in Cairo library > * MFSA 2013-35/CVE-2013-0796 (bmo#827106) WebGL crash > with Mesa graphics driver on Linux > * MFSA 2013-36/CVE-2013-0795 (bmo#825697) Bypass of SOW > protections allows cloning of protected nodes > * MFSA 2013-38/CVE-2013-0793 (bmo#803870) Cross-site > scripting (XSS) using timed history navigations > > Changes in seamonkey: > - update to SeaMonkey 2.17 (bnc#813026) > * requires NSPR 4.9.5 and NSS 3.14.3 > * MFSA 2013-30/CVE-2013-0788/CVE-2013-0789 Miscellaneous > memory safety hazards > * MFSA 2013-31/CVE-2013-0800 (bmo#825721) Out-of-bounds > write in Cairo library > * MFSA 2013-35/CVE-2013-0796 (bmo#827106) WebGL crash > with Mesa graphics driver on Linux > * MFSA 2013-36/CVE-2013-0795 (bmo#825697) Bypass of SOW > protections allows cloning of protected nodes > * MFSA 2013-37/CVE-2013-0794 (bmo#626775) Bypass of > tab-modal dialog origin disclosure > * MFSA 2013-38/CVE-2013-0793 (bmo#803870) Cross-site > scripting (XSS) using timed history navigations > * MFSA 2013-39/CVE-2013-0792 (bmo#722831) Memory > corruption while rendering grayscale PNG images > - use GStreamer 1.0 starting with 12.3 > (mozilla-gstreamer-1.patch) > > > Patch Instructions: > > To install this openSUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - openSUSE 11.4: > > zypper in -t patch 2013-58 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - openSUSE 11.4 (i586 x86_64): > > MozillaFirefox-20.0-69.1 > MozillaFirefox-branding-upstream-20.0-69.1 > MozillaFirefox-buildsymbols-20.0-69.1 > MozillaFirefox-debuginfo-20.0-69.1 > MozillaFirefox-debugsource-20.0-69.1 > MozillaFirefox-devel-20.0-69.1 > MozillaFirefox-translations-common-20.0-69.1 > MozillaFirefox-translations-other-20.0-69.1 > MozillaThunderbird-17.0.5-57.1 > MozillaThunderbird-buildsymbols-17.0.5-57.1 > MozillaThunderbird-debuginfo-17.0.5-57.1 > MozillaThunderbird-debugsource-17.0.5-57.1 > MozillaThunderbird-devel-17.0.5-57.1 > MozillaThunderbird-devel-debuginfo-17.0.5-57.1 > MozillaThunderbird-translations-common-17.0.5-57.1 > MozillaThunderbird-translations-other-17.0.5-57.1 > enigmail-1.5.1+17.0.5-57.1 > enigmail-debuginfo-1.5.1+17.0.5-57.1 > libfreebl3-3.14.3-58.1 > libfreebl3-debuginfo-3.14.3-58.1 > libsoftokn3-3.14.3-58.1 > libsoftokn3-debuginfo-3.14.3-58.1 > mozilla-nspr-4.9.6-24.1 > mozilla-nspr-debuginfo-4.9.6-24.1 > mozilla-nspr-debugsource-4.9.6-24.1 > mozilla-nspr-devel-4.9.6-24.1 > mozilla-nss-3.14.3-58.1 > mozilla-nss-certs-3.14.3-58.1 > mozilla-nss-certs-debuginfo-3.14.3-58.1 > mozilla-nss-debuginfo-3.14.3-58.1 > mozilla-nss-debugsource-3.14.3-58.1 > mozilla-nss-devel-3.14.3-58.1 > mozilla-nss-sysinit-3.14.3-58.1 > mozilla-nss-sysinit-debuginfo-3.14.3-58.1 > mozilla-nss-tools-3.14.3-58.1 > mozilla-nss-tools-debuginfo-3.14.3-58.1 > seamonkey-2.17-61.1 > seamonkey-debuginfo-2.17-61.1 > seamonkey-debugsource-2.17-61.1 > seamonkey-dom-inspector-2.17-61.1 > seamonkey-irc-2.17-61.1 > seamonkey-translations-common-2.17-61.1 > seamonkey-translations-other-2.17-61.1 > seamonkey-venkman-2.17-61.1 > > - openSUSE 11.4 (x86_64): > > libfreebl3-32bit-3.14.3-58.1 > libfreebl3-debuginfo-32bit-3.14.3-58.1 > libsoftokn3-32bit-3.14.3-58.1 > libsoftokn3-debuginfo-32bit-3.14.3-58.1 > mozilla-nspr-32bit-4.9.6-24.1 > mozilla-nspr-debuginfo-32bit-4.9.6-24.1 > mozilla-nss-32bit-3.14.3-58.1 > mozilla-nss-certs-32bit-3.14.3-58.1 > mozilla-nss-certs-debuginfo-32bit-3.14.3-58.1 > mozilla-nss-debuginfo-32bit-3.14.3-58.1 > mozilla-nss-sysinit-32bit-3.14.3-58.1 > mozilla-nss-sysinit-debuginfo-32bit-3.14.3-58.1 > > - openSUSE 11.4 (ia64): > > libfreebl3-debuginfo-x86-3.14.3-58.1 > libfreebl3-x86-3.14.3-58.1 > libsoftokn3-debuginfo-x86-3.14.3-58.1 > libsoftokn3-x86-3.14.3-58.1 > mozilla-nspr-debuginfo-x86-4.9.6-24.1 > mozilla-nspr-x86-4.9.6-24.1 > mozilla-nss-certs-debuginfo-x86-3.14.3-58.1 > mozilla-nss-certs-x86-3.14.3-58.1 > mozilla-nss-debuginfo-x86-3.14.3-58.1 > mozilla-nss-sysinit-debuginfo-x86-3.14.3-58.1 > mozilla-nss-sysinit-x86-3.14.3-58.1 > mozilla-nss-x86-3.14.3-58.1 > > > References: > > http://support.novell.com/security/cve/CVE-2013-0788.html > http://support.novell.com/security/cve/CVE-2013-0789.html > http://support.novell.com/security/cve/CVE-2013-0792.html > http://support.novell.com/security/cve/CVE-2013-0793.html > http://support.novell.com/security/cve/CVE-2013-0794.html > http://support.novell.com/security/cve/CVE-2013-0795.html > http://support.novell.com/security/cve/CVE-2013-0796.html > http://support.novell.com/security/cve/CVE-2013-0800.html > https://bugzilla.novell.com/813026 > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org > -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] Re: [security-announce] openSUSE-SU-2013:0630-1: important: Mozilla Firefox and others: Update to Firefox 20.0 release
by Wojciech Lisiewicz 05 Apr '13

05 Apr '13

Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 05.04.2013 um 15:06 schrieb opensuse-security(a)opensuse.org: > openSUSE Security Update: Mozilla Firefox and others: Update to Firefox 20.0 release > ______________________________________________________________________________ > > Announcement ID: openSUSE-SU-2013:0630-1 > Rating: important > References: #813026 > Cross-References: CVE-2013-0788 CVE-2013-0789 CVE-2013-0791 > CVE-2013-0792 CVE-2013-0793 CVE-2013-0794 > CVE-2013-0795 CVE-2013-0796 CVE-2013-0800 > CVE-2013-1620 > Affected Products: > openSUSE 12.3 > openSUSE 12.2 > openSUSE 12.1 > ______________________________________________________________________________ > > An update that fixes 10 vulnerabilities is now available. > > Description: > > > The Mozilla suite received security and bugfix updates: > > Mozilla Firefox was updated to version 20.0. Mozilla > Thunderbird was updated to version 17.0.5. Mozilla > Seamonkey was updated to version 17.0.5. Mozilla XULRunner > was updated to version 17.0.5. mozilla-nss was updated to > version 3.14.3. mozilla-nspr was updated to version 4.9.6. > > mozilla-nspr was updated to version 4.9.6: > * aarch64 support > * added PL_SizeOfArenaPoolExcludingPool function > (bmo#807883) > * Auto detect android api version for x86 (bmo#782214) > * Initialize Windows CRITICAL_SECTIONs without debug info > and with nonzero spin count (bmo#812085) Previous update > to version 4.9.5 > * bmo#634793: define NSPR's exact-width integer types > PRInt{N} and PRUint{N} types to match the <stdint.h> > exact-width integer types int{N}_t and uint{N}_t. > * bmo#782815: passing 'int *' to parameter of type > 'unsigned int *' in setsockopt(). > * bmo#822932: Port bmo#802527 (NDK r8b support for x86) to > NSPR. > * bmo#824742: NSPR shouldn't require librt on Android. > * bmo#831793: data race on lib->refCount in > PR_UnloadLibrary. > > mozilla-nss was updated to version 3.14.3: > * disable tests with