openSUSE Security Update: samba: Fixed various security issues
______________________________________________________________________________
Announcement ID: openSUSE-SU-2010:0346-1
Rating: important
References: #550002 #577868 #605935 #606947 #611927
Cross-References: CVE-2010-2063
Affected Products:
openSUSE 11.1
openSUSE 11.0
______________________________________________________________________________
An update that solves one vulnerability and has four fixes
is now available. It includes two new package versions.
Description:
This update of the Samba server package fixes security
issues and bugs.
Following security issues were fixed: CVE-2010-2063: A
buffer overrun was possible in chain_reply code in 3.3.x
and below, which could be used to crash the samba server or
potentially execute code.
CVE-2010-0787: Take extra care that a mount point of
mount.cifs isn't changed during mount.
Also the following bugs were fixed:
- Honor "interfaces" list in net ad dns register.
(bnc#606947)
- An uninitialized variable read could cause an smbd crash;
(bso#7254); (bnc#605935).
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 11.1:
zypper in -t patch cifs-mount-2543
- openSUSE 11.0:
zypper in -t patch cifs-mount-2543
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 11.1 (i586 ppc src x86_64) [New Version: 3.2.7]:
samba-3.2.7-11.7.1
- openSUSE 11.1 (i586 ppc x86_64) [New Version: 3.2.7]:
cifs-mount-3.2.7-11.7.1
ldapsmb-1.34b-6.7.1
libnetapi-devel-3.2.7-11.7.1
libnetapi0-3.2.7-11.7.1
libsmbclient-devel-3.2.7-11.7.1
libsmbclient0-3.2.7-11.7.1
libsmbsharemodes-devel-3.2.7-11.7.1
libsmbsharemodes0-3.2.7-11.7.1
libtalloc-devel-3.2.7-11.7.1
libtalloc1-3.2.7-11.7.1
libtdb-devel-3.2.7-11.7.1
libtdb1-3.2.7-11.7.1
libwbclient-devel-3.2.7-11.7.1
libwbclient0-3.2.7-11.7.1
samba-client-3.2.7-11.7.1
samba-devel-3.2.7-11.7.1
samba-krb-printing-3.2.7-11.7.1
samba-vscan-0.3.6b-6.7.1
samba-winbind-3.2.7-11.7.1
- openSUSE 11.1 (x86_64) [New Version: 3.2.7]:
libsmbclient0-32bit-3.2.7-11.7.1
libtalloc1-32bit-3.2.7-11.7.1
libtdb1-32bit-3.2.7-11.7.1
libwbclient0-32bit-3.2.7-11.7.1
samba-32bit-3.2.7-11.7.1
samba-client-32bit-3.2.7-11.7.1
samba-winbind-32bit-3.2.7-11.7.1
- openSUSE 11.1 (ppc) [New Version: 3.2.7]:
libsmbclient0-64bit-3.2.7-11.7.1
libtalloc1-64bit-3.2.7-11.7.1
libtdb1-64bit-3.2.7-11.7.1
libwbclient0-64bit-3.2.7-11.7.1
samba-64bit-3.2.7-11.7.1
samba-client-64bit-3.2.7-11.7.1
samba-winbind-64bit-3.2.7-11.7.1
- openSUSE 11.0 (i586 ppc src x86_64) [New Version: 3.2.4]:
samba-3.2.4-4.12
- openSUSE 11.0 (i586 ppc x86_64) [New Version: 3.2.4]:
cifs-mount-3.2.4-4.12
ldapsmb-1.34b-195.17
libnetapi-devel-3.2.4-4.12
libnetapi0-3.2.4-4.12
libsmbclient-devel-3.2.4-4.12
libsmbclient0-3.2.4-4.12
libsmbsharemodes-devel-3.2.4-4.12
libsmbsharemodes0-3.2.4-4.12
libtalloc-devel-3.2.4-4.12
libtalloc1-3.2.4-4.12
libtdb-devel-3.2.4-4.12
libtdb1-3.2.4-4.12
libwbclient-devel-3.2.4-4.12
libwbclient0-3.2.4-4.12
samba-client-3.2.4-4.12
samba-devel-3.2.4-4.12
samba-krb-printing-3.2.4-4.12
samba-winbind-3.2.4-4.12
- openSUSE 11.0 (x86_64) [New Version: 3.2.4]:
libsmbclient0-32bit-3.2.4-4.12
libtalloc1-32bit-3.2.4-4.12
libtdb1-32bit-3.2.4-4.12
libwbclient0-32bit-3.2.4-4.12
samba-32bit-3.2.4-4.12
samba-client-32bit-3.2.4-4.12
samba-winbind-32bit-3.2.4-4.12
- openSUSE 11.0 (ppc) [New Version: 3.2.4]:
libsmbclient0-64bit-3.2.4-4.12
libtalloc1-64bit-3.2.4-4.12
libtdb1-64bit-3.2.4-4.12
libwbclient0-64bit-3.2.4-4.12
samba-64bit-3.2.4-4.12
samba-client-64bit-3.2.4-4.12
samba-winbind-64bit-3.2.4-4.12
References:
http://support.novell.com/security/cve/CVE-2010-2063.htmlhttps://bugzilla.novell.com/550002https://bugzilla.novell.com/577868https://bugzilla.novell.com/605935https://bugzilla.novell.com/606947https://bugzilla.novell.com/611927
openSUSE Recommended Update: nagios-nrpe-client: Writes on installation to /etc/services without dependency of netcfg. Fixed by this update.
