August 2010 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2010:0532-1 (low): pulseaudio: Fix setup-pulseaudio script to set up the environment variables correctly.
by maintenance＠opensuse.org 23 Aug '10

23 Aug '10

openSUSE Recommended Update: pulseaudio: Fix setup-pulseaudio script to set up the environment variables correctly. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0532-1 Rating: low References: #619859 #623837 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: The setup-pulseaudio script included in 11.3 pulseaudio package doesn't set the environment variables correctly for enabling/disabling PulseAudio support. This update fixes the script so that the variables are properly set. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libpulse-browse0-2948 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): pulseaudio-0.9.21-10.1.1 - openSUSE 11.3 (i586 x86_64): libpulse-browse0-0.9.21-10.1.1 libpulse-devel-0.9.21-10.1.1 libpulse-mainloop-glib0-0.9.21-10.1.1 libpulse0-0.9.21-10.1.1 pulseaudio-esound-compat-0.9.21-10.1.1 pulseaudio-gdm-hooks-0.9.21-10.1.1 pulseaudio-module-bluetooth-0.9.21-10.1.1 pulseaudio-module-gconf-0.9.21-10.1.1 pulseaudio-module-jack-0.9.21-10.1.1 pulseaudio-module-lirc-0.9.21-10.1.1 pulseaudio-module-x11-0.9.21-10.1.1 pulseaudio-module-zeroconf-0.9.21-10.1.1 pulseaudio-utils-0.9.21-10.1.1 - openSUSE 11.3 (x86_64): libpulse-mainloop-glib0-32bit-0.9.21-10.1.1 libpulse0-32bit-0.9.21-10.1.1 - openSUSE 11.3 (noarch): pulseaudio-lang-0.9.21-10.1.1 References: https://bugzilla.novell.com/619859 https://bugzilla.novell.com/623837

1 0

openSUSE-RU-2010:0531-1 (low): NetworkManager: Remove call to NFS restart
by maintenance＠opensuse.org 23 Aug '10

23 Aug '10

openSUSE Recommended Update: NetworkManager: Remove call to NFS restart ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0531-1 Rating: low References: #559021 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The NetworkManager start does no longer run NFS restart during NetworkManager startup (bnc#559021) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch NetworkManager-2941 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): NetworkManager-0.8-8.2.1 - openSUSE 11.3 (i586 x86_64): NetworkManager-devel-0.8-8.2.1 NetworkManager-doc-0.8-8.2.1 NetworkManager-glib-0.8-8.2.1 References: https://bugzilla.novell.com/559021

1 0

openSUSE-RU-2010:0530-1 (moderate): inputattach: Fix syntax errors in the init script
by maintenance＠opensuse.org 23 Aug '10

23 Aug '10

openSUSE Recommended Update: inputattach: Fix syntax errors in the init script ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0530-1 Rating: moderate References: #629911 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes bug #629911 that causes syntax error whenever trying to run the init script. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch input-utils-2927 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): input-utils-2007.06.22-165.1.1 References: https://bugzilla.novell.com/629911

1 0

openSUSE-SU-2010:0430-4 (important): MozillaThunderbird: Update to 3.0.6 security release
by opensuse-security＠opensuse.org 23 Aug '10