expired certificates > * add SEC_PKCS7VerifyDetachedSignatureAtTime using patch > from mozilla tree to fulfill Firefox 21 requirements > > * No new major functionality is introduced in this release. > This release is a patch release to address CVE-2013-1620 > (bmo#822365) > * "certutil -a" was not correctly producing ASCII output as > requested. (bmo#840714) > * NSS 3.14.2 broke compilation with older versions of > sqlite that lacked the SQLITE_FCNTL_TEMPFILENAME file > control. NSS 3.14.3 now properly compiles when used with > older versions of sqlite (bmo#837799) - remove > system-sqlite.patch > * add arm aarch64 support > > * added system-sqlite.patch (bmo#837799) > * do not depend on latest sqlite just for a #define > * enable system sqlite usage again > > * update to 3.14.2 > * required for Firefox >= 20 > * removed obsolete nssckbi update patch > * MFSA 2013-40/CVE-2013-0791 (bmo#629816) Out-of-bounds > array read in CERT_DecodeCertPackage > * disable system sqlite usage since we depend on 3.7.15 > which is not provided in any openSUSE distribution > * add nss-sqlitename.patch to avoid any name clash > > Changes in MozillaFirefox: > - update to Firefox 20.0 (bnc#813026) > * requires NSPR 4.9.5 and NSS 3.14.3 > * MFSA 2013-30/CVE-2013-0788/CVE-2013-0789 Miscellaneous > memory safety hazards > * MFSA 2013-31/CVE-2013-0800 (bmo#825721) Out-of-bounds > write in Cairo library > * MFSA 2013-35/CVE-2013-0796 (bmo#827106) WebGL crash > with Mesa graphics driver on Linux > * MFSA 2013-36/CVE-2013-0795 (bmo#825697) Bypass of SOW > protections allows cloning of protected nodes > * MFSA 2013-37/CVE-2013-0794 (bmo#626775) Bypass of > tab-modal dialog origin disclosure > * MFSA 2013-38/CVE-2013-0793 (bmo#803870) Cross-site > scripting (XSS) using timed history navigations > * MFSA 2013-39/CVE-2013-0792 (bmo#722831) Memory > corruption while rendering grayscale PNG images > - use GStreamer 1.0 starting with 12.3 > (mozilla-gstreamer-1.patch) > - build fixes for armv7hl: > * disable debug build as armv7hl does not have enough > memory > * disable webrtc on armv7hl as it is non-compiling > > Changes in MozillaThunderbird: > - update to Thunderbird 17.0.5 (bnc#813026) > * requires NSPR 4.9.5 and NSS 3.14.3 > * MFSA 2013-30/CVE-2013-0788/CVE-2013-0789 Miscellaneous > memory safety hazards > * MFSA 2013-31/CVE-2013-0800 (bmo#825721) Out-of-bounds > write in Cairo library > * MFSA 2013-35/CVE-2013-0796 (bmo#827106) WebGL crash > with Mesa graphics driver on Linux > * MFSA 2013-36/CVE-2013-0795 (bmo#825697) Bypass of SOW > protections allows cloning of protected nodes > * MFSA 2013-38/CVE-2013-0793 (bmo#803870) Cross-site > scripting (XSS) using timed history navigations > > Changes in seamonkey: > - update to SeaMonkey 2.17 (bnc#813026) > * requires NSPR 4.9.5 and NSS 3.14.3 > * MFSA 2013-30/CVE-2013-0788/CVE-2013-0789 Miscellaneous > memory safety hazards > * MFSA 2013-31/CVE-2013-0800 (bmo#825721) Out-of-bounds > write in Cairo library > * MFSA 2013-35/CVE-2013-0796 (bmo#827106) WebGL crash > with Mesa graphics driver on Linux > * MFSA 2013-36/CVE-2013-0795 (bmo#825697) Bypass of SOW > protections allows cloning of protected nodes > * MFSA 2013-37/CVE-2013-0794 (bmo#626775) Bypass of > tab-modal dialog origin disclosure > * MFSA 2013-38/CVE-2013-0793 (bmo#803870) Cross-site > scripting (XSS) using timed history navigations > * MFSA 