November 2011 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2011:1288-1: moderate: puppet
by opensuse-security＠opensuse.org 30 Nov '11

30 Nov '11

openSUSE Security Update: puppet ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1288-1 Rating: moderate References: #721139 #726372 #727024 #727025 Cross-References: CVE-2011-3848 CVE-2011-3869 CVE-2011-3870 CVE-2011-3871 CVE-2011-3872 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks (CVE-2011-3872). Note: If you've set the 'certdnsnames' option in your master's puppet.conf file merely installing the updated packages is not sufficient to fix this problem. You need to either pick a new DNS name for the master and reconfigure all agents to use it or re-new certificates on all agents. Please refer to the documentation in /usr/share/doc/packages/puppet/puppetlabs-cve20113872-0.0.5 for detailed instructions and scripts. Puppetlabs' site also provides more information: http://puppetlabs.com/security/cve/cve-2011-3872/faq/ http://puppetlabs.com/blog/important-security-announcement-a ltnames-vulnerability/ -- Directory traversal vulnerability in puppet allowed unauthenticated remote attackers to upload x.509 certificate signing requests to arbitrary locations (CVE-2011-3848) Puppet was prone to several symlink attacks (CVE-2011-3870, CVE-2011-3869, CVE-2011-3871) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch puppet-5403 - openSUSE 11.3: zypper in -t patch puppet-5403 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): puppet-2.6.4-4.11.1 puppet-server-2.6.4-4.11.1 - openSUSE 11.3 (i586 x86_64): puppet-0.25.4-4.7.1 puppet-server-0.25.4-4.7.1 References: http://support.novell.com/security/cve/CVE-2011-3848.html http://support.novell.com/security/cve/CVE-2011-3869.html http://support.novell.com/security/cve/CVE-2011-3870.html http://support.novell.com/security/cve/CVE-2011-3871.html http://support.novell.com/security/cve/CVE-2011-3872.html https://bugzilla.novell.com/721139 https://bugzilla.novell.com/726372 https://bugzilla.novell.com/727024 https://bugzilla.novell.com/727025

1 0

openSUSE-SU-2011:1278-1: moderate: perl: decode_xs heap-based buffer overflow
by opensuse-security＠opensuse.org 24 Nov '11

24 Nov '11

openSUSE Security Update: perl: decode_xs heap-based buffer overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1278-1 Rating: moderate References: #728662 Cross-References: CVE-2011-2939 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of Perl fixes a heap based buffer overflow in the decode_xs() function (CVE-2011-2939, bnc#728662). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch perl-5471 - openSUSE 11.3: zypper in -t patch perl-5471 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): perl-5.12.3-11.18.1 perl-base-5.12.3-11.18.1 - openSUSE 11.4 (x86_64): perl-32bit-5.12.3-11.18.1 perl-base-32bit-5.12.3-11.18.1 - openSUSE 11.4 (noarch): perl-doc-5.12.3-11.18.1 - openSUSE 11.3 (i586 x86_64): perl-5.12.1-2.7.1 perl-base-5.12.1-2.7.1 - openSUSE 11.3 (x86_64): perl-32bit-5.12.1-2.7.1 perl-base-32bit-5.12.1-2.7.1 - openSUSE 11.3 (noarch): perl-doc-5.12.1-2.7.1 References: http://support.novell.com/security/cve/CVE-2011-2939.html https://bugzilla.novell.com/728662

1 0

openSUSE-SU-2011:1273-1: moderate: NetworkManager
by opensuse-security＠opensuse.org 23 Nov '11

23 Nov '11

openSUSE Security Update: NetworkManager ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1273-1 Rating: moderate References: #574266 #702016 Cross-References: CVE-2006-7246 CVE-2011-2176 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network (CVE-2006-7246). Please note that existing WPA2 Enterprise connections need to be deleted and re-created to take advantage of the new security checks. NetworkManager did not honor the PolicyKit auth_admin setting when creating Ad-Hoc wireless networks (CVE-2011-2176) Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch NetworkManager-5373 - openSUSE 11.3: zypper in -t patch NetworkManager-5373 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): NetworkManager-0.8.2-15.28.1 NetworkManager-devel-0.8.2-15.28.1 NetworkManager-doc-0.8.2-15.28.1 NetworkManager-glib-0.8.2-15.28.1 NetworkManager-gnome-0.8.2-9.12.1 wpa_supplicant-0.7.3-3.4.1 wpa_supplicant-gui-0.7.3-3.4.1 - openSUSE 11.4 (noarch): NetworkManager-gnome-lang-0.8.2-9.12.1 NetworkManager-lang-0.8.2-15.28.1 - openSUSE 11.3 (i586 x86_64): NetworkManager-0.8-8.13.1 NetworkManager-devel-0.8-8.13.1 NetworkManager-doc-0.8-8.13.1 NetworkManager-glib-0.8-8.13.1 NetworkManager-gnome-0.8-6.3.2 wpa_supplicant-0.7.1-5.3.1 wpa_supplicant-gui-0.7.1-5.3.1 References: http://support.novell.com/security/cve/CVE-2006-7246.html http://support.novell.com/security/cve/CVE-2011-2176.html https://bugzilla.novell.com/574266 https://bugzilla.novell.com/702016

1 0

openSUSE-SU-2011:1272-1: important: bind
by opensuse-security＠opensuse.org 22 Nov '11

22 Nov '11

openSUSE Security Update: bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1272-1 Rating: important References: #730995 Cross-References: CVE-2011-4313 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: specially crafted DNS queries could crash the bind name server (CVE-2011-4313). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch bind-5441 - openSUSE 11.3: zypper in -t patch bind-5441 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 9.7.4P1]: bind-9.7.4P1-0.2.1 bind-chrootenv-9.7.4P1-0.2.1 bind-devel-9.7.4P1-0.2.1 bind-libs-9.7.4P1-0.2.1 bind-utils-9.7.4P1-0.2.1 - openSUSE 11.4 (x86_64) [New Version: 9.7.4P1]: bind-libs-32bit-9.7.4P1-0.2.1 - openSUSE 11.4 (noarch) [New Version: 9.7.4P1]: bind-doc-9.7.4P1-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 9.7.4P1]: bind-9.7.4P1-0.2.1 bind-chrootenv-9.7.4P1-0.2.1 bind-devel-9.7.4P1-0.2.1 bind-libs-9.7.4P1-0.2.1 bind-utils-9.7.4P1-0.2.1 - openSUSE 11.3 (x86_64) [New Version: 9.7.4P1]: bind-libs-32bit-9.7.4P1-0.2.1 - openSUSE 11.3 (noarch) [New Version: 9.7.4P1]: bind-doc-9.7.4P1-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-4313.html https://bugzilla.novell.com/730995

