July 2010 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2010:0386-1 (important): OpenOffice: security update to fix python macro execution
by opensuse-security＠opensuse.org 16 Jul '10

16 Jul '10

openSUSE Security Update: OpenOffice: security update to fix python macro execution ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0386-1 Rating: important References: #607095 Cross-References: CVE-2010-0395 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of OpenOffice_org does not allow macros written in Python to be executed without permission, CVE-2010-0395. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch OpenOffice_org-base-drivers-postgresql-2578 - openSUSE 11.1: zypper in -t patch OpenOffice_org-base-drivers-postgresql-2578 - openSUSE 11.0: zypper in -t patch OpenOffice_org-2581 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): OpenOffice_org-libs-core-3.1.1.4-1.3.1 - openSUSE 11.2 (i586 x86_64): OpenOffice_org-base-drivers-postgresql-3.1.1.4-1.3.1 OpenOffice_org-gnome-3.1.1.4-1.3.1 OpenOffice_org-kde-3.1.1.4-1.3.1 OpenOffice_org-kde4-3.1.1.4-1.3.1 OpenOffice_org-libs-core-devel-3.1.1.4-1.3.1 OpenOffice_org-libs-core-l10n-prebuilt-3.1.1.4-1.3.1 OpenOffice_org-mailmerge-3.1.1.4-1.3.1 - openSUSE 11.1 (i586 ppc src x86_64): OpenOffice_org-libs-core-3.0.0.9-1.12.1 - openSUSE 11.1 (i586 ppc x86_64): OpenOffice_org-base-drivers-postgresql-3.0.0.9-1.12.1 OpenOffice_org-gnome-3.0.0.9-1.12.1 OpenOffice_org-kde-3.0.0.9-1.12.1 OpenOffice_org-libs-core-devel-3.0.0.9-1.12.1 OpenOffice_org-libs-core-l10n-prebuilt-3.0.0.9-1.12.1 OpenOffice_org-mailmerge-3.0.0.9-1.12.1 - openSUSE 11.0 (i586 ppc src x86_64): OpenOffice_org-2.4.0.14-1.8 - openSUSE 11.0 (i586 ppc x86_64): OpenOffice_org-base-2.4.0.14-1.8 OpenOffice_org-branding-upstream-2.4.0.14-1.8 OpenOffice_org-calc-2.4.0.14-1.8 OpenOffice_org-devel-2.4.0.14-1.8 OpenOffice_org-draw-2.4.0.14-1.8 OpenOffice_org-filters-2.4.0.14-1.8 OpenOffice_org-gnome-2.4.0.14-1.8 OpenOffice_org-icon-themes-prebuilt-2.4.0.14-1.8 OpenOffice_org-impress-2.4.0.14-1.8 OpenOffice_org-kde-2.4.0.14-1.8 OpenOffice_org-mailmerge-2.4.0.14-1.8 OpenOffice_org-math-2.4.0.14-1.8 OpenOffice_org-mono-2.4.0.14-1.8 OpenOffice_org-officebean-2.4.0.14-1.8 OpenOffice_org-pyuno-2.4.0.14-1.8 OpenOffice_org-sdk-2.4.0.14-1.8 OpenOffice_org-sdk-doc-2.4.0.14-1.8 OpenOffice_org-testtool-2.4.0.14-1.8 OpenOffice_org-writer-2.4.0.14-1.8 References: http://support.novell.com/security/cve/CVE-2010-0395.html https://bugzilla.novell.com/607095

1 0

openSUSE-RU-2010:0384-1 (low): ksh: Collective update for ksh
by maintenance＠opensuse.org 16 Jul '10

