October 2011 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2011:1196-1: moderate: java-1_6_0-openjdk: Update to the 1.10.4 release
by opensuse-security＠opensuse.org 28 Oct '11

28 Oct '11

openSUSE Security Update: java-1_6_0-openjdk: Update to the 1.10.4 release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1196-1 Rating: moderate References: #725167 Cross-References: CVE-2011-3389 CVE-2011-3516 CVE-2011-3521 CVE-2011-3544 CVE-2011-3545 CVE-2011-3546 CVE-2011-3547 CVE-2011-3548 CVE-2011-3549 CVE-2011-3550 CVE-2011-3551 CVE-2011-3552 CVE-2011-3553 CVE-2011-3554 CVE-2011-3555 CVE-2011-3556 CVE-2011-3557 CVE-2011-3558 CVE-2011-3560 CVE-2011-3561 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. It includes one version update. Description: Oracle/Sun OpenJDK 1.6.0 was updated to the 1.10.4release, fixing lots of bugs and security issues. Please see http://www.oracle.com/technetwork/topics/security/javacpuoct 2011-443431.html for more details. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch java-1_6_0-openjdk-5329 java-1_6_0-sun-5320 - openSUSE 11.3: zypper in -t patch java-1_6_0-openjdk-5329 java-1_6_0-sun-5320 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.6.0.u29]: java-1_6_0-openjdk-1.6.0.0_b22.1.10.4-0.3.2 java-1_6_0-openjdk-devel-1.6.0.0_b22.1.10.4-0.3.2 java-1_6_0-sun-1.6.0.u29-0.2.1 java-1_6_0-sun-alsa-1.6.0.u29-0.2.1 java-1_6_0-sun-demo-1.6.0.u29-0.2.1 java-1_6_0-sun-devel-1.6.0.u29-0.2.1 java-1_6_0-sun-jdbc-1.6.0.u29-0.2.1 java-1_6_0-sun-plugin-1.6.0.u29-0.2.1 java-1_6_0-sun-src-1.6.0.u29-0.2.1 - openSUSE 11.4 (noarch): java-1_6_0-openjdk-demo-1.6.0.0_b22.1.10.4-0.3.2 java-1_6_0-openjdk-javadoc-1.6.0.0_b22.1.10.4-0.3.2 java-1_6_0-openjdk-src-1.6.0.0_b22.1.10.4-0.3.2 - openSUSE 11.3 (i586 x86_64) [New Version: 1.6.0.u29]: java-1_6_0-openjdk-1.6.0.0_b22.1.10.4-0.3.2 java-1_6_0-openjdk-devel-1.6.0.0_b22.1.10.4-0.3.2 java-1_6_0-sun-1.6.0.u29-0.2.1 java-1_6_0-sun-alsa-1.6.0.u29-0.2.1 java-1_6_0-sun-devel-1.6.0.u29-0.2.1 java-1_6_0-sun-jdbc-1.6.0.u29-0.2.1 java-1_6_0-sun-plugin-1.6.0.u29-0.2.1 java-1_6_0-sun-src-1.6.0.u29-0.2.1 - openSUSE 11.3 (noarch): java-1_6_0-openjdk-demo-1.6.0.0_b22.1.10.4-0.3.2 java-1_6_0-openjdk-javadoc-1.6.0.0_b22.1.10.4-0.3.2 java-1_6_0-openjdk-src-1.6.0.0_b22.1.10.4-0.3.2 References: http://support.novell.com/security/cve/CVE-2011-3389.html http://support.novell.com/security/cve/CVE-2011-3516.html http://support.novell.com/security/cve/CVE-2011-3521.html http://support.novell.com/security/cve/CVE-2011-3544.html http://support.novell.com/security/cve/CVE-2011-3545.html http://support.novell.com/security/cve/CVE-2011-3546.html http://support.novell.com/security/cve/CVE-2011-3547.html http://support.novell.com/security/cve/CVE-2011-3548.html http://support.novell.com/security/cve/CVE-2011-3549.html http://support.novell.com/security/cve/CVE-2011-3550.html http://support.novell.com/security/cve/CVE-2011-3551.html http://support.novell.com/security/cve/CVE-2011-3552.html http://support.novell.com/security/cve/CVE-2011-3553.html http://support.novell.com/security/cve/CVE-2011-3554.html http://support.novell.com/security/cve/CVE-2011-3555.html http://support.novell.com/security/cve/CVE-2011-3556.html http://support.novell.com/security/cve/CVE-2011-3557.html http://support.novell.com/security/cve/CVE-2011-3558.html http://support.novell.com/security/cve/CVE-2011-3560.html http://support.novell.com/security/cve/CVE-2011-3561.html https://bugzilla.novell.com/725167

1 0

openSUSE-RU-2011:1191-1: important: timezone: Update to 2011m
by maintenance＠opensuse.org 27 Oct '11

27 Oct '11

openSUSE Recommended Update: timezone: Update to 2011m ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1191-1 Rating: important References: #726162 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update provides 2011m which provides the following important changes: * All Ukrainian timezones are going back to winter time on Oct 30th, 2011 * Adding Tiraspol to the zone.tab * America/Bahia switched to DST on Oct 16th, 2011 * West Bank ended DST 2011-09-30 already * Fiji enters DST on October 23th 2011 * Palestine suspends DST during Ramadan in 2011; Gaza and Hebron split in 2011, leading to a new Asia/Hebron zone (thanks to Steffen Thorsen and Alexander Krivenshev). * Belarus adopts permanent DST in 2011 (thanks to Yauhen Kharuzhy, Alexander Bokovoy, Alexander Krivenyshev, and Kirill A. Shutemov). * "Russia" rules changed to reflect end of use in 2010. * "FET" used as abbreviation for Belarus, Ukraine, and western Russia Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch timezone-2011m-5325 - openSUSE 11.3: zypper in -t patch timezone-2011m-5325 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2011m]: timezone-2011m-0.2.1 - openSUSE 11.4 (noarch) [New Version: 2011m]: timezone-java-2011m-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2011m]: timezone-2011m-0.2.1 - openSUSE 11.3 (noarch) [New Version: 2011m]: timezone-java-2011m-0.2.1 References: https://bugzilla.novell.com/726162

1 0

openSUSE-SU-2011:1190-1: moderate: puppet (CVE-2011-3848)
by opensuse-security＠opensuse.org 27 Oct '11

27 Oct '11

openSUSE Security Update: puppet (CVE-2011-3848) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1190-1 Rating: moderate References: #721139 Cross-References: CVE-2011-3848 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A directory traversal vulnerability in puppet allowed unauthenticated remote attackers to upload x.509 certificate signing requests to arbitrary locations (CVE-2011-3848) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch puppet-5243 - openSUSE 11.3: zypper in -t patch puppet-5243 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): puppet-2.6.4-4.7.1 puppet-server-2.6.4-4.7.1 - openSUSE 11.3 (i586 x86_64): puppet-0.25.4-4.3.1 puppet-server-0.25.4-4.3.1 References: http://support.novell.com/security/cve/CVE-2011-3848.html https://bugzilla.novell.com/721139

1 0

openSUSE-RU-2011:1182-1: kdebase4: fix create new directory in subdirectory
by maintenance＠opensuse.org 25 Oct '11

25 Oct '11

openSUSE Recommended Update: kdebase4: fix create new directory in subdirectory ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1182-1 Rating: low References: #677973 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a bug in Dolphin where it was unable to create new directory in subdirectory from context menu. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch dolphin-5302 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): dolphin-4.6.0-6.10.1 kdebase4-4.6.0-6.10.1 kdebase4-libkonq-4.6.0-6.10.1 kdebase4-nsplugin-4.6.0-6.10.1 kdepasswd-4.6.0-6.10.1 kdialog-4.6.0-6.10.1 keditbookmarks-4.6.0-6.10.1 kfind-4.6.0-6.10.1 konqueror-4.6.0-6.10.1 konsole-4.6.0-6.10.1 kwrite-4.6.0-6.10.1 libkonq-devel-4.6.0-6.10.1 libkonq5-4.6.0-6.10.1 - openSUSE 11.4 (x86_64): libkonq5-32bit-4.6.0-6.10.1 References: https://bugzilla.novell.com/677973

1 0

openSUSE-RU-2011:1181-1: ddclient: Make sure all necessary dependencies are installed with the package
by maintenance＠opensuse.org 25 Oct '11

25 Oct '11

openSUSE Recommended Update: ddclient: Make sure all necessary dependencies are installed with the package ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1181-1 Rating: low References: #267306 #723688 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This patch fixes two problems in ddclient: - #723688: not all necessary dependencies are installed with the package - #267306: /etc/init.d/ddclient can't see ddclient running Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch ddclient-5300 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): ddclient-3.8.0-13.14.1 References: https://bugzilla.novell.com/267306 https://bugzilla.novell.com/723688

1 0

openSUSE-SU-2011:1177-1: moderate: clamav: fixing recursion level crash (CVE-2011-3627)
by opensuse-security＠opensuse.org 24 Oct '11

24 Oct '11

openSUSE Security Update: clamav: fixing recursion level crash (CVE-2011-3627) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1177-1 Rating: moderate References: #724856 Cross-References: CVE-2011-3627 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This version update of clamav fixes a recursion level crash. CVE-2011-3627 was assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch clamav-5308 - openSUSE 11.3: zypper in -t patch clamav-5308 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 0.97.3]: clamav-0.97.3-0.2.1 - openSUSE 11.4 (noarch) [New Version: 0.97.3]: clamav-db-0.97.3-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 0.97.3]: clamav-0.97.3-0.2.1 - openSUSE 11.3 (noarch) [New Version: 0.97.3]: clamav-db-0.97.3-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3627.html https://bugzilla.novell.com/724856

1 0

openSUSE-SU-2011:1176-1: moderate: etherape: Update to 0.9.12 to fix a remote crash
by opensuse-security＠opensuse.org 24 Oct '11

24 Oct '11

openSUSE Security Update: etherape: Update to 0.9.12 to fix a remote crash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1176-1 Rating: moderate References: #719086 Cross-References: CVE-2011-3369 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Etherape was updated to 0.9.12 to fix a security issue (CVE-2011-3369) and various bugs. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch etherape-5318 - openSUSE 11.3: zypper in -t patch etherape-5318 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): etherape-0.9.12-2.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 0.9.12]: etherape-0.9.12-2.3.1 References: http://support.novell.com/security/cve/CVE-2011-3369.html https://bugzilla.novell.com/719086

