December 2010 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2010:1056-1 (low): gnome-do: It is auto-started under KDE4 by default. Fixed by this update.
by maintenance＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Recommended Update: gnome-do: It is auto-started under KDE4 by default. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1056-1 Rating: low References: #629385 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: gnome-do was incorrectly auto-started under KDE4 by default, causing tracker to be started in addition to KDE Nepomuk. This package fixes this issue Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnome-do-3668 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): gnome-do-0.8.3-4.3.1 - openSUSE 11.3 (noarch): gnome-do-lang-0.8.3-4.3.1 References: https://bugzilla.novell.com/629385

1 0

openSUSE-RU-2010:1055-1 (low): gnome-keyring: Better handling of non-ASCII keyring name
by maintenance＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Recommended Update: gnome-keyring: Better handling of non-ASCII keyring name ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1055-1 Rating: low References: #635743 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a bug in gnome-keyring / libgnome-keyring that could prevent keyring creation with a non-ASCII name. Special Instructions and Notes: Please log out and log in again after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnome-keyring-3652 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): gnome-keyring-2.30.1-3.3.1 gnome-keyring-pam-2.30.1-3.3.1 libgcr-devel-2.30.1-3.3.1 libgcr0-2.30.1-3.3.1 libgnome-keyring-devel-2.30.1-2.3.1 libgnome-keyring0-2.30.1-2.3.1 libgp11-0-2.30.1-3.3.1 libgp11-devel-2.30.1-3.3.1 libgp11-modules-2.30.1-3.3.1 - openSUSE 11.3 (x86_64): gnome-keyring-pam-32bit-2.30.1-3.3.1 libgcr0-32bit-2.30.1-3.3.1 libgnome-keyring0-32bit-2.30.1-2.3.1 libgp11-0-32bit-2.30.1-3.3.1 - openSUSE 11.3 (noarch): gnome-keyring-lang-2.30.1-3.3.1 libgnome-keyring-lang-2.30.1-2.3.1 References: https://bugzilla.novell.com/635743

