July 2010 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2010:0417-1 (moderate): spideroak: Update to version 9681
by maintenance＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Recommended Update: spideroak: Update to version 9681 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0417-1 Rating: moderate References: #621581 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This updates SpiderOak to the latest official version, 9681 (bnc#621581). SpiderOak provides an easy, secure and consolidated free online backup, sync, sharing, access & storage solution. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch spideroak-9681-2748 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64) [New Version: 9681]: python-transaction-1.0a1-2.1.1 spideroak-9681-0.1.1 - openSUSE 11.3 (i586 x86_64): python-bsddb3-5.0.0-1.1 python-crypto-2.1.0-1.9 python-curl-7.19.0-3.2 python-louie-1.1-1.2 python-nose-0.11.1-1.2 python-zconfig-3.6.0-1.2 python-zodb3-3.6.0-1.2 python-zope-event-3.5.0-2.2 python-zope-proxy-3.6.0-1.2 - openSUSE 11.3 (noarch): python-asn1-0.0.11-1.2 python-cerealizer-0.7-1.2 python-concurrentloghandler-0.8.4-1.2 python-zc-lockfile-1.0.0-2.1 python-zdaemon-2.0.4-1.2 References: https://bugzilla.novell.com/621581

1 0

openSUSE-SU-2010:0416-1 (moderate): exim: fixes two local issues;CVE-2010-2023 and CVE-2010-2024
by opensuse-security＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Security Update: exim: fixes two local issues;CVE-2010-2023 and CVE-2010-2024 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0416-1 Rating: moderate References: #612549 Cross-References: CVE-2010-2023 CVE-2010-2024 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Two local vulnerabilities have been fixed in the exim MTA which allowed attackers to create arbitrary files or to change ownership of arbitrary files. CVE-2010-2023 and CVE-2010-2024 have been assigned to these issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch exim-2750 - openSUSE 11.2: zypper in -t patch exim-2750 - openSUSE 11.1: zypper in -t patch exim-2750 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): exim-4.71-4.1.1 - openSUSE 11.3 (i586 x86_64): eximon-4.71-4.1.1 eximstats-html-4.71-4.1.1 - openSUSE 11.2 (i586 src x86_64): exim-4.69-72.4.1 - openSUSE 11.2 (i586 x86_64): eximon-4.69-72.4.1 eximstats-html-4.69-72.4.1 - openSUSE 11.1 (i586 ppc src x86_64): exim-4.69-70.14.1 - openSUSE 11.1 (i586 ppc x86_64): eximon-4.69-70.14.1 eximstats-html-4.69-70.14.1 References: http://support.novell.com/security/cve/CVE-2010-2023.html http://support.novell.com/security/cve/CVE-2010-2024.html https://bugzilla.novell.com/612549

1 0

openSUSE-SU-2010:0414-1 (low): clamav: remote denial of service
by opensuse-security＠opensuse.org 21 Jul '10

21 Jul '10

openSUSE Security Update: clamav: remote denial of service ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0414-1 Rating: low References: #608188 Cross-References: CVE-2010-1639 CVE-2010-1640 CVE-2010-2077 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes one version update. Description: This update fixes a off-by-one buffer overflow (CVE-2010-1640) and a crash while parsing PDFs (CVE-2010-1639, CVE-2010-2077) in clamav that can be used as a remote denial of service attack. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch clamav-2478 - openSUSE 11.1: zypper in -t patch clamav-2478 - openSUSE 11.0: zypper in -t patch clamav-2478 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 0.96.1]: clamav-0.96.1-0.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 0.96.1]: clamav-db-0.96.1-0.1.1 - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 0.96.1]: clamav-0.96.1-0.1.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 0.96.1]: clamav-db-0.96.1-0.1.1 - openSUSE 11.0 (i586 ppc src x86_64) [New Version: 0.96.1]: clamav-0.96.1-0.1 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 0.96.1]: clamav-db-0.96.1-0.1 References: http://support.novell.com/security/cve/CVE-2010-1639.html http://support.novell.com/security/cve/CVE-2010-1640.html http://support.novell.com/security/cve/CVE-2010-2077.html https://bugzilla.novell.com/608188

1 0

openSUSE-RU-2010:0410-1 (moderate): spideroak: Update to version 9681
by maintenance＠opensuse.org 20 Jul '10

20 Jul '10

openSUSE Recommended Update: spideroak: Update to version 9681 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0410-1 Rating: moderate References: #621581 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This updates SpiderOak to the latest official version, 9681 (bnc#621581). SpiderOak provides an easy, secure and consolidated free online backup, sync, sharing, access & storage solution. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch spideroak-9681-2748 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64) [New Version: 9681]: python-transaction-1.0a1-2.1.1 spideroak-9681-0.1.1 - openSUSE 11.3 (i586 x86_64): python-bsddb3-5.0.0-1.1 python-crypto-2.1.0-1.9 python-curl-7.19.0-3.2 python-louie-1.1-1.2 python-nose-0.11.1-1.2 python-zconfig-3.6.0-1.2 python-zodb3-3.6.0-1.2 python-zope-event-3.5.0-2.2 python-zope-proxy-3.6.0-1.2 - openSUSE 11.3 (noarch): python-asn1-0.0.11-1.2 python-cerealizer-0.7-1.2 python-concurrentloghandler-0.8.4-1.2 python-zc-lockfile-1.0.0-2.1 python-zdaemon-2.0.4-1.2 References: https://bugzilla.novell.com/621581