1 0

openSUSE-SU-2011:1175-1: moderate: fail2ban
by opensuse-security＠opensuse.org 24 Oct '11

24 Oct '11

openSUSE Security Update: fail2ban ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1175-1 Rating: moderate References: #690853 Cross-References: CVE-2009-5023 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: fail2ban IP used insecure temporary files when unbanning an IP address (CVE-2009-5023). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch fail2ban-5301 - openSUSE 11.3: zypper in -t patch fail2ban-5301 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): fail2ban-0.8.4-11.12.1 - openSUSE 11.3 (noarch): fail2ban-0.8.4-5.3.1 References: http://support.novell.com/security/cve/CVE-2009-5023.html https://bugzilla.novell.com/690853

1 0

openSUSE-SU-2011:1172-1: important: opera: Release 11.52 to fix memory corruption via SVG content
by opensuse-security＠opensuse.org 24 Oct '11

24 Oct '11

openSUSE Security Update: opera: Release 11.52 to fix memory corruption via SVG content ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1172-1 Rating: important References: #724754 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: This update of Opera fixes a memory flaw in the code that processes SVG content which could be exploited by attackers to execute arbitrary code through specially crafted websites. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch opera-5314 - openSUSE 11.3: zypper in -t patch opera-5314 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 11.52]: opera-11.52-0.2.1 opera-gtk-11.52-0.2.1 opera-kde4-11.52-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 11.52]: opera-11.52-0.2.1 opera-gtk-11.52-0.2.1 opera-kde4-11.52-0.2.1 References: https://bugzilla.novell.com/724754

1 0

openSUSE-SU-2011:1170-1: moderate: Fix a Cyrus IMAPd nntpd authentication bypass and a DoS (CVE-2011-3372, CVE-2011-3481)
by opensuse-security＠opensuse.org 24 Oct '11

24 Oct '11

openSUSE Security Update: Fix a Cyrus IMAPd nntpd authentication bypass and a DoS (CVE-2011-3372, CVE-2011-3481) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1170-1 Rating: moderate References: #719998 Cross-References: CVE-2011-3372 CVE-2011-3481 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: An authentication bypass (CVE-2011-3372) and a DoS vulnerability (CVE-2011-3481) have been fixed in the Cyrus IMAPd nntpd. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch cyrus-imapd-5240 - openSUSE 11.3: zypper in -t patch cyrus-imapd-5240 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): cyrus-imapd-2.3.16-16.21.1 cyrus-imapd-devel-2.3.16-16.21.1 perl-Cyrus-IMAP-2.3.16-16.21.1 perl-Cyrus-SIEVE-managesieve-2.3.16-16.21.1 - openSUSE 11.3 (i586 x86_64): cyrus-imapd-2.3.16-8.9.1 cyrus-imapd-devel-2.3.16-8.9.1 perl-Cyrus-IMAP-2.3.16-8.9.1 perl-Cyrus-SIEVE-managesieve-2.3.16-8.9.1 References: http://support.novell.com/security/cve/CVE-2011-3372.html http://support.novell.com/security/cve/CVE-2011-3481.html https://bugzilla.novell.com/719998

1 0

openSUSE-SU-2011:1169-1: important: krb5: fixed kdc remote denial of service ( CVE-2011-1528, CVE-2011-1529) and unauthorized file access (CVE-2011-1526)
by opensuse-security＠opensuse.org 24 Oct '11

24 Oct '11

openSUSE Security Update: krb5: fixed kdc remote denial of service ( CVE-2011-1528, CVE-2011-1529) and unauthorized file access (CVE-2011-1526) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1169-1 Rating: important References: #719393 Cross-References: CVE-2011-1526 CVE-2011-1528 CVE-2011-1529 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The following issues have been fixed: - CVE-2011-1528: In releases krb5-1.8 and later, the KDC can crash due to an assertion failure. - CVE-2011-1529: In releases krb5-1.8 and later, the KDC can crash due to a null pointer dereference. Both bugs could be triggered by unauthenticated remote attackers. Additionally CVE-2011-1526 was fixed that allowed authenticated users to access files via krb5 ftpd they should not have access to. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch krb5-5303 - openSUSE 11.3: zypper in -t patch krb5-5303 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): krb5-1.8.3-16.19.1 krb5-appl-clients-1.0-7.10.1 krb5-appl-servers-1.0-7.10.1 krb5-client-1.8.3-16.19.1 krb5-devel-1.8.3-16.19.1 krb5-plugin-kdb-ldap-1.8.3-16.19.1 krb5-plugin-preauth-pkinit-1.8.3-16.19.1 krb5-server-1.8.3-16.19.1 - openSUSE 11.4 (x86_64): krb5-32bit-1.8.3-16.19.1 krb5-devel-32bit-1.8.3-16.19.1 - openSUSE 11.3 (i586 x86_64): krb5-1.8.1-5.11.1 krb5-appl-clients-1.0-4.3.1 krb5-appl-servers-1.0-4.3.1 krb5-client-1.8.1-5.11.1 krb5-devel-1.8.1-5.11.1 krb5-plugin-kdb-ldap-1.8.1-5.11.1 krb5-plugin-preauth-pkinit-1.8.1-5.11.1 krb5-server-1.8.1-5.11.1 - openSUSE 11.3 (x86_64): krb5-32bit-1.8.1-5.11.1 krb5-devel-32bit-1.8.1-5.11.1 References: http://support.novell.com/security/cve/CVE-2011-1526.html http://support.novell.com/security/cve/CVE-2011-1528.html http://support.novell.com/security/cve/CVE-2011-1529.html https://bugzilla.novell.com/719393

1 0

openSUSE-RU-2011:1168-1: enchant: Fix dictionary detection
by maintenance＠opensuse.org 24 Oct '11

24 Oct '11

openSUSE Recommended Update: enchant: Fix dictionary detection ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1168-1 Rating: low References: #722693 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: - 722693: enchant cannot use hunspell because dictionaries are not found Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch enchant-5288 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): enchant-devel-1.6.0-8.9.1 enchant-tools-1.6.0-8.9.1 enchant-voikko-1.6.0-8.9.1 libenchant1-1.6.0-8.9.1 - openSUSE 11.4 (x86_64): enchant-voikko-32bit-1.6.0-8.9.1 enchant-zemberek-32bit-1.6.0-8.9.1 libenchant1-32bit-1.6.0-8.9.1 References: https://bugzilla.novell.com/722693

1 0

openSUSE-RU-2011:1166-1: xdelta : Fix support for large files
by maintenance＠opensuse.org 22 Oct '11

22 Oct '11

openSUSE Recommended Update: xdelta : Fix support for large files ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1166-1 Rating: low References: #644388 #720382 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update provides multiple fixes for large file support Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch xdelta-5269 - openSUSE 11.3: zypper in -t patch xdelta-5269 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): xdelta-1.1.4-189.190.1 xdelta-devel-1.1.4-189.190.1 - openSUSE 11.3 (i586 x86_64): xdelta-1.1.4-186.3.1 xdelta-devel-1.1.4-186.3.1 References: https://bugzilla.novell.com/644388 https://bugzilla.novell.com/720382

1 0

openSUSE-SU-2011:1161-1: important: ldns (CVE-2011-3581)
by opensuse-security＠opensuse.org 20 Oct '11

20 Oct '11

openSUSE Security Update: ldns (CVE-2011-3581) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1161-1 Rating: important References: #720277 Cross-References: CVE-2011-3581 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A boundary error in ldns_rr_new_frm_str_internal() could lead to a heap-based buffer overfow when processing RR records (CVE-2011-3581). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch ldns-5289 - openSUSE 11.3: zypper in -t patch ldns-5289 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libldns-devel-1.5.1-10.11.1 libldns1-1.5.1-10.11.1 - openSUSE 11.3 (i586 x86_64): libldns-devel-1.5.1-7.3.1 libldns1-1.5.1-7.3.1 References: http://support.novell.com/security/cve/CVE-2011-3581.html https://bugzilla.novell.com/720277

1 0

openSUSE-SU-2011:1155-1: important: quagga: fixing multiple vulnerabilities
by opensuse-security＠opensuse.org 18 Oct '11

18 Oct '11

openSUSE Security Update: quagga: fixing multiple vulnerabilities ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1155-1 Rating: important References: #718056 #718058 #718059 #718061 #718062 Cross-References: CVE-2011-3323 CVE-2011-3324 CVE-2011-3325 CVE-2011-3326 CVE-2011-3327 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. It includes one version update. Description: This update fixes the following security issues: - 718056: OSPF6D buffer overflow while decoding Link State Update with Inter Area Prefix Lsa (CVE-2011-3323) - 718058: OSPF6D DoS while decoding Database Description packet (CVE-2011-3324) - 718059: OSPFD DoS while decoding Hello packet (CVE-2011-3325) - 718061: OSPFD DoS while decoding Link State Update (CVE-2011-3326) - 718062: DoS while decoding EXTENDED_COMMUNITIES in Quagga's BGP (CVE-2011-3327) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch quagga-5276 - openSUSE 11.3: zypper in -t patch quagga-5276 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): quagga-0.99.17-4.11.1 quagga-devel-0.99.17-4.11.1 - openSUSE 11.3 (i586 x86_64) [New Version: 0.99.17]: quagga-0.99.17-1.11.1 quagga-devel-0.99.17-1.11.1 References: http://support.novell.com/security/cve/CVE-2011-3323.html http://support.novell.com/security/cve/CVE-2011-3324.html http://support.novell.com/security/cve/CVE-2011-3325.html http://support.novell.com/security/cve/CVE-2011-3326.html http://support.novell.com/security/cve/CVE-2011-3327.html https://bugzilla.novell.com/718056 https://bugzilla.novell.com/718058 https://bugzilla.novell.com/718059 https://bugzilla.novell.com/718061 https://bugzilla.novell.com/718062

1 0

openSUSE-SU-2011:1152-1: moderate: VUL-0: gimp: LZW heap corruption (CVE-2011-2896)
by opensuse-security＠opensuse.org 18 Oct '11

