October 2011 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2011:1138-1: moderate: php5
by opensuse-security＠opensuse.org 17 Oct '11

17 Oct '11

openSUSE Security Update: php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1138-1 Rating: moderate References: #699711 #701491 #709549 #715640 #715646 Cross-References: CVE-2011-2202 CVE-2011-2483 CVE-2011-3267 CVE-2011-3268 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: The blowfish password hashing implementation did not properly handle 8-characters in passwords, which made it easier for attackers to crack the hash (CVE-2011-2483). After this update existing hashes with id "$2a$" for passwords that contain 8-bit characters will no longer be compatible with newly generated hashes. Affected users will either have to change their password to store a new hash or the id of the existing hash has to be manually changed to "$2x$" in order to activate a compat mode. Please see the description of the CVE-2011-2483 glibc update for details. File uploads could potentially overwrite files owned by the user running php (CVE-2011-2202). A long salt argument to the crypt function could cause a buffer overflow (CVE-2011-3268) Incorrect implementation of the error_log function could crash php (CVE-2011-3267) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch apache2-mod_php5-5113 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-mod_php5-5.3.5-5.16.1 php5-5.3.5-5.16.1 php5-bcmath-5.3.5-5.16.1 php5-bz2-5.3.5-5.16.1 php5-calendar-5.3.5-5.16.1 php5-ctype-5.3.5-5.16.1 php5-curl-5.3.5-5.16.1 php5-dba-5.3.5-5.16.1 php5-devel-5.3.5-5.16.1 php5-dom-5.3.5-5.16.1 php5-enchant-5.3.5-5.16.1 php5-exif-5.3.5-5.16.1 php5-fastcgi-5.3.5-5.16.1 php5-fileinfo-5.3.5-5.16.1 php5-fpm-5.3.5-5.16.1 php5-ftp-5.3.5-5.16.1 php5-gd-5.3.5-5.16.1 php5-gettext-5.3.5-5.16.1 php5-gmp-5.3.5-5.16.1 php5-hash-5.3.5-5.16.1 php5-iconv-5.3.5-5.16.1 php5-imap-5.3.5-5.16.1 php5-intl-5.3.5-5.16.1 php5-json-5.3.5-5.16.1 php5-ldap-5.3.5-5.16.1 php5-mbstring-5.3.5-5.16.1 php5-mcrypt-5.3.5-5.16.1 php5-mysql-5.3.5-5.16.1 php5-odbc-5.3.5-5.16.1 php5-openssl-5.3.5-5.16.1 php5-pcntl-5.3.5-5.16.1 php5-pdo-5.3.5-5.16.1 php5-pgsql-5.3.5-5.16.1 php5-phar-5.3.5-5.16.1 php5-posix-5.3.5-5.16.1 php5-pspell-5.3.5-5.16.1 php5-readline-5.3.5-5.16.1 php5-shmop-5.3.5-5.16.1 php5-snmp-5.3.5-5.16.1 php5-soap-5.3.5-5.16.1 php5-sockets-5.3.5-5.16.1 php5-sqlite-5.3.5-5.16.1 php5-suhosin-5.3.5-5.16.1 php5-sysvmsg-5.3.5-5.16.1 php5-sysvsem-5.3.5-5.16.1 php5-sysvshm-5.3.5-5.16.1 php5-tidy-5.3.5-5.16.1 php5-tokenizer-5.3.5-5.16.1 php5-wddx-5.3.5-5.16.1 php5-xmlreader-5.3.5-5.16.1 php5-xmlrpc-5.3.5-5.16.1 php5-xmlwriter-5.3.5-5.16.1 php5-xsl-5.3.5-5.16.1 php5-zip-5.3.5-5.16.1 php5-zlib-5.3.5-5.16.1 - openSUSE 11.4 (noarch): php5-pear-5.3.5-5.16.1 References: http://support.novell.com/security/cve/CVE-2011-2202.html http://support.novell.com/security/cve/CVE-2011-2483.html http://support.novell.com/security/cve/CVE-2011-3267.html http://support.novell.com/security/cve/CVE-2011-3268.html https://bugzilla.novell.com/699711 https://bugzilla.novell.com/701491 https://bugzilla.novell.com/709549 https://bugzilla.novell.com/715640 https://bugzilla.novell.com/715646

