October 2010 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2010:0755-1 (important): choqok: Fixed for the new Twitter authentication APIs
by maintenance＠opensuse.org 22 Oct '10

22 Oct '10

openSUSE Recommended Update: choqok: Fixed for the new Twitter authentication APIs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0755-1 Rating: important References: #636217 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This fixes the switch of Twitter to use OAUTH only. - #636217: shipped version of choqok no longer works with Twitter due to removal of http basic auth Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch choqok-3320 - openSUSE 11.2: zypper in -t patch choqok-3320 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): choqok-0.9.90+svn1171227-1.2.1 libqoauth1-1.0.1-2.1.1 qoauth-devel-1.0.1-2.1.1 - openSUSE 11.2 (i586 x86_64): choqok-0.9.90+svn1171227-1.2.1 libqoauth1-1.0.1-2.1.1 qoauth-devel-1.0.1-2.1.1 References: https://bugzilla.novell.com/636217

1 0

openSUSE-SU-2010:0754-1 (critical): java-1_6_0-sun: Security Update to U22
by opensuse-security＠opensuse.org 21 Oct '10

21 Oct '10

openSUSE Security Update: java-1_6_0-sun: Security Update to U22 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0754-1 Rating: critical References: #646073 Cross-References: CVE-2009-3555 CVE-2010-1321 CVE-2010-3541 CVE-2010-3548 CVE-2010-3549 CVE-2010-3550 CVE-2010-3551 CVE-2010-3552 CVE-2010-3553 CVE-2010-3554 CVE-2010-3555 CVE-2010-3556 CVE-2010-3557 CVE-2010-3558 CVE-2010-3559 CVE-2010-3560 CVE-2010-3561 CVE-2010-3562 CVE-2010-3563 CVE-2010-3565 CVE-2010-3566 CVE-2010-3567 CVE-2010-3568 CVE-2010-3569 CVE-2010-3570 CVE-2010-3571 CVE-2010-3572 CVE-2010-3573 CVE-2010-3574 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes 29 vulnerabilities is now available. It includes one version update. Description: Sun Java 1.6.0 was updated to Security Update U22. The release notes for this release are on: http://www.oracle.com/technetwork/java/javase/6u22releasenot es-176121.html Security advisory page for this update: http://www.oracle.com/technetwork/topics/security/javacpuoct 2010-176258.html Following CVEs are tracked by the update: CVE-2010-3556 CVE-2010-3562 CVE-2010-3565 CVE-2010-3566 CVE-2010-3567 CVE-2010-3571 CVE-2010-3554 CVE-2010-3563 CVE-2010-3568 CVE-2010-3569 CVE-2010-3558 CVE-2010-3552 CVE-2010-3559 CVE-2010-3572 CVE-2010-3553 CVE-2010-3555 CVE-2010-3550 CVE-2010-3570 CVE-2010-3561 CVE-2009-3555 CVE-2010-1321 CVE-2010-3549 CVE-2010-3557 CVE-2010-3541 CVE-2010-3573 CVE-2010-3574 CVE-2010-3548 CVE-2010-3551 CVE-2010-3560 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch java-1_6_0-sun-3354 - openSUSE 11.2: zypper in -t patch java-1_6_0-sun-3354 - openSUSE 11.1: zypper in -t patch java-1_6_0-sun-3354 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 1.6.0.u22]: java-1_6_0-sun-1.6.0.u22-1.2.1 java-1_6_0-sun-alsa-1.6.0.u22-1.2.1 java-1_6_0-sun-devel-1.6.0.u22-1.2.1 java-1_6_0-sun-jdbc-1.6.0.u22-1.2.1 java-1_6_0-sun-plugin-1.6.0.u22-1.2.1 java-1_6_0-sun-src-1.6.0.u22-1.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.6.0.u22]: java-1_6_0-sun-1.6.0.u22-1.2.1 java-1_6_0-sun-alsa-1.6.0.u22-1.2.1 java-1_6_0-sun-demo-1.6.0.u22-1.2.1 java-1_6_0-sun-devel-1.6.0.u22-1.2.1 java-1_6_0-sun-jdbc-1.6.0.u22-1.2.1 java-1_6_0-sun-plugin-1.6.0.u22-1.2.1 java-1_6_0-sun-src-1.6.0.u22-1.2.1 - openSUSE 11.1 (i586 x86_64) [New Version: 1.6.0.u22]: java-1_6_0-sun-1.6.0.u22-1.2.1 java-1_6_0-sun-alsa-1.6.0.u22-1.2.1 java-1_6_0-sun-devel-1.6.0.u22-1.2.1 java-1_6_0-sun-jdbc-1.6.0.u22-1.2.1 java-1_6_0-sun-plugin-1.6.0.u22-1.2.1 java-1_6_0-sun-src-1.6.0.u22-1.2.1 References: http://support.novell.com/security/cve/CVE-2009-3555.html http://support.novell.com/security/cve/CVE-2010-1321.html http://support.novell.com/security/cve/CVE-2010-3541.html http://support.novell.com/security/cve/CVE-2010-3548.html http://support.novell.com/security/cve/CVE-2010-3549.html http://support.novell.com/security/cve/CVE-2010-3550.html http://support.novell.com/security/cve/CVE-2010-3551.html http://support.novell.com/security/cve/CVE-2010-3552.html http://support.novell.com/security/cve/CVE-2010-3553.html http://support.novell.com/security/cve/CVE-2010-3554.html http://support.novell.com/security/cve/CVE-2010-3555.html http://support.novell.com/security/cve/CVE-2010-3556.html http://support.novell.com/security/cve/CVE-2010-3557.html http://support.novell.com/security/cve/CVE-2010-3558.html http://support.novell.com/security/cve/CVE-2010-3559.html http://support.novell.com/security/cve/CVE-2010-3560.html http://support.novell.com/security/cve/CVE-2010-3561.html http://support.novell.com/security/cve/CVE-2010-3562.html http://support.novell.com/security/cve/CVE-2010-3563.html http://support.novell.com/security/cve/CVE-2010-3565.html http://support.novell.com/security/cve/CVE-2010-3566.html http://support.novell.com/security/cve/CVE-2010-3567.html http://support.novell.com/security/cve/CVE-2010-3568.html http://support.novell.com/security/cve/CVE-2010-3569.html http://support.novell.com/security/cve/CVE-2010-3570.html http://support.novell.com/security/cve/CVE-2010-3571.html http://support.novell.com/security/cve/CVE-2010-3572.html http://support.novell.com/security/cve/CVE-2010-3573.html http://support.novell.com/security/cve/CVE-2010-3574.html https://bugzilla.novell.com/646073