18 Oct '11

openSUSE Security Update: VUL-0: gimp: LZW heap corruption (CVE-2011-2896) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1152-1 Rating: moderate References: #711491 Cross-References: CVE-2011-2896 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: specially crafted gif files could cause an infinite loop or a heap-based buffer overflow in the gif decoder (CVE-2011-2896). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch gimp-5151 - openSUSE 11.3: zypper in -t patch gimp-5151 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gimp-2.6.11-13.18.1 gimp-branding-upstream-2.6.11-13.18.1 gimp-devel-2.6.11-13.18.1 gimp-help-browser-2.6.11-13.18.1 gimp-module-hal-2.6.11-13.18.1 gimp-plugins-python-2.6.11-13.18.1 libgimp-2_0-0-2.6.11-13.18.1 libgimpui-2_0-0-2.6.11-13.18.1 - openSUSE 11.4 (x86_64): libgimp-2_0-0-32bit-2.6.11-13.18.1 libgimpui-2_0-0-32bit-2.6.11-13.18.1 - openSUSE 11.4 (noarch): gimp-lang-2.6.11-13.18.1 - openSUSE 11.3 (i586 x86_64): gimp-2.6.8-7.9.1 gimp-branding-upstream-2.6.8-7.9.1 gimp-devel-2.6.8-7.9.1 gimp-help-browser-2.6.8-7.9.1 gimp-module-hal-2.6.8-7.9.1 gimp-plugins-python-2.6.8-7.9.1 - openSUSE 11.3 (noarch): gimp-lang-2.6.8-7.9.1 References: http://support.novell.com/security/cve/CVE-2011-2896.html https://bugzilla.novell.com/711491

1 0

openSUSE-SU-2011:1143-2: moderate: libreoffice to 3.4
by opensuse-security＠opensuse.org 17 Oct '11

17 Oct '11

openSUSE Security Update: libreoffice to 3.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1143-2 Rating: moderate References: #647959 #650049 #651250 #652562 #653662 #663622 #665112 #675868 #675961 #676858 #678998 #680272 #681738 #683578 #684784 #693238 #693477 #694119 #694344 #695479 #696630 #702506 #704311 #704639 #704642 #705949 #706792 #707486 #707779 #708137 #708518 #710061 #710920 #711977 #712358 #715268 #715416 #715856 #715931 #717262 Cross-References: CVE-2011-2685 CVE-2011-2713 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves two vulnerabilities and has 38 fixes is now available. It includes two new package versions. Description: LibreOffice 3.4 includes new interesting features and fixes, see http://www.libreoffice.org/download/3-4-new-features-and-fix es/ The update fixes the following security issue: - 704311: libreoffice Lotus Word Pro filter multiple vulnerabilities (CVE-2011-2685) - 722075: LibreOffice: Out-of-bounds read in DOC sprm (CVE-2011-2713) This update also fixes the following non-security issues: - 647959: LibO has a regression problem to show emf charts properly. - 650049: pptx presentation has text in boxes and circles. Only text is displayed. - 651250: Video and Audio does not play in slide show mode of LibO Impress. - 652562: LibreOffice crashes on start on 11.4-MS3 NET/DVD install - 653662: libreoffice build calls mkbundle2 (deprecated) instead of mkbundle - 663622: Writer crash during document save - 665112: could not type or edit office document - 675868: eliminate wording of ooconvert existed in loconvert --help - 675961: Libreoffice Copy paste of formula in Writer tables does not work as expected - 676858: Document with full page graphic in header will not allow click-drag or right-click. - 678998: Libre Office 3.3.1 does not detect KDE3 - 680272: Deleting multiple sheets results in run-time error/crash - 681738: DDE link is lost when .xls file is opened/saved in Calc. - 683578: Large xlsx file takes extremely long to open with Libreoffice calc - 684784: Microsoft Office spreadsheet does not display anything - 693238: Column format in docx file is not displayed correctly. - 693477: Format of Word .doc file from HP is bad. - 694119: Using File-->Send-->Document as E-mail will crash Impress - 694344: 3rd level bulleted items are not displayed properly. - 695479: L3: RTF file is not displayed correctly by Writer. - 696630: DDE link from Calc to Excel needs Excel open to update link in Calc. - 702506: Writer crashes when opening docx files. - 704639: HTML document appearance changes when opened in open office vs LibreOffice - 704642: 16 digit numbers change in LibreOffice when opening a file created in MS Excel - 705949: Information missing from MS Word document when opened in LibreOffice (w:sdt) - 706792: PTF 3.3.1-21 introduced a crash when opening a pptx presentation. - 707486: Macro from excel fails on Selection.Copy when run in Calc. - 707779: Disappearing text - 708137: xls spreadsheet is extremely slow to open and check boxes are broken. - 708518: Bullet symbol is not rendered correctly in a specific slide. - 710061: ODP export to PDF produces broken images - 710920: RPM installation ending with redundant error. - 711977: File association for fod* files are missing. - 712358: Some extensions broken after upgrading. - 715268: Command libreoffice --help does not work when LibreOffice is already started - 715856: LibreOffice:Stable/libreoffice-converter: Bug - 715416: Impress crashes starting Slide show in the context of dual monitors extension mode. - 715931: failed to save an odp file. - 717262: libtool adds /usr/lib64 into rpath Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libreoffice-34-5253 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 3.4.2.6]: libreoffice-3.4.2.6-2.3.1 libreoffice-base-3.4.2.6-2.3.1 libreoffice-base-drivers-mysql-3.4.2.6-2.3.1 libreoffice-base-drivers-postgresql-3.4.2.6-2.3.1 libreoffice-base-extensions-3.4.2.6-2.3.1 libreoffice-calc-3.4.2.6-2.3.1 libreoffice-calc-extensions-3.4.2.6-2.3.1 libreoffice-draw-3.4.2.6-2.3.1 libreoffice-draw-extensions-3.4.2.6-2.3.1 libreoffice-filters-optional-3.4.2.6-2.3.1 libreoffice-gnome-3.4.2.6-2.3.1 libreoffice-icon-themes-prebuilt-3.4.2.6-2.3.1 libreoffice-impress-3.4.2.6-2.3.1 libreoffice-impress-extensions-3.4.2.6-2.3.1 libreoffice-kde4-3.4.2.6-2.3.1 libreoffice-l10n-prebuilt-3.4.2.6-2.3.1 libreoffice-mailmerge-3.4.2.6-2.3.1 libreoffice-math-3.4.2.6-2.3.1 libreoffice-officebean-3.4.2.6-2.3.1 libreoffice-pyuno-3.4.2.6-2.3.1 libreoffice-testtool-3.4.2.6-2.3.1 libreoffice-writer-3.4.2.6-2.3.1 libreoffice-writer-extensions-3.4.2.6-2.3.1 - openSUSE 11.4 (noarch) [New Version: 1.4 and 3.4.2.6]: libreoffice-branding-upstream-3.4.2.6-2.3.1 libreoffice-converter-3.3-1.4.1 libreoffice-help-cs-3.4.2.6-2.3.1 libreoffice-help-da-3.4.2.6-2.3.1 libreoffice-help-de-3.4.2.6-2.3.1 libreoffice-help-en-GB-3.4.2.6-2.3.1 libreoffice-help-en-US-3.4.2.6-2.3.1 libreoffice-help-en-ZA-3.4.2.6-2.3.1 libreoffice-help-es-3.4.2.6-2.3.1 libreoffice-help-et-3.4.2.6-2.3.1 libreoffice-help-fr-3.4.2.6-2.3.1 libreoffice-help-gl-3.4.2.6-2.3.1 libreoffice-help-gu-IN-3.4.2.6-2.3.1 libreoffice-help-hi-IN-3.4.2.6-2.3.1 libreoffice-help-hu-3.4.2.6-2.3.1 libreoffice-help-it-3.4.2.6-2.3.1 libreoffice-help-ja-3.4.2.6-2.3.1 libreoffice-help-km-3.4.2.6-2.3.1 libreoffice-help-ko-3.4.2.6-2.3.1 libreoffice-help-nl-3.4.2.6-2.3.1 libreoffice-help-pl-3.4.2.6-2.3.1 libreoffice-help-pt-3.4.2.6-2.3.1 libreoffice-help-pt-BR-3.4.2.6-2.3.1 libreoffice-help-ru-3.4.2.6-2.3.1 libreoffice-help-sl-3.4.2.6-2.3.1 libreoffice-help-sv-3.4.2.6-2.3.1 libreoffice-help-zh-CN-3.4.2.6-2.3.1 libreoffice-help-zh-TW-3.4.2.6-2.3.1 libreoffice-icon-theme-crystal-3.4.2.6-1.3.1 libreoffice-icon-theme-galaxy-3.4.2.6-1.3.1 libreoffice-icon-theme-hicontrast-3.4.2.6-1.3.1 libreoffice-icon-theme-oxygen-3.4.2.6-1.3.1 libreoffice-icon-theme-tango-3.4.2.6-1.3.1 libreoffice-l10n-af-3.4.2.6-1.3.1 libreoffice-l10n-ar-3.4.2.6-1.3.1 libreoffice-l10n-be-BY-3.4.2.6-1.3.1 libreoffice-l10n-bg-3.4.2.6-1.3.1 libreoffice-l10n-br-3.4.2.6-1.3.1 libreoffice-l10n-ca-3.4.2.6-1.3.1 libreoffice-l10n-cs-3.4.2.6-1.3.1 libreoffice-l10n-cy-3.4.2.6-1.3.1 libreoffice-l10n-da-3.4.2.6-1.3.1 libreoffice-l10n-de-3.4.2.6-1.3.1 libreoffice-l10n-el-3.4.2.6-1.3.1 libreoffice-l10n-en-GB-3.4.2.6-1.3.1 libreoffice-l10n-en-ZA-3.4.2.6-1.3.1 libreoffice-l10n-es-3.4.2.6-1.3.1 libreoffice-l10n-et-3.4.2.6-1.3.1 libreoffice-l10n-fi-3.4.2.6-1.3.1 libreoffice-l10n-fr-3.4.2.6-1.3.1 libreoffice-l10n-ga-3.4.2.6-1.3.1 libreoffice-l10n-gl-3.4.2.6-1.3.1 libreoffice-l10n-gu-IN-3.4.2.6-1.3.1 libreoffice-l10n-he-3.4.2.6-1.3.1 libreoffice-l10n-hi-IN-3.4.2.6-1.3.1 libreoffice-l10n-hr-3.4.2.6-1.3.1 libreoffice-l10n-hu-3.4.2.6-1.3.1 libreoffice-l10n-it-3.4.2.6-1.3.1 libreoffice-l10n-ja-3.4.2.6-1.3.1 libreoffice-l10n-ka-3.4.2.6-1.3.1 libreoffice-l10n-km-3.4.2.6-1.3.1 libreoffice-l10n-ko-3.4.2.6-1.3.1 libreoffice-l10n-lt-3.4.2.6-1.3.1 libreoffice-l10n-mk-3.4.2.6-1.3.1 libreoffice-l10n-nb-3.4.2.6-1.3.1 libreoffice-l10n-nl-3.4.2.6-1.3.1 libreoffice-l10n-nn-3.4.2.6-1.3.1 libreoffice-l10n-nr-3.4.2.6-1.3.1 libreoffice-l10n-pa-IN-3.4.2.6-1.3.1 libreoffice-l10n-pl-3.4.2.6-1.3.1 libreoffice-l10n-pt-3.4.2.6-1.3.1 libreoffice-l10n-pt-BR-3.4.2.6-1.3.1 libreoffice-l10n-ru-3.4.2.6-1.3.1 libreoffice-l10n-rw-3.4.2.6-1.3.1 libreoffice-l10n-sh-3.4.2.6-1.3.1 libreoffice-l10n-sk-3.4.2.6-1.3.1 libreoffice-l10n-sl-3.4.2.6-1.3.1 libreoffice-l10n-sr-3.4.2.6-1.3.1 libreoffice-l10n-ss-3.4.2.6-1.3.1 libreoffice-l10n-st-3.4.2.6-1.3.1 libreoffice-l10n-sv-3.4.2.6-1.3.1 libreoffice-l10n-tg-3.4.2.6-1.3.1 libreoffice-l10n-th-3.4.2.6-1.3.1 libreoffice-l10n-tr-3.4.2.6-1.3.1 libreoffice-l10n-ts-3.4.2.6-1.3.1 libreoffice-l10n-uk-3.4.2.6-1.3.1 libreoffice-l10n-ve-3.4.2.6-1.3.1 libreoffice-l10n-vi-3.4.2.6-1.3.1 libreoffice-l10n-xh-3.4.2.6-1.3.1 libreoffice-l10n-zh-CN-3.4.2.6-1.3.1 libreoffice-l10n-zh-TW-3.4.2.6-1.3.1 libreoffice-l10n-zu-3.4.2.6-1.3.1 libreoffice-languagetool-1.4-2.2.1 libreoffice-languagetool-ca-1.4-2.2.1 libreoffice-languagetool-de-1.4-2.2.1 libreoffice-languagetool-en-1.4-2.2.1 libreoffice-languagetool-es-1.4-2.2.1 libreoffice-languagetool-fr-1.4-2.2.1 libreoffice-languagetool-gl-1.4-2.2.1 libreoffice-languagetool-it-1.4-2.2.1 libreoffice-languagetool-nl-1.4-2.2.1 libreoffice-languagetool-pl-1.4-2.2.1 libreoffice-languagetool-ro-1.4-2.2.1 libreoffice-languagetool-ru-1.4-2.2.1 libreoffice-languagetool-sk-1.4-2.2.1 libreoffice-languagetool-sv-1.4-2.2.1 libreoffice-openclipart-3.4-1.3.1 References: http://support.novell.com/security/cve/CVE-2011-2685.html http://support.novell.com/security/cve/CVE-2011-2713.html https://bugzilla.novell.com/647959 https://bugzilla.novell.com/650049 https://bugzilla.novell.com/651250 https://bugzilla.novell.com/652562 https://bugzilla.novell.com/653662 https://bugzilla.novell.com/663622 https://bugzilla.novell.com/665112 https://bugzilla.novell.com/675868 https://bugzilla.novell.com/675961 https://bugzilla.novell.com/676858 https://bugzilla.novell.com/678998 https://bugzilla.novell.com/680272 https://bugzilla.novell.com/681738 https://bugzilla.novell.com/683578 https://bugzilla.novell.com/684784 https://bugzilla.novell.com/693238 https://bugzilla.novell.com/693477 https://bugzilla.novell.com/694119 https://bugzilla.novell.com/694344 https://bugzilla.novell.com/695479 https://bugzilla.novell.com/696630 https://bugzilla.novell.com/702506 https://bugzilla.novell.com/704311 https://bugzilla.novell.com/704639 https://bugzilla.novell.com/704642 https://bugzilla.novell.com/705949 https://bugzilla.novell.com/706792 https://bugzilla.novell.com/707486 https://bugzilla.novell.com/707779 https://bugzilla.novell.com/708137 https://bugzilla.novell.com/708518 https://bugzilla.novell.com/710061 https://bugzilla.novell.com/710920 https://bugzilla.novell.com/711977 https://bugzilla.novell.com/712358 https://bugzilla.novell.com/715268 https://bugzilla.novell.com/715416 https://bugzilla.novell.com/715856 https://bugzilla.novell.com/715931 https://bugzilla.novell.com/717262

