September 2010 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2010:0641-1 (low): postfix: Collective update for postfix
by maintenance＠opensuse.org 21 Sep '10

21 Sep '10

openSUSE Recommended Update: postfix: Collective update for postfix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0641-1 Rating: low References: #586486 #622873 #625657 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: The following bugs are fixed by this update: - #625657: SuSEconfig.postfix and smtp_use_tls - #622873: postfix doesn't start if ipv6 is disabled - #627632: /etc/postfix/virtual.db is older than source file /etc/postfix/virtual Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch postfix-3104 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): postfix-2.7.1-2.2.1 postfix-devel-2.7.1-2.2.1 postfix-mysql-2.7.1-2.2.1 postfix-postgresql-2.7.1-2.2.1 - openSUSE 11.3 (noarch): postfix-doc-2.7.1-2.2.1 yast2-mail-2.18.5-2.1.1 yast2-mail-plugins-2.18.5-2.1.1 References: https://bugzilla.novell.com/586486 https://bugzilla.novell.com/622873 https://bugzilla.novell.com/625657

1 0

openSUSE-RU-2010:0640-1 (low): libgphoto2: Fixed Olympus x-750 camera cannot be mounted
by maintenance＠opensuse.org 21 Sep '10

21 Sep '10

openSUSE Recommended Update: libgphoto2: Fixed Olympus x-750 camera cannot be mounted ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0640-1 Rating: low References: #634208 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes incorrect detection of mass storage cameras as ptp cameras: - bnc#634208: gphoto: Olympus x-750 camera cannot be mounted Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libgphoto2-3111 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libgphoto2-2.4.9-4.1.1 libgphoto2-devel-2.4.9-4.1.1 - openSUSE 11.3 (x86_64): libgphoto2-32bit-2.4.9-4.1.1 - openSUSE 11.3 (noarch): libgphoto2-lang-2.4.9-4.1.1 References: https://bugzilla.novell.com/634208

1 0

openSUSE-RU-2010:0639-1 (low): cups: Set CUPS default size of RIPCache to 128 MB
by maintenance＠opensuse.org 21 Sep '10

21 Sep '10

openSUSE Recommended Update: cups: Set CUPS default size of RIPCache to 128 MB ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0639-1 Rating: low References: #628233 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The CUPS upstream default "RIPCache 8m" is too small for nowadays higher resolution printing and can cause various kind of printout failures (see CUPS STR 3535 at http://www.cups.org/str.php?L3535 and the openSUSE Bugzilla bug 628233). Such issues are avoided with a default "RIPCache 128m" setting. If needed a different value can be explicitly specified in /etc/cups/cupsd.conf via a line like "RIPCache 256m". Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch cups-3107 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): cups-1.4.4-3.1.1 cups-client-1.4.4-3.1.1 cups-ddk-1.4.4-3.1.1 cups-devel-1.4.4-3.1.1 cups-libs-1.4.4-3.1.1 - openSUSE 11.3 (x86_64): cups-libs-32bit-1.4.4-3.1.1 References: https://bugzilla.novell.com/628233

1 0

openSUSE-RU-2010:0638-1 (critical): libQtWebKit4: Fix Flash Player 10.1 support
by maintenance＠opensuse.org 21 Sep '10

21 Sep '10

openSUSE Recommended Update: libQtWebKit4: Fix Flash Player 10.1 support ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0638-1 Rating: critical References: #613818 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update initializes gtk2 before invoking the flash player initialisation, as it crashes otherwise. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libQtWebKit-devel-3110 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libQtWebKit-devel-4.6.3-2.1.1 libQtWebKit4-4.6.3-2.1.1 libqt4-4.6.3-2.1.1 libqt4-devel-4.6.3-2.1.1 libqt4-qt3support-4.6.3-2.1.1 libqt4-sql-4.6.3-2.1.1 libqt4-sql-sqlite-4.6.3-2.1.1 libqt4-x11-4.6.3-2.1.1 - openSUSE 11.3 (x86_64): libQtWebKit4-32bit-4.6.3-2.1.1 libqt4-32bit-4.6.3-2.1.1 libqt4-qt3support-32bit-4.6.3-2.1.1 libqt4-sql-32bit-4.6.3-2.1.1 libqt4-sql-sqlite-32bit-4.6.3-2.1.1 libqt4-x11-32bit-4.6.3-2.1.1 References: https://bugzilla.novell.com/613818