1 0

openSUSE-RU-2010:0746-1 (important): php5: Fix regression in XML parser.
by maintenance＠opensuse.org 20 Oct '10

20 Oct '10

openSUSE Recommended Update: php5: Fix regression in XML parser. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0746-1 Rating: important References: #642291 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update fixes a regression in the PHP XML parser triggered by the previous security update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch apache2-mod_php5-3261 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64) [New Version: 5.2.14]: apache2-mod_php5-5.2.14-0.2.1 php5-5.2.14-0.2.1 php5-bcmath-5.2.14-0.2.1 php5-bz2-5.2.14-0.2.1 php5-calendar-5.2.14-0.2.1 php5-ctype-5.2.14-0.2.1 php5-curl-5.2.14-0.2.1 php5-dba-5.2.14-0.2.1 php5-dbase-5.2.14-0.2.1 php5-devel-5.2.14-0.2.1 php5-dom-5.2.14-0.2.1 php5-exif-5.2.14-0.2.1 php5-fastcgi-5.2.14-0.2.1 php5-ftp-5.2.14-0.2.1 php5-gd-5.2.14-0.2.1 php5-gettext-5.2.14-0.2.1 php5-gmp-5.2.14-0.2.1 php5-hash-5.2.14-0.2.1 php5-iconv-5.2.14-0.2.1 php5-imap-5.2.14-0.2.1 php5-json-5.2.14-0.2.1 php5-ldap-5.2.14-0.2.1 php5-mbstring-5.2.14-0.2.1 php5-mcrypt-5.2.14-0.2.1 php5-mysql-5.2.14-0.2.1 php5-ncurses-5.2.14-0.2.1 php5-odbc-5.2.14-0.2.1 php5-openssl-5.2.14-0.2.1 php5-pcntl-5.2.14-0.2.1 php5-pdo-5.2.14-0.2.1 php5-pear-5.2.14-0.2.1 php5-pgsql-5.2.14-0.2.1 php5-posix-5.2.14-0.2.1 php5-pspell-5.2.14-0.2.1 php5-readline-5.2.14-0.2.1 php5-shmop-5.2.14-0.2.1 php5-snmp-5.2.14-0.2.1 php5-soap-5.2.14-0.2.1 php5-sockets-5.2.14-0.2.1 php5-sqlite-5.2.14-0.2.1 php5-suhosin-5.2.14-0.2.1 php5-sysvmsg-5.2.14-0.2.1 php5-sysvsem-5.2.14-0.2.1 php5-sysvshm-5.2.14-0.2.1 php5-tidy-5.2.14-0.2.1 php5-tokenizer-5.2.14-0.2.1 php5-wddx-5.2.14-0.2.1 php5-xmlreader-5.2.14-0.2.1 php5-xmlrpc-5.2.14-0.2.1 php5-xmlwriter-5.2.14-0.2.1 php5-xsl-5.2.14-0.2.1 php5-zip-5.2.14-0.2.1 php5-zlib-5.2.14-0.2.1 References: https://bugzilla.novell.com/642291