______________________________________________________________________________
Announcement ID: openSUSE-RU-2010:0341-1
Rating: low
References: #608164
Affected Products:
openSUSE 11.2
openSUSE 11.1
______________________________________________________________________________
An update that has one recommended fix can now be installed.
Description:
nagios-nrpe-client writes to /etc/services without having
an dependency on netcfg. As result the file /etc/services
can sometimes be nearly empty if nagios-nrpe-client is
installed before netcfg. Fixed by this update.
Patch Instructions:
To install this openSUSE Recommended Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 11.2:
zypper in -t patch nagios-nrpe-client-2582
- openSUSE 11.1:
zypper in -t patch nagios-nrpe-client-2582
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 11.2 (i586 x86_64):
nagios-nrpe-client-2.12-4.6.1
- openSUSE 11.2 (src):
nagios-nrpe-2.12-4.6.1
- openSUSE 11.1 (i586 ppc x86_64):
nagios-nrpe-client-2.12-3.3.1
- openSUSE 11.1 (src):
nagios-nrpe-2.12-3.3.1
References:
https://bugzilla.novell.com/608164
openSUSE Security Update: aria2: Update to 1.9.3 to fix a metalink name Directory Traversal Vulnerability
______________________________________________________________________________
Announcement ID: openSUSE-SU-2010:0338-1
Rating: important
References: #605937
Cross-References: CVE-2010-1512
Affected Products:
openSUSE 11.2
______________________________________________________________________________
An update that fixes one vulnerability is now available. It
includes one version update.
Description:
This aria2 update to 1.9.3 fixes a metalink name Directory
Traversal issue (CVE-2010-1512).
The version was also bumped from 1.8.2 to 1.9.3 to fix lots
of bugs.
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 11.2:
zypper in -t patch aria2-2515
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 11.2 (i586 src x86_64) [New Version: 1.9.3]:
aria2-1.9.3-0.1.1
References:
http://support.novell.com/security/cve/CVE-2010-1512.htmlhttps://bugzilla.novell.com/605937
openSUSE Recommended Update: NetworkManager-gnome: It crash when a profile is edit. Fixed by this update.
______________________________________________________________________________
Announcement ID: openSUSE-RU-2010:0335-1
Rating: moderate
References: #611630
Affected Products:
openSUSE 11.2
______________________________________________________________________________
An update that has one recommended fix can now be installed.
Description:
A crash occurs if a profile is edit by the user. This bug
is fixed by this update.
Patch Instructions:
To install this openSUSE Recommended Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 11.2:
zypper in -t patch NetworkManager-gnome-2516
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 11.2 (i586 src x86_64):
NetworkManager-gnome-0.7.1-5.5.1
References:
https://bugzilla.novell.com/611630
openSUSE Security Update: lftp: fixed a http client unexpected download filename vulnerability
______________________________________________________________________________
Announcement ID: openSUSE-SU-2010:0334-1
Rating: important
References: #606319
Cross-References: CVE-2010-2251
Affected Products:
openSUSE 11.2
openSUSE 11.1
openSUSE 11.0
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update of lftp improves the filename handling of
downloaded files to avoid downloading arbitrary content to
unexpected locations (like .login). (CVE-2010-2251)
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 11.2:
zypper in -t patch lftp-2534
- openSUSE 11.1:
zypper in -t patch lftp-2534
- openSUSE 11.0:
zypper in -t patch lftp-2534
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 11.2 (i586 src x86_64):
lftp-3.6.3-58.2.1
- openSUSE 11.1 (i586 ppc src x86_64):
lftp-3.6.3-5.68.1
- openSUSE 11.0 (i586 ppc src x86_64):
lftp-3.6.3-28.2
References:
http://support.novell.com/security/cve/CVE-2010-2251.htmlhttps://bugzilla.novell.com/606319
openSUSE Recommended Update: unzip: Encoding of Cyrillic filenames in zip archive, created under Windows, is incorrect. Fixed by this update.
