July 2010 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2010:0427-1 (moderate): openldap: fixed MODRDN DoS, replicating inconsistencies and \0 character-DoS
by opensuse-security＠opensuse.org 24 Jul '10

24 Jul '10

openSUSE Security Update: openldap: fixed MODRDN DoS, replicating inconsistencies and \0 character-DoS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0427-1 Rating: moderate References: #612430 Cross-References: CVE-2010-0211 CVE-2010-0212 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The following issues have been fixed in OpenLDAP: specially crafted MODRDN operations can crash the OpenLDAP server (CVE-2010-0211 and CVE-2010-0212). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch openldap2-2727 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): openldap2-2.4.9-7.8 openldap2-client-2.4.9-7.8 - openSUSE 11.0 (i586 ppc x86_64): openldap2-back-meta-2.4.9-7.8 openldap2-back-perl-2.4.9-7.8 openldap2-devel-2.4.9-7.8 - openSUSE 11.0 (x86_64): openldap2-client-32bit-2.4.9-7.8 openldap2-devel-32bit-2.4.9-7.8 - openSUSE 11.0 (ppc): openldap2-client-64bit-2.4.9-7.8 openldap2-devel-64bit-2.4.9-7.8 References: http://support.novell.com/security/cve/CVE-2010-0211.html http://support.novell.com/security/cve/CVE-2010-0212.html https://bugzilla.novell.com/612430

1 0

openSUSE-SU-2010:0426-1 (moderate): lxsession security update
by opensuse-security＠opensuse.org 23 Jul '10

23 Jul '10

openSUSE Security Update: lxsession security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0426-1 Rating: moderate References: #622083 #623192 Cross-References: CVE-2010-2532 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: lxsession-logout did not properly lock the screen before suspending, hibernating and switching between users which could allow attackers with physical access to take control of the system to obtain sensitive information and / or execute arbitrary code in the context of the user who is currently logged in (CVE-2010-2532). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch lxsession-2776 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): lxsession-0.4.4-3.1.1 References: http://support.novell.com/security/cve/CVE-2010-2532.html https://bugzilla.novell.com/622083 https://bugzilla.novell.com/623192

1 0

openSUSE-SU-2010:0425-1 (important): ghostscript security update
by opensuse-security＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Security Update: ghostscript security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0425-1 Rating: important References: #559122 #605043 #608071 Cross-References: CVE-2009-4270 CVE-2009-4897 CVE-2010-1628 CVE-2010-1869 CVE-2010-2055 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: Specially crafted postscript (.ps) files could cause buffer overflows in ghostscript that could potentially be exploited to execute arbitrary code (CVE-2010-1628, CVE-2010-1869, CVE-2009-4270) ghostscript by default read some initialization files from the current working directory. Local attackers could potentially exploit that to have other users execute arbitrary commands by placing such files e.g. in /tmp (CVE-2010-2055). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch ghostscript-devel-2705 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): ghostscript-library-8.62-17.8 - openSUSE 11.0 (i586 ppc x86_64): ghostscript-devel-8.62-17.8 ghostscript-fonts-other-8.62-17.8 ghostscript-fonts-rus-8.62-17.8 ghostscript-fonts-std-8.62-17.8 ghostscript-ijs-devel-8.62-17.8 ghostscript-omni-8.62-17.8 ghostscript-x11-8.62-17.8 libgimpprint-4.2.7-258.8 libgimpprint-devel-4.2.7-258.8 References: http://support.novell.com/security/cve/CVE-2009-4270.html http://support.novell.com/security/cve/CVE-2009-4897.html http://support.novell.com/security/cve/CVE-2010-1628.html http://support.novell.com/security/cve/CVE-2010-1869.html http://support.novell.com/security/cve/CVE-2010-2055.html https://bugzilla.novell.com/559122 https://bugzilla.novell.com/605043 https://bugzilla.novell.com/608071

1 0

openSUSE-OU-2010:0424-1 (low): Download and Install Microsoft(r) TrueType Core Fonts
by maintenance＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Optional Update: Download and Install Microsoft(r) TrueType Core Fonts ______________________________________________________________________________ Announcement ID: openSUSE-OU-2010:0424-1 Rating: low References: #621540 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: Installing this update will download install the Core TrueType fonts to your system. For legal reasons we can't include the Microsoft(R) TrueType Core Fonts in our product. This patch downloads these fonts and installs them on your system. Please note that about 4 MByte data are downloaded additionality to this patch. The License for the fonts will be installed as /usr/share/doc/corefonts/EULA.html Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch flash-player-2713 pullin-msttf-fonts-2712 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch src): fetchmsttfonts-11.3-1.1.5 pullin-msttf-fonts-11.3.1-1.3.1 - openSUSE 11.3 (i586 src): flash-player-10.1.53.64-2.1.1 References: https://bugzilla.novell.com/621540