1 0

openSUSE-SU-2010:0404-1 (moderate): vte security update
by opensuse-security＠opensuse.org 20 Jul '10

20 Jul '10

openSUSE Security Update: vte security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0404-1 Rating: moderate References: #621097 Cross-References: CVE-2010-2713 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: VTE was vulnerable to an old title set+query attack which could be used by remote attackers to execute arbitrary code (CVE-2010-2713). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch vte-2729 - openSUSE 11.2: zypper in -t patch vte-2729 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): vte-0.24.1-2.1.1 - openSUSE 11.3 (i586 x86_64): vte-devel-0.24.1-2.1.1 - openSUSE 11.3 (noarch): vte-lang-0.24.1-2.1.1 - openSUSE 11.2 (i586 src x86_64) [New Version: 0.22.5]: vte-0.22.5-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 0.22.5]: vte-devel-0.22.5-0.2.1 - openSUSE 11.2 (noarch) [New Version: 0.22.5]: vte-lang-0.22.5-0.2.1 References: http://support.novell.com/security/cve/CVE-2010-2713.html https://bugzilla.novell.com/621097

1 0

openSUSE-RU-2010:0402-1 (critical): glibc: initgroups leaves out NIS groups on the second invocation
by maintenance＠opensuse.org 20 Jul '10

20 Jul '10

openSUSE Recommended Update: glibc: initgroups leaves out NIS groups on the second invocation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0402-1 Rating: critical References: #623098 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a bug in glibc: - bnc#607064: glibc initgroups leaves out NIS groups on the second invocation Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch glibc-2744 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 i686 src x86_64): glibc-2.11.2-3.1.1 - openSUSE 11.3 (x86_64): glibc-32bit-2.11.2-3.1.1 References: https://bugzilla.novell.com/623098

1 0

openSUSE-SU-2010:0397-1 (important): Linux Kernel: Security/Bugfix update to 2.6.27.48
by opensuse-security＠opensuse.org 19 Jul '10

19 Jul '10

openSUSE Security Update: Linux Kernel: Security/Bugfix update to 2.6.27.48 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0397-1 Rating: important References: #465707 #543480 #557710 #559111 #567376 #569916 #574006 #577967 #583677 #584216 #590415 #591371 #591556 #593881 #596113 #596462 #597337 #599213 #599955 #600774 #601283 #602969 #604183 #608366 #608576 #608933 #609134 #610296 #612213 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.48 fixing various bugs and security issues. CVE-2010-1641: The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS ioctl request. CVE-2010-1087: The nfs_wait_on_request function in fs/nfs/pagelist.c in the Linux kernel allows attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an operation that is not interruptible. CVE-2010-1643: mm/shmem.c in the Linux kernel, when strict overcommit is enabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. CVE-2010-1437: Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function. CVE-2010-1446: arch/powerpc/mm/fsl_booke_mmu.c in KGDB in the Linux kernel, when running on PowerPC, does not properly perform a security check for access to a kernel page, which allows local users to overwrite arbitrary kernel memory, related to Fsl booke. CVE-2010-1162: The release_one_tty function in drivers/char/tty_io.c in the Linux kernel omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors. CVE-2009-4537: drivers/net/r8169.c in the r8169 driver in the Linux kernel does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters, related to the value of the status register and erroneous behavior associated with the RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch kernel-2695 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 2.6.27.48]: kernel-source-2.6.27.48-0.1.1 kernel-syms-2.6.27.48-0.1.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 2.6.27.48]: kernel-default-2.6.27.48-0.1.1 kernel-default-base-2.6.27.48-0.1.1 kernel-default-extra-2.6.27.48-0.1.1 kernel-vanilla-2.6.27.48-0.1.1 - openSUSE 11.1 (i586 x86_64) [New Version: 2.6.27.48]: kernel-debug-2.6.27.48-0.1.1 kernel-debug-base-2.6.27.48-0.1.1 kernel-debug-extra-2.6.27.48-0.1.1 kernel-trace-2.6.27.48-0.1.1 kernel-trace-base-2.6.27.48-0.1.1 kernel-trace-extra-2.6.27.48-0.1.1 kernel-xen-2.6.27.48-0.1.1 kernel-xen-base-2.6.27.48-0.1.1 kernel-xen-extra-2.6.27.48-0.1.1 - openSUSE 11.1 (noarch src): kernel-docs-2.6.3-3.13.109 - openSUSE 11.1 (i586) [New Version: 2.6.27.48]: kernel-pae-2.6.27.48-0.1.1 kernel-pae-base-2.6.27.48-0.1.1 kernel-pae-extra-2.6.27.48-0.1.1 - openSUSE 11.1 (ppc) [New Version: 2.6.27.48]: kernel-kdump-2.6.27.48-0.1.1 kernel-ppc64-2.6.27.48-0.1.1 kernel-ppc64-base-2.6.27.48-0.1.1 kernel-ppc64-extra-2.6.27.48-0.1.1 kernel-ps3-2.6.27.48-0.1.1 References: https://bugzilla.novell.com/465707 https://bugzilla.novell.com/543480 https://bugzilla.novell.com/557710 https://bugzilla.novell.com/559111 https://bugzilla.novell.com/567376 https://bugzilla.novell.com/569916 https://bugzilla.novell.com/574006 https://bugzilla.novell.com/577967 https://bugzilla.novell.com/583677 https://bugzilla.novell.com/584216 https://bugzilla.novell.com/590415 https://bugzilla.novell.com/591371 https://bugzilla.novell.com/591556 https://bugzilla.novell.com/593881 https://bugzilla.novell.com/596113 https://bugzilla.novell.com/596462 https://bugzilla.novell.com/597337 https://bugzilla.novell.com/599213 https://bugzilla.novell.com/599955 https://bugzilla.novell.com/600774 https://bugzilla.novell.com/601283 https://bugzilla.novell.com/602969 https://bugzilla.novell.com/604183 https://bugzilla.novell.com/608366 https://bugzilla.novell.com/608576 https://bugzilla.novell.com/608933 https://bugzilla.novell.com/609134 https://bugzilla.novell.com/610296 https://bugzilla.novell.com/612213

