April 2010 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2010:0156-1 (low): glib2 security update
by opensuse-security＠opensuse.org 26 Apr '10

26 Apr '10

openSUSE Security Update: glib2 security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0156-1 Rating: low References: #500520 #538005 Cross-References: CVE-2009-3289 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. It includes one version update. Description: The when copying symbolic links the g_file_copy function set the target of the link to mode 0777 therefore exposing potentially sensitive information or allowing other user to modify files they should not have access to (CVE-2009-3289). This update also fixes a problem where glib2 couldn't access remote URLs when run outside of a gnome session. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch glib2-1828 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc src x86_64): glib2-2.18.2-5.4.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 0]: glib2-branding-upstream-2.18.2-5.4.1 glib2-devel-2.18.2-5.4.1 glib2-doc-2.18.2-5.4.1 glib2-lang-2.18.2-5.4.1 libgio-2_0-0-2.18.2-5.4.1 libgio-fam-2.18.2-5.4.1 libglib-2_0-0-2.18.2-5.4.1 libgmodule-2_0-0-2.18.2-5.4.1 libgobject-2_0-0-2.18.2-5.4.1 libgthread-2_0-0-2.18.2-5.4.1 - openSUSE 11.1 (x86_64) [New Version: 0]: libgio-2_0-0-32bit-2.18.2-5.4.1 libglib-2_0-0-32bit-2.18.2-5.4.1 libgmodule-2_0-0-32bit-2.18.2-5.4.1 libgobject-2_0-0-32bit-2.18.2-5.4.1 libgthread-2_0-0-32bit-2.18.2-5.4.1 - openSUSE 11.1 (ppc) [New Version: 0]: libgio-2_0-0-64bit-2.18.2-5.4.1 libglib-2_0-0-64bit-2.18.2-5.4.1 libgmodule-2_0-0-64bit-2.18.2-5.4.1 libgobject-2_0-0-64bit-2.18.2-5.4.1 libgthread-2_0-0-64bit-2.18.2-5.4.1 References: http://support.novell.com/security/cve/CVE-2009-3289.html https://bugzilla.novell.com/500520 https://bugzilla.novell.com/538005

1 0

openSUSE-SU-2010:0155-1 (low): glib2 security update
by opensuse-security＠opensuse.org 26 Apr '10

26 Apr '10

openSUSE Security Update: glib2 security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0155-1 Rating: low References: #538005 Cross-References: CVE-2009-3289 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: The when copying symbolic links the g_file_copy function set the target of the link to mode 0777 therefore exposing potentially sensitive information or allowing other user to modify files they should not have access to (CVE-2009-3289). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch glib2-1822 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): glib2-2.16.3-20.8 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 0]: glib2-branding-upstream-2.16.3-20.8 glib2-devel-2.16.3-20.8 glib2-doc-2.16.3-20.8 libgio-2_0-0-2.16.3-20.8 libgio-fam-2.16.3-20.8 libglib-2_0-0-2.16.3-20.8 libgmodule-2_0-0-2.16.3-20.8 libgobject-2_0-0-2.16.3-20.8 libgthread-2_0-0-2.16.3-20.8 - openSUSE 11.0 (x86_64) [New Version: 0]: libgio-2_0-0-32bit-2.16.3-20.8 libglib-2_0-0-32bit-2.16.3-20.8 libgmodule-2_0-0-32bit-2.16.3-20.8 libgobject-2_0-0-32bit-2.16.3-20.8 libgthread-2_0-0-32bit-2.16.3-20.8 - openSUSE 11.0 (ppc) [New Version: 0]: glib2-devel-64bit-2.16.3-20.8 libgio-2_0-0-64bit-2.16.3-20.8 libglib-2_0-0-64bit-2.16.3-20.8 libgmodule-2_0-0-64bit-2.16.3-20.8 libgobject-2_0-0-64bit-2.16.3-20.8 libgthread-2_0-0-64bit-2.16.3-20.8 References: http://support.novell.com/security/cve/CVE-2009-3289.html https://bugzilla.novell.com/538005

1 0

openSUSE-SU-2010:0154-1 (low): mediawiki security update
by opensuse-security＠opensuse.org 26 Apr '10

26 Apr '10

openSUSE Security Update: mediawiki security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0154-1 Rating: low References: #592574 Cross-References: CVE-2010-1189 CVE-2010-1190 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: MediaWiki was prone to a CSS validation flaw and data leakage vulnerability (CVE-2010-1189, CVE-2010-1190). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch mediawiki-2356 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): mediawiki-1.11.2-36.4 References: http://support.novell.com/security/cve/CVE-2010-1189.html http://support.novell.com/security/cve/CVE-2010-1190.html https://bugzilla.novell.com/592574