1 0

openSUSE-RU-2010:0637-1 (moderate): xen: Collective update for xen
by maintenance＠opensuse.org 20 Sep '10

20 Sep '10

openSUSE Recommended Update: xen: Collective update for xen ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0637-1 Rating: moderate References: #569744 #584204 #586221 #591799 #599550 #599929 #603008 #604611 #605182 #605186 #606882 #607219 #608191 #608194 #609153 #610658 #612189 #613529 #613957 #620694 #623201 #623438 #623833 #624250 #624285 #625003 #625520 #626262 #626299 #627449 #629226 #629261 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has 32 recommended fixes can now be installed. It includes one version update. Description: Collective Xen Update, fixing the following reports: Xen Hypervisor and Tools bnc#626262 - Populate-on-demand memory problem on xen with hvm guest bnc#584204 - xm usb-list broken bnc#625520 - TP-L3: NMI cannot be triggered for xen kernel bnc#613529 - TP-L3: kdump kernel hangs when crash was initiated from xen kernel bnc#623833 - Error in Xend-API method VM_set_actions_after_crash bnc#625003 - Fix vm config options coredump-{restart,destroy} bnc#605186 - Squelch harmless error messages in block-iscsi bnc#623438 - Add ability to control SCSI device path scanning in xend bnc#624285 - TP-L3: xen rdtsc emulation reports wrong frequency bnc#623201 - drbd xvd will fail in new xen4 packages due to wrong popen2 arguments in blkif.py bnc#620694 - Xen yast vm-install for existing paravirtualized disk fails with UnboundLocalError: local variable 'dev_type' referenced before assignment bnc#586221 - cannot add DomU with USB host controller defined bnc#599550 - Xen cannot distinguish the status of 'pause' bnc#604611 - Do not store vif device details when vif config contains invalid mac address. bnc#609153 - xm migrate <domain_name> localhost -l fails on Windows VMs bnc#612189 - Clear APIC Timer Initial Count Register when masking timer interrupt bnc#610658 - XEN: PXE boot fails for fully virtualized guests - e1000 virtual nic. bnc#608191 - /var/adm/fillup-templates/sysconfig.xend from package xen-tools is no a valid sysconfig file bnc#608194 - /etc/xen/* config files are not packaged with noreplace bnc#569744 - SLE HVM guest clock/timezone is incorrect after reboot bnc#606882 - Allow spaces in vbd path names bnc#591799 - The status of Caps Lock is incorrect in domU bnc#607219 - AMD Erratum 383 workaround for Xen bnc#603008 - On an 8 Socket Nehalem-EX system, the fix for 593536 causes a hang during network setup. bnc#605182 - /etc/xen/scripts/xen-hotplug-cleanup: line 24: [: !=: unary operator expected bnc#599929 - Hot add/remove Kawela NIC device over 500 times will cause guest domain crash Virtual Machine Installer (vm-install) bnc#629226 - vm-install --vm-settings does not work with kvm config bnc#629261 - vm-install for KVM fails if more than one ISO image is configured bnc#613957 - Fedora 13 PV DomU can't be installed with virt-manager bnc#627449 - Wrong MAC assigned to NIC card when using KVM when installing machine using vm-install bnc#626299 - vmdk wont work with virt-manager Virtual Machine Manager (virt-manager) bnc#624250 - L3: virt-manager doesn't update "Autostart" setting in vm configuration correctly Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch virt-manager-2988 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 0.4.26]: virt-manager-0.8.4-5.1.1 vm-install-0.4.26-0.1.1 xen-4.0.0_21091_06-0.1.1 xen-devel-4.0.0_21091_06-0.1.1 xen-doc-html-4.0.0_21091_06-0.1.1 xen-doc-pdf-4.0.0_21091_06-0.1.1 xen-kmp-default-4.0.0_21091_06_k2.6.34.0_12-0.1.1 xen-kmp-desktop-4.0.0_21091_06_k2.6.34.0_12-0.1.1 xen-libs-4.0.0_21091_06-0.1.1 xen-tools-4.0.0_21091_06-0.1.1 xen-tools-domU-4.0.0_21091_06-0.1.1 - openSUSE 11.3 (i586): xen-kmp-pae-4.0.0_21091_06_k2.6.34.0_12-0.1.1 References: https://bugzilla.novell.com/569744 https://bugzilla.novell.com/584204 https://bugzilla.novell.com/586221 https://bugzilla.novell.com/591799 https://bugzilla.novell.com/599550 https://bugzilla.novell.com/599929 https://bugzilla.novell.com/603008 https://bugzilla.novell.com/604611 https://bugzilla.novell.com/605182 https://bugzilla.novell.com/605186 https://bugzilla.novell.com/606882 https://bugzilla.novell.com/607219 https://bugzilla.novell.com/608191 https://bugzilla.novell.com/608194 https://bugzilla.novell.com/609153 https://bugzilla.novell.com/610658 https://bugzilla.novell.com/612189 https://bugzilla.novell.com/613529 https://bugzilla.novell.com/613957 https://bugzilla.novell.com/620694 https://bugzilla.novell.com/623201 https://bugzilla.novell.com/623438 https://bugzilla.novell.com/623833 https://bugzilla.novell.com/624250 https://bugzilla.novell.com/624285 https://bugzilla.novell.com/625003 https://bugzilla.novell.com/625520 https://bugzilla.novell.com/626262 https://bugzilla.novell.com/626299 https://bugzilla.novell.com/627449 https://bugzilla.novell.com/629226 https://bugzilla.novell.com/629261