1 0

openSUSE-SU-2010:0393-1 (low): w3m security update (CVE-2010-2074) to handle 0 characters in x509 certificates properly.
by opensuse-security＠opensuse.org 19 Jul '10

19 Jul '10

openSUSE Security Update: w3m security update (CVE-2010-2074) to handle 0 characters in x509 certificates properly. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0393-1 Rating: low References: #609451 Cross-References: CVE-2010-2074 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: w3m did not handle embedded nul characters in the common name and in subject alternative names of x509 certificates. CVE-2010-2074 has been assigned to this issue. This update also turns on verification of x509 certificates by default which was not the case before. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch w3m-2559 - openSUSE 11.1: zypper in -t patch w3m-2559 - openSUSE 11.0: zypper in -t patch w3m-2559 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): w3m-0.5.2-132.2.1 - openSUSE 11.2 (i586 x86_64): w3m-inline-image-0.5.2-132.2.1 - openSUSE 11.1 (i586 ppc src x86_64): w3m-0.5.2-128.7.1 - openSUSE 11.1 (i586 ppc x86_64): w3m-inline-image-0.5.2-128.7.1 - openSUSE 11.0 (i586 ppc src x86_64): w3m-0.5.2-90.2 - openSUSE 11.0 (i586 ppc x86_64): w3m-inline-image-0.5.2-90.2 References: http://support.novell.com/security/cve/CVE-2010-2074.html https://bugzilla.novell.com/609451

1 0

openSUSE-RU-2010:0392-1 (low): libQtWebKit: Update to QtWebKit from 4.5.3
by maintenance＠opensuse.org 19 Jul '10

19 Jul '10

openSUSE Recommended Update: libQtWebKit: Update to QtWebKit from 4.5.3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0392-1 Rating: low References: #600468 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides an update of QtWebKit rendering engine to the one shipped in Qt 4.5.3, which fixes: Canvas (r40546, r41221 r41355, r42996, r43645) Memory (r41527, r43764, r43828, r43830) JavaScript (r39882, r40086, r40131, r40133) Rendering (r41285, r41296, r41659, r42887) Network (r41664, r42516, r42747) Plugins (r41346, r43550, r43915, r43917, r43923) Clipboard (r41360) SVG (r43590, r43795) * Backported various security fixes (r41262, r41568, r41741, r41854, r42081, r42216, r42223, r42333, r42365, r42532, r42533, r44010) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch libQtWebKit-devel-2660 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): libQtWebKit-devel-4.4.0-12.8 - openSUSE 11.0 (i586 ppc x86_64): libQtWebKit4-4.4.0-12.8 libqt4-devel-doc-4.4.0-12.8 qt4-x11-tools-4.4.0-12.8 References: https://bugzilla.novell.com/600468

1 0

openSUSE-SU-2010:0387-1 (moderate): libtiff security updates
by opensuse-security＠opensuse.org 16 Jul '10

16 Jul '10

openSUSE Security Update: libtiff security updates ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0387-1 Rating: moderate References: #612879 Cross-References: CVE-2010-2067 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: specially crafted tiff images could cause a buffer overflow in libtiff (CVE-2010-2067). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch tiff-2720 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): tiff-3.9.2-5.1.1 References: http://support.novell.com/security/cve/CVE-2010-2067.html https://bugzilla.novell.com/612879

1 0