______________________________________________________________________________
Announcement ID: openSUSE-RU-2010:0331-1
Rating: low
References: #540598
Affected Products:
openSUSE 11.2
______________________________________________________________________________
An update that has one recommended fix can now be installed.
Description:
This update adds the use of librcc0 to unzip. So from now
unzip can correctly encode Cyrillic and Czech file names.
Patch Instructions:
To install this openSUSE Recommended Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 11.2:
zypper in -t patch librcc-devel-2496
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 11.2 (i586 src x86_64):
librcc0-0.2.9-1.1.1
librcd0-0.1.13-1.1.1
unzip-5.52-143.5.1
- openSUSE 11.2 (i586 x86_64):
librcc-devel-0.2.9-1.1.1
librcd-devel-0.1.13-1.1.1
rcc-runtime-0.2.9-1.1.1
References:
https://bugzilla.novell.com/540598
openSUSE Recommended Update: viewvc: Fix exceptions on various cases
______________________________________________________________________________
Announcement ID: openSUSE-RU-2010:0330-1
Rating: moderate
References: #612090
Affected Products:
openSUSE 11.2
openSUSE 11.1
openSUSE 11.0
______________________________________________________________________________
An update that has one recommended fix can now be
installed. It includes two new package versions.
Description:
This updates viewvc to version 1.1.6:
* add rudimentary support for WSGI-based deployments
* fix exception caused by trying to HTML-escape non-string
data
* fix incorrect RSS feed Content-Type header
* fix RSS <title> encoding problem
* allow 'svndbadmin purge' to work on missing repositories
Patch Instructions:
To install this openSUSE Recommended Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 11.2:
zypper in -t patch viewvc-2523
- openSUSE 11.1:
zypper in -t patch viewvc-2522
- openSUSE 11.0:
zypper in -t patch viewvc-2522
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 11.2 (noarch src) [New Version: 1.1.6]:
viewvc-1.1.6-0.1.1
- openSUSE 11.1 (i586 ppc src x86_64) [New Version: 1.0.12]:
viewvc-1.0.12-0.1.1
- openSUSE 11.0 (i586 ppc src x86_64) [New Version: 1.0.12]:
viewvc-1.0.12-0.1
References:
https://bugzilla.novell.com/612090
openSUSE Security Update: libtiff: integer overflow can lead to corrupted heap
______________________________________________________________________________
Announcement ID: openSUSE-SU-2010:0324-1
Rating: important
References: #605837
Cross-References: CVE-2010-1411
Affected Products:
openSUSE 11.2
openSUSE 11.1
openSUSE 11.0
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update of libtiff fixes several integer overflows that
could lead to a corrupted heap memory. This bug can be
exploited remotely with a crafted TIFF file to cause an
application crash or probably to execute arbitrary code.
(CVE-2010-1411)
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 11.2:
zypper in -t patch libtiff-devel-2477
- openSUSE 11.1:
zypper in -t patch libtiff-devel-2477
- openSUSE 11.0:
zypper in -t patch libtiff-devel-2477
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 11.2 (i586 src x86_64):
tiff-3.8.2-145.4.1
- openSUSE 11.2 (i586 x86_64):
libtiff-devel-3.8.2-145.4.1
libtiff3-3.8.2-145.4.1
- openSUSE 11.2 (x86_64):
libtiff-devel-32bit-3.8.2-145.4.1
libtiff3-32bit-3.8.2-145.4.1
- openSUSE 11.1 (i586 ppc src x86_64):
tiff-3.8.2-133.39.1
- openSUSE 11.1 (i586 ppc x86_64):
libtiff-devel-3.8.2-133.39.1
libtiff3-3.8.2-133.39.1
- openSUSE 11.1 (x86_64):
libtiff-devel-32bit-3.8.2-133.39.1
libtiff3-32bit-3.8.2-133.39.1
- openSUSE 11.1 (ppc):
libtiff-devel-64bit-3.8.2-133.39.1
libtiff3-64bit-3.8.2-133.39.1
- openSUSE 11.0 (i586 ppc src x86_64):
tiff-3.8.2-108.9
- openSUSE 11.0 (i586 ppc x86_64):
libtiff-devel-3.8.2-108.9
libtiff3-3.8.2-108.9
- openSUSE 11.0 (x86_64):
libtiff-devel-32bit-3.8.2-108.9
libtiff3-32bit-3.8.2-108.9
- openSUSE 11.0 (ppc):
libtiff-devel-64bit-3.8.2-108.9
libtiff3-64bit-3.8.2-108.9
References:
http://support.novell.com/security/cve/CVE-2010-1411.htmlhttps://bugzilla.novell.com/605837