1 0

openSUSE-SU-2010:0636-1 (low): dovecot security update
by opensuse-security＠opensuse.org 20 Sep '10

20 Sep '10

openSUSE Security Update: dovecot security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0636-1 Rating: low References: #640005 Cross-References: CVE-2010-3304 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: When using Maildir all ACLs on INBOX were copied to newly created mailboxes although only default ACLs should have been copied (CVE-2010-3304). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch dovecot12-3137 - openSUSE 11.2: zypper in -t patch dovecot12-3137 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): dovecot12-1.2.11-3.1.1 dovecot12-backend-mysql-1.2.11-3.1.1 dovecot12-backend-pgsql-1.2.11-3.1.1 dovecot12-backend-sqlite-1.2.11-3.1.1 dovecot12-devel-1.2.11-3.1.1 dovecot12-fts-lucene-1.2.11-3.1.1 dovecot12-fts-solr-1.2.11-3.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.2.9]: dovecot12-1.2.9-0.3.1 dovecot12-backend-mysql-1.2.9-0.3.1 dovecot12-backend-pgsql-1.2.9-0.3.1 dovecot12-backend-sqlite-1.2.9-0.3.1 dovecot12-devel-1.2.9-0.3.1 dovecot12-fts-lucene-1.2.9-0.3.1 References: http://support.novell.com/security/cve/CVE-2010-3304.html https://bugzilla.novell.com/640005

1 0

openSUSE-SU-2010:0632-2 (critical): seamonkey: Security update to 2.0.8
by opensuse-security＠opensuse.org 17 Sep '10