2013-39/CVE-2013-0792 (bmo#722831) Memory > corruption while rendering grayscale PNG images > - use GStreamer 1.0 starting with 12.3 > (mozilla-gstreamer-1.patch) > > Changes in xulrunner: > - update to 17.0.5esr (bnc#813026) > * requires NSPR 4.9.5 and NSS 3.14.3 > * MFSA 2013-30/CVE-2013-0788 Miscellaneous memory safety > hazards > * MFSA 2013-31/CVE-2013-0800 (bmo#825721) Out-of-bounds > write in Cairo library > * MFSA 2013-35/CVE-2013-0796 (bmo#827106) WebGL crash > with Mesa graphics driver on Linux > * MFSA 2013-36/CVE-2013-0795 (bmo#825697) Bypass of SOW > protections allows cloning of protected nodes > * MFSA 2013-37/CVE-2013-0794 (bmo#626775) Bypass of > tab-modal dialog origin disclosure > * MFSA 2013-38/CVE-2013-0793 (bmo#803870) Cross-site > scripting (XSS) using timed history navigations > > > Patch Instructions: > > To install this openSUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - openSUSE 12.3: > > zypper in -t patch openSUSE-2013-309 > > - openSUSE 12.2: > > zypper in -t patch openSUSE-2013-309 > > - openSUSE 12.1: > > zypper in -t patch openSUSE-2013-309 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - openSUSE 12.3 (i586 x86_64): > > MozillaFirefox-20.0-1.8.3 > MozillaFirefox-branding-upstream-20.0-1.8.3 > MozillaFirefox-buildsymbols-20.0-1.8.3 > MozillaFirefox-debuginfo-20.0-1.8.3 > MozillaFirefox-debugsource-20.0-1.8.3 > MozillaFirefox-devel-20.0-1.8.3 > MozillaFirefox-translations-common-20.0-1.8.3 > MozillaFirefox-translations-other-20.0-1.8.3 > MozillaThunderbird-17.0.5-61.9.4 > MozillaThunderbird-buildsymbols-17.0.5-61.9.4 > MozillaThunderbird-debuginfo-17.0.5-61.9.4 > MozillaThunderbird-debugsource-17.0.5-61.9.4 > MozillaThunderbird-devel-17.0.5-61.9.4 > MozillaThunderbird-devel-debuginfo-17.0.5-61.9.4 > MozillaThunderbird-translations-common-17.0.5-61.9.4 > MozillaThunderbird-translations-other-17.0.5-61.9.4 > enigmail-1.5.1+17.0.5-61.9.4 > enigmail-debuginfo-1.5.1+17.0.5-61.9.4 > libfreebl3-3.14.3-1.8.1 > libfreebl3-debuginfo-3.14.3-1.8.1 > libsoftokn3-3.14.3-1.8.1 > libsoftokn3-debuginfo-3.14.3-1.8.1 > mozilla-js-17.0.5-1.8.3 > mozilla-js-debuginfo-17.0.5-1.8.3 > mozilla-nspr-4.9.6-1.4.1 > mozilla-nspr-debuginfo-4.9.6-1.4.1 > mozilla-nspr-debugsource-4.9.6-1.4.1 > mozilla-nspr-devel-4.9.6-1.4.1 > mozilla-nss-3.14.3-1.8.1 > mozilla-nss-certs-3.14.3-1.8.1 > mozilla-nss-certs-debuginfo-3.14.3-1.8.1 > mozilla-nss-debuginfo-3.14.3-1.8.1 > mozilla-nss-debugsource-3.14.3-1.8.1 > mozilla-nss-devel-3.14.3-1.8.1 > mozilla-nss-sysinit-3.14.3-1.8.1 > mozilla-nss-sysinit-debuginfo-3.14.3-1.8.1 > mozilla-nss-tools-3.14.3-1.8.1 > mozilla-nss-tools-debuginfo-3.14.3-1.8.1 > xulrunner-17.0.5-1.8.3 > xulrunner-buildsymbols-17.0.5-1.8.3 > xulrunner-debuginfo-17.0.5-1.8.3 > xulrunner-debugsource-17.0.5-1.8.3 > xulrunner-devel-17.0.5-1.8.3 > xulrunner-devel-debuginfo-17.0.5-1.8.3 > > - openSUSE 12.3 (x86_64): > > libfreebl3-32bit-3.14.3-1.8.1 > libfreebl3-debuginfo-32bit-3.14.3-1.8.1 > libsoftokn3-32bit-3.14.3-1.8.1 > libsoftokn3-debuginfo-32bit-3.14.3-1.8.1 > mozilla-js-32bit-17.0.5-1.8.3 > mozilla-js-debuginfo-32bit-17.0.5-1.8.3 > mozilla-nspr-32bit-4.9.6-1.4.1 > mozilla-nspr-debuginfo-32bit-4.9.6-1.4.1 > mozilla-nss-32bit-3.14.3-1.8.1 > mozilla-nss-certs-32bit-3.14.3-1.8.1 > mozilla-nss-certs-debuginfo-32bit-3.14.3-1.8.1 > mozilla-nss-debuginfo-32bit-3.14.3-1.8.1 > mozilla-nss-sysinit-32bit-3.14.3-1.8.1 > mozilla-nss-sysinit-debuginfo-32bit-3.14.3-1.8.1 > xulrunner-32bit-17.0.5-1.8.3 > xulrunner-debuginfo-32bit-17.0.5-1.8.3 > > - openSUSE 12.2 (i586 x86_64): > > MozillaFirefox-20.0-2.41.3 > MozillaFirefox-branding-upstream-20.0-2.41.3 > MozillaFirefox-buildsymbols-20.0-2.41.3 > MozillaFirefox-debuginfo-20.0-2.41.3 > MozillaFirefox-debugsource-20.0-2.41.3 > MozillaFirefox-devel-20.0-2.41.3 > MozillaFirefox-translations-common-20.0-2.41.3 > MozillaFirefox-translations-other-20.0-2.41.3 > MozillaThunderbird-17.0.5-49.39.3 > MozillaThunderbird-buildsymbols-17.0.5-49.39.3 > MozillaThunderbird-debuginfo-17.0.5-49.39.3 > MozillaThunderbird-debugsource-17.0.5-49.39.3 > MozillaThunderbird-devel-17.0.5-49.39.3 > MozillaThunderbird-devel-debuginfo-17.0.5-49.39.3 > MozillaThunderbird-translations-common-17.0.5-49.39.3 > MozillaThunderbird-translations-other-17.0.5-49.39.3 > enigmail-1.5.1+17.0.5-49.39.3 > enigmail-debuginfo-1.5.1+17.0.5-49.39.3 > libfreebl3-3.14.3-2.19.2 > libfreebl3-debuginfo-3.14.3-2.19.2 > libsoftokn3-3.14.3-2.19.2 > libsoftokn3-debuginfo-3.14.3-2.19.2 > mozilla-js-17.0.5-2.38.2 > mozilla-js-debuginfo-17.0.5-2.38.2 > mozilla-nspr-4.9.6-1.12.1 > mozilla-nspr-debuginfo-4.9.6-1.12.1 > mozilla-nspr-debugsource-4.9.6-1.12.1 > mozilla-nspr-devel-4.9.6-1.12.1 > mozilla-nss-3.14.3-2.19.2 > mozilla-nss-certs-3.14.3-2.19.2 > mozilla-nss-certs-debuginfo-3.14.3-2.19.2 > mozilla-nss-debuginfo-3.14.3-2.19.2 > mozilla-nss-debugsource-3.14.3-2.19.2 > mozilla-nss-devel-3.14.3-2.19.2 > mozilla-nss-sysinit-3.14.3-2.19.2 > mozilla-nss-sysinit-debuginfo-3.14.3-2.19.2 > mozilla-nss-tools-3.14.3-2.19.2 > mozilla-nss-tools-debuginfo-3.14.3-2.19.2 > xulrunner-17.0.5-2.38.2 > xulrunner-buildsymbols-17.0.5-2.38.2 > xulrunner-debuginfo-17.0.5-2.38.2 > xulrunner-debugsource-17.0.5-2.38.2 > xulrunner-devel-17.0.5-2.38.2 > xulrunner-devel-debuginfo-17.0.5-2.38.2 > > - openSUSE 12.2 (x86_64): > > libfreebl3-32bit-3.14.3-2.19.2 > libfreebl3-debuginfo-32bit-3.14.3-2.19.2 > libsoftokn3-32bit-3.14.3-2.19.2 > libsoftokn3-debuginfo-32bit-3.14.3-2.19.2 > mozilla-js-32bit-17.0.5-2.38.2 > mozilla-js-debuginfo-32bit-17.0.5-2.38.2 > mozilla-nspr-32bit-4.9.6-1.12.1 > mozilla-nspr-debuginfo-32bit-4.9.6-1.12.1 > mozilla-nss-32bit-3.14.3-2.19.2 > mozilla-nss-certs-32bit-3.14.3-2.19.2 > mozilla-nss-certs-debuginfo-32bit-3.14.3-2.19.2 > mozilla-nss-debuginfo-32bit-3.14.3-2.19.2 > mozilla-nss-sysinit-32bit-3.14.3-2.19.2 > mozilla-nss-sysinit-debuginfo-32bit-3.14.3-2.19.2 > xulrunner-32bit-17.0.5-2.38.2 > xulrunner-debuginfo-32bit-17.0.5-2.38.2 > > - openSUSE 12.1 (i586 x86_64): > > MozillaFirefox-20.0-2.70.3 > MozillaFirefox-branding-upstream-20.0-2.70.3 > MozillaFirefox-buildsymbols-20.0-2.70.3 > MozillaFirefox-debuginfo-20.0-2.70.3 > MozillaFirefox-debugsource-20.0-2.70.3 > MozillaFirefox-devel-20.0-2.70.3 > MozillaFirefox-translations-common-20.0-2.70.3 > MozillaFirefox-translations-other-20.0-2.70.3 > MozillaThunderbird-17.0.5-33.59.3 > MozillaThunderbird-buildsymbols-17.0.5-33.59.3 > MozillaThunderbird-debuginfo-17.0.5-33.59.3 > MozillaThunderbird-debugsource-17.0.5-33.59.3 > MozillaThunderbird-devel-17.0.5-33.59.3 > MozillaThunderbird-devel-debuginfo-17.0.5-33.59.3 > MozillaThunderbird-translations-common-17.0.5-33.59.3 > MozillaThunderbird-translations-other-17.0.5-33.59.3 > enigmail-1.5.1+17.0.5-33.59.3 > enigmail-debuginfo-1.5.1+17.0.5-33.59.3 > libfreebl3-3.14.3-9.29.2 > libfreebl3-debuginfo-3.14.3-9.29.2 > libsoftokn3-3.14.3-9.29.2 > libsoftokn3-debuginfo-3.14.3-9.29.2 > mozilla-js-17.0.5-2.65.2 > mozilla-js-debuginfo-17.0.5-2.65.2 > mozilla-nspr-4.9.6-3.15.1 > mozilla-nspr-debuginfo-4.9.6-3.15.1 > mozilla-nspr-debugsource-4.9.6-3.15.1 > mozilla-nspr-devel-4.9.6-3.15.1 > mozilla-nss-3.14.3-9.29.2 > mozilla-nss-certs-3.14.3-9.29.2 > mozilla-nss-certs-debuginfo-3.14.3-9.29.2 > mozilla-nss-debuginfo-3.14.3-9.29.2 > mozilla-nss-debugsource-3.14.3-9.29.2 > mozilla-nss-devel-3.14.3-9.29.2 > mozilla-nss-sysinit-3.14.3-9.29.2 > mozilla-nss-sysinit-debuginfo-3.14.3-9.29.2 > mozilla-nss-tools-3.14.3-9.29.2 > mozilla-nss-tools-debuginfo-3.14.3-9.29.2 > seamonkey-2.17-2.61.2 > seamonkey-debuginfo-2.17-2.61.2 > seamonkey-debugsource-2.17-2.61.2 > seamonkey-dom-inspector-2.17-2.61.2 > seamonkey-irc-2.17-2.61.2 > seamonkey-translations-common-2.17-2.61.2 > seamonkey-translations-other-2.17-2.61.2 > seamonkey-venkman-2.17-2.61.2 > xulrunner-17.0.5-2.65.2 > xulrunner-buildsymbols-17.0.5-2.65.2 > xulrunner-debuginfo-17.0.5-2.65.2 > xulrunner-debugsource-17.0.5-2.65.2 > xulrunner-devel-17.0.5-2.65.2 > xulrunner-devel-debuginfo-17.0.5-2.65.2 > > - openSUSE 12.1 (x86_64): > > libfreebl3-32bit-3.14.3-9.29.2 > libfreebl3-debuginfo-32bit-3.14.3-9.29.2 > libsoftokn3-32bit-3.14.3-9.29.2 > libsoftokn3-debuginfo-32bit-3.14.3-9.29.2 > mozilla-js-32bit-17.0.5-2.65.2 > mozilla-js-debuginfo-32bit-17.0.5-2.65.2 > mozilla-nspr-32bit-4.9.6-3.15.1 > mozilla-nspr-debuginfo-32bit-4.9.6-3.15.1 > mozilla-nss-32bit-3.14.3-9.29.2 > mozilla-nss-certs-32bit-3.14.3-9.29.2 > mozilla-nss-certs-debuginfo-32bit-3.14.3-9.29.2 > mozilla-nss-debuginfo-32bit-3.14.3-9.29.2 > mozilla-nss-sysinit-32bit-3.14.3-9.29.2 > mozilla-nss-sysinit-debuginfo-32bit-3.14.3-9.29.2 > xulrunner-32bit-17.0.5-2.65.2 > xulrunner-debuginfo-32bit-17.0.5-2.65.2 > > - openSUSE 12.1 (ia64): > > libfreebl3-debuginfo-x86-3.14.3-9.29.2 > libfreebl3-x86-3.14.3-9.29.2 > libsoftokn3-debuginfo-x86-3.14.3-9.29.2 > libsoftokn3-x86-3.14.3-9.29.2 > mozilla-js-debuginfo-x86-17.0.5-2.65.2 > mozilla-js-x86-17.0.5-2.65.2 > mozilla-nspr-debuginfo-x86-4.9.6-3.15.1 > mozilla-nspr-x86-4.9.6-3.15.1 > mozilla-nss-certs-debuginfo-x86-3.14.3-9.29.2 > mozilla-nss-certs-x86-3.14.3-9.29.2 > mozilla-nss-debuginfo-x86-3.14.3-9.29.2 > mozilla-nss-sysinit-debuginfo-x86-3.14.3-9.29.2 > mozilla-nss-sysinit-x86-3.14.3-9.29.2 > mozilla-nss-x86-3.14.3-9.29.2 > xulrunner-debuginfo-x86-17.0.5-2.65.2 > xulrunner-x86-17.0.5-2.65.2 > > > References: > > http://support.novell.com/security/cve/CVE-2013-0788.html > http://support.novell.com/security/cve/CVE-2013-0789.html > http://support.novell.com/security/cve/CVE-2013-0791.html > http://support.novell.com/security/cve/CVE-2013-0792.html > http://support.novell.com/security/cve/CVE-2013-0793.html > http://support.novell.com/security/cve/CVE-2013-0794.html > http://support.novell.com/security/cve/CVE-2013-0795.html > http://support.novell.com/security/cve/CVE-2013-0796.html > http://support.novell.com/security/cve/CVE-2013-0800.html > http://support.novell.com/security/cve/CVE-2013-1620.html > https://bugzilla.novell.com/813026 > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org > -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] Re: [security-announce] openSUSE-SU-2013:0628-1: important: postgresql92: Various security fixes. Update to 9.2.4.