1 0

openSUSE-SU-2011:1144-1: moderate: openssl
by opensuse-security＠opensuse.org 17 Oct '11

17 Oct '11

openSUSE Security Update: openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1144-1 Rating: moderate References: #716143 #716144 Cross-References: CVE-2011-3207 CVE-2011-3210 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: OpenSSL's internal certificate verification routines could incorrectly accept a CRL whose nextUpdate field is in the past (CVE-2011-3207). Server code for ECDH could crash if it received a specially crafted handshake message (CVE-2011-3210). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libopenssl-devel-5178 - openSUSE 11.3: zypper in -t patch libopenssl-devel-5178 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libopenssl-devel-1.0.0c-18.21.1 libopenssl0_9_8-0.9.8m-6.7.1 libopenssl1_0_0-1.0.0c-18.21.1 openssl-1.0.0c-18.21.1 - openSUSE 11.4 (x86_64): libopenssl0_9_8-32bit-0.9.8m-6.7.1 libopenssl1_0_0-32bit-1.0.0c-18.21.1 - openSUSE 11.4 (noarch): openssl-doc-1.0.0c-18.21.1 - openSUSE 11.3 (i586 x86_64): libopenssl-devel-1.0.0-6.11.1 libopenssl0_9_8-0.9.8m-3.9.1 libopenssl1_0_0-1.0.0-6.11.1 openssl-1.0.0-6.11.1 - openSUSE 11.3 (x86_64): libopenssl0_9_8-32bit-0.9.8m-3.9.1 libopenssl1_0_0-32bit-1.0.0-6.11.1 - openSUSE 11.3 (noarch): openssl-doc-1.0.0-6.11.1 References: http://support.novell.com/security/cve/CVE-2011-3207.html http://support.novell.com/security/cve/CVE-2011-3210.html https://bugzilla.novell.com/716143 https://bugzilla.novell.com/716144

1 0

openSUSE-SU-2011:1143-1: moderate: libreoffice: Update to 3.4
by opensuse-security＠opensuse.org 17 Oct '11