17 Sep '10

openSUSE Security Update: seamonkey: Security update to 2.0.8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0632-2 Rating: critical References: #637303 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: Mozilla Seamonkey 2.0 was updated to version 2.0.8, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim's computer. MFSA 2010-52 / CVE-2010-3131: Security researcher Haifei Li of FortiGuard Labs reported that Firefox could be used to load a malicious code library that had been planted on a victim's computer. Firefox attempts to load dwmapi.dll upon startup as part of its platform detection, so on systems that don't have this library, such as Windows XP, Firefox will subsequently attempt to load the library from the current working directory. An attacker could use this vulnerability to trick a user into downloading a HTML file and a malicious copy of dwmapi.dll into the same directory on their computer and opening the HTML file with Firefox, thus causing the malicious code to be executed. If the attacker was on the same network as the victim, the malicious DLL could also be loaded via a UNC path. The attack also requires that Firefox not currently be running when it is asked to open the HTML file and accompanying DLL. As this is a Windows only problem, it does not affect the Linux version. It is listed for completeness only. MFSA 2010-53 / CVE-2010-3166: Security researcher wushi of team509 reported a heap buffer overflow in code routines responsible for transforming text runs. A page could be constructed with a bidirectional text run which upon reflow could result in an incorrect length being calculated for the run of text. When this value is subsequently used to allocate memory for the text too small a buffer may be created potentially resulting in a buffer overflow and the execution of attacker controlled memory. MFSA 2010-54 / CVE-2010-2760: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that there was a remaining dangling pointer issue leftover from the fix to CVE-2010-2753. Under certain circumstances one of the pointers held by a XUL tree selection could be freed and then later reused, potentially resulting in the execution of attacker-controlled memory. MFSA 2010-55 / CVE-2010-3168: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that XUL <tree> objects could be manipulated such that the setting of certain properties on the object would trigger the removal of the tree from the DOM and cause certain sections of deleted memory to be accessed. In products based on Gecko version 1.9.2 (Firefox 3.6, Thunderbird 3.1) and newer this memory has been overwritten by a value that will cause an unexploitable crash. In products based on Gecko version 1.9.1 (Firefox 3.5, Thunderbird 3.0, and SeaMonkey 2.0) and older an attacker could potentially use this vulnerability to crash a victim's browser and run arbitrary code on their computer. MFSA 2010-56 / CVE-2010-3167: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that the implementation of XUL <tree>'s content view contains a dangling pointer vulnerability. One of the content view's methods for accessing the internal structure of the tree could be manipulated into removing a node prior to accessing it, resulting in the accessing of deleted memory. If an attacker can control the contents of the deleted memory prior to its access they could use this vulnerability to run arbitrary code on a victim's machine. MFSA 2010-57 / CVE-2010-2766: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that code used to normalize a document contained a logical flaw that could be leveraged to run arbitrary code. When the normalization code ran, a static count of the document's child nodes was used in the traversal, so a page could be constructed that would remove DOM nodes during this normalization which could lead to the accessing of a deleted object and potentially the execution of attacker-controlled memory. MFSA 2010-58 / CVE-2010-2770: Security researcher Marc Schoenefeld reported that a specially crafted font could be applied to a document and cause a crash on Mac systems. The crash showed signs of memory corruption and presumably could be used by an attacker to execute arbitrary code on a victim's computer. This issue probably does not affect the Linux builds and so is listed for completeness. MFSA 2010-59 / CVE-2010-2762: Mozilla developer Blake Kaplan reported that the wrapper class XPCSafeJSObjectWrapper (SJOW), a security wrapper that allows content-defined objects to be safely accessed by privileged code, creates scope chains ending in outer objects. Users of SJOWs which expect the scope chain to end on an inner object may be handed a chrome privileged object which could be leveraged to run arbitrary JavaScript with chrome privileges. Michal Zalewski's recent contributions helped to identify this architectural weakness. MFSA 2010-60 / CVE-2010-2763: Mozilla security researcher moz_bug_r_a4 reported that the wrapper class XPCSafeJSObjectWrapper (SJOW) on the Mozilla 1.9.1 development branch has a logical error in its scripted function implementation that allows the caller to run the function within the context of another site. This is a violation of the same-origin policy and could be used to mount an XSS attack. MFSA 2010-61 / CVE-2010-2768: Security researchers David Huang and Collin Jackson of Carnegie Mellon University CyLab (Silicon Valley campus) reported that the type attribute of an <object> tag can override the charset of a framed HTML document, even when the document is included across origins. A page could be constructed containing such an <object> tag which sets the charset of the framed document to UTF-7. This could potentially allow an attacker to inject UTF-7 encoded JavaScript into a site, bypassing the site's XSS filters, and then executing the code using the above technique. MFSA 2010-62 / CVE-2010-2769: Security researcher Paul Stone reported that when an HTML selection containing JavaScript is copy-and-pasted or dropped onto a document with designMode enabled the JavaScript will be executed within the context of the site where the code was dropped. A malicious site could leverage this issue in an XSS attack by persuading a user into taking such an action and in the process running malicious JavaScript within the context of another site. MFSA 2010-63 / CVE-2010-2764: Matt Haggard reported that the statusText property of an XMLHttpRequest object is readable by the requestor even when the request is made across origins. This status information reveals the presence of a web server and could be used to gather information about servers on internal private networks. This issue was also independently reported to Mozilla by Nicholas Berthaume Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch seamonkey-3138 - openSUSE 11.2: zypper in -t patch seamonkey-3138 - openSUSE 11.1: zypper in -t patch seamonkey-3138 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.0.8]: seamonkey-2.0.8-0.3.1 seamonkey-dom-inspector-2.0.8-0.3.1 seamonkey-irc-2.0.8-0.3.1 seamonkey-translations-common-2.0.8-0.3.1 seamonkey-translations-other-2.0.8-0.3.1 seamonkey-venkman-2.0.8-0.3.1 - openSUSE 11.2 (i586 x86_64) [New Version: 2.0.8]: seamonkey-2.0.8-0.3.1 seamonkey-dom-inspector-2.0.8-0.3.1 seamonkey-irc-2.0.8-0.3.1 seamonkey-venkman-2.0.8-0.3.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 2.0.8]: seamonkey-2.0.8-0.3.1 seamonkey-dom-inspector-2.0.8-0.3.1 seamonkey-irc-2.0.8-0.3.1 seamonkey-venkman-2.0.8-0.3.1 References: https://bugzilla.novell.com/637303