1 0

openSUSE-RU-2010:0739-1 (moderate): yast2-ldap-server: YaST fails to create a kerberos server configuration. Fixed by this update.
by maintenance＠opensuse.org 19 Oct '10

19 Oct '10

openSUSE Recommended Update: yast2-ldap-server: YaST fails to create a kerberos server configuration. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0739-1 Rating: moderate References: #615805 #619549 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. It includes two new package versions. Description: A backwards incompatible change in the API of yast2-ldap-server caused yast2-kerberos-server to error out when creating a LDAP based kerberos server setup. This updates fixes the API of yast2-ldap-server to be backwards compatible with older versions again. Additionally yast2-kerberos-server was fixed, to use the correct LDAP server name when creating the initial configuration. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch yast2-kerberos-server-2797 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.19.2]: yast2-ldap-server-2.19.2-0.1.1 - openSUSE 11.3 (noarch) [New Version: 2.18.1]: yast2-kerberos-server-2.18.1-0.1.1 References: https://bugzilla.novell.com/615805 https://bugzilla.novell.com/619549

1 0

openSUSE-SU-2010:0738-1 (important): Linux Kernel: security and bugfix update
by opensuse-security＠opensuse.org 18 Oct '10

18 Oct '10

openSUSE Security Update: Linux Kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0738-1 Rating: important References: #614670 #640721 #642009 #644046 Cross-References: CVE-2010-2962 CVE-2010-3310 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. It includes one version update. Description: The updated openSUSE 11.2 kernel fixes the following security bugs: CVE-2010-3310: Local users could corrupt kernel heap memory via ROSE sockets. CVE-2010-2962: Local users could write to any kernel memory location via the i915 GEM ioctl interface. Additionally the update restores the compat_alloc_userspace() inline function and includes several other bug fixes. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch kernel-3323 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64) [New Version: 2.6.31.14]: kernel-debug-2.6.31.14-0.2.1 kernel-debug-base-2.6.31.14-0.2.1 kernel-debug-devel-2.6.31.14-0.2.1 kernel-default-2.6.31.14-0.2.1 kernel-default-base-2.6.31.14-0.2.1 kernel-default-devel-2.6.31.14-0.2.1 kernel-desktop-2.6.31.14-0.2.1 kernel-desktop-base-2.6.31.14-0.2.1 kernel-desktop-devel-2.6.31.14-0.2.1 kernel-syms-2.6.31.14-0.2.1 kernel-trace-2.6.31.14-0.2.1 kernel-trace-base-2.6.31.14-0.2.1 kernel-trace-devel-2.6.31.14-0.2.1 kernel-vanilla-2.6.31.14-0.2.1 kernel-vanilla-base-2.6.31.14-0.2.1 kernel-vanilla-devel-2.6.31.14-0.2.1 kernel-xen-2.6.31.14-0.2.1 kernel-xen-base-2.6.31.14-0.2.1 kernel-xen-devel-2.6.31.14-0.2.1 preload-kmp-default-1.1_2.6.31.14_0.2-6.9.31 preload-kmp-desktop-1.1_2.6.31.14_0.2-6.9.31 - openSUSE 11.2 (noarch) [New Version: 2.6.31.14]: kernel-source-2.6.31.14-0.2.1 kernel-source-vanilla-2.6.31.14-0.2.1 - openSUSE 11.2 (i586) [New Version: 2.6.31.14]: kernel-pae-2.6.31.14-0.2.1 kernel-pae-base-2.6.31.14-0.2.1 kernel-pae-devel-2.6.31.14-0.2.1 References: http://support.novell.com/security/cve/CVE-2010-2962.html http://support.novell.com/security/cve/CVE-2010-3310.html https://bugzilla.novell.com/614670 https://bugzilla.novell.com/640721 https://bugzilla.novell.com/642009 https://bugzilla.novell.com/644046