23 Aug '10

openSUSE Security Update: MozillaThunderbird: Update to 3.0.6 security release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0430-4 Rating: important References: #622506 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes two new package versions. Description: This update brings Mozilla Thunderbird to the 3.0.6 security release. It fixes following security bugs: MFSA 2010-34 / CVE-2010-1211: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Jesse Ruderman, Ehsan Akhgari, Mats Palmgren, Igor Bukanov, Gary Kwong, Tobias Markus and Daniel Holbert reported memory safety problems that affected Firefox 3.6 and Firefox 3.5. MFSA 2010-39 / CVE-2010-2752: Security researcher J23 reported via TippingPoint's Zero Day Initiative that an array class used to store CSS values contained an integer overflow vulnerability. The 16 bit integer value used in allocating the size of the array could overflow, resulting in too small a memory buffer being created. When the array was later populated with CSS values data would be written past the end of the buffer potentially resulting in the execution of attacker-controlled memory. MFSA 2010-40 / CVE-2010-2753: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an integer overflow vulnerability in the implementation of the XUL <tree> element's selection attribute. When the size of a new selection is sufficiently large the integer used in calculating the length of the selection can overflow, resulting in a bogus range being marked selected. When adjustSelection is then called on the bogus range the range is deleted leaving dangling references to the ranges which could be used by an attacker to call into deleted memory and run arbitrary code on a victim's computer. MFSA 2010-41 / CVE-2010-1205: OUSPG researcher Aki Helin reported a buffer overflow in Mozilla graphics code which consumes image data processed by libpng. A malformed PNG file could be created which would cause libpng to incorrectly report the size of the image to downstream consumers. When the dimensions of such images are underreported, the Mozilla code responsible for displaying the graphic will allocate too small a memory buffer to contain the image data and will wind up writing data past the end of the buffer. This could result in the execution of attacker-controlled memory. MFSA 2011-42 / CVE-2010-1213: Security researcher Yosuke Hasegawa reported that the Web Worker method importScripts can read and parse resources from other domains even when the content is not valid JavaScript. This is a violation of the same-origin policy and could be used by an attacker to steal information from other sites. MFSA 2010-46 / CVE-2010-0654: Google security researcher Chris Evans reported that data can be read across domains by injecting bogus CSS selectors into a target site and then retrieving the data using JavaScript APIs. If an attacker can inject opening and closing portions of a CSS selector into points A and B of a target page, then the region between the two injection points becomes readable to JavaScript through, for example, the getComputedStyle() API. MFSA 2010-47 / CVE-2010-2754: Security researcher Soroush Dalili reported that potentially sensitive URL parameters could be leaked across domains upon script errors when the script filename and line number is included in the error message. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch MozillaThunderbird-2755 - openSUSE 11.2: zypper in -t patch MozillaThunderbird-2755 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64) [New Version: 3.0.6]: MozillaThunderbird-3.0.6-0.1.1 - openSUSE 11.3 (i586 x86_64) [New Version: 3.0.6]: MozillaThunderbird-devel-3.0.6-0.1.1 MozillaThunderbird-translations-common-3.0.6-0.1.1 MozillaThunderbird-translations-other-3.0.6-0.1.1 enigmail-1.0.1-3.1.1 - openSUSE 11.2 (i586 src x86_64) [New Version: 3.0.6]: MozillaThunderbird-3.0.6-0.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.0.1 and 3.0.6]: MozillaThunderbird-devel-3.0.6-0.1.1 MozillaThunderbird-translations-common-3.0.6-0.1.1 MozillaThunderbird-translations-other-3.0.6-0.1.1 enigmail-1.0.1-1.1.1 References: https://bugzilla.novell.com/622506

1 0

openSUSE-RU-2010:0528-1 (moderate): xfig: After the last security update for ghostscript it is unable to import .eps files. Fixed by this update.
by maintenance＠opensuse.org 19 Aug '10

19 Aug '10

openSUSE Recommended Update: xfig: After the last security update for ghostscript it is unable to import .eps files. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0528-1 Rating: moderate References: #629462 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The following bug is fixed by this update: After the last security update for ghostscript, xfig is unable to import .eps files (bnc#629462) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch xfig-2905 - openSUSE 11.2: zypper in -t patch xfig-2905 - openSUSE 11.1: zypper in -t patch xfig-2905 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): xfig-3.2.5b-6.1.1 - openSUSE 11.2 (i586 src x86_64): xfig-3.2.5-136.2.1 - openSUSE 11.1 (i586 ppc src x86_64): xfig-3.2.5-92.60.1 References: https://bugzilla.novell.com/629462

1 0

openSUSE-RU-2010:0527-1 (low): exiv2: Add pkg-config provides
by maintenance＠opensuse.org 19 Aug '10

19 Aug '10

openSUSE Recommended Update: exiv2: Add pkg-config provides ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0527-1 Rating: low References: #625466 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update adds pkg-config provides to the package. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch exiv2-2928 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): exiv2-0.19-5.1.1 - openSUSE 11.3 (i586 x86_64): libexiv2-6-0.19-5.1.1 libexiv2-devel-0.19-5.1.1 - openSUSE 11.3 (x86_64): libexiv2-6-32bit-0.19-5.1.1 - openSUSE 11.3 (noarch): exiv2-lang-0.19-5.1.1 References: https://bugzilla.novell.com/625466

1 0

openSUSE-RU-2010:0525-1 (low): cups-drivers-splix: splix should not contain PPDs for printers which require JBIG. Fixed by this update.
by maintenance＠opensuse.org 19 Aug '10

19 Aug '10

openSUSE Recommended Update: cups-drivers-splix: splix should not contain PPDs for printers which require JBIG. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0525-1 Rating: low References: #628698 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update remove all PPD files that require the patented JBIG library. This update also fix PPDs paths. Cups is now able to locate CMS files. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch cups-drivers-splix-2923 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): cups-drivers-splix-2.0.0-2.1.1 References: https://bugzilla.novell.com/628698