1 0

openSUSE-RU-2010:0635-1 (critical): ndiswrapper,wacom,lirc: Kernel modules needed to be rebuilt after the kernel update update
by maintenance＠opensuse.org 17 Sep '10

17 Sep '10

openSUSE Recommended Update: ndiswrapper,wacom,lirc: Kernel modules needed to be rebuilt after the kernel update update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0635-1 Rating: critical References: #637880 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The ndiswrapper, wacom and lirc kernel modules needed to be rebuilt after the last kernel update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch kmps-3136 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): liblirc_client0-0.8.6_0.8.7pre1-0.1.1 lirc-0.8.6_0.8.7pre1-0.1.1 lirc-devel-0.8.6_0.8.7pre1-0.1.1 lirc-kmp-default-0.8.6_0.8.7pre1_k2.6.34.7_0.2-0.1.2 lirc-kmp-desktop-0.8.6_0.8.7pre1_k2.6.34.7_0.2-0.1.2 lirc-kmp-xen-0.8.6_0.8.7pre1_k2.6.34.7_0.2-0.1.2 lirc-remotes-0.8.6_0.8.7pre1-0.1.1 ndiswrapper-1.55-8.1.2 ndiswrapper-kmp-default-1.55_k2.6.34.7_0.2-8.1.2 ndiswrapper-kmp-desktop-1.55_k2.6.34.7_0.2-8.1.2 wacom-kmp-default-0.8.1_k2.6.34.7_0.2-11.1.2 wacom-kmp-desktop-0.8.1_k2.6.34.7_0.2-11.1.2 wacom-kmp-xen-0.8.1_k2.6.34.7_0.2-11.1.2 - openSUSE 11.3 (x86_64): liblirc_client0-32bit-0.8.6_0.8.7pre1-0.1.1 - openSUSE 11.3 (i586): lirc-kmp-pae-0.8.6_0.8.7pre1_k2.6.34.7_0.2-0.1.2 ndiswrapper-kmp-pae-1.55_k2.6.34.7_0.2-8.1.2 wacom-kmp-pae-0.8.1_k2.6.34.7_0.2-11.1.2 References: https://bugzilla.novell.com/637880

1 0

openSUSE-SU-2010:0634-1 (critical): kernel: security and bugfix update to 2.6.34.7
by opensuse-security＠opensuse.org 17 Sep '10