1 0

openSUSE-SU-2011:1263-1: important: VUL-1: wireshark: new updates fix two DoS issues
by opensuse-security＠opensuse.org 19 Nov '11

19 Nov '11

openSUSE Security Update: VUL-1: wireshark: new updates fix two DoS issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1263-1 Rating: important References: #706728 Cross-References: CVE-2011-2597 CVE-2011-3266 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: Wireshark version upgrade to 1.4.10 to fix various security flaws and other non-security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch wireshark-5431 - openSUSE 11.3: zypper in -t patch wireshark-5431 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.4.10]: wireshark-1.4.10-0.8.1 wireshark-devel-1.4.10-0.8.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.4.10]: wireshark-1.4.10-0.7.1 wireshark-devel-1.4.10-0.7.1 References: http://support.novell.com/security/cve/CVE-2011-2597.html http://support.novell.com/security/cve/CVE-2011-3266.html https://bugzilla.novell.com/706728

1 0

openSUSE-SU-2011:1259-1: libcap
by opensuse-security＠opensuse.org 19 Nov '11

19 Nov '11

openSUSE Security Update: libcap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1259-1 Rating: low References: #727715 Cross-References: CVE-2011-4099 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: capsh did not chdir("/") after callling chroot(). Programs could therefore access the current directory outside of the chroot (CVE-2011-4099). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libcap-5369 - openSUSE 11.3: zypper in -t patch libcap-5369 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libcap-devel-2.19-9.10.1 libcap-progs-2.19-9.10.1 libcap2-2.19-9.10.1 - openSUSE 11.4 (x86_64): libcap2-32bit-2.19-9.10.1 - openSUSE 11.3 (i586 x86_64): libcap-devel-2.16-10.3.1 libcap-progs-2.16-10.3.1 libcap2-2.16-10.3.1 - openSUSE 11.3 (x86_64): libcap2-32bit-2.16-10.3.1 References: http://support.novell.com/security/cve/CVE-2011-4099.html https://bugzilla.novell.com/727715

1 0

openSUSE-SU-2011:1257-1: moderate: empathy
by opensuse-security＠opensuse.org 19 Nov '11

19 Nov '11

openSUSE Security Update: empathy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1257-1 Rating: moderate References: #727003 Cross-References: CVE-2011-3635 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Insufficient quoting of nick names allowed attackers to inject arbitrary html (CVE-2011-3635) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch empathy-5376 - openSUSE 11.3: zypper in -t patch empathy-5376 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): empathy-2.32.2-7.10.1 nautilus-sendto-plugin-empathy-2.32.2-7.10.1 - openSUSE 11.4 (noarch): empathy-lang-2.32.2-7.10.1 - openSUSE 11.3 (i586 x86_64): empathy-2.30.1-3.5.1 nautilus-sendto-plugin-empathy-2.30.1-3.5.1 - openSUSE 11.3 (noarch): empathy-lang-2.30.1-3.5.1 References: http://support.novell.com/security/cve/CVE-2011-3635.html https://bugzilla.novell.com/727003

1 0

openSUSE-SU-2011:1240-2: critical: VUL-0: flash-player: sec. update to version 11.1.102.55
by opensuse-security＠opensuse.org 17 Nov '11

17 Nov '11

openSUSE Security Update: VUL-0: flash-player: sec. update to version 11.1.102.55 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1240-2 Rating: critical References: #729797 Cross-References: CVE-2011-2445 CVE-2011-2450 CVE-2011-2451 CVE-2011-2452 CVE-2011-2453 CVE-2011-2454 CVE-2011-2455 CVE-2011-2456 CVE-2011-2457 CVE-2011-2458 CVE-2011-2459 CVE-2011-2460 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. It includes one version update. Description: flash-player update to version 11.1.102.55 to fix the following critical security issues: CVE-2011-2445, CVE-2011-2450, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2456, CVE-2011-2457, CVE-2011-2458, CVE-2011-2459, CVE-2011-2460 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch flash-player-5436 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 11.1.102.55]: flash-player-11.1.102.55-0.6.1 References: http://support.novell.com/security/cve/CVE-2011-2445.html http://support.novell.com/security/cve/CVE-2011-2450.html http://support.novell.com/security/cve/CVE-2011-2451.html http://support.novell.com/security/cve/CVE-2011-2452.html http://support.novell.com/security/cve/CVE-2011-2453.html http://support.novell.com/security/cve/CVE-2011-2454.html http://support.novell.com/security/cve/CVE-2011-2455.html http://support.novell.com/security/cve/CVE-2011-2456.html http://support.novell.com/security/cve/CVE-2011-2457.html http://support.novell.com/security/cve/CVE-2011-2458.html http://support.novell.com/security/cve/CVE-2011-2459.html http://support.novell.com/security/cve/CVE-2011-2460.html https://bugzilla.novell.com/729797

1 0

openSUSE-SU-2011:1251-1: moderate: VUL-0: CVE-2011-2939: icedtea-web: second-level domain subdomains and suffix domain SOP bypass
by opensuse-security＠opensuse.org 17 Nov '11

17 Nov '11

openSUSE Security Update: VUL-0: CVE-2011-2939: icedtea-web: second-level domain subdomains and suffix domain SOP bypass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1251-1 Rating: moderate References: #729870 Cross-References: CVE-2011-2939 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Update to version 1.1.4 of icedtea-web to fix the following issues: - CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass - PR778: Jar download and server certificate verification deadlock Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch icedtea-web-5422 - openSUSE 11.3: zypper in -t patch icedtea-web-5422 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.1.4]: icedtea-web-1.1.4-0.2.1 - openSUSE 11.4 (noarch) [New Version: 1.1.4]: icedtea-web-javadoc-1.1.4-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.1.4]: icedtea-web-1.1.4-0.2.1 - openSUSE 11.3 (noarch) [New Version: 1.1.4]: icedtea-web-javadoc-1.1.4-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-2939.html https://bugzilla.novell.com/729870

1 0

openSUSE-SU-2011:1250-1: moderate: mysql
by opensuse-security＠opensuse.org 17 Nov '11

