January 2011 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2011:0086-1 (moderate): calibre: security update fixing a XSS issue
by opensuse-security＠opensuse.org 31 Jan '11

31 Jan '11

openSUSE Security Update: calibre: security update fixing a XSS issue ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0086-1 Rating: moderate References: #664505 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update of calibre fixes a cross-site scripting (XSS) and a file disclosure vulnerability. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch calibre-3896 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): calibre-0.6.53-3.3.1 References: https://bugzilla.novell.com/664505

1 0

openSUSE-RU-2011:0085-1 (low): kdepim4: Update to 4.4.9
by maintenance＠opensuse.org 31 Jan '11

31 Jan '11

openSUSE Recommended Update: kdepim4: Update to 4.4.9 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0085-1 Rating: low References: #651155 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update provides an update of kdepim to 4.4.9, improving compatibility with KDE 4.6 and providing many stability fixes and enhancements. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch akregator-3886 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 4.4.9]: akregator-4.4.9-2.3.1 blogilo-4.4.9-2.3.1 kaddressbook-4.4.9-2.3.1 kalarm-4.4.9-2.3.1 kdepim4-4.4.9-2.3.1 kdepim4-devel-4.4.9-2.3.1 kdepim4-runtime-4.4.9-1.3.1 kdepim4-runtime-devel-4.4.9-1.3.1 kdepim4-wizards-4.4.9-2.3.1 kjots-4.4.9-2.3.1 kmail-4.4.9-2.3.1 knode-4.4.9-2.3.1 knotes-4.4.9-2.3.1 kontact-4.4.9-2.3.1 korganizer-4.4.9-2.3.1 ktimetracker-4.4.9-2.3.1 libkdepim4-4.4.9-2.3.1 libkdepim4-devel-4.4.9-2.3.1 References: https://bugzilla.novell.com/651155

1 0

openSUSE-SU-2011:0083-1 (moderate): perl-CGI-Simple: fix crlf injection (CVE-2010-4410, CVE-2010-4411)
by opensuse-security＠opensuse.org 28 Jan '11

28 Jan '11

openSUSE Security Update: perl-CGI-Simple: fix crlf injection (CVE-2010-4410, CVE-2010-4411) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0083-1 Rating: moderate References: #663396 Cross-References: CVE-2010-4410 CVE-2010-4411 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: The following vulnerabilities have been fixed in perl-CGI-Simple: CVE-2010-4410 - crlf injection CVE-2010-4411 - incomplete fix for crlf injection Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch perl-CGI-Simple-3872 - openSUSE 11.2: zypper in -t patch perl-CGI-Simple-3872 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 1.113]: perl-CGI-Simple-1.113-0.3.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.113]: perl-CGI-Simple-1.113-0.3.1 References: http://support.novell.com/security/cve/CVE-2010-4410.html http://support.novell.com/security/cve/CVE-2010-4411.html https://bugzilla.novell.com/663396

1 0

openSUSE-SU-2011:0082-1 (important): tomcat6: fixing a XSS vulnerability (CVE-2010-4172)
by opensuse-security＠opensuse.org 28 Jan '11

28 Jan '11

openSUSE Security Update: tomcat6: fixing a XSS vulnerability (CVE-2010-4172) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0082-1 Rating: important References: #655440 Cross-References: CVE-2010-4172 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a cross-site scripting vulnerability that affects the session list screen. This can be used to steal session cookies because tomcat 6 does not use the httpOnly flag for its cookies. (CVE-2010-4172) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch tomcat6-3849 - openSUSE 11.2: zypper in -t patch tomcat6-3849 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch): tomcat6-6.0.24-5.8.2 tomcat6-admin-webapps-6.0.24-5.8.2 tomcat6-docs-webapp-6.0.24-5.8.2 tomcat6-el-1_0-api-6.0.24-5.8.2 tomcat6-javadoc-6.0.24-5.8.2 tomcat6-jsp-2_1-api-6.0.24-5.8.2 tomcat6-lib-6.0.24-5.8.2 tomcat6-servlet-2_5-api-6.0.24-5.8.2 tomcat6-webapps-6.0.24-5.8.2 - openSUSE 11.2 (noarch): tomcat6-6.0.20-24.27.2 tomcat6-admin-webapps-6.0.20-24.27.2 tomcat6-docs-webapp-6.0.20-24.27.2 tomcat6-javadoc-6.0.20-24.27.2 tomcat6-jsp-2_1-api-6.0.20-24.27.2 tomcat6-lib-6.0.20-24.27.2 tomcat6-servlet-2_5-api-6.0.20-24.27.2 tomcat6-webapps-6.0.20-24.27.2 References: http://support.novell.com/security/cve/CVE-2010-4172.html https://bugzilla.novell.com/655440

1 0

openSUSE-RU-2011:0081-1 (low): exiv2: Fix crash on reading some files
by maintenance＠opensuse.org 28 Jan '11

28 Jan '11

openSUSE Recommended Update: exiv2: Fix crash on reading some files ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0081-1 Rating: low References: #661016 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides a crash fix for opening certain frequently occuring crashes when opening exif image files(bnc#661016). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch exiv2-3884 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): exiv2-0.19-5.3.1 libexiv2-6-0.19-5.3.1 libexiv2-devel-0.19-5.3.1 - openSUSE 11.3 (x86_64): libexiv2-6-32bit-0.19-5.3.1 - openSUSE 11.3 (noarch): exiv2-lang-0.19-5.3.1 References: https://bugzilla.novell.com/661016