1 0

openSUSE-SU-2010:1054-1 (important): MozillaThunderbird: 3.0.11 update fixes security issues
by opensuse-security＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Security Update: MozillaThunderbird: 3.0.11 update fixes security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1054-1 Rating: important References: #657016 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes three new package versions. Description: Mozilla Thunderbird 3.0 was updated to update 3.0.11 fixing several security issues. MFSA 2010-74: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Jesee Ruderman, Andreas Gal, Nils, and Brian Hackett reported memory safety problems that affected Firefox 3.6 and Firefox 3.5. (CVE-2010-3776) Igor Bukanov reported a memory safety problem that was fixed in Firefox 3.6 only. (CVE-2010-3777) Jesse Ruderman reported a crash which affected Firefox 3.5 only. (CVE-2010-3778) MFSA 2010-75 / CVE-2010-3769: Dirk Heinrich reported that on Windows platforms when document.write() was called with a very long string a buffer overflow was caused in line breaking routines attempting to process the string for display. Such cases triggered an invalid read past the end of an array causing a crash which an attacker could potentially use to run arbitrary code on a victim's computer. MFSA 2010-76 / CVE-2010-3771: Security researcher echo reported that a web page could open a window with an about:blank location and then inject an <isindex> element into that page which upon submission would redirect to a chrome: document. The effect of this defect was that the original page would wind up with a reference to a chrome-privileged object, the opened window, which could be leveraged for privilege escalation attacks. Mozilla security researcher moz_bug_r_a4 provided proof-of-concept code demonstrating how the above vulnerability could be used to run arbitrary code with chrome privileges. MFSA 2010-77 / CVE-2010-3772: Security researcher wushi of team509 reported that when a XUL tree had an HTML <div> element nested inside a <treechildren> element then code attempting to display content in the XUL tree would incorrectly treat the <div> element as a parent node to tree content underneath it resulting in incorrect indexes being calculated for the child content. These incorrect indexes were used in subsequent array operations which resulted in writing data past the end of an allocated buffer. An attacker could use this issue to crash a victim's browser and run arbitrary code on their machine. MFSA 2010-78 / CVE-2010-3768: Mozilla added the OTS font sanitizing library to prevent downloadable fonts from exposing vulnerabilities in the underlying OS font code. This library mitigates against several issues independently reported by Red Hat Security Response Team member Marc Schoenefeld and Mozilla security researcher Christoph Diehl. MFSA 2010-79 / CVE-2010-3775: Security researcher Gregory Fleischer reported that when a Java LiveConnect script was loaded via a data: URL which redirects via a meta refresh, then the resulting plugin object was created with the wrong security principal and thus received elevated privileges such as the abilities to read local files, launch processes, and create network connections. MFSA 2010-80 / CVE-2010-3766: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that a nsDOMAttribute node can be modified without informing the iterator object responsible for various DOM traversals. This flaw could lead to a inconsistent state where the iterator points to an object it believes is part of the DOM but actually points to some other object. If such an object had been deleted and its memory reclaimed by the system, then the iterator could be used to call into attacker-controlled memory. MFSA 2010-81 / CVE-2010-3767: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that JavaScript arrays were vulnerable to an integer overflow vulnerability. The report demonstrated that an array could be constructed containing a very large number of items such that when memory was allocated to store the array items, the integer value used to calculate the buffer size would overflow resulting in too small a buffer being allocated. Subsequent use of the array object could then result in data being written past the end of the buffer and causing memory corruption. MFSA 2010-82 / CVE-2010-3773: Mozilla security researcher moz_bug_r_a4 reported that the fix for CVE-2010-0179 could be circumvented permitting the execution of arbitrary JavaScript with chrome privileges. MFSA 2010-83 / CVE-2010-3774: Google security researcher Michal Zalewski reported that when a window was opened to a site resulting in a network or certificate error page, the opening site could access the document inside the opened window and inject arbitrary content. An attacker could use this bug to spoof the location bar and trick a user into thinking they were on a different site than they actually were. MFSA 2010-84 / CVE-2010-3770: Security researchers Yosuke Hasegawa and Masatoshi Kimura reported that the x-mac-arabic, x-mac-farsi and x-mac-hebrew character encodings are vulnerable to XSS attacks due to some characters being converted to angle brackets when displayed by the rendering engine. Sites using these character encodings would thus be potentially vulnerable to script injection attacks if their script filtering code fails to strip out these specific characters. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch MozillaThunderbird-3687 seamonkey-3690 - openSUSE 11.2: zypper in -t patch MozillaThunderbird-3687 seamonkey-3690 - openSUSE 11.1: zypper in -t patch MozillaThunderbird-3687 seamonkey-3690 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.0.11 and 3.0.11]: MozillaThunderbird-3.0.11-0.5.1 MozillaThunderbird-devel-3.0.11-0.5.1 MozillaThunderbird-translations-common-3.0.11-0.5.1 MozillaThunderbird-translations-other-3.0.11-0.5.1 enigmail-1.0.1-4.5.1 seamonkey-2.0.11-0.2.1 seamonkey-dom-inspector-2.0.11-0.2.1 seamonkey-irc-2.0.11-0.2.1 seamonkey-translations-common-2.0.11-0.2.1 seamonkey-translations-other-2.0.11-0.2.1 seamonkey-venkman-2.0.11-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.0.1,2.0.11 and 3.0.11]: MozillaThunderbird-3.0.11-0.5.1 MozillaThunderbird-devel-3.0.11-0.5.1 MozillaThunderbird-translations-common-3.0.11-0.5.1 MozillaThunderbird-translations-other-3.0.11-0.5.1 enigmail-1.0.1-3.5.1 seamonkey-2.0.11-0.2.1 seamonkey-dom-inspector-2.0.11-0.2.1 seamonkey-irc-2.0.11-0.2.1 seamonkey-venkman-2.0.11-0.2.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 2.0.11 and 3.0.11]: MozillaThunderbird-3.0.11-0.6.1 MozillaThunderbird-devel-3.0.11-0.6.1 MozillaThunderbird-translations-common-3.0.11-0.6.1 MozillaThunderbird-translations-other-3.0.11-0.6.1 enigmail-1.0.1-6.6.1 seamonkey-2.0.11-0.1.1 seamonkey-dom-inspector-2.0.11-0.1.1 seamonkey-irc-2.0.11-0.1.1 seamonkey-venkman-2.0.11-0.1.1 References: https://bugzilla.novell.com/657016

