December 2010 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2010:1077-1 (moderate): kdenetwork: security update
by opensuse-security＠opensuse.org 17 Dec '10

17 Dec '10

openSUSE Security Update: kdenetwork: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1077-1 Rating: moderate References: #516347 #525528 #604709 #653852 Cross-References: CVE-2008-4776 CVE-2010-1000 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update of kdenetwork fixes several bugs, the security related issues are: - CVE-2010-1000: CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N): CWE-22 The "name" attribute of the "file" element of metalink files is not properly sanitised this can be exploited to download files to arbitrary directories. - CVE-2008-4776: CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P): CWE-119 The included libgadu version allowed remote servers to cause a denial of service (crash) via a buffer over-read. Non-security issues: - bnc#653852: kopete: ICQ login broken; login server changed - bnc#516347: kopete cant connect to yahoo Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch kde4-kdnssd-3561 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): kde4-kdnssd-4.1.3-4.15.1 kde4-kget-4.1.3-4.15.1 kde4-knewsticker-4.1.3-4.15.1 kde4-kopete-4.1.3-4.15.1 kde4-kopete-devel-4.1.3-4.15.1 kde4-kppp-4.1.3-4.15.1 kde4-krdc-4.1.3-4.15.1 kde4-krfb-4.1.3-4.15.1 kdenetwork4-4.1.3-4.15.1 kdenetwork4-filesharing-4.1.3-4.15.1 References: http://support.novell.com/security/cve/CVE-2008-4776.html http://support.novell.com/security/cve/CVE-2010-1000.html https://bugzilla.novell.com/516347 https://bugzilla.novell.com/525528 https://bugzilla.novell.com/604709 https://bugzilla.novell.com/653852

1 0

openSUSE-SU-2010:1076-1 (moderate): kdenetwork: security update
by opensuse-security＠opensuse.org 17 Dec '10

17 Dec '10

openSUSE Security Update: kdenetwork: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1076-1 Rating: moderate References: #604709 #653852 Cross-References: CVE-2008-4776 CVE-2010-1000 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: This update of kdenetwork fixes several bugs, the security related issues are: - CVE-2010-1000: CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N): CWE-22 The "name" attribute of the "file" element of metalink files is not properly sanitised this can be exploited to download files to arbitrary directories. Non-security issues: - bnc#653852: kopete: ICQ login broken; login server changed Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch kdenetwork4-3560 - openSUSE 11.2: zypper in -t patch kdenetwork4-3560 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): kdenetwork4-4.4.4-2.3.1 kdenetwork4-filesharing-4.4.4-2.3.1 kdnssd-4.4.4-2.3.1 kget-4.4.4-2.3.1 kopete-4.4.4-2.3.1 kopete-devel-4.4.4-2.3.1 kppp-4.4.4-2.3.1 krdc-4.4.4-2.3.1 krfb-4.4.4-2.3.1 - openSUSE 11.2 (i586 x86_64) [New Version: 4.3.5]: kdenetwork4-4.3.5-0.4.1 kdenetwork4-filesharing-4.3.5-0.4.1 kdnssd-4.3.5-0.4.1 kget-4.3.5-0.4.1 kopete-4.3.5-0.4.1 kopete-devel-4.3.5-0.4.1 kppp-4.3.5-0.4.1 krdc-4.3.5-0.4.1 krfb-4.3.5-0.4.1 References: http://support.novell.com/security/cve/CVE-2008-4776.html http://support.novell.com/security/cve/CVE-2010-1000.html https://bugzilla.novell.com/604709 https://bugzilla.novell.com/653852

1 0

openSUSE-RU-2010:1073-1 (low): spamassassin: It still uses openwhois tests, a squatted domain. This unnecessary test is removed by this update.
by maintenance＠opensuse.org 16 Dec '10

16 Dec '10

openSUSE Recommended Update: spamassassin: It still uses openwhois tests, a squatted domain. This unnecessary test is removed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1073-1 Rating: low References: #606231 Affected Products: openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Spamassassin still uses openwhois tests, a squatted domain. Users were reporting false-positive issues, where every message checked by SpamAssassin would receive a score of 2.43. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch perl-spamassassin-3341 - openSUSE 11.1: zypper in -t patch perl-spamassassin-3341 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): perl-spamassassin-3.2.5-28.7.1 spamassassin-3.2.5-28.7.1 - openSUSE 11.1 (i586 ppc x86_64): perl-spamassassin-3.2.5-26.10.1 spamassassin-3.2.5-26.10.1 References: https://bugzilla.novell.com/606231

1 0

openSUSE-RU-2010:1068-1 (low): gnome-icon-theme: Missing GNOME-icons are added by this update.
by maintenance＠opensuse.org 15 Dec '10

15 Dec '10

openSUSE Recommended Update: gnome-icon-theme: Missing GNOME-icons are added by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1068-1 Rating: low References: #632602 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Some SVG files used as icons by GNOME are missing, causing blurry icons to be sometime displayed. This packages fixes this issue.q Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnome-icon-theme-3663 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch): gnome-icon-theme-2.30.2.1-2.3.1 References: https://bugzilla.novell.com/632602

