September 2010 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2010:0629-1 (low): rpm: Fix security problem where we miss to clear the SUID/SGID bits during package updates.
by opensuse-security＠opensuse.org 16 Sep '10

16 Sep '10

openSUSE Security Update: rpm: Fix security problem where we miss to clear the SUID/SGID bits during package updates. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0629-1 Rating: low References: #445037 #456695 #457908 #536256 #552622 #572280 #592269 #610941 Cross-References: CVE-2010-2059 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that solves one vulnerability and has 7 fixes is now available. Description: This update fixes the problem where RPM misses to clear the SUID/SGID bit of old files during package updates. (CVE-2010-2059) Also following bugfixes were merged from SLE11: - make 'rpmconfigcheck status' exit with 4 [bnc#592269] - do not use glibc for passwd/group lookups when --root is used [bnc#536256] - disable cpio md5 checking for repackaged rpms [bnc#572280] - Add rpm-4.4.2.3-no-order-rescan-limit.patch from upstream (bnc#552622) - backport lazy statfs patch [fate#302038] - define disttag as optional tag with macro just like disturl - add popt-devel and rpm-devel to baselibs config (bnc#445037) - brp-symlink: whitelist kde4 doc path (bnc#457908) - find-supplements.ksyms: Module aliases may contain special characters that rpm does not allow in dependencies, such as commas. Encode those as %XX to avoid generating broken dependencies (bnc#456695). - find-debuginfo.sh: Don't convert to binary. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch popt-2531 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): popt-1.7-20.4.1 popt-devel-1.7-20.4.1 rpm-4.4.2.3-20.4.1 rpm-devel-4.4.2.3-20.4.1 rpm-devel-static-4.4.2.3-20.4.1 - openSUSE 11.1 (x86_64): popt-32bit-1.7-20.4.1 rpm-32bit-4.4.2.3-20.4.1 - openSUSE 11.1 (ppc): popt-64bit-1.7-20.4.1 rpm-64bit-4.4.2.3-20.4.1 References: http://support.novell.com/security/cve/CVE-2010-2059.html https://bugzilla.novell.com/445037 https://bugzilla.novell.com/456695 https://bugzilla.novell.com/457908 https://bugzilla.novell.com/536256 https://bugzilla.novell.com/552622 https://bugzilla.novell.com/572280 https://bugzilla.novell.com/592269 https://bugzilla.novell.com/610941

1 0

openSUSE-SU-2010:0627-1 (low): rpm: Fix security problem where we miss to clear the SUID/SGID bits during package updates.
by opensuse-security＠opensuse.org 16 Sep '10

16 Sep '10

openSUSE Security Update: rpm: Fix security problem where we miss to clear the SUID/SGID bits during package updates. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0627-1 Rating: low References: #536256 #558475 #572280 #610941 Cross-References: CVE-2010-2059 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update fixes the problem where RPM misses to clear the SUID/SGID bit of old files during package updates. (CVE-2010-2059) Also following bugs were fixed: - backport nosource/nopatch srpm tag generation fix - backport spurious tar message fix [bnc#558475] - do not use glibc for passwd/group lookups when --root is used [bnc#536256] - disable cpio md5 checking for repackaged rpms [bnc#572280] - fix endless loop when rpm database lock fails Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch rpm-2528 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): rpm-4.7.1-6.8.1 rpm-devel-4.7.1-6.8.1 - openSUSE 11.2 (x86_64): rpm-32bit-4.7.1-6.8.1 References: http://support.novell.com/security/cve/CVE-2010-2059.html https://bugzilla.novell.com/536256 https://bugzilla.novell.com/558475 https://bugzilla.novell.com/572280 https://bugzilla.novell.com/610941

1 0

openSUSE-SU-2010:0625-1 (important): libvirt security update
by opensuse-security＠opensuse.org 16 Sep '10