1 0

openSUSE-SU-2010:0423-1 (moderate): vte security update
by opensuse-security＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Security Update: vte security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0423-1 Rating: moderate References: #621097 Cross-References: CVE-2010-2713 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: VTE was vulnerable to an old title set+query attack which could be used by remote attackers to execute arbitrary code (CVE-2010-2713). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch vte-2729 - openSUSE 11.2: zypper in -t patch vte-2729 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): vte-0.24.1-2.1.1 - openSUSE 11.3 (i586 x86_64): vte-devel-0.24.1-2.1.1 - openSUSE 11.3 (noarch): vte-lang-0.24.1-2.1.1 - openSUSE 11.2 (i586 src x86_64) [New Version: 0.22.5]: vte-0.22.5-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 0.22.5]: vte-devel-0.22.5-0.2.1 - openSUSE 11.2 (noarch) [New Version: 0.22.5]: vte-lang-0.22.5-0.2.1 References: http://support.novell.com/security/cve/CVE-2010-2713.html https://bugzilla.novell.com/621097

1 0

openSUSE-SU-2010:0422-1 (moderate): opera: cross-origin loading of CSS stylesheets
by opensuse-security＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Security Update: opera: cross-origin loading of CSS stylesheets ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0422-1 Rating: moderate References: #583620 #607823 #615942 Cross-References: CVE-2010-0653 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. It includes one version update. Description: Opera was upgraded to the 10.60 release. It brings lots of new features, bugfixes and security fixes. Security fixes include: CVE-2010-0653: Opera permits cross-origin loading of CSS style sheets even when the style sheet download has an incorrect MIME type and the style sheet document is malformed, which allows remote HTTP servers to obtain sensitive information via a crafted document. CVE-2010-1993: Opera 9.52 does not properly handle an IFRAME element with a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (resource consumption) via an HTML document with many IFRAME elements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch opera-2681 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 10.60]: opera-10.60-0.1.1 References: http://support.novell.com/security/cve/CVE-2010-0653.html https://bugzilla.novell.com/583620 https://bugzilla.novell.com/607823 https://bugzilla.novell.com/615942

1 0

openSUSE-RU-2010:0421-1 (low): smolt: Trigger smolt run
by maintenance＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Recommended Update: smolt: Trigger smolt run ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0421-1 Rating: low References: #621540 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Installing this update will trigger the updater applets to ask about submitting the hardware information to smolts.org. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch pullin-flash-player-2715 smolt-2714 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): pullin-flash-player-11.3.1-2.1.1 - openSUSE 11.3 (noarch src): smolt-1.4.2.2-3.1.1 - openSUSE 11.3 (noarch): smolt-gui-1.4.2.2-3.1.1 References: https://bugzilla.novell.com/621540

1 0

openSUSE-SU-2010:0420-1 (moderate): libtiff security updates
by opensuse-security＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Security Update: libtiff security updates ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0420-1 Rating: moderate References: #612879 Cross-References: CVE-2010-2067 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: specially crafted tiff images could cause a buffer overflow in libtiff (CVE-2010-2067). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libtiff-devel-2720 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): tiff-3.9.2-5.1.1 - openSUSE 11.3 (i586 x86_64): libtiff-devel-3.9.2-5.1.1 libtiff3-3.9.2-5.1.1 - openSUSE 11.3 (x86_64): libtiff-devel-32bit-3.9.2-5.1.1 libtiff3-32bit-3.9.2-5.1.1 References: http://support.novell.com/security/cve/CVE-2010-2067.html https://bugzilla.novell.com/612879

1 0

openSUSE-RU-2010:0419-1 (critical): glibc: initgroups leaves out NIS groups on the second invocation
by maintenance＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Recommended Update: glibc: initgroups leaves out NIS groups on the second invocation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0419-1 Rating: critical References: #623098 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a bug in glibc: - bnc#607064: glibc initgroups leaves out NIS groups on the second invocation Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch glibc-2744 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 i686 src x86_64): glibc-2.11.2-3.1.1 - openSUSE 11.3 (i586 i686 x86_64): glibc-devel-2.11.2-3.1.1 - openSUSE 11.3 (i586 x86_64): glibc-html-2.11.2-3.1.1 glibc-i18ndata-2.11.2-3.1.1 glibc-info-2.11.2-3.1.1 glibc-locale-2.11.2-3.1.1 glibc-obsolete-2.11.2-3.1.1 glibc-profile-2.11.2-3.1.1 nscd-2.11.2-3.1.1 - openSUSE 11.3 (x86_64): glibc-32bit-2.11.2-3.1.1 glibc-devel-32bit-2.11.2-3.1.1 glibc-locale-32bit-2.11.2-3.1.1 glibc-profile-32bit-2.11.2-3.1.1 References: https://bugzilla.novell.com/623098

1 0

openSUSE-SU-2010:0418-1 (moderate): python-mako security update
by opensuse-security＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Security Update: python-mako security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0418-1 Rating: moderate References: #619134 Cross-References: CVE-2010-2480 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Python-mako was prone to a Cross-Site Scripting flaw due to improperly escaped single quotes (CVE-2010-2480). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch python-mako-2728 - openSUSE 11.2: zypper in -t patch python-mako-2728 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch src): python-mako-0.2.5-4.2.1 - openSUSE 11.2 (noarch src): python-mako-0.2.4-2.2.1 References: http://support.novell.com/security/cve/CVE-2010-2480.html https://bugzilla.novell.com/619134

1 0