1 0

openSUSE-RU-2010:1067-1 (low): SDL: This update fixes an segmentation fault when pressing some keys on a D-pad.
by maintenance＠opensuse.org 15 Dec '10

15 Dec '10

openSUSE Recommended Update: SDL: This update fixes an segmentation fault when pressing some keys on a D-pad. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1067-1 Rating: low References: #632271 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: All programs using SDL (usually games) will crash when user presses a button on D-Pad controller. This is caused by structure size change in new kernel releases. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch SDL-3671 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libSDL-1_2-0-1.2.14-6.3.1 libSDL-devel-1.2.14-6.3.1 - openSUSE 11.3 (x86_64): libSDL-1_2-0-32bit-1.2.14-6.3.1 libSDL-devel-32bit-1.2.14-6.3.1 References: https://bugzilla.novell.com/632271

1 0

openSUSE-RU-2010:1066-1 (low): nautilus-sendto: Is broken in gnome-main-menu. Fixed by this update.
by maintenance＠opensuse.org 15 Dec '10

15 Dec '10

openSUSE Recommended Update: nautilus-sendto: Is broken in gnome-main-menu. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1066-1 Rating: low References: #647263 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Using send-to action by right-click on documents in gnome-main-menu was not working properly. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnome-main-menu-3677 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): gnome-main-menu-0.9.14-4.3.1 nautilus-gnome-main-menu-0.9.14-4.3.1 - openSUSE 11.3 (noarch): gnome-main-menu-lang-0.9.14-4.3.1 References: https://bugzilla.novell.com/647263

1 0

openSUSE-SU-2010:1062-1 (critical): moonlight security update
by opensuse-security＠opensuse.org 15 Dec '10

15 Dec '10

openSUSE Security Update: moonlight security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1062-1 Rating: critical References: #655847 Cross-References: CVE-2010-4254 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Untrusted Moonlight apps could bypass constraints on methods which potentially allowed attackers to execute arbitrary code (CVE-2010-4254). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libmoon-devel-3672 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libmoon-devel-2.2-4.3.1 libmoon0-2.2-4.3.1 moonlight-desktop-2.2-4.3.1 moonlight-desktop-devel-2.2-4.3.1 moonlight-plugin-2.2-4.3.1 moonlight-tools-2.2-4.3.1 moonlight-web-devel-2.2-4.3.1 References: http://support.novell.com/security/cve/CVE-2010-4254.html https://bugzilla.novell.com/655847

1 0

openSUSE-SU-2010:1061-1 (moderate): otrs security update
by opensuse-security＠opensuse.org 15 Dec '10

15 Dec '10

openSUSE Security Update: otrs security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1061-1 Rating: moderate References: #640729 #640830 Cross-References: CVE-2010-2080 CVE-2010-3476 CVE-2010-4071 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes two new package versions. Description: OTRS version 2.4.9 fixes among other things two cross-site-scripting and a denial of service vulnerability (CVE-2010-2080, CVE-2010-3476, CVE-2010-4071). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch otrs-3695 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch) [New Version: 2.1.1 and 2.4.9]: otrs-2.4.9-0.3.1 otrs-doc-2.4.9-0.3.1 otrs-itsm-2.1.1-0.3.1 References: http://support.novell.com/security/cve/CVE-2010-2080.html http://support.novell.com/security/cve/CVE-2010-3476.html http://support.novell.com/security/cve/CVE-2010-4071.html https://bugzilla.novell.com/640729 https://bugzilla.novell.com/640830

1 0

openSUSE-RU-2010:1058-1 (low): hamster-applet: This updates adds a missing dependency for python-xdg
by maintenance＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Recommended Update: hamster-applet: This updates adds a missing dependency for python-xdg ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1058-1 Rating: low References: #653578 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: hamster-applet package was missing a dependency on python-xdg package, which could prevent the application to start properly. This package fixes this issue. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch hamster-applet-3669 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): hamster-applet-2.30.1-2.3.1 - openSUSE 11.3 (noarch): hamster-applet-lang-2.30.1-2.3.1 References: https://bugzilla.novell.com/653578

1 0

openSUSE-RU-2010:1057-1 (low): libpixman: This update prevents Xvnc from aborting by using different VNC versions.
by maintenance＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Recommended Update: libpixman: This update prevents Xvnc from aborting by using different VNC versions. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1057-1 Rating: low References: #597424 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This pixman update prevents Xvnc from aborting in the case different version are used on server and client site. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libpixman-1-0-3658 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): libpixman-1-0-0.16.0-1.3.1 libpixman-1-0-devel-0.16.0-1.3.1 - openSUSE 11.2 (x86_64): libpixman-1-0-32bit-0.16.0-1.3.1 References: https://bugzilla.novell.com/597424

1 0