16 Jul '10

openSUSE Recommended Update: ksh: Collective update for ksh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0384-1 Rating: low References: #502622 #520598 #523212 #548558 #555938 #561405 #564967 #585244 #591248 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. It includes one version update. Description: Collective update for ksh version 93t, including the following fixes: - #502622: ksh: assigning to SECONDS in a subshell causes corruption/crash - #520598: memory leak in ksh - #523212: ksh error when "~user" is used and NIS is enabled - #555938: ksh cursor position regression - #561405: ksh JM 93t+ 2009-01-20 bug - #564967: Trap does not work on signals over 16 in ksh - #585244: regression: ksh not detecting exit status correctly - #591248: Unreliable results in ksh when trapping SIGCHILD Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch ksh-2299 - openSUSE 11.1: zypper in -t patch ksh-2299 - openSUSE 11.0: zypper in -t patch ksh-2299 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): ksh-93t-165.3.1 - openSUSE 11.2 (i586 x86_64): ksh-devel-93t-165.3.1 - openSUSE 11.1 (i586 ppc src x86_64): ksh-93t-6.6.1 - openSUSE 11.1 (i586 ppc x86_64): ksh-devel-93t-6.6.1 - openSUSE 11.0 (i586 ppc src x86_64) [New Version: 93t]: ksh-93t-22.1 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 93t]: ksh-devel-93t-22.1 References: https://bugzilla.novell.com/502622 https://bugzilla.novell.com/520598 https://bugzilla.novell.com/523212 https://bugzilla.novell.com/548558 https://bugzilla.novell.com/555938 https://bugzilla.novell.com/561405 https://bugzilla.novell.com/564967 https://bugzilla.novell.com/585244 https://bugzilla.novell.com/591248

1 0

openSUSE-SU-2010:0383-1 (moderate): python-mako security update
by opensuse-security＠opensuse.org 16 Jul '10

16 Jul '10

openSUSE Security Update: python-mako security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0383-1 Rating: moderate References: #619134 Cross-References: CVE-2010-2480 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Python-mako was prone to a Cross-Site Scripting flaw due to improperly escaped single quotes (CVE-2010-2480). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch python-mako-2728 - openSUSE 11.2: zypper in -t patch python-mako-2728 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch src): python-mako-0.2.5-4.2.1 - openSUSE 11.2 (noarch src): python-mako-0.2.4-2.2.1 References: http://support.novell.com/security/cve/CVE-2010-2480.html https://bugzilla.novell.com/619134

1 0

openSUSE-OU-2010:0373-2 (low): Download and Install Microsoft(r) TrueType Core Fonts
by maintenance＠opensuse.org 15 Jul '10

15 Jul '10

openSUSE Optional Update: Download and Install Microsoft(r) TrueType Core Fonts ______________________________________________________________________________ Announcement ID: openSUSE-OU-2010:0373-2 Rating: low References: #621540 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: Installing this update will download install the Core TrueType fonts to your system. For legal reasons we can't include the Microsoft(R) TrueType Core Fonts in our product. This patch downloads these fonts and installs them on your system. Please note that about 4 MByte data are downloaded additionality to this patch. The License for the fonts will be installed as /usr/share/doc/corefonts/EULA.html Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch pullin-msttf-fonts-2712 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch src): fetchmsttfonts-11.3-1.1.5 pullin-msttf-fonts-11.3.1-1.3.1 References: https://bugzilla.novell.com/621540

1 0

openSUSE-OU-2010:0373-1 (low): flash-player: openSUSE maintained Flash Player 10.1
by maintenance＠opensuse.org 14 Jul '10

14 Jul '10

openSUSE Optional Update: flash-player: openSUSE maintained Flash Player 10.1 ______________________________________________________________________________ Announcement ID: openSUSE-OU-2010:0373-1 Rating: low References: #621540 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This patch adds an openSUSE maintained Adobe Flash Player to openSUSE 11.3. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch flash-player-2713 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src): flash-player-10.1.53.64-2.1.1 References: https://bugzilla.novell.com/621540

1 0

openSUSE-RU-2010:0372-1 (low): smolt: Trigger smolt run
by maintenance＠opensuse.org 14 Jul '10