17 Sep '10

openSUSE Security Update: kernel: security and bugfix update to 2.6.34.7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0634-1 Rating: critical References: #600948 #628604 #632309 #633543 #633581 #635862 #636112 #637436 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: The openSUSE 11.3 kernel was updated to versiuon 2.6.34.7. It fixes lots of bugs and security issues. A major regression in handling some USB Input devices (Mice and Keyboard) introduced by the previous update was fixed. Fixed lots of bugs in the ATH5K wireless driver. Following security issues were fixed: CVE-2010-3078: A XFS stack memory information disclosure was fixed. CVE-2010-2954: A NULL pointer dereference in the IRDA stack was fixed, which could lead to kernel crashes. CVE-2010-2959: A privilege escalation possibility in the CAN bus protocol module can_bcm was fixed. CVE-2010-2942: Several memory leaks in the net scheduling code were fixed. CVE-2010-2803: Fixed kernel memory information leaks from DRM ioctls. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch kernel-3105 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.6.34.7]: kernel-debug-2.6.34.7-0.2.2 kernel-debug-base-2.6.34.7-0.2.2 kernel-debug-devel-2.6.34.7-0.2.2 kernel-default-2.6.34.7-0.2.2 kernel-default-base-2.6.34.7-0.2.2 kernel-default-devel-2.6.34.7-0.2.2 kernel-desktop-2.6.34.7-0.2.2 kernel-desktop-base-2.6.34.7-0.2.2 kernel-desktop-devel-2.6.34.7-0.2.2 kernel-ec2-2.6.34.7-0.2.2 kernel-ec2-base-2.6.34.7-0.2.2 kernel-ec2-devel-2.6.34.7-0.2.2 kernel-ec2-extra-2.6.34.7-0.2.2 kernel-syms-2.6.34.7-0.2.2 kernel-trace-2.6.34.7-0.2.2 kernel-trace-base-2.6.34.7-0.2.2 kernel-trace-devel-2.6.34.7-0.2.2 kernel-vanilla-2.6.34.7-0.2.2 kernel-vanilla-base-2.6.34.7-0.2.2 kernel-vanilla-devel-2.6.34.7-0.2.2 kernel-xen-2.6.34.7-0.2.2 kernel-xen-base-2.6.34.7-0.2.2 kernel-xen-devel-2.6.34.7-0.2.2 preload-kmp-default-1.1_k2.6.34.7_0.2-19.1.2 preload-kmp-desktop-1.1_k2.6.34.7_0.2-19.1.2 - openSUSE 11.3 (noarch) [New Version: 2.6.34.7]: kernel-devel-2.6.34.7-0.2.2 kernel-source-2.6.34.7-0.2.2 kernel-source-vanilla-2.6.34.7-0.2.2 - openSUSE 11.3 (i586) [New Version: 2.6.34.7]: kernel-pae-2.6.34.7-0.2.2 kernel-pae-base-2.6.34.7-0.2.2 kernel-pae-devel-2.6.34.7-0.2.2 kernel-vmi-2.6.34.7-0.2.2 kernel-vmi-base-2.6.34.7-0.2.2 kernel-vmi-devel-2.6.34.7-0.2.2 References: https://bugzilla.novell.com/600948 https://bugzilla.novell.com/628604 https://bugzilla.novell.com/632309 https://bugzilla.novell.com/633543 https://bugzilla.novell.com/633581 https://bugzilla.novell.com/635862 https://bugzilla.novell.com/636112 https://bugzilla.novell.com/637436

1 0

openSUSE-SU-2010:0632-1 (critical): MozillaFirefox: Security update to 3.6.10
by opensuse-security＠opensuse.org 17 Sep '10