1 0

openSUSE-SU-2011:1137-1: moderate: php5
by opensuse-security＠opensuse.org 17 Oct '11

17 Oct '11

openSUSE Security Update: php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1137-1 Rating: moderate References: #699711 #701491 #709549 #715646 Cross-References: CVE-2011-2202 CVE-2011-2483 CVE-2011-3268 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. It includes one version update. Description: The blowfish password hashing implementation did not properly handle 8-characters in passwords, which made it easier for attackers to crack the hash (CVE-2011-2483). After this update existing hashes with id "$2a$" for passwords that contain 8-bit characters will no longer be compatible with newly generated hashes. Affected users will either have to change their password to store a new hash or the id of the existing hash has to be manually changed to "$2x$" in order to activate a compat mode. Please see the description of the CVE-2011-2483 glibc update for details. File uploads could potentially overwrite files owned by the user running php (CVE-2011-2202). A long salt argument to the crypt function could cause a buffer overflow (CVE-2011-3268) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch apache2-mod_php5-5112 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 5.3.3]: apache2-mod_php5-5.3.3-0.21.1 php5-5.3.3-0.21.1 php5-bcmath-5.3.3-0.21.1 php5-bz2-5.3.3-0.21.1 php5-calendar-5.3.3-0.21.1 php5-ctype-5.3.3-0.21.1 php5-curl-5.3.3-0.21.1 php5-dba-5.3.3-0.21.1 php5-devel-5.3.3-0.21.1 php5-dom-5.3.3-0.21.1 php5-enchant-5.3.3-0.21.1 php5-exif-5.3.3-0.21.1 php5-fastcgi-5.3.3-0.21.1 php5-fileinfo-5.3.3-0.21.1 php5-ftp-5.3.3-0.21.1 php5-gd-5.3.3-0.21.1 php5-gettext-5.3.3-0.21.1 php5-gmp-5.3.3-0.21.1 php5-hash-5.3.3-0.21.1 php5-iconv-5.3.3-0.21.1 php5-imap-5.3.3-0.21.1 php5-intl-5.3.3-0.21.1 php5-json-5.3.3-0.21.1 php5-ldap-5.3.3-0.21.1 php5-mbstring-5.3.3-0.21.1 php5-mcrypt-5.3.3-0.21.1 php5-mysql-5.3.3-0.21.1 php5-odbc-5.3.3-0.21.1 php5-openssl-5.3.3-0.21.1 php5-pcntl-5.3.3-0.21.1 php5-pdo-5.3.3-0.21.1 php5-pgsql-5.3.3-0.21.1 php5-phar-5.3.3-0.21.1 php5-posix-5.3.3-0.21.1 php5-pspell-5.3.3-0.21.1 php5-readline-5.3.3-0.21.1 php5-shmop-5.3.3-0.21.1 php5-snmp-5.3.3-0.21.1 php5-soap-5.3.3-0.21.1 php5-sockets-5.3.3-0.21.1 php5-sqlite-5.3.3-0.21.1 php5-suhosin-5.3.3-0.21.1 php5-sysvmsg-5.3.3-0.21.1 php5-sysvsem-5.3.3-0.21.1 php5-sysvshm-5.3.3-0.21.1 php5-tidy-5.3.3-0.21.1 php5-tokenizer-5.3.3-0.21.1 php5-wddx-5.3.3-0.21.1 php5-xmlreader-5.3.3-0.21.1 php5-xmlrpc-5.3.3-0.21.1 php5-xmlwriter-5.3.3-0.21.1 php5-xsl-5.3.3-0.21.1 php5-zip-5.3.3-0.21.1 php5-zlib-5.3.3-0.21.1 - openSUSE 11.3 (noarch) [New Version: 5.3.3]: php5-pear-5.3.3-0.21.1 References: http://support.novell.com/security/cve/CVE-2011-2202.html http://support.novell.com/security/cve/CVE-2011-2483.html http://support.novell.com/security/cve/CVE-2011-3268.html https://bugzilla.novell.com/699711 https://bugzilla.novell.com/701491 https://bugzilla.novell.com/709549 https://bugzilla.novell.com/715646