1 0

openSUSE-RU-2010:0524-1 (low): lvm2: "lvcreate --snapshot" results in scary error messages. Fixed by this update.
by maintenance＠opensuse.org 19 Aug '10

19 Aug '10

openSUSE Recommended Update: lvm2: "lvcreate --snapshot" results in scary error messages. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0524-1 Rating: low References: #556177 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: "lvcreate --snapshot" results in scary error messages to console and /var/log/messages. This bug is fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch device-mapper-2924 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): device-mapper-1.02.49-4.1.1 lvm2-2.02.67-4.1.1 - openSUSE 11.3 (i586 x86_64): device-mapper-devel-1.02.49-4.1.1 - openSUSE 11.3 (x86_64): device-mapper-32bit-1.02.49-4.1.1 References: https://bugzilla.novell.com/556177

1 0

openSUSE-SU-2010:0519-1 (moderate): perl: Fixed two Safe.pm security issues and some bugs
by opensuse-security＠opensuse.org 18 Aug '10

18 Aug '10

openSUSE Security Update: perl: Fixed two Safe.pm security issues and some bugs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0519-1 Rating: moderate References: #446098 #515948 #528423 #557636 #588338 #596167 #601242 #603840 #605918 #605928 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: perl Safe.pm module was affected by two problems where attackers could break out of such a safed execution. (CVE-2010-1447 , CVE-2010-1168) This update fixes this problem. Also the following bugs were fixed: - fix tell cornercase [bnc#596167] - fix regex memory leak [bnc#557636] - also run h2ph on /usr/include/linux [bnc#603840] - backport h2ph include fix from 5.12.0 [bnc#601242] - fix segfault when using regexpes in threaded apps [bnc#588338] - backport upstream fixes for POSIX module to avoid clashes with Fcntl [bnc#446098], [bnc#515948] - backport upstream fix for ISA assertion failure [bnc#528423] - move unicode files from perl-doc to perl, otherwise some perl modules will not work Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch perl-2829 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc src x86_64): perl-5.10.0-62.19.1 - openSUSE 11.1 (i586 ppc x86_64): perl-base-5.10.0-62.19.1 perl-doc-5.10.0-62.19.1 - openSUSE 11.1 (x86_64): perl-32bit-5.10.0-62.19.1 perl-base-32bit-5.10.0-62.19.1 - openSUSE 11.1 (ppc): perl-64bit-5.10.0-62.19.1 perl-base-64bit-5.10.0-62.19.1 References: https://bugzilla.novell.com/446098 https://bugzilla.novell.com/515948 https://bugzilla.novell.com/528423 https://bugzilla.novell.com/557636 https://bugzilla.novell.com/588338 https://bugzilla.novell.com/596167 https://bugzilla.novell.com/601242 https://bugzilla.novell.com/603840 https://bugzilla.novell.com/605918 https://bugzilla.novell.com/605928

1 0

openSUSE-SU-2010:0518-1 (moderate): perl: Fixed two Safe.pm security issues and some bugs
by opensuse-security＠opensuse.org 18 Aug '10

18 Aug '10

openSUSE Security Update: perl: Fixed two Safe.pm security issues and some bugs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0518-1 Rating: moderate References: #557636 #596167 #601242 #603840 #605918 #605928 #624628 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: perl Safe.pm module was affected by two problems where attackers could break out of such a safed execution. (CVE-2010-1447 , CVE-2010-1168) This update fixes this problem. Also following non-security bugs were fixed: - fix tell cornercase [bnc#596167] - fix regex memory leak [bnc#557636] - do not add vendorlib/auto to filelist [bnc#624628] - also run h2ph on /usr/include/linux [bnc#603840] - backport h2ph include fix from 5.12.0 [bnc#601242] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch perl-2830 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): perl-5.10.0-72.7.1 - openSUSE 11.2 (i586 x86_64): perl-base-5.10.0-72.7.1 perl-doc-5.10.0-72.7.1 - openSUSE 11.2 (x86_64): perl-32bit-5.10.0-72.7.1 perl-base-32bit-5.10.0-72.7.1 References: https://bugzilla.novell.com/557636 https://bugzilla.novell.com/596167 https://bugzilla.novell.com/601242 https://bugzilla.novell.com/603840 https://bugzilla.novell.com/605918 https://bugzilla.novell.com/605928 https://bugzilla.novell.com/624628

1 0