1 0

openSUSE-SU-2010:0736-1 (moderate): mipv6d security update
by opensuse-security＠opensuse.org 17 Oct '10

17 Oct '10

openSUSE Security Update: mipv6d security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0736-1 Rating: moderate References: #424311 Cross-References: CVE-2010-2522 CVE-2010-2523 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: the mipv6 daemon did not check the origin of netlink messages, therefore allowing local users to spoof messages (CVE-2010-2522). remote attackers could cause buffer overflows in mipv6d (CVE-2010-2523). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch mipv6d-3093 - openSUSE 11.2: zypper in -t patch mipv6d-3093 - openSUSE 11.1: zypper in -t patch mipv6d-3093 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): mipv6d-2.0.2-8.1.1 - openSUSE 11.2 (i586 x86_64): mipv6d-2.0.2-4.1.1 - openSUSE 11.1 (i586 ppc x86_64): mipv6d-2.0.2-2.1.1 References: http://support.novell.com/security/cve/CVE-2010-2522.html http://support.novell.com/security/cve/CVE-2010-2523.html https://bugzilla.novell.com/424311

1 0

openSUSE-SU-2010:0734-1 (important): kernel: security and bugfix update.
by opensuse-security＠opensuse.org 15 Oct '10

15 Oct '10

openSUSE Security Update: kernel: security and bugfix update. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0734-1 Rating: important References: #613835 #614670 #638709 #640338 #640568 #640721 #641479 #642009 #644046 Cross-References: CVE-2010-2962 CVE-2010-3310 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 7 fixes is now available. It includes one version update. Description: This updated openSUSE 11.3 kernel fixes the following security bugs: CVE-2010-3310: local users could corrupt kernel heap memory via ROSE sockets. CVE-2010-2962: local users could write to any kernel memory location via the i915 GEM ioctl interface. Additionally the update restores the compat_alloc_userspace() inline function and includes several other bug fixes. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch kernel-3315 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.6.34.7]: kernel-debug-2.6.34.7-0.4.1 kernel-debug-base-2.6.34.7-0.4.1 kernel-debug-devel-2.6.34.7-0.4.1 kernel-default-2.6.34.7-0.4.1 kernel-default-base-2.6.34.7-0.4.1 kernel-default-devel-2.6.34.7-0.4.1 kernel-desktop-2.6.34.7-0.4.1 kernel-desktop-base-2.6.34.7-0.4.1 kernel-desktop-devel-2.6.34.7-0.4.1 kernel-ec2-2.6.34.7-0.4.1 kernel-ec2-base-2.6.34.7-0.4.1 kernel-ec2-devel-2.6.34.7-0.4.1 kernel-ec2-extra-2.6.34.7-0.4.1 kernel-syms-2.6.34.7-0.4.1 kernel-trace-2.6.34.7-0.4.1 kernel-trace-base-2.6.34.7-0.4.1 kernel-trace-devel-2.6.34.7-0.4.1 kernel-vanilla-2.6.34.7-0.4.1 kernel-vanilla-base-2.6.34.7-0.4.1 kernel-vanilla-devel-2.6.34.7-0.4.1 kernel-xen-2.6.34.7-0.4.1 kernel-xen-base-2.6.34.7-0.4.1 kernel-xen-devel-2.6.34.7-0.4.1 preload-kmp-default-1.1_k2.6.34.7_0.4-19.1.7 preload-kmp-desktop-1.1_k2.6.34.7_0.4-19.1.7 - openSUSE 11.3 (noarch) [New Version: 2.6.34.7]: kernel-devel-2.6.34.7-0.4.1 kernel-source-2.6.34.7-0.4.1 kernel-source-vanilla-2.6.34.7-0.4.1 - openSUSE 11.3 (i586) [New Version: 2.6.34.7]: kernel-pae-2.6.34.7-0.4.1 kernel-pae-base-2.6.34.7-0.4.1 kernel-pae-devel-2.6.34.7-0.4.1 kernel-vmi-2.6.34.7-0.4.1 kernel-vmi-base-2.6.34.7-0.4.1 kernel-vmi-devel-2.6.34.7-0.4.1 References: http://support.novell.com/security/cve/CVE-2010-2962.html http://support.novell.com/security/cve/CVE-2010-3310.html https://bugzilla.novell.com/613835 https://bugzilla.novell.com/614670 https://bugzilla.novell.com/638709 https://bugzilla.novell.com/640338 https://bugzilla.novell.com/640568 https://bugzilla.novell.com/640721 https://bugzilla.novell.com/641479 https://bugzilla.novell.com/642009 https://bugzilla.novell.com/644046