1 0

openSUSE-RU-2010:0152-1 (critical): lighttpd: It doesn't start after the last openssl update when "ssl.use-sslv2" is disabled. Fixed by this update.
by maintenance＠opensuse.org 23 Apr '10

23 Apr '10

openSUSE Recommended Update: lighttpd: It doesn't start after the last openssl update when "ssl.use-sslv2" is disabled. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0152-1 Rating: critical References: #597765 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: bnc #597765: lighttpd doesn't start after the last openssl update when "ssl.use-sslv2" is disabled. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch lighttpd-2350 - openSUSE 11.1: zypper in -t patch lighttpd-2350 - openSUSE 11.0: zypper in -t patch lighttpd-2350 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): lighttpd-1.4.20-3.8.2 - openSUSE 11.2 (i586 x86_64): lighttpd-mod_cml-1.4.20-3.8.2 lighttpd-mod_magnet-1.4.20-3.8.2 lighttpd-mod_mysql_vhost-1.4.20-3.8.2 lighttpd-mod_rrdtool-1.4.20-3.8.2 lighttpd-mod_trigger_b4_dl-1.4.20-3.8.2 lighttpd-mod_webdav-1.4.20-3.8.2 - openSUSE 11.1 (i586 ppc src x86_64): lighttpd-1.4.20-2.6.1 - openSUSE 11.1 (i586 ppc x86_64): lighttpd-mod_cml-1.4.20-2.6.1 lighttpd-mod_magnet-1.4.20-2.6.1 lighttpd-mod_mysql_vhost-1.4.20-2.6.1 lighttpd-mod_rrdtool-1.4.20-2.6.1 lighttpd-mod_trigger_b4_dl-1.4.20-2.6.1 lighttpd-mod_webdav-1.4.20-2.6.1 - openSUSE 11.0 (i586 ppc src x86_64): lighttpd-1.4.19-6.8 - openSUSE 11.0 (i586 ppc x86_64): lighttpd-mod_cml-1.4.19-6.8 lighttpd-mod_magnet-1.4.19-6.8 lighttpd-mod_mysql_vhost-1.4.19-6.8 lighttpd-mod_rrdtool-1.4.19-6.8 lighttpd-mod_trigger_b4_dl-1.4.19-6.8 lighttpd-mod_webdav-1.4.19-6.8 References: https://bugzilla.novell.com/597765

1 0

openSUSE-SU-2010:0149-1 (low): clamav update
by opensuse-security＠opensuse.org 23 Apr '10

23 Apr '10

openSUSE Security Update: clamav update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0149-1 Rating: low References: #587363 Cross-References: CVE-2010-0098 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: clamav has been updated to version 0.96. Citing freshmeat.net: This Release introduces new malware detection mechanisms and other significant improvements to the scan engine. Key features include the bytecode interpreter, heuristic improvements, signature improvements, support for new archives, support for new executable file formats, support for UPX 3.0, performance improvements and memory optimizations. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch clamav-2263 - openSUSE 11.1: zypper in -t patch clamav-2263 - openSUSE 11.0: zypper in -t patch clamav-2263 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 0.96]: clamav-0.96-0.3.1 - openSUSE 11.2 (i586 x86_64) [New Version: 0.96]: clamav-db-0.96-0.3.1 - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 0.96]: clamav-0.96-0.3.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 0.96]: clamav-db-0.96-0.3.1 - openSUSE 11.0 (i586 ppc src x86_64) [New Version: 0.96]: clamav-0.96-0.3 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 0.96]: clamav-db-0.96-0.3 References: http://support.novell.com/security/cve/CVE-2010-0098.html https://bugzilla.novell.com/587363

1 0

openSUSE-SU-2010:0147-1 (moderate): krb5 security update
by opensuse-security＠opensuse.org 22 Apr '10

22 Apr '10

openSUSE Security Update: krb5 security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0147-1 Rating: moderate References: #596002 Cross-References: CVE-2010-1320 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted requests be authenticated remote attackers could crash the KDC (CVE-2010-1320). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch krb5-2348 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): krb5-1.7-6.5.1 krb5-mini-1.7-6.5.1 - openSUSE 11.2 (i586 x86_64): krb5-apps-clients-1.7-6.5.1 krb5-apps-servers-1.7-6.5.1 krb5-client-1.7-6.5.1 krb5-devel-1.7-6.5.1 krb5-mini-devel-1.7-6.5.1 krb5-plugin-kdb-ldap-1.7-6.5.1 krb5-plugin-preauth-pkinit-1.7-6.5.1 krb5-server-1.7-6.5.1 - openSUSE 11.2 (x86_64): krb5-32bit-1.7-6.5.1 krb5-devel-32bit-1.7-6.5.1 References: http://support.novell.com/security/cve/CVE-2010-1320.html https://bugzilla.novell.com/596002