17 Oct '11

openSUSE Security Update: libreoffice: Update to 3.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1143-1 Rating: moderate References: #647959 #650049 #651250 #652562 #653662 #663622 #665112 #675868 #675961 #676858 #678998 #680272 #681738 #683578 #684784 #693238 #693477 #694119 #694344 #695479 #696630 #702506 #704311 #704639 #704642 #705949 #706792 #707486 #707779 #708137 #708518 #710061 #710920 #711977 #712358 #715268 #715416 #715856 #715931 #717262 Cross-References: CVE-2011-2685 CVE-2011-2713 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 38 fixes is now available. It includes three new package versions. Description: LibreOffice 3.4 includes new interesting features and fixes, see http://www.libreoffice.org/download/3-4-new-features-and-fix es/ The update fixes the following security issue: - 704311: libreoffice Lotus Word Pro filter multiple vulnerabilities (CVE-2011-2685) - 722075: LibreOffice: Out-of-bounds read in DOC sprm (CVE-2011-2713) This update also fixes the following non-security issues: - 647959: LibO has a regression problem to show emf charts properly. - 650049: pptx presentation has text in boxes and circles. Only text is displayed. - 651250: Video and Audio does not play in slide show mode of LibO Impress. - 652562: LibreOffice crashes on start on 11.4-MS3 NET/DVD install - 653662: libreoffice build calls mkbundle2 (deprecated) instead of mkbundle - 663622: Writer crash during document save - 665112: could not type or edit office document - 675868: eliminate wording of ooconvert existed in loconvert --help - 675961: Libreoffice Copy paste of formula in Writer tables does not work as expected - 676858: Document with full page graphic in header will not allow click-drag or right-click. - 678998: Libre Office 3.3.1 does not detect KDE3 - 680272: Deleting multiple sheets results in run-time error/crash - 681738: DDE link is lost when .xls file is opened/saved in Calc. - 683578: Large xlsx file takes extremely long to open with Libreoffice calc - 684784: Microsoft Office spreadsheet does not display anything - 693238: Column format in docx file is not displayed correctly. - 693477: Format of Word .doc file from HP is bad. - 694119: Using File-->Send-->Document as E-mail will crash Impress - 694344: 3rd level bulleted items are not displayed properly. - 695479: L3: RTF file is not displayed correctly by Writer. - 696630: DDE link from Calc to Excel needs Excel open to update link in Calc. - 702506: Writer crashes when opening docx files. - 704639: HTML document appearance changes when opened in open office vs LibreOffice - 704642: 16 digit numbers change in LibreOffice when opening a file created in MS Excel - 705949: Information missing from MS Word document when opened in LibreOffice (w:sdt) - 706792: PTF 3.3.1-21 introduced a crash when opening a pptx presentation. - 707486: Macro from excel fails on Selection.Copy when run in Calc. - 707779: Disappearing text - 708137: xls spreadsheet is extremely slow to open and check boxes are broken. - 708518: Bullet symbol is not rendered correctly in a specific slide. - 710061: ODP export to PDF produces broken images - 710920: RPM installation ending with redundant error. - 711977: File association for fod* files are missing. - 712358: Some extensions broken after upgrading. - 715268: Command libreoffice --help does not work when LibreOffice is already started - 715856: LibreOffice:Stable/libreoffice-converter: Bug - 715416: Impress crashes starting Slide show in the context of dual monitors extension mode. - 715931: failed to save an odp file. - 717262: libtool adds /usr/lib64 into rpath Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libreoffice-34-5252 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 3.4.2.6]: libreoffice-3.4.2.6-2.2.1 libreoffice-base-3.4.2.6-2.2.1 libreoffice-base-drivers-mysql-3.4.2.6-2.2.1 libreoffice-base-drivers-postgresql-3.4.2.6-2.2.1 libreoffice-base-extensions-3.4.2.6-2.2.1 libreoffice-calc-3.4.2.6-2.2.1 libreoffice-calc-extensions-3.4.2.6-2.2.1 libreoffice-draw-3.4.2.6-2.2.1 libreoffice-draw-extensions-3.4.2.6-2.2.1 libreoffice-filters-optional-3.4.2.6-2.2.1 libreoffice-gnome-3.4.2.6-2.2.1 libreoffice-icon-themes-prebuilt-3.4.2.6-2.2.1 libreoffice-impress-3.4.2.6-2.2.1 libreoffice-impress-extensions-3.4.2.6-2.2.1 libreoffice-kde-3.4.2.6-2.2.1 libreoffice-kde4-3.4.2.6-2.2.1 libreoffice-l10n-prebuilt-3.4.2.6-2.2.1 libreoffice-mailmerge-3.4.2.6-2.2.1 libreoffice-math-3.4.2.6-2.2.1 libreoffice-mono-3.4.2.6-2.2.1 libreoffice-officebean-3.4.2.6-2.2.1 libreoffice-pyuno-3.4.2.6-2.2.1 libreoffice-testtool-3.4.2.6-2.2.1 libreoffice-writer-3.4.2.6-2.2.1 libreoffice-writer-extensions-3.4.2.6-2.2.1 - openSUSE 11.3 (noarch) [New Version: 1.4,3.4 and 3.4.2.6]: libreoffice-branding-upstream-3.4.2.6-2.2.1 libreoffice-converter-3.3-2.4.1 libreoffice-help-cs-3.4.2.6-2.2.1 libreoffice-help-da-3.4.2.6-2.2.1 libreoffice-help-de-3.4.2.6-2.2.1 libreoffice-help-en-GB-3.4.2.6-2.2.1 libreoffice-help-en-US-3.4.2.6-2.2.1 libreoffice-help-en-ZA-3.4.2.6-2.2.1 libreoffice-help-es-3.4.2.6-2.2.1 libreoffice-help-et-3.4.2.6-2.2.1 libreoffice-help-fr-3.4.2.6-2.2.1 libreoffice-help-gl-3.4.2.6-2.2.1 libreoffice-help-gu-IN-3.4.2.6-2.2.1 libreoffice-help-hi-IN-3.4.2.6-2.2.1 libreoffice-help-hu-3.4.2.6-2.2.1 libreoffice-help-it-3.4.2.6-2.2.1 libreoffice-help-ja-3.4.2.6-2.2.1 libreoffice-help-km-3.4.2.6-2.2.1 libreoffice-help-ko-3.4.2.6-2.2.1 libreoffice-help-nl-3.4.2.6-2.2.1 libreoffice-help-pl-3.4.2.6-2.2.1 libreoffice-help-pt-3.4.2.6-2.2.1 libreoffice-help-pt-BR-3.4.2.6-2.2.1 libreoffice-help-ru-3.4.2.6-2.2.1 libreoffice-help-sl-3.4.2.6-2.2.1 libreoffice-help-sv-3.4.2.6-2.2.1 libreoffice-help-zh-CN-3.4.2.6-2.2.1 libreoffice-help-zh-TW-3.4.2.6-2.2.1 libreoffice-icon-theme-crystal-3.4.2.6-1.2.1 libreoffice-icon-theme-galaxy-3.4.2.6-1.2.1 libreoffice-icon-theme-hicontrast-3.4.2.6-1.2.1 libreoffice-icon-theme-oxygen-3.4.2.6-1.2.1 libreoffice-icon-theme-tango-3.4.2.6-1.2.1 libreoffice-l10n-af-3.4.2.6-1.2.1 libreoffice-l10n-ar-3.4.2.6-1.2.1 libreoffice-l10n-be-BY-3.4.2.6-1.2.1 libreoffice-l10n-bg-3.4.2.6-1.2.1 libreoffice-l10n-br-3.4.2.6-1.2.1 libreoffice-l10n-ca-3.4.2.6-1.2.1 libreoffice-l10n-cs-3.4.2.6-1.2.1 libreoffice-l10n-cy-3.4.2.6-1.2.1 libreoffice-l10n-da-3.4.2.6-1.2.1 libreoffice-l10n-de-3.4.2.6-1.2.1 libreoffice-l10n-el-3.4.2.6-1.2.1 libreoffice-l10n-en-GB-3.4.2.6-1.2.1 libreoffice-l10n-en-ZA-3.4.2.6-1.2.1 libreoffice-l10n-es-3.4.2.6-1.2.1 libreoffice-l10n-et-3.4.2.6-1.2.1 libreoffice-l10n-fi-3.4.2.6-1.2.1 libreoffice-l10n-fr-3.4.2.6-1.2.1 libreoffice-l10n-ga-3.4.2.6-1.2.1 libreoffice-l10n-gl-3.4.2.6-1.2.1 libreoffice-l10n-gu-IN-3.4.2.6-1.2.1 libreoffice-l10n-he-3.4.2.6-1.2.1 libreoffice-l10n-hi-IN-3.4.2.6-1.2.1 libreoffice-l10n-hr-3.4.2.6-1.2.1 libreoffice-l10n-hu-3.4.2.6-1.2.1 libreoffice-l10n-it-3.4.2.6-1.2.1 libreoffice-l10n-ja-3.4.2.6-1.2.1 libreoffice-l10n-ka-3.4.2.6-1.2.1 libreoffice-l10n-km-3.4.2.6-1.2.1 libreoffice-l10n-ko-3.4.2.6-1.2.1 libreoffice-l10n-lt-3.4.2.6-1.2.1 libreoffice-l10n-mk-3.4.2.6-1.2.1 libreoffice-l10n-nb-3.4.2.6-1.2.1 libreoffice-l10n-nl-3.4.2.6-1.2.1 libreoffice-l10n-nn-3.4.2.6-1.2.1 libreoffice-l10n-nr-3.4.2.6-1.2.1 libreoffice-l10n-pa-IN-3.4.2.6-1.2.1 libreoffice-l10n-pl-3.4.2.6-1.2.1 libreoffice-l10n-pt-3.4.2.6-1.2.1 libreoffice-l10n-pt-BR-3.4.2.6-1.2.1 libreoffice-l10n-ru-3.4.2.6-1.2.1 libreoffice-l10n-rw-3.4.2.6-1.2.1 libreoffice-l10n-sh-3.4.2.6-1.2.1 libreoffice-l10n-sk-3.4.2.6-1.2.1 libreoffice-l10n-sl-3.4.2.6-1.2.1 libreoffice-l10n-sr-3.4.2.6-1.2.1 libreoffice-l10n-ss-3.4.2.6-1.2.1 libreoffice-l10n-st-3.4.2.6-1.2.1 libreoffice-l10n-sv-3.4.2.6-1.2.1 libreoffice-l10n-tg-3.4.2.6-1.2.1 libreoffice-l10n-th-3.4.2.6-1.2.1 libreoffice-l10n-tr-3.4.2.6-1.2.1 libreoffice-l10n-ts-3.4.2.6-1.2.1 libreoffice-l10n-uk-3.4.2.6-1.2.1 libreoffice-l10n-ve-3.4.2.6-1.2.1 libreoffice-l10n-vi-3.4.2.6-1.2.1 libreoffice-l10n-xh-3.4.2.6-1.2.1 libreoffice-l10n-zh-CN-3.4.2.6-1.2.1 libreoffice-l10n-zh-TW-3.4.2.6-1.2.1 libreoffice-l10n-zu-3.4.2.6-1.2.1 libreoffice-languagetool-1.4-2.2.1 libreoffice-languagetool-ca-1.4-2.2.1 libreoffice-languagetool-de-1.4-2.2.1 libreoffice-languagetool-en-1.4-2.2.1 libreoffice-languagetool-es-1.4-2.2.1 libreoffice-languagetool-fr-1.4-2.2.1 libreoffice-languagetool-gl-1.4-2.2.1 libreoffice-languagetool-it-1.4-2.2.1 libreoffice-languagetool-nl-1.4-2.2.1 libreoffice-languagetool-pl-1.4-2.2.1 libreoffice-languagetool-ro-1.4-2.2.1 libreoffice-languagetool-ru-1.4-2.2.1 libreoffice-languagetool-sk-1.4-2.2.1 libreoffice-languagetool-sv-1.4-2.2.1 libreoffice-openclipart-3.4-1.2.1 References: http://support.novell.com/security/cve/CVE-2011-2685.html http://support.novell.com/security/cve/CVE-2011-2713.html https://bugzilla.novell.com/647959 https://bugzilla.novell.com/650049 https://bugzilla.novell.com/651250 https://bugzilla.novell.com/652562 https://bugzilla.novell.com/653662 https://bugzilla.novell.com/663622 https://bugzilla.novell.com/665112 https://bugzilla.novell.com/675868 https://bugzilla.novell.com/675961 https://bugzilla.novell.com/676858 https://bugzilla.novell.com/678998 https://bugzilla.novell.com/680272 https://bugzilla.novell.com/681738 https://bugzilla.novell.com/683578 https://bugzilla.novell.com/684784 https://bugzilla.novell.com/693238 https://bugzilla.novell.com/693477 https://bugzilla.novell.com/694119 https://bugzilla.novell.com/694344 https://bugzilla.novell.com/695479 https://bugzilla.novell.com/696630 https://bugzilla.novell.com/702506 https://bugzilla.novell.com/704311 https://bugzilla.novell.com/704639 https://bugzilla.novell.com/704642 https://bugzilla.novell.com/705949 https://bugzilla.novell.com/706792 https://bugzilla.novell.com/707486 https://bugzilla.novell.com/707779 https://bugzilla.novell.com/708137 https://bugzilla.novell.com/708518 https://bugzilla.novell.com/710061 https://bugzilla.novell.com/710920 https://bugzilla.novell.com/711977 https://bugzilla.novell.com/712358 https://bugzilla.novell.com/715268 https://bugzilla.novell.com/715416 https://bugzilla.novell.com/715856 https://bugzilla.novell.com/715931 https://bugzilla.novell.com/717262