17 Nov '11

openSUSE Security Update: mysql ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1250-1 Rating: moderate References: #644864 Cross-References: CVE-2010-3833 CVE-2010-3834 CVE-2010-3835 CVE-2010-3836 CVE-2010-3837 CVE-2010-3838 CVE-2010-3839 CVE-2010-3840 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. It includes one version update. Description: This mysql update fixes the following security issues - CVE-2010-3833: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors (CWE-399) - CVE-2010-3834: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Insufficient Information (CWE-noinfo) - CVE-2010-3835: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Numeric Errors (CWE-189) - CVE-2010-3836: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors (CWE-399) - CVE-2010-3837: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Resource Management Errors (CWE-399) - CVE-2010-3838: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other) - CVE-2010-3839: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Design Error (CWE-DesignError) - CVE-2010-3840: CVSS v2 Base Score: 4.0 (moderate) (AV:N/AC:L/Au:S/C:N/I:N/A:P): Other (CWE-Other) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libmysqlclient-devel-4676 - openSUSE 11.3: zypper in -t patch libmysqlclient-devel-4676 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 5.1.57]: libmysqlclient-devel-5.1.57-0.3.1 libmysqlclient16-5.1.57-0.3.1 libmysqlclient_r16-5.1.57-0.3.1 libmysqld-devel-5.1.57-0.3.1 libmysqld0-5.1.57-0.3.1 mysql-community-server-5.1.57-0.3.1 mysql-community-server-bench-5.1.57-0.3.1 mysql-community-server-client-5.1.57-0.3.1 mysql-community-server-debug-5.1.57-0.3.1 mysql-community-server-test-5.1.57-0.3.1 mysql-community-server-tools-5.1.57-0.3.1 - openSUSE 11.4 (x86_64) [New Version: 5.1.57]: libmysqlclient16-32bit-5.1.57-0.3.1 libmysqlclient_r16-32bit-5.1.57-0.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 5.1.57]: libmysqlclient-devel-5.1.57-0.3.1 libmysqlclient16-5.1.57-0.3.1 libmysqlclient_r16-5.1.57-0.3.1 libmysqld-devel-5.1.57-0.3.1 libmysqld0-5.1.57-0.3.1 mysql-community-server-5.1.57-0.3.1 mysql-community-server-bench-5.1.57-0.3.1 mysql-community-server-client-5.1.57-0.3.1 mysql-community-server-debug-5.1.57-0.3.1 mysql-community-server-test-5.1.57-0.3.1 mysql-community-server-tools-5.1.57-0.3.1 - openSUSE 11.3 (x86_64) [New Version: 5.1.57]: libmysqlclient16-32bit-5.1.57-0.3.1 libmysqlclient_r16-32bit-5.1.57-0.3.1 References: http://support.novell.com/security/cve/CVE-2010-3833.html http://support.novell.com/security/cve/CVE-2010-3834.html http://support.novell.com/security/cve/CVE-2010-3835.html http://support.novell.com/security/cve/CVE-2010-3836.html http://support.novell.com/security/cve/CVE-2010-3837.html http://support.novell.com/security/cve/CVE-2010-3838.html http://support.novell.com/security/cve/CVE-2010-3839.html http://support.novell.com/security/cve/CVE-2010-3840.html https://bugzilla.novell.com/644864

1 0

openSUSE-RU-2011:1248-1: ipv6, rcnetwork returns before dad completed
by maintenance＠opensuse.org 16 Nov '11

16 Nov '11

openSUSE Recommended Update: ipv6, rcnetwork returns before dad completed ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1248-1 Rating: low References: #697929 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for sysconfig: - 697929: Fixed to wait for the end of ipv6 duplicate address detection, that can cause failures of further services. Added LINK_READY_WAIT and IPV6_DAD_WAIT variables Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch sysconfig-5396 - openSUSE 11.3: zypper in -t patch sysconfig-5396 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): sysconfig-0.74.5-6.9.1 - openSUSE 11.3 (i586 x86_64): sysconfig-0.73.7-2.11.1 References: https://bugzilla.novell.com/697929

1 0

openSUSE-SU-2011:1247-1: moderate: radvd: security issues fixed
by opensuse-security＠opensuse.org 16 Nov '11

16 Nov '11

openSUSE Security Update: radvd: security issues fixed ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1247-1 Rating: moderate References: #721968 Cross-References: CVE-2011-3601 CVE-2011-3602 CVE-2011-3603 CVE-2011-3604 CVE-2011-3605 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update of radvd fixes the following security flaws: - arbitrary file overwrite flaw through unsanitized interface names (CVE-2011-3602), - missing return value checks in privsep_init() which could cause radvd to keep running with root privileges (CVE-2011-3603), - buffer overread flaws in the process_ra() function (CVE-2011-3604), - temporary denial of service flaw triggered with a flood of ND_ROUTER_SOLICIT (CVE-2011-3605) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch radvd-5316 - openSUSE 11.3: zypper in -t patch radvd-5316 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): radvd-1.3-9.10.1 - openSUSE 11.3 (i586 x86_64): radvd-1.3-6.3.1 References: http://support.novell.com/security/cve/CVE-2011-3601.html http://support.novell.com/security/cve/CVE-2011-3602.html http://support.novell.com/security/cve/CVE-2011-3603.html http://support.novell.com/security/cve/CVE-2011-3604.html http://support.novell.com/security/cve/CVE-2011-3605.html https://bugzilla.novell.com/721968

1 0

openSUSE-SU-2011:1243-1: critical: MozillaFirefox secuirty update
by opensuse-security＠opensuse.org 16 Nov '11