1 0

openSUSE-RU-2010:0142-1 (moderate): cifs-mount: Fix workgroup enumeration, for client printer and file share selection.
by maintenance＠opensuse.org 22 Apr '10

22 Apr '10

openSUSE Recommended Update: cifs-mount: Fix workgroup enumeration, for client printer and file share selection. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0142-1 Rating: moderate References: #591636 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: Fix workgroup enumeration, for client printer and file share selection; (bso#6880); (bnc#586215) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch cifs-mount-2288 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 3.4.3]: samba-3.4.3-3.3.1 - openSUSE 11.2 (i586 x86_64) [New Version: 3.4.3]: cifs-mount-3.4.3-3.3.1 ldapsmb-1.34b-3.3.1 libnetapi-devel-3.4.3-3.3.1 libnetapi0-3.4.3-3.3.1 libsmbclient-devel-3.4.3-3.3.1 libsmbclient0-3.4.3-3.3.1 libsmbsharemodes-devel-3.4.3-3.3.1 libsmbsharemodes0-3.4.3-3.3.1 libtalloc-devel-3.4.3-3.3.1 libtalloc1-3.4.3-3.3.1 libtdb-devel-3.4.3-3.3.1 libtdb1-3.4.3-3.3.1 libwbclient-devel-3.4.3-3.3.1 libwbclient0-3.4.3-3.3.1 samba-client-3.4.3-3.3.1 samba-devel-3.4.3-3.3.1 samba-krb-printing-3.4.3-3.3.1 samba-winbind-3.4.3-3.3.1 - openSUSE 11.2 (noarch src) [New Version: 3.4.3]: samba-doc-3.4.3-3.3.1 - openSUSE 11.2 (x86_64) [New Version: 3.4.3]: libsmbclient0-32bit-3.4.3-3.3.1 libtalloc1-32bit-3.4.3-3.3.1 libtdb1-32bit-3.4.3-3.3.1 libwbclient0-32bit-3.4.3-3.3.1 samba-32bit-3.4.3-3.3.1 samba-client-32bit-3.4.3-3.3.1 samba-winbind-32bit-3.4.3-3.3.1 References: https://bugzilla.novell.com/591636

1 0

openSUSE-SU-2010:0140-1 (critical): SUN Java security update
by opensuse-security＠opensuse.org 22 Apr '10

22 Apr '10

openSUSE Security Update: SUN Java security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0140-1 Rating: critical References: #596010 Cross-References: CVE-2010-0887 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Oracle has released JRE 6 Update 20 in order to fix potential remote code execution vulnerabilities (CVE-2010-0887). Please refer to Oracle's site for more information: http://www.oracle.com/technology/deploy/security/alerts/aler t-cve-2010-0886.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch java-1_6_0-sun-2345 - openSUSE 11.1: zypper in -t patch java-1_6_0-sun-2345 - openSUSE 11.0: zypper in -t patch java-1_6_0-sun-2345 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64) [New Version: 1.6.0.u20]: java-1_6_0-sun-1.6.0.u20-0.1.1 java-1_6_0-sun-alsa-1.6.0.u20-0.1.1 java-1_6_0-sun-demo-1.6.0.u20-0.1.1 java-1_6_0-sun-devel-1.6.0.u20-0.1.1 java-1_6_0-sun-jdbc-1.6.0.u20-0.1.1 java-1_6_0-sun-plugin-1.6.0.u20-0.1.1 java-1_6_0-sun-src-1.6.0.u20-0.1.1 - openSUSE 11.1 (i586 x86_64) [New Version: 1.6.0.u20]: java-1_6_0-sun-1.6.0.u20-0.1.1 java-1_6_0-sun-alsa-1.6.0.u20-0.1.1 java-1_6_0-sun-devel-1.6.0.u20-0.1.1 java-1_6_0-sun-jdbc-1.6.0.u20-0.1.1 java-1_6_0-sun-plugin-1.6.0.u20-0.1.1 java-1_6_0-sun-src-1.6.0.u20-0.1.1 - openSUSE 11.0 (i586 x86_64) [New Version: 1.6.0.u20]: java-1_6_0-sun-1.6.0.u20-0.1 java-1_6_0-sun-alsa-1.6.0.u20-0.1 java-1_6_0-sun-demo-1.6.0.u20-0.1 java-1_6_0-sun-devel-1.6.0.u20-0.1 java-1_6_0-sun-jdbc-1.6.0.u20-0.1 java-1_6_0-sun-plugin-1.6.0.u20-0.1 java-1_6_0-sun-src-1.6.0.u20-0.1 References: http://support.novell.com/security/cve/CVE-2010-0887.html https://bugzilla.novell.com/596010