1 0

openSUSE-SU-2011:1142-1: moderate: wireshark 1.6.2 fixing multiple issues
by opensuse-security＠opensuse.org 17 Oct '11

17 Oct '11

openSUSE Security Update: wireshark 1.6.2 fixing multiple issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1142-1 Rating: moderate References: #697516 #706728 #718032 Cross-References: CVE-2011-1957 CVE-2011-1958 CVE-2011-1959 CVE-2011-2174 CVE-2011-2175 CVE-2011-2597 CVE-2011-2698 CVE-2011-3266 CVE-2011-3360 CVE-2011-3483 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. It includes one version update. Description: This update of wireshark fixes the following vulnerabilities: - CVE-2011-3266: Wireshark IKE dissector vulnerability - CVE-2011-3360: Wireshark Lua script execution vulnerability - CVE-2011-3483: Wireshark buffer exception handling vulnerability - CVE-2011-2597: Lucent/Ascend file parser susceptible to infinite loop - CVE-2011-2698: ANSI MAP dissector susceptible to infinite loop - CVE-2011-1957: Large/infinite loop in the DICOM dissector - CVE-2011-1959: A corrupted snoop file could crash Wireshark - CVE-2011-2174: Malformed compressed capture data could crash Wireshark - CVE-2011-2175: A corrupted Visual Networks file could crash Wireshark - CVE-2011-1958: dereferene a NULL pointer if we had a corrupted Diameter dictionary Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch wireshark-5278 - openSUSE 11.3: zypper in -t patch wireshark-5278 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.4.4]: wireshark-1.4.4-0.7.1 wireshark-devel-1.4.4-0.7.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.4.4]: wireshark-1.4.4-0.6.1 wireshark-devel-1.4.4-0.6.1 References: http://support.novell.com/security/cve/CVE-2011-1957.html http://support.novell.com/security/cve/CVE-2011-1958.html http://support.novell.com/security/cve/CVE-2011-1959.html http://support.novell.com/security/cve/CVE-2011-2174.html http://support.novell.com/security/cve/CVE-2011-2175.html http://support.novell.com/security/cve/CVE-2011-2597.html http://support.novell.com/security/cve/CVE-2011-2698.html http://support.novell.com/security/cve/CVE-2011-3266.html http://support.novell.com/security/cve/CVE-2011-3360.html http://support.novell.com/security/cve/CVE-2011-3483.html https://bugzilla.novell.com/697516 https://bugzilla.novell.com/706728 https://bugzilla.novell.com/718032

1 0

openSUSE-SU-2011:1138-1: moderate: php5
by opensuse-security＠opensuse.org 17 Oct '11

17 Oct '11

openSUSE Security Update: php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1138-1 Rating: moderate References: #699711 #701491 #709549 #715640 #715646 Cross-References: CVE-2011-2202 CVE-2011-2483 CVE-2011-3267 CVE-2011-3268 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: The blowfish password hashing implementation did not properly handle 8-characters in passwords, which made it easier for attackers to crack the hash (CVE-2011-2483). After this update existing hashes with id "$2a$" for passwords that contain 8-bit characters will no longer be compatible with newly generated hashes. Affected users will either have to change their password to store a new hash or the id of the existing hash has to be manually changed to "$2x$" in order to activate a compat mode. Please see the description of the CVE-2011-2483 glibc update for details. File uploads could potentially overwrite files owned by the user running php (CVE-2011-2202). A long salt argument to the crypt function could cause a buffer overflow (CVE-2011-3268) Incorrect implementation of the error_log function could crash php (CVE-2011-3267) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch apache2-mod_php5-5113 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-mod_php5-5.3.5-5.16.1 php5-5.3.5-5.16.1 php5-bcmath-5.3.5-5.16.1 php5-bz2-5.3.5-5.16.1 php5-calendar-5.3.5-5.16.1 php5-ctype-5.3.5-5.16.1 php5-curl-5.3.5-5.16.1 php5-dba-5.3.5-5.16.1 php5-devel-5.3.5-5.16.1 php5-dom-5.3.5-5.16.1 php5-enchant-5.3.5-5.16.1 php5-exif-5.3.5-5.16.1 php5-fastcgi-5.3.5-5.16.1 php5-fileinfo-5.3.5-5.16.1 php5-fpm-5.3.5-5.16.1 php5-ftp-5.3.5-5.16.1 php5-gd-5.3.5-5.16.1 php5-gettext-5.3.5-5.16.1 php5-gmp-5.3.5-5.16.1 php5-hash-5.3.5-5.16.1 php5-iconv-5.3.5-5.16.1 php5-imap-5.3.5-5.16.1 php5-intl-5.3.5-5.16.1 php5-json-5.3.5-5.16.1 php5-ldap-5.3.5-5.16.1 php5-mbstring-5.3.5-5.16.1 php5-mcrypt-5.3.5-5.16.1 php5-mysql-5.3.5-5.16.1 php5-odbc-5.3.5-5.16.1 php5-openssl-5.3.5-5.16.1 php5-pcntl-5.3.5-5.16.1 php5-pdo-5.3.5-5.16.1 php5-pgsql-5.3.5-5.16.1 php5-phar-5.3.5-5.16.1 php5-posix-5.3.5-5.16.1 php5-pspell-5.3.5-5.16.1 php5-readline-5.3.5-5.16.1 php5-shmop-5.3.5-5.16.1 php5-snmp-5.3.5-5.16.1 php5-soap-5.3.5-5.16.1 php5-sockets-5.3.5-5.16.1 php5-sqlite-5.3.5-5.16.1 php5-suhosin-5.3.5-5.16.1 php5-sysvmsg-5.3.5-5.16.1 php5-sysvsem-5.3.5-5.16.1 php5-sysvshm-5.3.5-5.16.1 php5-tidy-5.3.5-5.16.1 php5-tokenizer-5.3.5-5.16.1 php5-wddx-5.3.5-5.16.1 php5-xmlreader-5.3.5-5.16.1 php5-xmlrpc-5.3.5-5.16.1 php5-xmlwriter-5.3.5-5.16.1 php5-xsl-5.3.5-5.16.1 php5-zip-5.3.5-5.16.1 php5-zlib-5.3.5-5.16.1 - openSUSE 11.4 (noarch): php5-pear-5.3.5-5.16.1 References: http://support.novell.com/security/cve/CVE-2011-2202.html http://support.novell.com/security/cve/CVE-2011-2483.html http://support.novell.com/security/cve/CVE-2011-3267.html http://support.novell.com/security/cve/CVE-2011-3268.html https://bugzilla.novell.com/699711 https://bugzilla.novell.com/701491 https://bugzilla.novell.com/709549 https://bugzilla.novell.com/715640 https://bugzilla.novell.com/715646

1 0

openSUSE-SU-2011:1137-1: moderate: php5
by opensuse-security＠opensuse.org 17 Oct '11

17 Oct '11

openSUSE Security Update: php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1137-1 Rating: moderate References: #699711 #701491 #709549 #715646 Cross-References: CVE-2011-2202 CVE-2011-2483 CVE-2011-3268 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. It includes one version update. Description: The blowfish password hashing implementation did not properly handle 8-characters in passwords, which made it easier for attackers to crack the hash (CVE-2011-2483). After this update existing hashes with id "$2a$" for passwords that contain 8-bit characters will no longer be compatible with newly generated hashes. Affected users will either have to change their password to store a new hash or the id of the existing hash has to be manually changed to "$2x$" in order to activate a compat mode. Please see the description of the CVE-2011-2483 glibc update for details. File uploads could potentially overwrite files owned by the user running php (CVE-2011-2202). A long salt argument to the crypt function could cause a buffer overflow (CVE-2011-3268) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch apache2-mod_php5-5112 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 5.3.3]: apache2-mod_php5-5.3.3-0.21.1 php5-5.3.3-0.21.1 php5-bcmath-5.3.3-0.21.1 php5-bz2-5.3.3-0.21.1 php5-calendar-5.3.3-0.21.1 php5-ctype-5.3.3-0.21.1 php5-curl-5.3.3-0.21.1 php5-dba-5.3.3-0.21.1 php5-devel-5.3.3-0.21.1 php5-dom-5.3.3-0.21.1 php5-enchant-5.3.3-0.21.1 php5-exif-5.3.3-0.21.1 php5-fastcgi-5.3.3-0.21.1 php5-fileinfo-5.3.3-0.21.1 php5-ftp-5.3.3-0.21.1 php5-gd-5.3.3-0.21.1 php5-gettext-5.3.3-0.21.1 php5-gmp-5.3.3-0.21.1 php5-hash-5.3.3-0.21.1 php5-iconv-5.3.3-0.21.1 php5-imap-5.3.3-0.21.1 php5-intl-5.3.3-0.21.1 php5-json-5.3.3-0.21.1 php5-ldap-5.3.3-0.21.1 php5-mbstring-5.3.3-0.21.1 php5-mcrypt-5.3.3-0.21.1 php5-mysql-5.3.3-0.21.1 php5-odbc-5.3.3-0.21.1 php5-openssl-5.3.3-0.21.1 php5-pcntl-5.3.3-0.21.1 php5-pdo-5.3.3-0.21.1 php5-pgsql-5.3.3-0.21.1 php5-phar-5.3.3-0.21.1 php5-posix-5.3.3-0.21.1 php5-pspell-5.3.3-0.21.1 php5-readline-5.3.3-0.21.1 php5-shmop-5.3.3-0.21.1 php5-snmp-5.3.3-0.21.1 php5-soap-5.3.3-0.21.1 php5-sockets-5.3.3-0.21.1 php5-sqlite-5.3.3-0.21.1 php5-suhosin-5.3.3-0.21.1 php5-sysvmsg-5.3.3-0.21.1 php5-sysvsem-5.3.3-0.21.1 php5-sysvshm-5.3.3-0.21.1 php5-tidy-5.3.3-0.21.1 php5-tokenizer-5.3.3-0.21.1 php5-wddx-5.3.3-0.21.1 php5-xmlreader-5.3.3-0.21.1 php5-xmlrpc-5.3.3-0.21.1 php5-xmlwriter-5.3.3-0.21.1 php5-xsl-5.3.3-0.21.1 php5-zip-5.3.3-0.21.1 php5-zlib-5.3.3-0.21.1 - openSUSE 11.3 (noarch) [New Version: 5.3.3]: php5-pear-5.3.3-0.21.1 References: http://support.novell.com/security/cve/CVE-2011-2202.html http://support.novell.com/security/cve/CVE-2011-2483.html http://support.novell.com/security/cve/CVE-2011-3268.html https://bugzilla.novell.com/699711 https://bugzilla.novell.com/701491 https://bugzilla.novell.com/709549 https://bugzilla.novell.com/715646