14 Jul '10

openSUSE Recommended Update: smolt: Trigger smolt run ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0372-1 Rating: low References: #621540 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Installing this update will trigger the updater applets to ask about submitting the hardware information to smolts.org. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch pullin-flash-player-2715 smolt-2714 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): pullin-flash-player-11.3.1-2.1.1 - openSUSE 11.3 (noarch src): smolt-1.4.2.2-3.1.1 References: https://bugzilla.novell.com/621540

1 0

openSUSE-SU-2010:0371-1 (moderate): postgresql: security update to fix four vulnerabilities
by opensuse-security＠opensuse.org 13 Jul '10

13 Jul '10

openSUSE Security Update: postgresql: security update to fix four vulnerabilities ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0371-1 Rating: moderate References: #588996 #605845 #605926 #607778 Cross-References: CVE-2010-0733 CVE-2010-1169 CVE-2010-1170 CVE-2010-1975 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes two new package versions. Description: This update of postgresql was pblished to fix several minor security vulnerabilities: - CVE-2010-1975: postgresql does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings. - CVE-2010-1170: The PL/Tcl implementation in postgresql loads Tcl code from the pltcl_modules table regardless of the table's ownership and permissions, which allows remote authenticated users, with database-creation privileges, to execute arbitrary Tcl code. - CVE-2010-1169: Postgresql does not properly restrict PL/perl procedures, which allows remote authenticated users, with database-creation privileges, to execute arbitrary Perl code via a crafted script. - CVE-2010-0733: An integer overflow in postgresql allows remote authenticated users to crash the daemon via a SELECT statement. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch postgresql-2472 - openSUSE 11.1: zypper in -t patch postgresql-2472 - openSUSE 11.0: zypper in -t patch postgresql-2472 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 8.4.4]: postgresql-8.4.4-0.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 8.4.4]: postgresql-contrib-8.4.4-0.1.1 postgresql-devel-8.4.4-0.1.1 postgresql-docs-8.4.4-0.1.1 postgresql-libs-8.4.4-0.1.1 postgresql-plperl-8.4.4-0.1.1 postgresql-plpython-8.4.4-0.1.1 postgresql-pltcl-8.4.4-0.1.1 postgresql-server-8.4.4-0.1.1 - openSUSE 11.2 (x86_64) [New Version: 8.4.4]: postgresql-libs-32bit-8.4.4-0.1.1 - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 8.3.11]: postgresql-8.3.11-0.1.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 8.3.11]: postgresql-contrib-8.3.11-0.1.1 postgresql-devel-8.3.11-0.1.1 postgresql-docs-8.3.11-0.1.1 postgresql-libs-8.3.11-0.1.1 postgresql-plperl-8.3.11-0.1.1 postgresql-plpython-8.3.11-0.1.1 postgresql-pltcl-8.3.11-0.1.1 postgresql-server-8.3.11-0.1.1 - openSUSE 11.1 (x86_64) [New Version: 8.3.11]: postgresql-libs-32bit-8.3.11-0.1.1 - openSUSE 11.1 (ppc) [New Version: 8.3.11]: postgresql-libs-64bit-8.3.11-0.1.1 - openSUSE 11.0 (i586 ppc ppc64 src x86_64) [New Version: 8.3.11]: postgresql-8.3.11-0.1 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 8.3.11]: postgresql-contrib-8.3.11-0.1 postgresql-devel-8.3.11-0.1 postgresql-docs-8.3.11-0.1 postgresql-libs-8.3.11-0.1 postgresql-plperl-8.3.11-0.1 postgresql-plpython-8.3.11-0.1 postgresql-pltcl-8.3.11-0.1 postgresql-server-8.3.11-0.1 - openSUSE 11.0 (x86_64) [New Version: 8.3.11]: postgresql-libs-32bit-8.3.11-0.1 - openSUSE 11.0 (ppc) [New Version: 8.3.11]: postgresql-libs-64bit-8.3.11-0.1 References: http://support.novell.com/security/cve/CVE-2010-0733.html http://support.novell.com/security/cve/CVE-2010-1169.html http://support.novell.com/security/cve/CVE-2010-1170.html http://support.novell.com/security/cve/CVE-2010-1975.html https://bugzilla.novell.com/588996 https://bugzilla.novell.com/605845 https://bugzilla.novell.com/605926 https://bugzilla.novell.com/607778