16 Sep '10

openSUSE Security Update: libvirt security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0625-1 Rating: important References: #618155 #619991 Cross-References: CVE-2010-2237 CVE-2010-2238 CVE-2010-2239 CVE-2010-2242 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: libvirt did not properly handle configured disk formats which potenially allowed users to read arbitrary files (CVE-2010-2237, CVE-2010-2238, CVE-2010-2239) Improperly mapped source privileged ports in guests may allow obtaining privileged resources on the host (CVE-2010-2242). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libvirt-2903 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libvirt-0.8.1-4.2.1 libvirt-client-0.8.1-4.2.1 libvirt-devel-0.8.1-4.2.1 libvirt-doc-0.8.1-4.2.1 libvirt-python-0.8.1-4.2.1 References: http://support.novell.com/security/cve/CVE-2010-2237.html http://support.novell.com/security/cve/CVE-2010-2238.html http://support.novell.com/security/cve/CVE-2010-2239.html http://support.novell.com/security/cve/CVE-2010-2242.html https://bugzilla.novell.com/618155 https://bugzilla.novell.com/619991

1 0

openSUSE-SU-2010:0621-1 (important): VUL-0: multiple issues in libvirt
by opensuse-security＠opensuse.org 16 Sep '10

16 Sep '10

openSUSE Security Update: VUL-0: multiple issues in libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0621-1 Rating: important References: #618155 Cross-References: CVE-2010-2242 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Improperly mapped source privileged ports in guests may allow obtaining privileged resources on the host (CVE-2010-2242). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch libvirt-2783 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): libvirt-0.4.6-11.17.1 libvirt-devel-0.4.6-11.17.1 libvirt-doc-0.4.6-11.17.1 libvirt-python-0.4.6-11.17.1 References: http://support.novell.com/security/cve/CVE-2010-2242.html https://bugzilla.novell.com/618155

1 0

openSUSE-SU-2010:0620-1 (important): libvirt: security fix for multiple issues
by opensuse-security＠opensuse.org 16 Sep '10

16 Sep '10

openSUSE Security Update: libvirt: security fix for multiple issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0620-1 Rating: important References: #618155 Cross-References: CVE-2010-2237 CVE-2010-2238 CVE-2010-2239 CVE-2010-2242 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: libvirt did not properly handle configured disk formats which potenially allowed users to read arbitrary files (CVE-2010-2237, CVE-2010-2238, CVE-2010-2239) Improperly mapped source privileged ports in guests may allow obtaining privileged resources on the host (CVE-2010-2242). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libvirt-2892 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): libvirt-0.7.2-1.1.3.5 libvirt-devel-0.7.2-1.1.3.5 libvirt-doc-0.7.2-1.1.3.5 libvirt-python-0.7.2-1.1.3.5 References: http://support.novell.com/security/cve/CVE-2010-2237.html http://support.novell.com/security/cve/CVE-2010-2238.html http://support.novell.com/security/cve/CVE-2010-2239.html http://support.novell.com/security/cve/CVE-2010-2242.html https://bugzilla.novell.com/618155

1 0

openSUSE-SU-2010:0619-1 (important): libtiff security update
by opensuse-security＠opensuse.org 16 Sep '10

16 Sep '10

openSUSE Security Update: libtiff security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0619-1 Rating: important References: #624215 Cross-References: CVE-2010-3087 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: specially crafted tiff files could cause a memory corruption in libtiff. Attackers could potentially exploit that to execute arbitrary code in applications that use libtiff for processing tiff files (CVE-2010-3087). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libtiff-devel-3117 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libtiff-devel-3.9.2-5.2.1 libtiff3-3.9.2-5.2.1 tiff-3.9.2-5.2.1 - openSUSE 11.3 (x86_64): libtiff-devel-32bit-3.9.2-5.2.1 libtiff3-32bit-3.9.2-5.2.1 References: http://support.novell.com/security/cve/CVE-2010-3087.html https://bugzilla.novell.com/624215

1 0

openSUSE-SU-2010:0616-1 (moderate): tomcat security update
by opensuse-security＠opensuse.org 15 Sep '10