1 0

openSUSE-SU-2010:1053-1 (important): krb5: Fixes for multiple remote vulnerabilities in MIT krb5
by opensuse-security＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Security Update: krb5: Fixes for multiple remote vulnerabilities in MIT krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1053-1 Rating: important References: #650650 Cross-References: CVE-2010-1323 CVE-2010-1324 CVE-2010-4020 CVE-2010-4021 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Multiple remote vulnerabilities in the MIT krb5 package have been fixed. They affect client as well as server software. CVE-2010-1323, CVE-2010-1324,CVE-2010-4020 and CVE-2010-4021 have been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch krb5-3612 - openSUSE 11.2: zypper in -t patch krb5-3612 - openSUSE 11.1: zypper in -t patch krb5-3612 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): krb5-1.8.1-5.3.1 krb5-client-1.8.1-5.3.1 krb5-devel-1.8.1-5.3.1 krb5-plugin-kdb-ldap-1.8.1-5.3.1 krb5-plugin-preauth-pkinit-1.8.1-5.3.1 krb5-server-1.8.1-5.3.1 - openSUSE 11.3 (x86_64): krb5-32bit-1.8.1-5.3.1 krb5-devel-32bit-1.8.1-5.3.1 - openSUSE 11.2 (i586 x86_64): krb5-1.7-6.8.1 krb5-apps-clients-1.7-6.8.1 krb5-apps-servers-1.7-6.8.1 krb5-client-1.7-6.8.1 krb5-devel-1.7-6.8.1 krb5-plugin-kdb-ldap-1.7-6.8.1 krb5-plugin-preauth-pkinit-1.7-6.8.1 krb5-server-1.7-6.8.1 - openSUSE 11.2 (x86_64): krb5-32bit-1.7-6.8.1 krb5-devel-32bit-1.7-6.8.1 - openSUSE 11.1 (i586 ppc x86_64): krb5-1.6.3-132.10.1 krb5-apps-clients-1.6.3-132.10.1 krb5-apps-servers-1.6.3-132.10.1 krb5-client-1.6.3-132.10.1 krb5-devel-1.6.3-132.10.1 krb5-plugin-kdb-ldap-1.6.3-132.10.1 krb5-plugin-preauth-pkinit-1.6.3-132.10.1 krb5-server-1.6.3-132.10.1 - openSUSE 11.1 (x86_64): krb5-32bit-1.6.3-132.10.1 krb5-devel-32bit-1.6.3-132.10.1 - openSUSE 11.1 (ppc): krb5-64bit-1.6.3-132.10.1 krb5-devel-64bit-1.6.3-132.10.1 References: http://support.novell.com/security/cve/CVE-2010-1323.html http://support.novell.com/security/cve/CVE-2010-1324.html http://support.novell.com/security/cve/CVE-2010-4020.html http://support.novell.com/security/cve/CVE-2010-4021.html https://bugzilla.novell.com/650650