16 Nov '11

openSUSE Security Update: MozillaFirefox secuirty update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1243-1 Rating: critical References: #728520 Cross-References: CVE-2011-3648 CVE-2011-3650 CVE-2011-3651 CVE-2011-3652 CVE-2011-3654 CVE-2011-3655 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. It includes 5 new package versions. Description: MozillaFirefox was updated to version 8 (bnc#728520) to fix the following security issues: * MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS against sites using Shift-JIS * MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654 Miscellaneous memory safety hazards * MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory corruption while profiling using Firebug * MFSA 2011-52/CVE-2011-3655 (bmo#672182) Code execution via NoWaiverWrapper - rebased patches Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch MozillaFirefox-5399 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.9.2.24,3.1.16,5.0 and 8.0]: MozillaFirefox-8.0-0.2.2 MozillaFirefox-branding-openSUSE-5.0-2.5.1 MozillaFirefox-branding-upstream-8.0-0.2.2 MozillaFirefox-buildsymbols-8.0-0.2.2 MozillaFirefox-devel-8.0-0.2.2 MozillaFirefox-translations-common-8.0-0.2.2 MozillaFirefox-translations-other-8.0-0.2.2 MozillaThunderbird-3.1.16-0.19.2 MozillaThunderbird-buildsymbols-3.1.16-0.19.2 MozillaThunderbird-devel-3.1.16-0.19.2 MozillaThunderbird-translations-common-3.1.16-0.19.2 MozillaThunderbird-translations-other-3.1.16-0.19.2 enigmail-1.1.2+3.1.16-0.19.2 mozilla-js192-1.9.2.24-0.2.2 mozilla-xulrunner192-1.9.2.24-0.2.2 mozilla-xulrunner192-buildsymbols-1.9.2.24-0.2.2 mozilla-xulrunner192-devel-1.9.2.24-0.2.2 mozilla-xulrunner192-gnome-1.9.2.24-0.2.2 mozilla-xulrunner192-translations-common-1.9.2.24-0.2.2 mozilla-xulrunner192-translations-other-1.9.2.24-0.2.2 - openSUSE 11.4 (x86_64) [New Version: 1.9.2.24]: mozilla-js192-32bit-1.9.2.24-0.2.2 mozilla-xulrunner192-32bit-1.9.2.24-0.2.2 mozilla-xulrunner192-gnome-32bit-1.9.2.24-0.2.2 mozilla-xulrunner192-translations-common-32bit-1.9.2.24-0.2.2 mozilla-xulrunner192-translations-other-32bit-1.9.2.24-0.2.2 References: http://support.novell.com/security/cve/CVE-2011-3648.html http://support.novell.com/security/cve/CVE-2011-3650.html http://support.novell.com/security/cve/CVE-2011-3651.html http://support.novell.com/security/cve/CVE-2011-3652.html http://support.novell.com/security/cve/CVE-2011-3654.html http://support.novell.com/security/cve/CVE-2011-3655.html https://bugzilla.novell.com/728520

1 0

openSUSE-SU-2011:1242-1: critical: MozillaFirefox
by opensuse-security＠opensuse.org 16 Nov '11

16 Nov '11

openSUSE Security Update: MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1242-1 Rating: critical References: #728520 Cross-References: CVE-2011-3647 CVE-2011-3648 CVE-2011-3650 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes four new package versions. Description: MozillaFirefox has been updated to version 3.6.24 to fix the following security issues: * MFSA 2011-46/CVE-2011-3647 (bmo#680880) loadSubScript unwraps XPCNativeWrapper scope parameter * MFSA 2011-47/CVE-2011-3648 (bmo#690225) Potential XSS against sites using Shift-JIS * MFSA 2011-49/CVE-2011-3650 (bmo#674776) Memory corruption while profiling using Firebug Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch MozillaFirefox-5408 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 1.9.2.24,3.1.16 and 3.6.24]: MozillaFirefox-3.6.24-0.2.1 MozillaFirefox-branding-openSUSE-3.5-17.3.1 MozillaFirefox-branding-upstream-3.6.24-0.2.1 MozillaFirefox-translations-common-3.6.24-0.2.1 MozillaFirefox-translations-other-3.6.24-0.2.1 MozillaThunderbird-3.1.16-0.23.1 MozillaThunderbird-devel-3.1.16-0.23.1 MozillaThunderbird-translations-common-3.1.16-0.23.1 MozillaThunderbird-translations-other-3.1.16-0.23.1 enigmail-1.1.2+3.1.16-0.23.1 mozilla-js192-1.9.2.24-0.2.1 mozilla-xulrunner192-1.9.2.24-0.2.1 mozilla-xulrunner192-buildsymbols-1.9.2.24-0.2.1 mozilla-xulrunner192-devel-1.9.2.24-0.2.1 mozilla-xulrunner192-gnome-1.9.2.24-0.2.1 mozilla-xulrunner192-translations-common-1.9.2.24-0.2.1 mozilla-xulrunner192-translations-other-1.9.2.24-0.2.1 - openSUSE 11.3 (x86_64) [New Version: 1.9.2.24]: mozilla-js192-32bit-1.9.2.24-0.2.1 mozilla-xulrunner192-32bit-1.9.2.24-0.2.1 mozilla-xulrunner192-gnome-32bit-1.9.2.24-0.2.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.24-0.2.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.24-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3647.html http://support.novell.com/security/cve/CVE-2011-3648.html http://support.novell.com/security/cve/CVE-2011-3650.html https://bugzilla.novell.com/728520

1 0

openSUSE-SU-2011:1241-1: mozilla-nss
by opensuse-security＠opensuse.org 16 Nov '11

16 Nov '11

openSUSE Security Update: mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1241-1 Rating: low References: #726096 #728520 Cross-References: CVE-2011-3640 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. It includes one version update. Description: This mozilla update fixes the following security issues: - explicitely distrust DigiCert Sdn. Bhd (bnc#728520, bmo#698753) - make sure NSS_NoDB_Init does not try to use wrong certificate databases (CVE-2011-3640, bnc#726096, bmo#641052) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libfreebl3-5398 - openSUSE 11.3: zypper in -t patch libfreebl3-5398 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 3.12.11]: libfreebl3-3.12.11-1.7.1 libsoftokn3-3.12.11-1.7.1 mozilla-nss-3.12.11-1.7.1 mozilla-nss-certs-3.12.11-1.7.1 mozilla-nss-devel-3.12.11-1.7.1 mozilla-nss-sysinit-3.12.11-1.7.1 mozilla-nss-tools-3.12.11-1.7.1 - openSUSE 11.4 (x86_64) [New Version: 3.12.11]: libfreebl3-32bit-3.12.11-1.7.1 libsoftokn3-32bit-3.12.11-1.7.1 mozilla-nss-32bit-3.12.11-1.7.1 mozilla-nss-certs-32bit-3.12.11-1.7.1 mozilla-nss-sysinit-32bit-3.12.11-1.7.1 - openSUSE 11.3 (i586 x86_64) [New Version: 3.12.11]: libfreebl3-3.12.11-1.7.1 libsoftokn3-3.12.11-1.7.1 mozilla-nss-3.12.11-1.7.1 mozilla-nss-certs-3.12.11-1.7.1 mozilla-nss-devel-3.12.11-1.7.1 mozilla-nss-sysinit-3.12.11-1.7.1 mozilla-nss-tools-3.12.11-1.7.1 - openSUSE 11.3 (x86_64) [New Version: 3.12.11]: libfreebl3-32bit-3.12.11-1.7.1 libsoftokn3-32bit-3.12.11-1.7.1 mozilla-nss-32bit-3.12.11-1.7.1 mozilla-nss-certs-32bit-3.12.11-1.7.1 mozilla-nss-sysinit-32bit-3.12.11-1.7.1 References: http://support.novell.com/security/cve/CVE-2011-3640.html https://bugzilla.novell.com/726096 https://bugzilla.novell.com/728520