by Wojciech Lisiewicz 05 Apr '13

05 Apr '13

Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 05.04.2013 um 10:04 schrieb opensuse-security(a)opensuse.org: > openSUSE Security Update: postgresql92: Various security fixes. Update to 9.2.4. > ______________________________________________________________________________ > > Announcement ID: openSUSE-SU-2013:0628-1 > Rating: important > References: #812525 > Cross-References: CVE-2013-1899 CVE-2013-1900 CVE-2013-1901 > > Affected Products: > openSUSE 12.3 > ______________________________________________________________________________ > > An update that fixes three vulnerabilities is now available. > > Description: > > > postgresql was updated to version 9.2.4 (bnc#812525): > * CVE-2013-1899: Fix insecure parsing of server > command-line switches. A connection request containing > a database name that begins with "-" could be crafted > to damage or destroy files within the server's data > directory, even if the request is eventually rejected. > * CVE-2013-1900: Reset OpenSSL randomness state in each > postmaster child process. This avoids a scenario > wherein random numbers generated by "contrib/pgcrypto" > functions might be relatively easy for another database > user to guess. The risk is only significant when the > postmaster is configured with ssl = on but most > connections don't use SSL encryption. > * CVE-2013-1901: Make REPLICATION privilege checks test > current user not authenticated user. An unprivileged > database user could exploit this mistake to call > pg_start_backup() or pg_stop_backup(), thus possibly > interfering with creation of routine backups. > * See the release notes for the rest of the changes: > http://www.postgresql.org/docs/9.2/static/release-9-2-4.html > /usr/share/doc/packages/postgresql92/HISTORY > > > Patch Instructions: > > To install this openSUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - openSUSE 12.3: > > zypper in -t patch openSUSE-2013-306 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - openSUSE 12.3 (i586 x86_64): > > postgresql92-9.2.4-1.4.1 > postgresql92-contrib-9.2.4-1.4.1 > postgresql92-contrib-debuginfo-9.2.4-1.4.1 > postgresql92-debuginfo-9.2.4-1.4.1 > postgresql92-debugsource-9.2.4-1.4.1 > postgresql92-plperl-9.2.4-1.4.1 > postgresql92-plperl-debuginfo-9.2.4-1.4.1 > postgresql92-plpython-9.2.4-1.4.1 > postgresql92-plpython-debuginfo-9.2.4-1.4.1 > postgresql92-pltcl-9.2.4-1.4.1 > postgresql92-pltcl-debuginfo-9.2.4-1.4.1 > postgresql92-server-9.2.4-1.4.1 > postgresql92-server-debuginfo-9.2.4-1.4.1 > > - openSUSE 12.3 (noarch): > > postgresql92-docs-9.2.4-1.4.1 > > > References: > > http://support.novell.com/security/cve/CVE-2013-1899.html > http://support.novell.com/security/cve/CVE-2013-1900.html > http://support.novell.com/security/cve/CVE-2013-1901.html > https://bugzilla.novell.com/812525 > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org > -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] Re: [security-announce] openSUSE-SU-2013:0627-1: important: postgresql91 to version 9.1.9.
by Wojciech Lisiewicz 05 Apr '13

05 Apr '13

Sehr geehrte Damen und Herren, wegen eines Auslandsaufenthaltes kann ich die Nachricht vermutlich bis zum 4.4. nicht lesen. In dringenden Fällen stehe ich Ihnen unter +49 177 7902970 telefonisch zur Verfügung. Mit freundlichen Grüßen W. Lisiewicz ------------- Szanowni Państwo, z powodu pobytu za granicą nie będę prawdopodobnie mógł przeczytać Państwa wiadomości do dnia 4.4. W pilnych przypadkach jestem dostępny pod numerem telefonu +49 177 7902970. Pozdrawiam serdecznie W. Lisiewicz Am 05.04.2013 um 10:04 schrieb opensuse-security(a)opensuse.org: > openSUSE Security Update: postgresql91 to version 9.1.9. > ______________________________________________________________________________ > > Announcement ID: openSUSE-SU-2013:0627-1 > Rating: important > References: #812525 > Cross-References: CVE-2013-1899 CVE-2013-1900 CVE-2013-1901 > > Affected Products: > openSUSE 12.2 > openSUSE 12.1 > ______________________________________________________________________________ > > An update that fixes three vulnerabilities is now