1 0

openSUSE-SU-2010:1052-1 (critical): exim security update
by opensuse-security＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Security Update: exim security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1052-1 Rating: critical References: #658731 Cross-References: CVE-2010-4344 CVE-2010-4345 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: remote attackers could trick exim into running arbitrary code (CVE-2010-4344). A privilege escalation flaw allowed attackers to gain root access (CVE-2010-4345). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch exim-3680 - openSUSE 11.2: zypper in -t patch exim-3680 - openSUSE 11.1: zypper in -t patch exim-3680 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): exim-4.71-4.3.1 eximon-4.71-4.3.1 eximstats-html-4.71-4.3.1 - openSUSE 11.2 (i586 x86_64): exim-4.69-72.6.1 eximon-4.69-72.6.1 eximstats-html-4.69-72.6.1 - openSUSE 11.1 (i586 ppc x86_64): exim-4.69-70.15.1 eximon-4.69-70.15.1 eximstats-html-4.69-70.15.1 References: http://support.novell.com/security/cve/CVE-2010-4344.html http://support.novell.com/security/cve/CVE-2010-4345.html https://bugzilla.novell.com/658731

1 0

openSUSE-SU-2010:1051-1 (important): python security update
by opensuse-security＠opensuse.org 10 Dec '10

10 Dec '10

openSUSE Security Update: python security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1051-1 Rating: important References: #638233 Cross-References: CVE-2010-3493 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: a race condition in the accept() implementation of smtpd.py could lead to a denial of service (CVE-2010-3493) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libpython2_6-1_0-3488 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libpython2_6-1_0-2.6.5-3.3.1 python-2.6.5-3.3.1 python-base-2.6.5-3.3.1 python-curses-2.6.5-3.3.1 python-demo-2.6.5-3.3.1 python-devel-2.6.5-3.3.1 python-gdbm-2.6.5-3.3.1 python-idle-2.6.5-3.3.1 python-tk-2.6.5-3.3.1 python-xml-2.6.5-3.3.1 - openSUSE 11.3 (x86_64): libpython2_6-1_0-32bit-2.6.5-3.3.1 python-32bit-2.6.5-3.3.1 python-base-32bit-2.6.5-3.3.1 References: http://support.novell.com/security/cve/CVE-2010-3493.html https://bugzilla.novell.com/638233

1 0

openSUSE-SU-2010:1049-1 (important): python security update
by opensuse-security＠opensuse.org 10 Dec '10

10 Dec '10

openSUSE Security Update: python security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1049-1 Rating: important References: #609759 #609761 #638233 Cross-References: CVE-2010-1634 CVE-2010-2089 CVE-2010-3493 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: - a race condition in the accept() implementation of smtpd.py could lead to a denial of service (CVE-2010-3493). - integer overflows and insufficient size checks could crash the audioop module (CVE-2010-2089, CVE-2010-1634). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libpython2_6-1_0-3487 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): libpython2_6-1_0-2.6.2-6.7.1 python-2.6.2-6.7.1 python-base-2.6.2-6.7.1 python-curses-2.6.2-6.7.1 python-demo-2.6.2-6.7.1 python-devel-2.6.2-6.7.1 python-gdbm-2.6.2-6.7.1 python-idle-2.6.2-6.7.1 python-tk-2.6.2-6.7.1 python-xml-2.6.2-6.7.1 - openSUSE 11.2 (x86_64): libpython2_6-1_0-32bit-2.6.2-6.7.1 python-32bit-2.6.2-6.7.1 python-base-32bit-2.6.2-6.7.1 References: http://support.novell.com/security/cve/CVE-2010-1634.html http://support.novell.com/security/cve/CVE-2010-2089.html http://support.novell.com/security/cve/CVE-2010-3493.html https://bugzilla.novell.com/609759 https://bugzilla.novell.com/609761 https://bugzilla.novell.com/638233

1 0

openSUSE-SU-2010:1047-1 (important): Linux Kernel: Security/Bugfix update to fix local privilege escalations
by opensuse-security＠opensuse.org 10 Dec '10