1 0

openSUSE-SU-2011:1135-1: moderate: kdelibs4: fixing input validation flaw when displaying certificates (CVE-2011-3365)
by opensuse-security＠opensuse.org 17 Oct '11

17 Oct '11

openSUSE Security Update: kdelibs4: fixing input validation flaw when displaying certificates (CVE-2011-3365) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1135-1 Rating: moderate References: #721974 Cross-References: CVE-2011-3365 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: An input validation flaw when displaying certificates has been fixed in KDE's KSSL (kdelibs4). CVE-2011-3365 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch kdelibs4-5258 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): kdelibs4-4.6.0-6.17.1 kdelibs4-branding-upstream-4.6.0-6.17.1 kdelibs4-core-4.6.0-6.17.1 kdelibs4-doc-4.6.0-6.17.1 libkde4-4.6.0-6.17.1 libkde4-devel-4.6.0-6.17.1 libkdecore4-4.6.0-6.17.1 libkdecore4-devel-4.6.0-6.17.1 libksuseinstall-devel-4.6.0-6.17.1 libksuseinstall1-4.6.0-6.17.1 - openSUSE 11.4 (x86_64): libkde4-32bit-4.6.0-6.17.1 libkdecore4-32bit-4.6.0-6.17.1 libksuseinstall1-32bit-4.6.0-6.17.1 References: http://support.novell.com/security/cve/CVE-2011-3365.html https://bugzilla.novell.com/721974

1 0

openSUSE-SU-2011:1134-1: moderate: tomcat
by opensuse-security＠opensuse.org 17 Oct '11

17 Oct '11

openSUSE Security Update: tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1134-1 Rating: moderate References: #715991 Cross-References: CVE-2011-3190 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted AJP messages could be used bypass authentication (CVE-2011-3190). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch tomcat6-5149 - openSUSE 11.3: zypper in -t patch tomcat6-5149 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): tomcat6-6.0.32-7.10.1 tomcat6-admin-webapps-6.0.32-7.10.1 tomcat6-docs-webapp-6.0.32-7.10.1 tomcat6-el-1_0-api-6.0.32-7.10.1 tomcat6-javadoc-6.0.32-7.10.1 tomcat6-jsp-2_1-api-6.0.32-7.10.1 tomcat6-lib-6.0.32-7.10.1 tomcat6-servlet-2_5-api-6.0.32-7.10.1 tomcat6-webapps-6.0.32-7.10.1 - openSUSE 11.3 (noarch): tomcat6-6.0.24-5.14.1 tomcat6-admin-webapps-6.0.24-5.14.1 tomcat6-docs-webapp-6.0.24-5.14.1 tomcat6-el-1_0-api-6.0.24-5.14.1 tomcat6-javadoc-6.0.24-5.14.1 tomcat6-jsp-2_1-api-6.0.24-5.14.1 tomcat6-lib-6.0.24-5.14.1 tomcat6-servlet-2_5-api-6.0.24-5.14.1 tomcat6-webapps-6.0.24-5.14.1 References: http://support.novell.com/security/cve/CVE-2011-3190.html https://bugzilla.novell.com/715991

1 0

openSUSE-RU-2011:1129-1: iftop: Fix drawing in UTF-8 mode
by maintenance＠opensuse.org 14 Oct '11

14 Oct '11

openSUSE Recommended Update: iftop: Fix drawing in UTF-8 mode ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1129-1 Rating: low References: #718922 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a drawing issue in UTF-8 mode due to wrong locale initialisation and ncurses usage (bnc#718922) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch iftop-5200 - openSUSE 11.3: zypper in -t patch iftop-5200 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): iftop-0.17-137.138.1 - openSUSE 11.3 (i586 x86_64): iftop-0.17-134.3.1 References: https://bugzilla.novell.com/718922

1 0

openSUSE-SU-2011:1076-3: important: seamonkey: Update to Mozilla Seamonkey 2.4.1
by opensuse-security＠opensuse.org 14 Oct '11

14 Oct '11

openSUSE Security Update: seamonkey: Update to Mozilla Seamonkey 2.4.1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1076-3 Rating: important References: #720264 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes two new package versions. Description: Mozilla Seamonkey was updated to version 2.4.1, which fixes some regressions found in the 2.4 release. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch MozillaFirefox-5239 seamonkey-5244 - openSUSE 11.3: zypper in -t patch seamonkey-5244 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.4.1 and 7.0.1]: MozillaFirefox-7.0.1-0.2.1 MozillaFirefox-branding-upstream-7.0.1-0.2.1 MozillaFirefox-buildsymbols-7.0.1-0.2.1 MozillaFirefox-devel-7.0.1-0.2.1 MozillaFirefox-translations-common-7.0.1-0.2.1 MozillaFirefox-translations-other-7.0.1-0.2.1 seamonkey-2.4.1-0.2.1 seamonkey-dom-inspector-2.4.1-0.2.1 seamonkey-irc-2.4.1-0.2.1 seamonkey-translations-common-2.4.1-0.2.1 seamonkey-translations-other-2.4.1-0.2.1 seamonkey-venkman-2.4.1-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.4.1]: seamonkey-2.4.1-0.2.1 seamonkey-dom-inspector-2.4.1-0.2.1 seamonkey-irc-2.4.1-0.2.1 seamonkey-translations-common-2.4.1-0.2.1 seamonkey-translations-other-2.4.1-0.2.1 seamonkey-venkman-2.4.1-0.2.1 References: https://bugzilla.novell.com/720264

1 0

openSUSE-RU-2011:1121-1: moderate: pcmciautils: Fix segmentation fault in argument handling
by maintenance＠opensuse.org 12 Oct '11

12 Oct '11

openSUSE Recommended Update: pcmciautils: Fix segmentation fault in argument handling ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1121-1 Rating: moderate References: #567197 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a segmentation fault in argument handling in pccardctl. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch pcmciautils-5260 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): pcmciautils-017-113.114.1 References: https://bugzilla.novell.com/567197

1 0

openSUSE-SU-2011:1120-1: libqt4
by opensuse-security＠opensuse.org 12 Oct '11

12 Oct '11

openSUSE Security Update: libqt4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1120-1 Rating: low References: #637275 #714984 Cross-References: CVE-2011-3193 CVE-2011-3194 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Specially crafted font files could cause a single byte heap based buffer overflow (CVE-2011-3193). Specially crafted grey scale images could cause a heap based buffer overflow (CVE-2011-3194). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libQtWebKit-devel-5129 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libQtWebKit-devel-4.7.1-8.15.1 libQtWebKit4-4.7.1-8.15.1 libqt4-4.7.1-8.15.1 libqt4-devel-4.7.1-8.15.1 libqt4-devel-doc-4.7.1-8.15.1 libqt4-qt3support-4.7.1-8.15.1 libqt4-sql-4.7.1-8.15.1 libqt4-sql-mysql-4.7.1-8.15.1 libqt4-sql-postgresql-4.7.1-8.15.1 libqt4-sql-sqlite-4.7.1-8.15.1 libqt4-sql-unixODBC-4.7.1-8.15.1 libqt4-x11-4.7.1-8.15.1 qt4-x11-tools-4.7.1-8.15.1 - openSUSE 11.4 (x86_64): libQtWebKit4-32bit-4.7.1-8.15.1 libqt4-32bit-4.7.1-8.15.1 libqt4-qt3support-32bit-4.7.1-8.15.1 libqt4-sql-32bit-4.7.1-8.15.1 libqt4-sql-mysql-32bit-4.7.1-8.15.1 libqt4-sql-postgresql-32bit-4.7.1-8.15.1 libqt4-sql-sqlite-32bit-4.7.1-8.15.1 libqt4-sql-unixODBC-32bit-4.7.1-8.15.1 libqt4-x11-32bit-4.7.1-8.15.1 - openSUSE 11.4 (noarch): libqt4-devel-doc-data-4.7.1-8.15.1 References: http://support.novell.com/security/cve/CVE-2011-3193.html http://support.novell.com/security/cve/CVE-2011-3194.html https://bugzilla.novell.com/637275 https://bugzilla.novell.com/714984

1 0

openSUSE-SU-2011:1119-1: libqt4
by opensuse-security＠opensuse.org 12 Oct '11

12 Oct '11

openSUSE Security Update: libqt4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1119-1 Rating: low References: #592962 #637275 #643848 #668210 #669604 #714984 Cross-References: CVE-2011-3193 CVE-2011-3194 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: Specially crafted font files could cause a single byte heap based buffer overflow (CVE-2011-3193). Specially crafted grey scale images could cause a heap based buffer overflow (CVE-2011-3194). The update also fixes the following non-security bugs: - fix QFileDialog not showing system files (bnc#669604) - fix font fallback handling (bnc#643848) - add support for postgresql 8.3 and 9 (bnc#668210) - Path added: bnc#592962 - Set application icon. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libQtWebKit-devel-5125 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libQtWebKit-devel-4.6.3-2.5.1 libQtWebKit4-4.6.3-2.5.1 libqt4-4.6.3-2.5.1 libqt4-devel-4.6.3-2.5.1 libqt4-devel-doc-4.6.3-2.5.1 libqt4-qt3support-4.6.3-2.5.1 libqt4-sql-4.6.3-2.5.1 libqt4-sql-mysql-4.6.3-2.5.1 libqt4-sql-postgresql-4.6.3-2.5.1 libqt4-sql-sqlite-4.6.3-2.5.1 libqt4-sql-unixODBC-4.6.3-2.5.1 libqt4-x11-4.6.3-2.5.1 qt4-x11-tools-4.6.3-2.5.1 - openSUSE 11.3 (x86_64): libQtWebKit4-32bit-4.6.3-2.5.1 libqt4-32bit-4.6.3-2.5.1 libqt4-qt3support-32bit-4.6.3-2.5.1 libqt4-sql-32bit-4.6.3-2.5.1 libqt4-sql-mysql-32bit-4.6.3-2.5.1 libqt4-sql-postgresql-32bit-4.6.3-2.5.1 libqt4-sql-sqlite-32bit-4.6.3-2.5.1 libqt4-sql-unixODBC-32bit-4.6.3-2.5.1 libqt4-x11-32bit-4.6.3-2.5.1 - openSUSE 11.3 (noarch): libqt4-devel-doc-data-4.6.3-2.5.1 References: http://support.novell.com/security/cve/CVE-2011-3193.html http://support.novell.com/security/cve/CVE-2011-3194.html https://bugzilla.novell.com/592962 https://bugzilla.novell.com/637275 https://bugzilla.novell.com/643848 https://bugzilla.novell.com/668210 https://bugzilla.novell.com/669604 https://bugzilla.novell.com/714984