1 0

openSUSE-SU-2010:0137-1 (critical): acroread security update
by opensuse-security＠opensuse.org 21 Apr '10

21 Apr '10

openSUSE Security Update: acroread security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0137-1 Rating: critical References: #595108 Cross-References: CVE-2010-0190 CVE-2010-0191 CVE-2010-0192 CVE-2010-0193 CVE-2010-0194 CVE-2010-0195 CVE-2010-0196 CVE-2010-0197 CVE-2010-0198 CVE-2010-0199 CVE-2010-0201 CVE-2010-0202 CVE-2010-0203 CVE-2010-0204 CVE-2010-1241 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. It includes three new package versions. Description: Specially crafted PDF documents could crash acroread or even lead to execution of arbitrary code (CVE-2010-0190, CVE-2010-0191, CVE-2010-0192, CVE-2010-0193 CVE-2010-0194, CVE-2010-0195, CVE-2010-0196, CVE-2010-0197 CVE-2010-0198, CVE-2010-0199, CVE-2010-0201, CVE-2010-0202 CVE-2010-0203, CVE-2010-0204, CVE-2010-1241). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch acroread-2321 - openSUSE 11.1: zypper in -t patch acroread-2321 - openSUSE 11.0: zypper in -t patch acroread-2321 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (noarch) [New Version: 9.3.2]: acroread-cmaps-9.3.2-0.2.1 acroread-fonts-ja-9.3.2-0.2.1 acroread-fonts-ko-9.3.2-0.2.1 acroread-fonts-zh_CN-9.3.2-0.2.1 acroread-fonts-zh_TW-9.3.2-0.2.1 - openSUSE 11.2 (i586) [New Version: 9.3.2]: acroread-9.3.2-0.2.1 - openSUSE 11.1 (noarch) [New Version: 9.3.2]: acroread-cmaps-9.3.2-0.1.1 acroread-fonts-ja-9.3.2-0.1.1 acroread-fonts-ko-9.3.2-0.1.1 acroread-fonts-zh_CN-9.3.2-0.1.1 acroread-fonts-zh_TW-9.3.2-0.1.1 - openSUSE 11.1 (i586) [New Version: 9.3.2]: acroread-9.3.2-0.1.1 - openSUSE 11.0 (noarch) [New Version: 9.3.2]: acroread-cmaps-9.3.2-0.1 acroread-fonts-ja-9.3.2-0.1 acroread-fonts-ko-9.3.2-0.1 acroread-fonts-zh_CN-9.3.2-0.1 acroread-fonts-zh_TW-9.3.2-0.1 - openSUSE 11.0 (i586) [New Version: 9.3.2]: acroread-9.3.2-0.1 References: http://support.novell.com/security/cve/CVE-2010-0190.html http://support.novell.com/security/cve/CVE-2010-0191.html http://support.novell.com/security/cve/CVE-2010-0192.html http://support.novell.com/security/cve/CVE-2010-0193.html http://support.novell.com/security/cve/CVE-2010-0194.html http://support.novell.com/security/cve/CVE-2010-0195.html http://support.novell.com/security/cve/CVE-2010-0196.html http://support.novell.com/security/cve/CVE-2010-0197.html http://support.novell.com/security/cve/CVE-2010-0198.html http://support.novell.com/security/cve/CVE-2010-0199.html http://support.novell.com/security/cve/CVE-2010-0201.html http://support.novell.com/security/cve/CVE-2010-0202.html http://support.novell.com/security/cve/CVE-2010-0203.html http://support.novell.com/security/cve/CVE-2010-0204.html http://support.novell.com/security/cve/CVE-2010-1241.html https://bugzilla.novell.com/595108

1 0

openSUSE-RU-2010:0134-1 (important): pcsc-cyberjack: cyberjack cardreader is not accessible. Fixed by this update.
by maintenance＠opensuse.org 19 Apr '10

19 Apr '10

openSUSE Recommended Update: pcsc-cyberjack: cyberjack cardreader is not accessible. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0134-1 Rating: important References: #555660 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: cyberjack cardreader is not accessible under openSUSE 11.2. Support for this cardreader is added by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch ctapi-cyberjack-2274 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 3.3.5]: pcsc-cyberjack-3.3.5-1.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 3.3.5]: ctapi-cyberjack-3.3.5-1.1.1 - openSUSE 11.2 (x86_64) [New Version: 3.3.5]: ctapi-cyberjack-32bit-3.3.5-1.1.1 References: https://bugzilla.novell.com/555660

1 0