1 0

openSUSE-SU-2011:1240-1: critical: VUL-0: flash-player: sec. update to version 11.1.102.55
by opensuse-security＠opensuse.org 15 Nov '11

15 Nov '11

openSUSE Security Update: VUL-0: flash-player: sec. update to version 11.1.102.55 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1240-1 Rating: critical References: #729797 Cross-References: CVE-2011-2445 CVE-2011-2450 CVE-2011-2451 CVE-2011-2452 CVE-2011-2453 CVE-2011-2454 CVE-2011-2455 CVE-2011-2456 CVE-2011-2457 CVE-2011-2458 CVE-2011-2459 CVE-2011-2460 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. It includes two new package versions. Description: flash-player update to version 11.1.102.55 to fix the following critical security issues: CVE-2011-2445, CVE-2011-2450, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2456, CVE-2011-2457, CVE-2011-2458, CVE-2011-2459, CVE-2011-2460 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch flash-player-5420 - openSUSE 11.3: zypper in -t patch flash-player-5420 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 11.1.102.55]: flash-player-11.1.102.55-0.4.1 - openSUSE 11.3 (i586) [New Version: 10.3.183.10]: flash-player-10.3.183.10-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-2445.html http://support.novell.com/security/cve/CVE-2011-2450.html http://support.novell.com/security/cve/CVE-2011-2451.html http://support.novell.com/security/cve/CVE-2011-2452.html http://support.novell.com/security/cve/CVE-2011-2453.html http://support.novell.com/security/cve/CVE-2011-2454.html http://support.novell.com/security/cve/CVE-2011-2455.html http://support.novell.com/security/cve/CVE-2011-2456.html http://support.novell.com/security/cve/CVE-2011-2457.html http://support.novell.com/security/cve/CVE-2011-2458.html http://support.novell.com/security/cve/CVE-2011-2459.html http://support.novell.com/security/cve/CVE-2011-2460.html https://bugzilla.novell.com/729797

1 0

openSUSE-SU-2011:1238-1: critical: acroread
by opensuse-security＠opensuse.org 15 Nov '11

15 Nov '11

openSUSE Security Update: acroread ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1238-1 Rating: critical References: #717724 Cross-References: CVE-2011-1353 CVE-2011-2431 CVE-2011-2432 CVE-2011-2433 CVE-2011-2434 CVE-2011-2435 CVE-2011-2436 CVE-2011-2437 CVE-2011-2438 CVE-2011-2439 CVE-2011-2440 CVE-2011-2441 CVE-2011-2442 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. It includes one version update. Description: acrobat reader was updated to version 9.4.6 to fix several security issues (CVE-2011-1353, CVE-2011-2431, CVE-2011-2432, CVE-2011-2433, CVE-2011-2434, CVE-2011-2435, CVE-2011-2436, CVE-2011-2437, CVE-2011-2438, CVE-2011-2439, CVE-2011-2440, CVE-2011-2441, CVE-2011-2442) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch acroread-5411 - openSUSE 11.3: zypper in -t patch acroread-5411 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586) [New Version: 9.4.6]: acroread-9.4.6-0.5.1 - openSUSE 11.3 (i586) [New Version: 9.4.6]: acroread-9.4.6-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-1353.html http://support.novell.com/security/cve/CVE-2011-2431.html http://support.novell.com/security/cve/CVE-2011-2432.html http://support.novell.com/security/cve/CVE-2011-2433.html http://support.novell.com/security/cve/CVE-2011-2434.html http://support.novell.com/security/cve/CVE-2011-2435.html http://support.novell.com/security/cve/CVE-2011-2436.html http://support.novell.com/security/cve/CVE-2011-2437.html http://support.novell.com/security/cve/CVE-2011-2438.html http://support.novell.com/security/cve/CVE-2011-2439.html http://support.novell.com/security/cve/CVE-2011-2440.html http://support.novell.com/security/cve/CVE-2011-2441.html http://support.novell.com/security/cve/CVE-2011-2442.html https://bugzilla.novell.com/717724

1 0

openSUSE-RU-2011:1236-1: moderate: sysstat stops creating reports at 6pm
by maintenance＠opensuse.org 12 Nov '11

12 Nov '11

openSUSE Recommended Update: sysstat stops creating reports at 6pm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1236-1 Rating: moderate References: #720609 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for sysstat: - 668385: daily sysstat statistics in /var/log/sa/sar* do not contain entries after 6pm. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch sysstat-5353 - openSUSE 11.3: zypper in -t patch sysstat-5353 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): sysstat-9.0.6.1-14.15.1 sysstat-isag-9.0.6.1-14.15.1 - openSUSE 11.3 (i586 x86_64): sysstat-9.0.4-7.3.1 sysstat-isag-9.0.4-7.3.1 References: https://bugzilla.novell.com/720609

1 0

openSUSE-RU-2011:1228-1: flash-player: Update to 11.0.1.152
by maintenance＠opensuse.org 10 Nov '11

10 Nov '11

openSUSE Recommended Update: flash-player: Update to 11.0.1.152 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1228-1 Rating: low References: #722151 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update provides Flash Player 11.0.1.152, which includes new features as well as enhancements and bug fixes related to security, stability, performance and device compatibility. Please read http://kb2.adobe.com/cps/919/cpsid_91932.html for details. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch flash-player-5229 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 11.0.1.152]: flash-player-11.0.1.152-0.2.1 References: https://bugzilla.novell.com/722151

1 0

openSUSE-RU-2011:1226-1: moderate: Xen: Collective October/2011 Update
by maintenance＠opensuse.org 10 Nov '11