17 Sep '10

openSUSE Security Update: MozillaFirefox: Security update to 3.6.10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0632-1 Rating: critical References: #637303 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes two new package versions. Description: Mozilla Firefox was updated to version 3.6.10, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-50 / CVE-2010-2765: Security researcher Chris Rohlf of Matasano Security reported that the implementation of the HTML frameset element contained an integer overflow vulnerability. The code responsible for parsing the frameset columns used an 8-byte counter for the column numbers, so when a very large number of columns was passed in the counter would overflow. When this counter was subsequently used to allocate memory for the frameset, the memory buffer would be too small, potentially resulting in a heap buffer overflow and execution of attacker-controlled memory. MFSA 2010-51 / CVE-2010-2767: Security researcher Sergey Glazunov reported a dangling pointer vulnerability in the implementation of navigator.plugins in which the navigator object could retain a pointer to the plugins array even after it had been destroyed. An attacker could potentially use this issue to crash the browser and run arbitrary code on a victim's computer. MFSA 2010-52 / CVE-2010-3131: Security researcher Haifei Li of FortiGuard Labs reported that Firefox could be used to load a malicious code library that had been planted on a victim's computer. Firefox attempts to load dwmapi.dll upon startup as part of its platform detection, so on systems that don't have this library, such as Windows XP, Firefox will subsequently attempt to load the library from the current working directory. An attacker could use this vulnerability to trick a user into downloading a HTML file and a malicious copy of dwmapi.dll into the same directory on their computer and opening the HTML file with Firefox, thus causing the malicious code to be executed. If the attacker was on the same network as the victim, the malicious DLL could also be loaded via a UNC path. The attack also requires that Firefox not currently be running when it is asked to open the HTML file and accompanying DLL. As this is a Windows only problem, it does not affect the Linux version. It is listed for completeness only. MFSA 2010-53 / CVE-2010-3166: Security researcher wushi of team509 reported a heap buffer overflow in code routines responsible for transforming text runs. A page could be constructed with a bidirectional text run which upon reflow could result in an incorrect length being calculated for the run of text. When this value is subsequently used to allocate memory for the text too small a buffer may be created potentially resulting in a buffer overflow and the execution of attacker controlled memory. MFSA 2010-54 / CVE-2010-2760: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that there was a remaining dangling pointer issue leftover from the fix to CVE-2010-2753. Under certain circumstances one of the pointers held by a XUL tree selection could be freed and then later reused, potentially resulting in the execution of attacker-controlled memory. MFSA 2010-55 / CVE-2010-3168: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that XUL <tree> objects could be manipulated such that the setting of certain properties on the object would trigger the removal of the tree from the DOM and cause certain sections of deleted memory to be accessed. In products based on Gecko version 1.9.2 (Firefox 3.6, Thunderbird 3.1) and newer this memory has been overwritten by a value that will cause an unexploitable crash. In products based on Gecko version 1.9.1 (Firefox 3.5, Thunderbird 3.0, and SeaMonkey 2.0) and older an attacker could potentially use this vulnerability to crash a victim's browser and run arbitrary code on their computer. MFSA 2010-56 / CVE-2010-3167: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that the implementation of XUL <tree>'s content view contains a dangling pointer vulnerability. One of the content view's methods for accessing the internal structure of the tree could be manipulated into removing a node prior to accessing it, resulting in the accessing of deleted memory. If an attacker can control the contents of the deleted memory prior to its access they could use this vulnerability to run arbitrary code on a victim's machine. MFSA 2010-57 / CVE-2010-2766: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that code used to normalize a document contained a logical flaw that could be leveraged to run arbitrary code. When the normalization code ran, a static count of the document's child nodes was used in the traversal, so a page could be constructed that would remove DOM nodes during this normalization which could lead to the accessing of a deleted object and potentially the execution of attacker-controlled memory. MFSA 2010-58 / CVE-2010-2770: Security researcher Marc Schoenefeld reported that a specially crafted font could be applied to a document and cause a crash on Mac systems. The crash showed signs of memory corruption and presumably could be used by an attacker to execute arbitrary code on a victim's computer. This issue probably does not