1 0

openSUSE-SU-2010:0370-1 (moderate): opera: cross-origin loading of CSS stylesheets
by opensuse-security＠opensuse.org 13 Jul '10

13 Jul '10

openSUSE Security Update: opera: cross-origin loading of CSS stylesheets ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0370-1 Rating: moderate References: #583620 #607823 #615942 Cross-References: CVE-2010-0653 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. It includes one version update. Description: Opera was upgraded to the 10.60 release. It brings lots of new features, bugfixes and security fixes. Security fixes include: CVE-2010-0653: Opera permits cross-origin loading of CSS style sheets even when the style sheet download has an incorrect MIME type and the style sheet document is malformed, which allows remote HTTP servers to obtain sensitive information via a crafted document. CVE-2010-1993: Opera 9.52 does not properly handle an IFRAME element with a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (resource consumption) via an HTML document with many IFRAME elements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch opera-2681 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 10.60]: opera-10.60-0.1.1 References: http://support.novell.com/security/cve/CVE-2010-0653.html https://bugzilla.novell.com/583620 https://bugzilla.novell.com/607823 https://bugzilla.novell.com/615942

1 0

openSUSE-SU-2010:0368-1 (moderate): opera: Upgrade to 10.60 release
by opensuse-security＠opensuse.org 13 Jul '10

13 Jul '10

openSUSE Security Update: opera: Upgrade to 10.60 release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0368-1 Rating: moderate References: #583620 #607823 #615942 Cross-References: CVE-2010-0653 CVE-2010-1993 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. It includes one version update. Description: Opera was upgraded to the 10.60 release. It brings lots of new features, bugfixes and security fixes. Security fixes include: CVE-2010-0653: Opera permits cross-origin loading of CSS style sheets even when the style sheet download has an incorrect MIME type and the style sheet document is malformed, which allows remote HTTP servers to obtain sensitive information via a crafted document. CVE-2010-1993: Opera 9.52 does not properly handle an IFRAME element with a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (resource consumption) via an HTML document with many IFRAME elements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch opera-2673 - openSUSE 11.1: zypper in -t patch opera-2673 - openSUSE 11.0: zypper in -t patch opera-2673 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64) [New Version: 10.60]: opera-10.60-0.1.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 10.60]: opera-10.60-0.1.1 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 10.60]: opera-10.60-0.1 References: http://support.novell.com/security/cve/CVE-2010-0653.html http://support.novell.com/security/cve/CVE-2010-1993.html https://bugzilla.novell.com/583620 https://bugzilla.novell.com/607823 https://bugzilla.novell.com/615942

1 0

openSUSE-SU-2010:0366-1 (important): otrs: Fixed a vulnerability in OTRS-Core that allowed SQL-Injection
by opensuse-security＠opensuse.org 13 Jul '10

13 Jul '10

openSUSE Security Update: otrs: Fixed a vulnerability in OTRS-Core that allowed SQL-Injection ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0366-1 Rating: important References: #576066 Cross-References: CVE-2010-0438 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: OTRS was prone to multiple SQL-injection vulnerabilities which could allow remote authenticated attackers to execute arbitrary SQL code via unspecified vectors.(CVE-2010-0438). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch otrs-2702 - openSUSE 11.1: zypper in -t patch otrs-2702 - openSUSE 11.0: zypper in -t patch otrs-2702 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): otrs-2.2.6-46.3.1 - openSUSE 11.1 (i586 ppc src x86_64): otrs-2.2.6-45.18.1 - openSUSE 11.0 (i586 ppc src x86_64): otrs-2.2.6-15.3 References: http://support.novell.com/security/cve/CVE-2010-0438.html https://bugzilla.novell.com/576066

1 0