10 Nov '11

openSUSE Recommended Update: Xen: Collective October/2011 Update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1226-1 Rating: moderate References: #683580 #691256 #694863 #701686 #704160 #706106 #706436 #706574 #712051 #712823 #715655 #716695 #722794 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has 13 recommended fixes can now be installed. It includes one version update. Description: Collective Update for Xen Xen: - 712823 - Xen guest does not start reliable when rebooted - 694863 - kexec fails in xen - 691256 - remove /etc/init.d/xencommons, its unused - 716695 - domUs using tap devices will not start - 683580 - Xen Hypervisor occasionally hangs forever during boot up after the message "Enabled directed EOI with ioapic_ack_old on! - 701686 - kdump hangs on megaraid_sas driver - 712051 - IOMMU fault livelock - 715655 - No support for performance counters for Westmere E7-8837 and SandyBridge i5-2500 - 706106 - Inconsistent reporting of VM names during migration - 704160 - crm resource migrate fails with xen machines - 706574 - xm console DomUName hang after "xm save/restore" of PVM on the latest Xen Libvirt: - 706436 - KVM crash dump speed limited by libvirt vm-install: - 722794 - Support for RHEL 6 is missing from vm-install Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch xen-201110-5261 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 0.4.32]: libvirt-0.8.1-4.12.1 libvirt-client-0.8.1-4.12.1 libvirt-devel-0.8.1-4.12.1 libvirt-doc-0.8.1-4.12.1 libvirt-python-0.8.1-4.12.1 vm-install-0.4.32-0.4.1 xen-4.0.2_21511_03-0.5.1 xen-devel-4.0.2_21511_03-0.5.1 xen-doc-html-4.0.2_21511_03-0.5.1 xen-doc-pdf-4.0.2_21511_03-0.5.1 xen-kmp-default-4.0.2_21511_03_k2.6.34.10_0.2-0.5.1 xen-kmp-desktop-4.0.2_21511_03_k2.6.34.10_0.2-0.5.1 xen-libs-4.0.2_21511_03-0.5.1 xen-tools-4.0.2_21511_03-0.5.1 xen-tools-domU-4.0.2_21511_03-0.5.1 - openSUSE 11.3 (i586): xen-kmp-pae-4.0.2_21511_03_k2.6.34.10_0.2-0.5.1 References: https://bugzilla.novell.com/683580 https://bugzilla.novell.com/691256 https://bugzilla.novell.com/694863 https://bugzilla.novell.com/701686 https://bugzilla.novell.com/704160 https://bugzilla.novell.com/706106 https://bugzilla.novell.com/706436 https://bugzilla.novell.com/706574 https://bugzilla.novell.com/712051 https://bugzilla.novell.com/712823 https://bugzilla.novell.com/715655 https://bugzilla.novell.com/716695 https://bugzilla.novell.com/722794

1 0

openSUSE-SU-2011:1222-1: moderate: kernel: security and bugfix update.
by opensuse-security＠opensuse.org 09 Nov '11

09 Nov '11

openSUSE Security Update: kernel: security and bugfix update. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1222-1 Rating: moderate References: #626119 #638985 #642896 #649625 #669378 #672008 #678097 #682204 #686412 #692784 #697901 #706374 #711203 #711539 #712023 #712366 #713229 #714001 #716901 #718028 #719450 #719710 Cross-References: CVE-2011-1776 CVE-2011-1833 CVE-2011-2183 CVE-2011-2695 CVE-2011-2918 CVE-2011-3191 CVE-2011-3353 CVE-2011-3363 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has 14 fixes is now available. It includes one version update. Description: The openSUSE 11.4 kernel was updated to 2.6.37.6 fixing lots of bugs and security issues. Following security issues have been fixed: CVE-2011-1833: Added a kernel option to ensure ecryptfs is mounting only on paths belonging to the current ui, which would have allowed local attackers to potentially gain privileges via symlink attacks. CVE-2011-2695: Multiple off-by-one errors in the ext4 subsystem in the Linux kernel allowed local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest possible 32-bit unsigned integer. CVE-2011-3363: Always check the path in CIFS mounts to avoid interesting filesystem path interaction issues and potential crashes. CVE-2011-2918: In the perf framework software event overflows could deadlock or delete an uninitialized timer. CVE-2011-3353: In the fuse filesystem, FUSE_NOTIFY_INVAL_ENTRY did not check the length of the write so the message processing could overrun and result in a BUG_ON() in fuse_copy_fill(). This flaw could be used by local users able to mount FUSE filesystems to crash the system. CVE-2011-2183: Fixed a race between ksmd and other memory management code, which could result in a NULL ptr dereference and kernel crash. CVE-2011-3191: A signedness issue in CIFS could possibly have lead to to memory corruption, if a malicious server could send crafted replies to the host. CVE-2011-1776: The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel did not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allowed physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577. Following non-security bugs were fixed: - novfs: Unable to change password in the Novell Client for Linux (bnc#713229). - novfs: last modification time not reliable (bnc#642896). - novfs: unlink directory after unmap (bnc#649625). - fs: novfs: Fix exit handlers on local_unlink (bnc#649625). - novfs: "Unable to save Login Script" appears when trying to save a user login script (bnc#638985). - fs: novfs: Limit check for datacopy between user and kernel space. - novfs: Fix checking of login id (bnc#626119). - novfs: Set the sticky bit for the novfs mountpoint (bnc#686412). - ACPICA: Fix issues/fault with automatic "serialized" method support (bnc#678097). - drm/radeon/kms: Fix I2C mask definitions (bnc#712023). - ext4: Fix max file size and logical block counting of extent format file (bnc#706374). - novfs: fix off-by-one allocation error (bnc#669378 bnc#719710). - novfs: fix some kmalloc/kfree issues (bnc#669378 bnc#719710). - novfs: fix some DirCache locking issues (bnc#669378 bnc#719710). - memsw: remove noswapaccount kernel parameter (bnc#719450). - Provide memory controller swap extension. Keep the feature disabled by default. Use swapaccount=1 kernel boot parameter for enabling it. - Config cleanups: CONFIG_OLPC should be enabled only for i386 non PAE - TTY: pty, fix pty counting (bnc#711203). - USB: OHCI: fix another regression for NVIDIA controllers (bnc#682204). - xen/blkfront: avoid NULL de-reference in CDROM ioctl handling. - x86, mtrr: lock stop machine during MTRR rendezvous sequence (bnc#672008). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch kernel-5359 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.6.37.6]: kernel-debug-2.6.37.6-0.9.1 kernel-debug-base-2.6.37.6-0.9.1 kernel-debug-devel-2.6.37.6-0.9.1 kernel-default-2.6.37.6-0.9.1 kernel-default-base-2.6.37.6-0.9.1 kernel-default-devel-2.6.37.6-0.9.1 kernel-desktop-2.6.37.6-0.9.1 kernel-desktop-base-2.6.37.6-0.9.1 kernel-desktop-devel-2.6.37.6-0.9.1 kernel-ec2-2.6.37.6-0.9.1 kernel-ec2-base-2.6.37.6-0.9.1 kernel-ec2-devel-2.6.37.6-0.9.1 kernel-ec2-extra-2.6.37.6-0.9.1 kernel-syms-2.6.37.6-0.9.1 kernel-trace-2.6.37.6-0.9.1 kernel-trace-base-2.6.37.6-0.9.1 kernel-trace-devel-2.6.37.6-0.9.1 kernel-vanilla-2.6.37.6-0.9.1 kernel-vanilla-base-2.6.37.6-0.9.1 kernel-vanilla-devel-2.6.37.6-0.9.1 kernel-xen-2.6.37.6-0.9.1 kernel-xen-base-2.6.37.6-0.9.1 kernel-xen-devel-2.6.37.6-0.9.1 preload-kmp-default-1.2_k2.6.37.6_0.9-6.7.20 preload-kmp-desktop-1.2_k2.6.37.6_0.9-6.7.20 - openSUSE 11.4 (noarch) [New Version: 2.6.37.6]: kernel-devel-2.6.37.6-0.9.1 kernel-docs-2.6.37.6-0.9.1 kernel-source-2.6.37.6-0.9.1 kernel-source-vanilla-2.6.37.6-0.9.1 - openSUSE 11.4 (i586) [New Version: 2.6.37.6]: kernel-pae-2.6.37.6-0.9.1 kernel-pae-base-2.6.37.6-0.9.1 kernel-pae-devel-2.6.37.6-0.9.1 kernel-vmi-2.6.37.6-0.9.1 kernel-vmi-base-2.6.37.6-0.9.1 kernel-vmi-devel-2.6.37.6-0.9.1 References: http://support.novell.com/security/cve/CVE-2011-1776.html http://support.novell.com/security/cve/CVE-2011-1833.html http://support.novell.com/security/cve/CVE-2011-2183.html http://support.novell.com/security/cve/CVE-2011-2695.html http://support.novell.com/security/cve/CVE-2011-2918.html http://support.novell.com/security/cve/CVE-2011-3191.html http://support.novell.com/security/cve/CVE-2011-3353.html http://support.novell.com/security/cve/CVE-2011-3363.html https://bugzilla.novell.com/626119 https://bugzilla.novell.com/638985 https://bugzilla.novell.com/642896 https://bugzilla.novell.com/649625 https://bugzilla.novell.com/669378 https://bugzilla.novell.com/672008 https://bugzilla.novell.com/678097 https://bugzilla.novell.com/682204 https://bugzilla.novell.com/686412 https://bugzilla.novell.com/692784 https://bugzilla.novell.com/697901 https://bugzilla.novell.com/706374 https://bugzilla.novell.com/711203 https://bugzilla.novell.com/711539 https://bugzilla.novell.com/712023 https://bugzilla.novell.com/712366 https://bugzilla.novell.com/713229 https://bugzilla.novell.com/714001 https://bugzilla.novell.com/716901 https://bugzilla.novell.com/718028 https://bugzilla.novell.com/719450 https://bugzilla.novell.com/719710