available. > > Description: > > > postgresql was updated to version 9.1.9 (bnc#812525): > * CVE-2013-1899: Fix insecure parsing of server > command-line switches. A connection request containing > a database name that begins with "-" could be crafted > to damage or destroy files within the server's data > directory, even if the request is eventually rejected. > * CVE-2013-1900: Reset OpenSSL randomness state in each > postmaster child process. This avoids a scenario > wherein random numbers generated by "contrib/pgcrypto" > functions might be relatively easy for another database > user to guess. The risk is only significant when the > postmaster is configured with ssl = on but most > connections don't use SSL encryption. > * CVE-2013-1901: Make REPLICATION privilege checks test > current user not authenticated user. An unprivileged > database user could exploit this mistake to call > pg_start_backup() or pg_stop_backup(), thus possibly > interfering with creation of routine backups. > * See the release notes for the rest of the changes: > http://www.postgresql.org/docs/9.1/static/release-9-1-9.html > /usr/share/doc/packages/postgresql91/HISTORY > > > Patch Instructions: > > To install this openSUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - openSUSE 12.2: > > zypper in -t patch openSUSE-2013-307 > > - openSUSE 12.1: > > zypper in -t patch openSUSE-2013-307 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - openSUSE 12.2 (i586 x86_64): > > libecpg6-9.1.9-20.1 > libecpg6-debuginfo-9.1.9-20.1 > libpq5-9.1.9-20.1 > libpq5-debuginfo-9.1.9-20.1 > postgresql91-9.1.9-20.1 > postgresql91-contrib-9.1.9-20.1 > postgresql91-contrib-debuginfo-9.1.9-20.1 > postgresql91-debuginfo-9.1.9-20.1 > postgresql91-debugsource-9.1.9-20.1 > postgresql91-devel-9.1.9-20.1 > postgresql91-devel-debuginfo-9.1.9-20.1 > postgresql91-libs-debugsource-9.1.9-20.1 > postgresql91-plperl-9.1.9-20.1 > postgresql91-plperl-debuginfo-9.1.9-20.1 > postgresql91-plpython-9.1.9-20.1 > postgresql91-plpython-debuginfo-9.1.9-20.1 > postgresql91-pltcl-9.1.9-20.1 > postgresql91-pltcl-debuginfo-9.1.9-20.1 > postgresql91-server-9.1.9-20.1 > postgresql91-server-debuginfo-9.1.9-20.1 > > - openSUSE 12.2 (x86_64): > > libecpg6-32bit-9.1.9-20.1 > libecpg6-debuginfo-32bit-9.1.9-20.1 > libpq5-32bit-9.1.9-20.1 > libpq5-debuginfo-32bit-9.1.9-20.1 > postgresql91-devel-32bit-9.1.9-20.1 > postgresql91-devel-debuginfo-32bit-9.1.9-20.1 > > - openSUSE 12.2 (noarch): > > postgresql91-docs-9.1.9-20.1 > > - openSUSE 12.1 (i586 x86_64): > > libecpg6-9.1.9-25.1 > libecpg6-debuginfo-9.1.9-25.1 > libpq5-9.1.9-25.1 > libpq5-debuginfo-9.1.9-25.1 > postgresql91-9.1.9-25.1 > postgresql91-contrib-9.1.9-25.1 > postgresql91-contrib-debuginfo-9.1.9-25.1 > postgresql91-debuginfo-9.1.9-25.1 > postgresql91-debugsource-9.1.9-25.1 > postgresql91-devel-9.1.9-25.1 > postgresql91-devel-debuginfo-9.1.9-25.1 > postgresql91-libs-debugsource-9.1.9-25.1 > postgresql91-plperl-9.1.9-25.1 > postgresql91-plperl-debuginfo-9.1.9-25.1 > postgresql91-plpython-9.1.9-25.1 > postgresql91-plpython-debuginfo-9.1.9-25.1 > postgresql91-pltcl-9.1.9-25.1 > postgresql91-pltcl-debuginfo-9.1.9-25.1 > postgresql91-server-9.1.9-25.1 > postgresql91-server-debuginfo-9.1.9-25.1 > > - openSUSE 12.1 (x86_64): > > libecpg6-32bit-9.1.9-25.1 > libecpg6-debuginfo-32bit-9.1.9-25.1 > libpq5-32bit-9.1.9-25.1 > libpq5-debuginfo-32bit-9.1.9-25.1 > postgresql91-devel-32bit-9.1.9-25.1 > postgresql91-devel-debuginfo-32bit-9.1.9-25.1 > > - openSUSE 12.1 (noarch): > > postgresql91-docs-9.1.9-25.1 > > - openSUSE 12.1 (ia64): > > libecpg6-debuginfo-x86-9.1.9-25.1 > libecpg6-x86-9.1.9-25.1 > libpq5-debuginfo-x86-9.1.9-25.1 > libpq5-x86-9.1.9-25.1 > postgresql91-devel-debuginfo-x86-9.1.9-25.1 > > > References: > > http://support.novell.com/security/cve/CVE-2013-1899.html > http://support.novell.com/security/cve/CVE-2013-1900.html > http://support.novell.com/security/cve/CVE-2013-1901.html > https://bugzilla.novell.com/812525 > > -- > To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org > For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org > -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0