1 0

openSUSE-SU-2010:0732-1 (moderate): OpenOffice_org security update
by opensuse-security＠opensuse.org 15 Oct '10

15 Oct '10

openSUSE Security Update: OpenOffice_org security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0732-1 Rating: moderate References: #629085 Cross-References: CVE-2010-2935 CVE-2010-2936 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Specially crafted ppt files could cause a heap based buffer overflow in OpenOffice_org Impress. Attackers could exploit that to crash OpenOffice_org or potentially even execute arbitrary code (CVE-2010-2935, CVE-2010-2936). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch OpenOffice_org-draw-3081 - openSUSE 11.2: zypper in -t patch OpenOffice_org-draw-3081 - openSUSE 11.1: zypper in -t patch OpenOffice_org-draw-3081 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): OpenOffice_org-draw-3.2.1.4-2.1.1 OpenOffice_org-impress-3.2.1.4-2.1.1 OpenOffice_org-impress-devel-3.2.1.4-2.1.1 OpenOffice_org-impress-l10n-prebuilt-3.2.1.4-2.1.1 OpenOffice_org-libs-gui-3.2.1.4-2.1.1 OpenOffice_org-libs-gui-devel-3.2.1.4-2.1.1 OpenOffice_org-libs-gui-l10n-prebuilt-3.2.1.4-2.1.1 - openSUSE 11.2 (i586 x86_64): OpenOffice_org-draw-3.1.1.4-1.2.2 OpenOffice_org-impress-3.1.1.4-1.2.2 OpenOffice_org-impress-devel-3.1.1.4-1.2.2 OpenOffice_org-impress-l10n-prebuilt-3.1.1.4-1.2.2 OpenOffice_org-libs-gui-3.1.1.4-1.1.8.1 OpenOffice_org-libs-gui-devel-3.1.1.4-1.1.8.1 OpenOffice_org-libs-gui-l10n-prebuilt-3.1.1.4-1.1.8.1 - openSUSE 11.1 (i586 ppc x86_64): OpenOffice_org-draw-3.0.0.9-1.13.1 OpenOffice_org-impress-3.0.0.9-1.13.1 OpenOffice_org-impress-devel-3.0.0.9-1.13.1 OpenOffice_org-impress-l10n-prebuilt-3.0.0.9-1.13.1 OpenOffice_org-libs-gui-3.0.0.9-1.13.1 OpenOffice_org-libs-gui-devel-3.0.0.9-1.13.1 OpenOffice_org-libs-gui-l10n-prebuilt-3.0.0.9-1.13.1 References: http://support.novell.com/security/cve/CVE-2010-2935.html http://support.novell.com/security/cve/CVE-2010-2936.html https://bugzilla.novell.com/629085

1 0

openSUSE-SU-2010:0731-1 (important): mysql security update
by opensuse-security＠opensuse.org 15 Oct '10

15 Oct '10

openSUSE Security Update: mysql security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0731-1 Rating: important References: #557669 #567977 #607466 #609551 #637499 Cross-References: CVE-2010-1626 CVE-2010-1848 CVE-2010-1849 CVE-2010-1850 CVE-2010-3677 CVE-2010-3678 CVE-2010-3681 CVE-2010-3682 CVE-2010-3683 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: - local users could delete data files for tables of other users (CVE-2010-1626). - authenticated users could gather information for tables they should not have access to (CVE-2010-1849) - authenticated users could crash mysqld (CVE-2010-1848) - authenticated users could potentially execute arbitrary code as the user running mysqld (CVE-2010-1850) - authenticated users could crash mysqld (CVE-2010-3677, CVE-2010-3678, CVE-2010-3681, CVE-2010-3682, CVE-2010-3683) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch libmysqlclient-devel-3232 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): libmysqlclient-devel-5.0.67-12.18.1 libmysqlclient15-5.0.67-12.18.1 libmysqlclient_r15-5.0.67-12.18.1 mysql-5.0.67-12.18.1 mysql-Max-5.0.67-12.18.1 mysql-bench-5.0.67-12.18.1 mysql-client-5.0.67-12.18.1 mysql-debug-5.0.67-12.18.1 mysql-test-5.0.67-12.18.1 mysql-tools-5.0.67-12.18.1 - openSUSE 11.1 (x86_64): libmysqlclient15-32bit-5.0.67-12.18.1 libmysqlclient_r15-32bit-5.0.67-12.18.1 - openSUSE 11.1 (ppc): libmysqlclient15-64bit-5.0.67-12.18.1 libmysqlclient_r15-64bit-5.0.67-12.18.1 References: http://support.novell.com/security/cve/CVE-2010-1626.html http://support.novell.com/security/cve/CVE-2010-1848.html http://support.novell.com/security/cve/CVE-2010-1849.html http://support.novell.com/security/cve/CVE-2010-1850.html http://support.novell.com/security/cve/CVE-2010-3677.html http://support.novell.com/security/cve/CVE-2010-3678.html http://support.novell.com/security/cve/CVE-2010-3681.html http://support.novell.com/security/cve/CVE-2010-3682.html http://support.novell.com/security/cve/CVE-2010-3683.html https://bugzilla.novell.com/557669 https://bugzilla.novell.com/567977 https://bugzilla.novell.com/607466 https://bugzilla.novell.com/609551 https://bugzilla.novell.com/637499