1 0

openSUSE-SU-2011:1135-1: moderate: kdelibs4: fixing input validation flaw when displaying certificates (CVE-2011-3365)
by opensuse-security＠opensuse.org 17 Oct '11

17 Oct '11

openSUSE Security Update: kdelibs4: fixing input validation flaw when displaying certificates (CVE-2011-3365) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1135-1 Rating: moderate References: #721974 Cross-References: CVE-2011-3365 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: An input validation flaw when displaying certificates has been fixed in KDE's KSSL (kdelibs4). CVE-2011-3365 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch kdelibs4-5258 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): kdelibs4-4.6.0-6.17.1 kdelibs4-branding-upstream-4.6.0-6.17.1 kdelibs4-core-4.6.0-6.17.1 kdelibs4-doc-4.6.0-6.17.1 libkde4-4.6.0-6.17.1 libkde4-devel-4.6.0-6.17.1 libkdecore4-4.6.0-6.17.1 libkdecore4-devel-4.6.0-6.17.1 libksuseinstall-devel-4.6.0-6.17.1 libksuseinstall1-4.6.0-6.17.1 - openSUSE 11.4 (x86_64): libkde4-32bit-4.6.0-6.17.1 libkdecore4-32bit-4.6.0-6.17.1 libksuseinstall1-32bit-4.6.0-6.17.1 References: http://support.novell.com/security/cve/CVE-2011-3365.html https://bugzilla.novell.com/721974

1 0

openSUSE-SU-2011:1134-1: moderate: tomcat
by opensuse-security＠opensuse.org 17 Oct '11

17 Oct '11

openSUSE Security Update: tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1134-1 Rating: moderate References: #715991 Cross-References: CVE-2011-3190 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted AJP messages could be used bypass authentication (CVE-2011-3190). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch tomcat6-5149 - openSUSE 11.3: zypper in -t patch tomcat6-5149 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): tomcat6-6.0.32-7.10.1 tomcat6-admin-webapps-6.0.32-7.10.1 tomcat6-docs-webapp-6.0.32-7.10.1 tomcat6-el-1_0-api-6.0.32-7.10.1 tomcat6-javadoc-6.0.32-7.10.1 tomcat6-jsp-2_1-api-6.0.32-7.10.1 tomcat6-lib-6.0.32-7.10.1 tomcat6-servlet-2_5-api-6.0.32-7.10.1 tomcat6-webapps-6.0.32-7.10.1 - openSUSE 11.3 (noarch): tomcat6-6.0.24-5.14.1 tomcat6-admin-webapps-6.0.24-5.14.1 tomcat6-docs-webapp-6.0.24-5.14.1 tomcat6-el-1_0-api-6.0.24-5.14.1 tomcat6-javadoc-6.0.24-5.14.1 tomcat6-jsp-2_1-api-6.0.24-5.14.1 tomcat6-lib-6.0.24-5.14.1 tomcat6-servlet-2_5-api-6.0.24-5.14.1 tomcat6-webapps-6.0.24-5.14.1 References: http://support.novell.com/security/cve/CVE-2011-3190.html https://bugzilla.novell.com/715991

1 0

openSUSE-RU-2011:1129-1: iftop: Fix drawing in UTF-8 mode
by maintenance＠opensuse.org 14 Oct '11