1 0

openSUSE-RU-2011:1109-1: libdc1394: Hide internal symbols
by maintenance＠opensuse.org 11 Oct '11

11 Oct '11

openSUSE Recommended Update: libdc1394: Hide internal symbols ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1109-1 Rating: low References: #712262 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes digiKam crashing on picture import. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libdc1394-5249 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libdc1394-2.1.3-21.22.1 libdc1394-22-2.1.3-21.22.1 libdc1394-devel-2.1.3-21.22.1 References: https://bugzilla.novell.com/712262

1 0

openSUSE-RU-2011:1108-1: Neon supports SNI
by maintenance＠opensuse.org 11 Oct '11

11 Oct '11

openSUSE Recommended Update: Neon supports SNI ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1108-1 Rating: low References: #721661 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update provides the following fix for neon: - 721661: Neon supports SNI Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libneon-devel-5241 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 0.29.4]: libneon-devel-0.29.4-0.3.1 libneon27-0.29.4-0.3.1 - openSUSE 11.4 (x86_64) [New Version: 0.29.4]: libneon27-32bit-0.29.4-0.3.1 References: https://bugzilla.novell.com/721661

1 0

openSUSE-RU-2011:1107-1: pam_mount: update to 2.12
by maintenance＠opensuse.org 11 Oct '11

11 Oct '11

openSUSE Recommended Update: pam_mount: update to 2.12 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1107-1 Rating: low References: #722480 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update provides the following fix for pam_mount: - 722480: pam_mount: Version-update from 2.11 to 2.12 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch pam_mount-5254 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.12]: pam_mount-2.12-0.2.1 - openSUSE 11.4 (x86_64) [New Version: 2.12]: pam_mount-32bit-2.12-0.2.1 References: https://bugzilla.novell.com/722480

1 0

openSUSE-SU-2011:1090-1: moderate: librsvg
by opensuse-security＠opensuse.org 05 Oct '11

05 Oct '11

openSUSE Security Update: librsvg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1090-1 Rating: moderate References: #714980 Cross-References: CVE-2011-3146 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted SVG files could make librsvg dereference a function pointer which potentially allows to execute arbitrary code (CVE-2011-3146). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch gdk-pixbuf-loader-rsvg-5168 - openSUSE 11.3: zypper in -t patch gdk-pixbuf-loader-rsvg-5168 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gdk-pixbuf-loader-rsvg-2.32.1-3.4.1 gtk2-engine-svg-2.32.1-3.4.1 librsvg-2-2-2.32.1-3.4.1 librsvg-devel-2.32.1-3.4.1 rsvg-view-2.32.1-3.4.1 - openSUSE 11.4 (x86_64): gdk-pixbuf-loader-rsvg-32bit-2.32.1-3.4.1 gtk2-engine-svg-32bit-2.32.1-3.4.1 librsvg-2-2-32bit-2.32.1-3.4.1 - openSUSE 11.3 (i586 x86_64): librsvg-2.26.3-2.3.1 librsvg-devel-2.26.3-2.3.1 rsvg-view-2.26.3-2.3.1 - openSUSE 11.3 (x86_64): librsvg-32bit-2.26.3-2.3.1 References: http://support.novell.com/security/cve/CVE-2011-3146.html https://bugzilla.novell.com/714980

1 0

openSUSE-SU-2011:1076-2: important: MozillaThunderbird: Update to Mozilla Thunderbird 3.1.14
by opensuse-security＠opensuse.org 04 Oct '11

04 Oct '11

openSUSE Security Update: MozillaThunderbird: Update to Mozilla Thunderbird 3.1.14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1076-2 Rating: important References: #720264 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes two new package versions. Description: Mozilla Thunderbird was updated to version 3.1.14, fixing various bugs and security issues. MFSA 2011-36: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. Benjamin Smedberg, Bob Clary, and Jesse Ruderman reported memory safety problems that affected Firefox 3.6 and Firefox 6. (CVE-2011-2995) Bob Clary, Andrew McCreight, Andreas Gal, Gary Kwong, Igor Bukanov, Jason Orendorff, Jesse Ruderman, and Marcia Knous reported memory safety problems that affected Firefox 6, fixed in Firefox 7. (CVE-2011-2997) MFSA 2011-38: Mozilla developer Boris Zbarsky reported that a frame named "location" could shadow the window.location object unless a script in a page grabbed a reference to the true object before the frame was created. Because some plugins use the value of window.location to determine the page origin this could fool the plugin into granting the plugin content access to another site or the local file system in violation of the Same Origin Policy. This flaw allows circumvention of the fix added for MFSA 2010-10. (CVE-2011-2999) MFSA 2011-39: Ian Graham of Citrix Online reported that when multiple Location headers were present in a redirect response Mozilla behavior differed from other browsers: Mozilla would use the second Location header while Chrome and Internet Explorer would use the first. Two copies of this header with different values could be a symptom of a CRLF injection attack against a vulnerable server. Most commonly it is the Location header itself that is vulnerable to the response splitting and therefore the copy preferred by Mozilla is more likely to be the malicious one. It is possible, however, that the first copy was the injected one depending on the nature of the server vulnerability. The Mozilla browser engine has been changed to treat two copies of this header with different values as an error condition. The same has been done with the headers Content-Length and Content-Disposition. (CVE-2011-3000) MFSA 2011-40: Mariusz Mlynski reported that if you could convince a user to hold down the Enter key--as part of a game or test, perhaps--a malicious page could pop up a download dialog where the held key would then activate the default Open action. For some file types this would be merely annoying (the equivalent of a pop-up) but other file types have powerful scripting capabilities. And this would provide an avenue for an attacker to exploit a vulnerability in applications not normally exposed to potentially hostile internet content. Mariusz also reported a similar flaw with manual plugin installation using the PLUGINSPAGE attribute. It was possible to create an internal error that suppressed a confirmation dialog, such that holding enter would lead to the installation of an arbitrary add-on. (This variant did not affect Firefox 3.6) Holding enter allows arbitrary code execution due to Download Manager (CVE-2011-2372) Holding enter allows arbitrary extension installation (CVE-2011-3001) MFSA 2011-42: Security researcher Aki Helin reported a potentially exploitable crash in the YARR regular expression library used by JavaScript. (CVE-2011-3232) MFSA 2011-44: sczimmer reported that Firefox crashed when loading a particular .ogg file. This was due to a use-after-free condition and could potentially be exploited to install malware. (CVE-2011-3005) This vulnerability does not affect Firefox 3.6 or earlier. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch MozillaThunderbird-5204 - openSUSE 11.3: zypper in -t patch MozillaThunderbird-5204 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 3.1.15]: MozillaThunderbird-3.1.15-0.17.1 MozillaThunderbird-buildsymbols-3.1.15-0.17.1 MozillaThunderbird-devel-3.1.15-0.17.1 MozillaThunderbird-translations-common-3.1.15-0.17.1 MozillaThunderbird-translations-other-3.1.15-0.17.1 enigmail-1.1.2+3.1.15-0.17.1 - openSUSE 11.3 (i586 x86_64) [New Version: 3.1.15]: MozillaThunderbird-3.1.15-0.21.1 MozillaThunderbird-devel-3.1.15-0.21.1 MozillaThunderbird-translations-common-3.1.15-0.21.1 MozillaThunderbird-translations-other-3.1.15-0.21.1 enigmail-1.1.2+3.1.15-0.21.1 References: https://bugzilla.novell.com/720264

1 0

openSUSE-RU-2011:1088-1: kdebase4: Fixed double click showing incorrect mouse cursor if hover the object
by maintenance＠opensuse.org 04 Oct '11

04 Oct '11

openSUSE Recommended Update: kdebase4: Fixed double click showing incorrect mouse cursor if hover the object ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1088-1 Rating: low References: #701517 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update of kdebase4 fixes: - bnc#701517: KDE with double click show incorrect mouse cursor if hover the object Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch dolphin-5217 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): dolphin-4.6.0-6.8.1 kdebase4-4.6.0-6.8.1 kdebase4-libkonq-4.6.0-6.8.1 kdebase4-nsplugin-4.6.0-6.8.1 kdepasswd-4.6.0-6.8.1 kdialog-4.6.0-6.8.1 keditbookmarks-4.6.0-6.8.1 kfind-4.6.0-6.8.1 konqueror-4.6.0-6.8.1 konsole-4.6.0-6.8.1 kwrite-4.6.0-6.8.1 libkonq-devel-4.6.0-6.8.1 libkonq5-4.6.0-6.8.1 - openSUSE 11.4 (x86_64): libkonq5-32bit-4.6.0-6.8.1 References: https://bugzilla.novell.com/701517

1 0

openSUSE-RU-2011:1087-1: metacity: Support for window switcher dialog at a drag and drop operation
by maintenance＠opensuse.org 04 Oct '11

04 Oct '11

openSUSE Recommended Update: metacity: Support for window switcher dialog at a drag and drop operation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1087-1 Rating: low References: #720212 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update adds support of alt-tab during drag and drop operation (bnc#720212). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch metacity-5211 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): metacity-2.30.3-7.8.1 metacity-devel-2.30.3-7.8.1 - openSUSE 11.4 (noarch): metacity-lang-2.30.3-7.8.1 References: https://bugzilla.novell.com/720212

1 0