1 0

openSUSE-SU-2010:0730-1 (important): mysql security update
by opensuse-security＠opensuse.org 15 Oct '10

15 Oct '10

openSUSE Security Update: mysql security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0730-1 Rating: important References: #582656 #607466 #609551 #637499 Cross-References: CVE-2010-1621 CVE-2010-1626 CVE-2010-1848 CVE-2010-1849 CVE-2010-1850 CVE-2010-2008 CVE-2010-3675 CVE-2010-3676 CVE-2010-3677 CVE-2010-3678 CVE-2010-3679 CVE-2010-3680 CVE-2010-3681 CVE-2010-3682 CVE-2010-3683 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. It includes one version update. Description: - local users could delete data files for tables of other users (CVE-2010-1626). - authenticated users could gather information for tables they should not have access to (CVE-2010-1849) - authenticated users could crash mysqld (CVE-2010-1848) - authenticated users could potentially execute arbitrary code as the user running mysqld (CVE-2010-1850) - authenticated users could crash mysqld (CVE-2010-3676, CVE-2010-3677, CVE-2010-3678, CVE-2010-3679, CVE-2010-3680, CVE-2010-3681, CVE-2010-3682, CVE-2010-3683, CVE-2010-2008) - a race condition in /etc/init.d/mysql allowed local users to make any file readable via symlink in /var/tmp (CVE-2010-3675) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libmysqlclient-devel-3260 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64) [New Version: 5.1.49]: libmysqlclient-devel-5.1.49-0.1.1 libmysqlclient16-5.1.49-0.1.1 libmysqlclient_r16-5.1.49-0.1.1 libmysqld-devel-5.1.49-0.1.1 mysql-5.1.49-0.1.1 mysql-bench-5.1.49-0.1.1 mysql-client-5.1.49-0.1.1 mysql-debug-5.1.49-0.1.1 mysql-ndb-extra-5.1.49-0.1.1 mysql-ndb-management-5.1.49-0.1.1 mysql-ndb-storage-5.1.49-0.1.1 mysql-ndb-tools-5.1.49-0.1.1 mysql-test-5.1.49-0.1.1 mysql-tools-5.1.49-0.1.1 - openSUSE 11.2 (x86_64) [New Version: 5.1.49]: libmysqlclient16-32bit-5.1.49-0.1.1 libmysqlclient_r16-32bit-5.1.49-0.1.1 References: http://support.novell.com/security/cve/CVE-2010-1621.html http://support.novell.com/security/cve/CVE-2010-1626.html http://support.novell.com/security/cve/CVE-2010-1848.html http://support.novell.com/security/cve/CVE-2010-1849.html http://support.novell.com/security/cve/CVE-2010-1850.html http://support.novell.com/security/cve/CVE-2010-2008.html http://support.novell.com/security/cve/CVE-2010-3675.html http://support.novell.com/security/cve/CVE-2010-3676.html http://support.novell.com/security/cve/CVE-2010-3677.html http://support.novell.com/security/cve/CVE-2010-3678.html http://support.novell.com/security/cve/CVE-2010-3679.html http://support.novell.com/security/cve/CVE-2010-3680.html http://support.novell.com/security/cve/CVE-2010-3681.html http://support.novell.com/security/cve/CVE-2010-3682.html http://support.novell.com/security/cve/CVE-2010-3683.html https://bugzilla.novell.com/582656 https://bugzilla.novell.com/607466 https://bugzilla.novell.com/609551 https://bugzilla.novell.com/637499

1 0