1 0

openSUSE-SU-2011:1221-1: moderate: kernel: security and bugfix update.
by opensuse-security＠opensuse.org 09 Nov '11

09 Nov '11

openSUSE Security Update: kernel: security and bugfix update. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1221-1 Rating: moderate References: #685276 #692784 #696107 #701355 #706374 #710352 #711203 #711539 #712023 #712366 #714001 #716901 #718028 #719117 Cross-References: CVE-2011-1776 CVE-2011-1833 CVE-2011-2918 CVE-2011-3191 CVE-2011-3353 CVE-2011-3363 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has 8 fixes is now available. It includes one version update. Description: The openSUSE 11.3 kernel was updated to fix various bugs and security issues. Following security issues have been fixed: CVE-2011-1833: Added a kernel option to ensure ecryptfs is mounting only on paths belonging to the current ui, which would have allowed local attackers to potentially gain privileges via symlink attacks. CVE-2011-3363: Always check the path in CIFS mounts to avoid interesting filesystem path interaction issues and potential crashes. CVE-2011-2918: In the perf framework software event overflows could deadlock or delete an uninitialized timer. CVE-2011-3353: In the fuse filesystem, FUSE_NOTIFY_INVAL_ENTRY did not check the length of the write so the message processing could overrun and result in a BUG_ON() in fuse_copy_fill(). This flaw could be used by local users able to mount FUSE filesystems to crash the system. CVE-2011-3191: A signedness issue in CIFS could possibly have lead to to memory corruption, if a malicious server could send crafted replies to the host. CVE-2011-1776: The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel did not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allowed physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577. Following non security bugs were fixed: - drm/radeon/kms: Fix I2C mask definitions (bnc#712023). - ext4: Fix max file size and logical block counting of extent format file (bnc#706374). - TTY: pty, fix pty counting (bnc#711203). - Update Xen patches to 2.6.34.10. - xen/blkfront: fix data size for xenbus_gather in connect(). - xen/xenbus: fix xenbus_transaction_start() hang caused by double xenbus_transaction_end(). - xen/blkback: don't fail empty barrier requests. - xen/blktap: fix locking (bnc#685276). - xen/xenbus: don't BUG() on user mode induced conditions (bnc#696107). - xen/blkfront: avoid NULL de-reference in CDROM ioctl handling (bnc#701355). - intr-remap: allow disabling source id checking (bnc#710352). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch kernel-5360 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.6.34.10]: kernel-debug-2.6.34.10-0.4.1 kernel-debug-base-2.6.34.10-0.4.1 kernel-debug-devel-2.6.34.10-0.4.1 kernel-default-2.6.34.10-0.4.1 kernel-default-base-2.6.34.10-0.4.1 kernel-default-devel-2.6.34.10-0.4.1 kernel-desktop-2.6.34.10-0.4.1 kernel-desktop-base-2.6.34.10-0.4.1 kernel-desktop-devel-2.6.34.10-0.4.1 kernel-ec2-2.6.34.10-0.4.1 kernel-ec2-base-2.6.34.10-0.4.1 kernel-ec2-devel-2.6.34.10-0.4.1 kernel-ec2-extra-2.6.34.10-0.4.1 kernel-syms-2.6.34.10-0.4.1 kernel-trace-2.6.34.10-0.4.1 kernel-trace-base-2.6.34.10-0.4.1 kernel-trace-devel-2.6.34.10-0.4.1 kernel-vanilla-2.6.34.10-0.4.1 kernel-vanilla-base-2.6.34.10-0.4.1 kernel-vanilla-devel-2.6.34.10-0.4.1 kernel-xen-2.6.34.10-0.4.1 kernel-xen-base-2.6.34.10-0.4.1 kernel-xen-devel-2.6.34.10-0.4.1 preload-kmp-default-1.1_k2.6.34.10_0.4-19.1.30 preload-kmp-desktop-1.1_k2.6.34.10_0.4-19.1.30 - openSUSE 11.3 (noarch) [New Version: 2.6.34.10]: kernel-devel-2.6.34.10-0.4.1 kernel-source-2.6.34.10-0.4.1 kernel-source-vanilla-2.6.34.10-0.4.1 - openSUSE 11.3 (i586) [New Version: 2.6.34.10]: kernel-pae-2.6.34.10-0.4.1 kernel-pae-base-2.6.34.10-0.4.1 kernel-pae-devel-2.6.34.10-0.4.1 kernel-vmi-2.6.34.10-0.4.1 kernel-vmi-base-2.6.34.10-0.4.1 kernel-vmi-devel-2.6.34.10-0.4.1 References: http://support.novell.com/security/cve/CVE-2011-1776.html http://support.novell.com/security/cve/CVE-2011-1833.html http://support.novell.com/security/cve/CVE-2011-2918.html http://support.novell.com/security/cve/CVE-2011-3191.html http://support.novell.com/security/cve/CVE-2011-3353.html http://support.novell.com/security/cve/CVE-2011-3363.html https://bugzilla.novell.com/685276 https://bugzilla.novell.com/692784 https://bugzilla.novell.com/696107 https://bugzilla.novell.com/701355 https://bugzilla.novell.com/706374 https://bugzilla.novell.com/710352 https://bugzilla.novell.com/711203 https://bugzilla.novell.com/711539 https://bugzilla.novell.com/712023 https://bugzilla.novell.com/712366 https://bugzilla.novell.com/714001 https://bugzilla.novell.com/716901 https://bugzilla.novell.com/718028 https://bugzilla.novell.com/719117