14 Oct '11

openSUSE Recommended Update: iftop: Fix drawing in UTF-8 mode ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1129-1 Rating: low References: #718922 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a drawing issue in UTF-8 mode due to wrong locale initialisation and ncurses usage (bnc#718922) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch iftop-5200 - openSUSE 11.3: zypper in -t patch iftop-5200 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): iftop-0.17-137.138.1 - openSUSE 11.3 (i586 x86_64): iftop-0.17-134.3.1 References: https://bugzilla.novell.com/718922

1 0

openSUSE-SU-2011:1076-3: important: seamonkey: Update to Mozilla Seamonkey 2.4.1
by opensuse-security＠opensuse.org 14 Oct '11

14 Oct '11

openSUSE Security Update: seamonkey: Update to Mozilla Seamonkey 2.4.1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1076-3 Rating: important References: #720264 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes two new package versions. Description: Mozilla Seamonkey was updated to version 2.4.1, which fixes some regressions found in the 2.4 release. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch MozillaFirefox-5239 seamonkey-5244 - openSUSE 11.3: zypper in -t patch seamonkey-5244 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.4.1 and 7.0.1]: MozillaFirefox-7.0.1-0.2.1 MozillaFirefox-branding-upstream-7.0.1-0.2.1 MozillaFirefox-buildsymbols-7.0.1-0.2.1 MozillaFirefox-devel-7.0.1-0.2.1 MozillaFirefox-translations-common-7.0.1-0.2.1 MozillaFirefox-translations-other-7.0.1-0.2.1 seamonkey-2.4.1-0.2.1 seamonkey-dom-inspector-2.4.1-0.2.1 seamonkey-irc-2.4.1-0.2.1 seamonkey-translations-common-2.4.1-0.2.1 seamonkey-translations-other-2.4.1-0.2.1 seamonkey-venkman-2.4.1-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.4.1]: seamonkey-2.4.1-0.2.1 seamonkey-dom-inspector-2.4.1-0.2.1 seamonkey-irc-2.4.1-0.2.1 seamonkey-translations-common-2.4.1-0.2.1 seamonkey-translations-other-2.4.1-0.2.1 seamonkey-venkman-2.4.1-0.2.1 References: https://bugzilla.novell.com/720264

1 0

openSUSE-RU-2011:1121-1: moderate: pcmciautils: Fix segmentation fault in argument handling
by maintenance＠opensuse.org 12 Oct '11

12 Oct '11

openSUSE Recommended Update: pcmciautils: Fix segmentation fault in argument handling ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1121-1 Rating: moderate References: #567197 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a segmentation fault in argument handling in pccardctl. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch pcmciautils-5260 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): pcmciautils-017-113.114.1 References: https://bugzilla.novell.com/567197

1 0

openSUSE-SU-2011:1120-1: libqt4
by opensuse-security＠opensuse.org 12 Oct '11

12 Oct '11

openSUSE Security Update: libqt4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1120-1 Rating: low References: #637275 #714984 Cross-References: CVE-2011-3193 CVE-2011-3194 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Specially crafted font files could cause a single byte heap based buffer overflow (CVE-2011-3193). Specially crafted grey scale images could cause a heap based buffer overflow (CVE-2011-3194). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libQtWebKit-devel-5129 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libQtWebKit-devel-4.7.1-8.15.1 libQtWebKit4-4.7.1-8.15.1 libqt4-4.7.1-8.15.1 libqt4-devel-4.7.1-8.15.1 libqt4-devel-doc-4.7.1-8.15.1 libqt4-qt3support-4.7.1-8.15.1 libqt4-sql-4.7.1-8.15.1 libqt4-sql-mysql-4.7.1-8.15.1 libqt4-sql-postgresql-4.7.1-8.15.1 libqt4-sql-sqlite-4.7.1-8.15.1 libqt4-sql-unixODBC-4.7.1-8.15.1 libqt4-x11-4.7.1-8.15.1 qt4-x11-tools-4.7.1-8.15.1 - openSUSE 11.4 (x86_64): libQtWebKit4-32bit-4.7.1-8.15.1 libqt4-32bit-4.7.1-8.15.1 libqt4-qt3support-32bit-4.7.1-8.15.1 libqt4-sql-32bit-4.7.1-8.15.1 libqt4-sql-mysql-32bit-4.7.1-8.15.1 libqt4-sql-postgresql-32bit-4.7.1-8.15.1 libqt4-sql-sqlite-32bit-4.7.1-8.15.1 libqt4-sql-unixODBC-32bit-4.7.1-8.15.1 libqt4-x11-32bit-4.7.1-8.15.1 - openSUSE 11.4 (noarch): libqt4-devel-doc-data-4.7.1-8.15.1 References: http://support.novell.com/security/cve/CVE-2011-3193.html http://support.novell.com/security/cve/CVE-2011-3194.html https://bugzilla.novell.com/637275 https://bugzilla.novell.com/714984