1 0

openSUSE-RU-2011:0077-1 (low): tracker: Plug file descriptor leaks. Fixed by this update.
by maintenance＠opensuse.org 25 Jan '11

25 Jan '11

openSUSE Recommended Update: tracker: Plug file descriptor leaks. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0077-1 Rating: low References: #617425 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Due to leaks in the gstreamer and xmp extractors in tracker, resources were not being appropriately freed. This update fixes this problem. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch evolution-tracker-3848 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): evolution-tracker-0.8.5-3.5.1 libtracker-client-0_8-0-0.8.5-3.5.1 libtracker-extract-0_8-0-0.8.5-3.5.1 libtracker-miner-0_8-0-0.8.5-3.5.1 nautilus-tracker-0.8.5-3.5.1 tracker-0.8.5-3.5.1 tracker-applet-0.8.5-3.5.1 tracker-devel-0.8.5-3.5.1 tracker-gui-0.8.5-3.5.1 - openSUSE 11.3 (noarch): tracker-lang-0.8.5-3.5.1 References: https://bugzilla.novell.com/617425

1 0

openSUSE-SU-2011:0068-1 (moderate): hplip security update (CVE-2010-4267)
by opensuse-security＠opensuse.org 21 Jan '11

21 Jan '11

openSUSE Security Update: hplip security update (CVE-2010-4267) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0068-1 Rating: moderate References: #336658 Cross-References: CVE-2010-4267 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted SNMP replies could cause a buffer overflow in hplip's sane backend (CVE-2010-4267). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch hplip-3814 - openSUSE 11.2: zypper in -t patch hplip-3814 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): hplip-3.10.2-2.3.1 hplip-hpijs-3.10.2-2.3.1 - openSUSE 11.2 (i586 x86_64): hplip-3.9.8-3.6.1 hplip-hpijs-3.9.8-3.6.1 References: http://support.novell.com/security/cve/CVE-2010-4267.html https://bugzilla.novell.com/336658

1 0

openSUSE-SU-2011:0064-1 (important): perl: fixed multiple header injection problems in CGI module (CVE-2010-2761, CVE-2010-4410,CVE-2010-4411).
by opensuse-security＠opensuse.org 20 Jan '11

20 Jan '11

openSUSE Security Update: perl: fixed multiple header injection problems in CGI module (CVE-2010-2761, CVE-2010-4410,CVE-2010-4411). ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0064-1 Rating: important References: #657343 Cross-References: CVE-2010-2761 CVE-2010-3172 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses. CVE-2010-2761, CVE-2010-4410 and CVE-2010-4411 have been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch perl-3806 - openSUSE 11.2: zypper in -t patch perl-3806 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): perl-5.12.1-2.3.1 perl-base-5.12.1-2.3.1 - openSUSE 11.3 (x86_64): perl-32bit-5.12.1-2.3.1 perl-base-32bit-5.12.1-2.3.1 - openSUSE 11.3 (noarch): perl-doc-5.12.1-2.3.1 - openSUSE 11.2 (i586 x86_64): perl-5.10.0-72.9.1 perl-base-5.10.0-72.9.1 perl-doc-5.10.0-72.9.1 - openSUSE 11.2 (x86_64): perl-32bit-5.10.0-72.9.1 perl-base-32bit-5.10.0-72.9.1 References: http://support.novell.com/security/cve/CVE-2010-2761.html http://support.novell.com/security/cve/CVE-2010-3172.html https://bugzilla.novell.com/657343

1 0

openSUSE-RU-2011:0063-1 (low): spamassassin: Update configuration enhancements
by maintenance＠opensuse.org 20 Jan '11

20 Jan '11

openSUSE Recommended Update: spamassassin: Update configuration enhancements ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0063-1 Rating: low References: #650645 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update adds a daily cron job run for calling sa-update. In addition, it removes a warning in spamd (bnc#650645) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch perl-Mail-SpamAssassin-3837 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): perl-Mail-SpamAssassin-3.3.1-3.3.1 perl-Mail-SpamAssassin-Plugin-iXhash-1.5.5-3.3.1 spamassassin-3.3.1-3.3.1 References: https://bugzilla.novell.com/650645

1 0

openSUSE-SU-2011:0058-1 (low): sssd: local denial of service (CVE-2010-4341)
by opensuse-security＠opensuse.org 19 Jan '11

19 Jan '11

openSUSE Security Update: sssd: local denial of service (CVE-2010-4341) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0058-1 Rating: low References: #660481 Cross-References: CVE-2010-4341 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a local denial-of-service attack that stops other users from logging in. The bug existed in the pam_parse_in_data_v2() function. (CVE-2010-4341: CVSS v2 Base Score: 2.1) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libcollection-devel-3829 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libcollection-devel-0.4.0-2.3.1 libcollection1-0.4.0-2.3.1 libdhash-devel-0.4.0-2.3.1 libdhash1-0.4.0-2.3.1 libini_config-devel-0.4.0-2.3.1 libini_config1-0.4.0-2.3.1 python-sssd-config-1.1.0-2.3.1 sssd-1.1.0-2.3.1 sssd-ipa-provider-1.1.0-2.3.1 sssd-tools-1.1.0-2.3.1 - openSUSE 11.3 (x86_64): sssd-32bit-1.1.0-2.3.1 References: http://support.novell.com/security/cve/CVE-2010-4341.html https://bugzilla.novell.com/660481

1 0