15 Sep '10

openSUSE Security Update: tomcat security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0616-1 Rating: moderate References: #622188 Cross-References: CVE-2010-1157 CVE-2010-2227 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of tomcat fixes denial of service and information disclosure vulnerabilities which could potentially be exploited by remote attackers to crash tomcat or to obtain sensitive information (CVE-2010-2227, CVE-2010-1157). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch tomcat6-2739 - openSUSE 11.2: zypper in -t patch tomcat6-2739 - openSUSE 11.1: zypper in -t patch tomcat6-2739 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch): tomcat6-6.0.24-5.1.1 tomcat6-admin-webapps-6.0.24-5.1.1 tomcat6-docs-webapp-6.0.24-5.1.1 tomcat6-el-1_0-api-6.0.24-5.1.1 tomcat6-javadoc-6.0.24-5.1.1 tomcat6-jsp-2_1-api-6.0.24-5.1.1 tomcat6-lib-6.0.24-5.1.1 tomcat6-servlet-2_5-api-6.0.24-5.1.1 tomcat6-webapps-6.0.24-5.1.1 - openSUSE 11.2 (noarch): tomcat6-6.0.20-24.7.1 tomcat6-admin-webapps-6.0.20-24.7.1 tomcat6-docs-webapp-6.0.20-24.7.1 tomcat6-javadoc-6.0.20-24.7.1 tomcat6-jsp-2_1-api-6.0.20-24.7.1 tomcat6-lib-6.0.20-24.7.1 tomcat6-servlet-2_5-api-6.0.20-24.7.1 tomcat6-webapps-6.0.20-24.7.1 - openSUSE 11.1 (noarch): tomcat6-6.0.18-16.4.1 tomcat6-admin-webapps-6.0.18-16.4.1 tomcat6-docs-webapp-6.0.18-16.4.1 tomcat6-javadoc-6.0.18-16.4.1 tomcat6-jsp-2_1-api-6.0.18-16.4.1 tomcat6-lib-6.0.18-16.4.1 tomcat6-servlet-2_5-api-6.0.18-16.4.1 tomcat6-webapps-6.0.18-16.4.1 References: http://support.novell.com/security/cve/CVE-2010-1157.html http://support.novell.com/security/cve/CVE-2010-2227.html https://bugzilla.novell.com/622188

1 0

openSUSE-SU-2010:0615-1 (important): lvm2-clvm: security update to fix a local privilege escalation
by opensuse-security＠opensuse.org 15 Sep '10

15 Sep '10

openSUSE Security Update: lvm2-clvm: security update to fix a local privilege escalation ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0615-1 Rating: important References: #622537 Cross-References: CVE-2010-2526 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: clvmd allowed unprivileged users to issue arbitrary lvm commands (CVE-2010-2526). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch lvm2-2920 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): lvm2-2.02.39-8.14.1 lvm2-clvm-2.02.39-8.14.1 References: http://support.novell.com/security/cve/CVE-2010-2526.html https://bugzilla.novell.com/622537

1 0

openSUSE-SU-2010:0612-1 (moderate): pcsc-lite: fixed pcscd local root exploit (CVE-2010-0407)
by opensuse-security＠opensuse.org 15 Sep '10

15 Sep '10

openSUSE Security Update: pcsc-lite: fixed pcscd local root exploit (CVE-2010-0407) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0612-1 Rating: moderate References: #609317 Cross-References: CVE-2010-0407 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of pcsc-lite fixes a local vulnerability (stack overflow) which allows every user with write-access to "/var/run/pcscd/pcscd.comm" to gain root privileges. CVE-2010-0407 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch pcsc-lite-2646 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): pcsc-lite-1.4.102-1.249.1 pcsc-lite-devel-1.4.102-1.249.1 - openSUSE 11.1 (x86_64): pcsc-lite-32bit-1.4.102-1.249.1 - openSUSE 11.1 (ppc): pcsc-lite-64bit-1.4.102-1.249.1 References: http://support.novell.com/security/cve/CVE-2010-0407.html https://bugzilla.novell.com/609317

1 0

openSUSE-RU-2010:0611-1 (low): python-xlib: Fixed cannot connect to display problem
by maintenance＠opensuse.org 14 Sep '10

14 Sep '10

openSUSE Recommended Update: python-xlib: Fixed cannot connect to display problem ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0611-1 Rating: low References: #623507 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: A bug where python-xlib could not connect to local displays was fixed. (bnc#623507) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch python-xlib-3082 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): python-xlib-0.14-90.1.1 References: https://bugzilla.novell.com/623507

1 0