1 0

openSUSE-SU-2011:1119-1: libqt4
by opensuse-security＠opensuse.org 12 Oct '11

12 Oct '11

openSUSE Security Update: libqt4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1119-1 Rating: low References: #592962 #637275 #643848 #668210 #669604 #714984 Cross-References: CVE-2011-3193 CVE-2011-3194 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: Specially crafted font files could cause a single byte heap based buffer overflow (CVE-2011-3193). Specially crafted grey scale images could cause a heap based buffer overflow (CVE-2011-3194). The update also fixes the following non-security bugs: - fix QFileDialog not showing system files (bnc#669604) - fix font fallback handling (bnc#643848) - add support for postgresql 8.3 and 9 (bnc#668210) - Path added: bnc#592962 - Set application icon. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libQtWebKit-devel-5125 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libQtWebKit-devel-4.6.3-2.5.1 libQtWebKit4-4.6.3-2.5.1 libqt4-4.6.3-2.5.1 libqt4-devel-4.6.3-2.5.1 libqt4-devel-doc-4.6.3-2.5.1 libqt4-qt3support-4.6.3-2.5.1 libqt4-sql-4.6.3-2.5.1 libqt4-sql-mysql-4.6.3-2.5.1 libqt4-sql-postgresql-4.6.3-2.5.1 libqt4-sql-sqlite-4.6.3-2.5.1 libqt4-sql-unixODBC-4.6.3-2.5.1 libqt4-x11-4.6.3-2.5.1 qt4-x11-tools-4.6.3-2.5.1 - openSUSE 11.3 (x86_64): libQtWebKit4-32bit-4.6.3-2.5.1 libqt4-32bit-4.6.3-2.5.1 libqt4-qt3support-32bit-4.6.3-2.5.1 libqt4-sql-32bit-4.6.3-2.5.1 libqt4-sql-mysql-32bit-4.6.3-2.5.1 libqt4-sql-postgresql-32bit-4.6.3-2.5.1 libqt4-sql-sqlite-32bit-4.6.3-2.5.1 libqt4-sql-unixODBC-32bit-4.6.3-2.5.1 libqt4-x11-32bit-4.6.3-2.5.1 - openSUSE 11.3 (noarch): libqt4-devel-doc-data-4.6.3-2.5.1 References: http://support.novell.com/security/cve/CVE-2011-3193.html http://support.novell.com/security/cve/CVE-2011-3194.html https://bugzilla.novell.com/592962 https://bugzilla.novell.com/637275 https://bugzilla.novell.com/643848 https://bugzilla.novell.com/668210 https://bugzilla.novell.com/669604 https://bugzilla.novell.com/714984

1 0

openSUSE-RU-2011:1109-1: libdc1394: Hide internal symbols
by maintenance＠opensuse.org 11 Oct '11

11 Oct '11

openSUSE Recommended Update: libdc1394: Hide internal symbols ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1109-1 Rating: low References: #712262 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes digiKam crashing on picture import. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libdc1394-5249 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libdc1394-2.1.3-21.22.1 libdc1394-22-2.1.3-21.22.1 libdc1394-devel-2.1.3-21.22.1 References: https://bugzilla.novell.com/712262

1 0