10 Dec '10

openSUSE Security Update: Linux Kernel: Security/Bugfix update to fix local privilege escalations ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1047-1 Rating: important References: #595215 #642302 #642311 #642312 #642313 #642314 #642484 #642486 #643477 #645659 #646045 #651218 #651356 #651626 #652563 #652940 #652945 #653260 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: This security update of the openSUSE 11.1 kernel updates the kernel to 2.6.27.56 and fixes various security issues and other bugs. Following security issues were fixed by this update: CVE-2010-2963: A problem in the compat ioctl handling in video4linux allowed local attackers with a video device plugged in to gain privileges on x86_64 systems. CVE-2010-4157: A 32bit vs 64bit integer mismatch in gdth_ioctl_alloc could lead to memory corruption in the GDTH driver. CVE-2010-4164: A remote (or local) attacker communicating over X.25 could cause a kernel panic by attempting to negotiate malformed facilities. CVE-2010-3874: A minor heap overflow in the CAN network module was fixed. Due to nature of the memory allocator it is likely not exploitable. CVE-2010-4158: A memory information leak in berkely packet filter rules allowed local attackers to read uninitialized memory of the kernel stack. CVE-2010-4162: A local denial of service in the blockdevice layer was fixed. CVE-2010-3437: A range checking overflow in pktcdvd ioctl was fixed. CVE-2010-4078: The sisfb_ioctl function in drivers/video/sis/sis_main.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call. CVE-2010-4082: The viafb_ioctl_get_viafb_info function in drivers/video/via/ioctl.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call. CVE-2010-4073: The ipc subsystem in the Linux kernel did not initialize certain structures, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in ipc/compat_mq.c. CVE-2010-4072: The copy_shmid_to_user function in ipc/shm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the shmctl system call and the "old shm interface." CVE-2010-4083: The copy_semid_to_user function in ipc/sem.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via a (1) IPC_INFO, (2) SEM_INFO, (3) IPC_STAT, or (4) SEM_STAT command in a semctl system call. CVE-2010-3067: Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel allowed local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call. CVE-2010-3442: Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel allowed local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call. CVE-2010-4080: The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call. CVE-2010-4081: The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch kernel-3619 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64) [New Version: 2.6.27.56]: kernel-default-2.6.27.56-0.1.1 kernel-default-base-2.6.27.56-0.1.1 kernel-default-extra-2.6.27.56-0.1.1 kernel-source-2.6.27.56-0.1.1 kernel-syms-2.6.27.56-0.1.1 kernel-vanilla-2.6.27.56-0.1.1 - openSUSE 11.1 (i586 x86_64) [New Version: 2.6.27.56]: kernel-debug-2.6.27.56-0.1.1 kernel-debug-base-2.6.27.56-0.1.1 kernel-debug-extra-2.6.27.56-0.1.1 kernel-trace-2.6.27.56-0.1.1 kernel-trace-base-2.6.27.56-0.1.1 kernel-trace-extra-2.6.27.56-0.1.1 kernel-xen-2.6.27.56-0.1.1 kernel-xen-base-2.6.27.56-0.1.1 kernel-xen-extra-2.6.27.56-0.1.1 - openSUSE 11.1 (noarch): kernel-docs-2.6.3-3.13.135 - openSUSE 11.1 (i586) [New Version: 2.6.27.56]: kernel-pae-2.6.27.56-0.1.1 kernel-pae-base-2.6.27.56-0.1.1 kernel-pae-extra-2.6.27.56-0.1.1 - openSUSE 11.1 (ppc) [New Version: 2.6.27.56]: kernel-kdump-2.6.27.56-0.1.1 kernel-ppc64-2.6.27.56-0.1.1 kernel-ppc64-base-2.6.27.56-0.1.1 kernel-ppc64-extra-2.6.27.56-0.1.1 kernel-ps3-2.6.27.56-0.1.1 References: https://bugzilla.novell.com/595215 https://bugzilla.novell.com/642302 https://bugzilla.novell.com/642311 https://bugzilla.novell.com/642312 https://bugzilla.novell.com/642313 https://bugzilla.novell.com/642314 https://bugzilla.novell.com/642484 https://bugzilla.novell.com/642486 https://bugzilla.novell.com/643477 https://bugzilla.novell.com/645659 https://bugzilla.novell.com/646045 https://bugzilla.novell.com/651218 https://bugzilla.novell.com/651356 https://bugzilla.novell.com/651626 https://bugzilla.novell.com/652563 https://bugzilla.novell.com/652940 https://bugzilla.novell.com/652945 https://bugzilla.novell.com/653260