affect the Linux builds and so is listed for completeness. MFSA 2010-59 / CVE-2010-2762: Mozilla developer Blake Kaplan reported that the wrapper class XPCSafeJSObjectWrapper (SJOW), a security wrapper that allows content-defined objects to be safely accessed by privileged code, creates scope chains ending in outer objects. Users of SJOWs which expect the scope chain to end on an inner object may be handed a chrome privileged object which could be leveraged to run arbitrary JavaScript with chrome privileges. Michal Zalewski's recent contributions helped to identify this architectural weakness. MFSA 2010-60 / CVE-2010-2763: Mozilla security researcher moz_bug_r_a4 reported that the wrapper class XPCSafeJSObjectWrapper (SJOW) on the Mozilla 1.9.1 development branch has a logical error in its scripted function implementation that allows the caller to run the function within the context of another site. This is a violation of the same-origin policy and could be used to mount an XSS attack. MFSA 2010-61 / CVE-2010-2768: Security researchers David Huang and Collin Jackson of Carnegie Mellon University CyLab (Silicon Valley campus) reported that the type attribute of an <object> tag can override the charset of a framed HTML document, even when the document is included across origins. A page could be constructed containing such an <object> tag which sets the charset of the framed document to UTF-7. This could potentially allow an attacker to inject UTF-7 encoded JavaScript into a site, bypassing the site's XSS filters, and then executing the code using the above technique. MFSA 2010-62 / CVE-2010-2769: Security researcher Paul Stone reported that when an HTML selection containing JavaScript is copy-and-pasted or dropped onto a document with designMode enabled the JavaScript will be executed within the context of the site where the code was dropped. A malicious site could leverage this issue in an XSS attack by persuading a user into taking such an action and in the process running malicious JavaScript within the context of another site. MFSA 2010-63 / CVE-2010-2764: Matt Haggard reported that the statusText property of an XMLHttpRequest object is readable by the requestor even when the request is made across origins. This status information reveals the presence of a web server and could be used to gather information about servers on internal private networks. This issue was also independently reported to Mozilla by Nicholas Berthaume Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch MozillaFirefox-3132 - openSUSE 11.2: zypper in -t patch MozillaFirefox-3132 - openSUSE 11.1: zypper in -t patch MozillaFirefox-3132 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 1.9.2.10 and 3.6.10]: MozillaFirefox-3.6.10-0.3.1 MozillaFirefox-branding-upstream-3.6.10-0.3.1 MozillaFirefox-translations-common-3.6.10-0.3.1 MozillaFirefox-translations-other-3.6.10-0.3.1 mozilla-js192-1.9.2.10-0.4.1 mozilla-xulrunner192-1.9.2.10-0.4.1 mozilla-xulrunner192-buildsymbols-1.9.2.10-0.4.1 mozilla-xulrunner192-devel-1.9.2.10-0.4.1 mozilla-xulrunner192-gnome-1.9.2.10-0.4.1 mozilla-xulrunner192-translations-common-1.9.2.10-0.4.1 mozilla-xulrunner192-translations-other-1.9.2.10-0.4.1 - openSUSE 11.3 (x86_64) [New Version: 1.9.2.10]: mozilla-js192-32bit-1.9.2.10-0.4.1 mozilla-xulrunner192-32bit-1.9.2.10-0.4.1 mozilla-xulrunner192-gnome-32bit-1.9.2.10-0.4.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.10-0.4.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.10-0.4.1 - openSUSE 11.2 (i586 x86_64) [New Version: 3.6.10]: MozillaFirefox-3.6.10-0.3.1 MozillaFirefox-branding-upstream-3.6.10-0.3.1 MozillaFirefox-translations-common-3.6.10-0.3.1 MozillaFirefox-translations-other-3.6.10-0.3.1 mozilla-js192-1.9.2.10-0.4.1 mozilla-xulrunner192-1.9.2.10-0.4.1 mozilla-xulrunner192-buildsymbols-1.9.2.10-0.4.1 mozilla-xulrunner192-devel-1.9.2.10-0.4.1 mozilla-xulrunner192-gnome-1.9.2.10-0.4.1 mozilla-xulrunner192-translations-common-1.9.2.10-0.4.1 mozilla-xulrunner192-translations-other-1.9.2.10-0.4.1 - openSUSE 11.2 (x86_64): mozilla-js192-32bit-1.9.2.10-0.4.1 mozilla-xulrunner192-32bit-1.9.2.10-0.4.1 mozilla-xulrunner192-gnome-32bit-1.9.2.10-0.4.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.10-0.4.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.10-0.4.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 3.6.10]: MozillaFirefox-3.6.10-0.3.1 MozillaFirefox-branding-upstream-3.6.10-0.3.1 MozillaFirefox-translations-common-3.6.10-0.3.1 MozillaFirefox-translations-other-3.6.10-0.3.1 - openSUSE 11.1 (i586 x86_64) [New Version: 1.9.2.10]: mozilla-js192-1.9.2.10-0.4.1 mozilla-xulrunner192-1.9.2.10-0.4.1 mozilla-xulrunner192-buildsymbols-1.9.2.10-0.4.1 mozilla-xulrunner192-devel-1.9.2.10-0.4.1 mozilla-xulrunner192-gnome-1.9.2.10-0.4.1 mozilla-xulrunner192-translations-common-1.9.2.10-0.4.1 mozilla-xulrunner192-translations-other-1.9.2.10-0.4.1 - openSUSE 11.1 (x86_64) [New Version: 1.9.2.10]: mozilla-js192-32bit-1.9.2.10-0.4.1 mozilla-xulrunner192-32bit-1.9.2.10-0.4.1 mozilla-xulrunner192-gnome-32bit-1.9.2.10-0.4.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.10-0.4.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.10-0.4.1 References: https://bugzilla.novell.com/637303

1 0