1 0

openSUSE-SU-2010:1042-1 (moderate): subversion security update
by opensuse-security＠opensuse.org 09 Dec '10

09 Dec '10

openSUSE Security Update: subversion security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1042-1 Rating: moderate References: #649861 Cross-References: CVE-2010-3315 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: when using "SVNPathAuthz short_circuit" mod_dav_svn didn't properly enforce access restrictions (CVE-2010-3315). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libsvn_auth_gnome_keyring-1-0-3423 - openSUSE 11.2: zypper in -t patch libsvn_auth_gnome_keyring-1-0-3423 - openSUSE 11.1: zypper in -t patch libsvn_auth_gnome_keyring-1-0-3423 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.6.9-4.3.1 libsvn_auth_kwallet-1-0-1.6.9-4.3.1 subversion-1.6.9-4.3.1 subversion-devel-1.6.9-4.3.1 subversion-perl-1.6.9-4.3.1 subversion-python-1.6.9-4.3.1 subversion-ruby-1.6.9-4.3.1 subversion-server-1.6.9-4.3.1 subversion-tools-1.6.9-4.3.1 - openSUSE 11.2 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.6.6-1.3.1 libsvn_auth_kwallet-1-0-1.6.6-1.3.1 subversion-1.6.6-1.3.1 subversion-devel-1.6.6-1.3.1 subversion-perl-1.6.6-1.3.1 subversion-python-1.6.6-1.3.1 subversion-ruby-1.6.6-1.3.1 subversion-server-1.6.6-1.3.1 subversion-tools-1.6.6-1.3.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 1.5.7]: subversion-1.5.7-0.2.2 subversion-devel-1.5.7-0.2.2 subversion-perl-1.5.7-0.2.2 subversion-python-1.5.7-0.2.2 subversion-server-1.5.7-0.2.2 subversion-tools-1.5.7-0.2.2 References: http://support.novell.com/security/cve/CVE-2010-3315.html https://bugzilla.novell.com/649861

1 0

openSUSE-SU-2010:1041-1 (moderate): clamav: security vulnerabilities fixed by upgrade to version 0.96.5
by opensuse-security＠opensuse.org 09 Dec '10

09 Dec '10

openSUSE Security Update: clamav: security vulnerabilities fixed by upgrade to version 0.96.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1041-1 Rating: moderate References: #656548 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: Upgrade to version clamav 0.96.5 to fix: - CVE-2010-4260: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P): Denial of service bugs while parsing PDFs. - CVE-2010-4261: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P): Memory corruption due to an off-by-one error within the icon_cb() function. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch clamav-3644 - openSUSE 11.2: zypper in -t patch clamav-3644 - openSUSE 11.1: zypper in -t patch clamav-3644 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 0.96.5]: clamav-0.96.5-0.2.1 - openSUSE 11.3 (noarch) [New Version: 0.96.5]: clamav-db-0.96.5-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 0.96.5]: clamav-0.96.5-0.2.1 clamav-db-0.96.5-0.2.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 0.96.5]: clamav-0.96.5-0.1.1 clamav-db-0.96.5-0.1.1 References: https://bugzilla.novell.com/656548

1 0