1 0

openSUSE-RU-2011:1220-1: logwatch: Fix start of service dmeventd service
by maintenance＠opensuse.org 06 Nov '11

06 Nov '11

openSUSE Recommended Update: logwatch: Fix start of service dmeventd service ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1220-1 Rating: low References: #724164 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: logwatch won't start with the service dmeventd because the crontab entry in /etc/cron.d/dmeventd is lacking the user name. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch logwatch-5290 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): logwatch-7.3.6-78.84.1 References: https://bugzilla.novell.com/724164

1 0

openSUSE-SU-2011:1217-1: important: apache2: Fixed several security issues
by opensuse-security＠opensuse.org 04 Nov '11

04 Nov '11

openSUSE Security Update: apache2: Fixed several security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1217-1 Rating: important References: #713966 #719236 #722545 Cross-References: CVE-2011-3192 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update fixes several security issues in the Apache webserver. The patch for the ByteRange remote denial of service attack (CVE-2011-3192) was refined and the configuration options used by upstream were added. Introduce new config option: Allow MaxRanges Number of ranges requested, if exceeded, the complete content is served. default: 200 0|unlimited: unlimited none: Range headers are ignored. This option is a backport from 2.2.21. Also fixed: CVE-2011-3348: Denial of service in proxy_ajp when using a undefined method. CVE-2011-3368: Exposure of internal servers via reverse proxy methods with mod_proxy enabled and incorrect Rewrite or Proxy Rules. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch apache2-5347 - openSUSE 11.3: zypper in -t patch apache2-5347 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-2.2.17-4.9.1 apache2-devel-2.2.17-4.9.1 apache2-example-certificates-2.2.17-4.9.1 apache2-example-pages-2.2.17-4.9.1 apache2-itk-2.2.17-4.9.1 apache2-prefork-2.2.17-4.9.1 apache2-utils-2.2.17-4.9.1 apache2-worker-2.2.17-4.9.1 - openSUSE 11.4 (noarch): apache2-doc-2.2.17-4.9.1 - openSUSE 11.3 (i586 x86_64): apache2-2.2.15-4.7.1 apache2-devel-2.2.15-4.7.1 apache2-example-certificates-2.2.15-4.7.1 apache2-example-pages-2.2.15-4.7.1 apache2-itk-2.2.15-4.7.1 apache2-prefork-2.2.15-4.7.1 apache2-utils-2.2.15-4.7.1 apache2-worker-2.2.15-4.7.1 - openSUSE 11.3 (noarch): apache2-doc-2.2.15-4.7.1 References: http://support.novell.com/security/cve/CVE-2011-3192.html https://bugzilla.novell.com/713966 https://bugzilla.novell.com/719236 https://bugzilla.novell.com/722545

1 0

openSUSE-SU-2011:1208-1: important: pam: fixing stack overflow (CVE-2011-3148), a local DoS (CVE-2011-3149) and CVE-2010-3316.
by opensuse-security＠opensuse.org 03 Nov '11

03 Nov '11

openSUSE Security Update: pam: fixing stack overflow (CVE-2011-3148), a local DoS (CVE-2011-3149) and CVE-2010-3316. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1208-1 Rating: important References: #631802 #724480 Cross-References: CVE-2010-3316 CVE-2011-3148 CVE-2011-3149 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The pam_env module is vulnerable to a stack overflow (CVE-2011-3148) and a DoS condition (CVE-2011-3149) when parsing users .pam_environment files. Additionally a missing return value check inside pam_xauth has been fixed (CVE-2010-3316). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch pam-5331 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): pam-1.1.1.90-2.3.1 pam-devel-1.1.1.90-2.3.1 - openSUSE 11.3 (x86_64): pam-32bit-1.1.1.90-2.3.1 pam-devel-32bit-1.1.1.90-2.3.1 - openSUSE 11.3 (noarch): pam-doc-1.1.1.90-2.3.1 References: http://support.novell.com/security/cve/CVE-2010-3316.html http://support.novell.com/security/cve/CVE-2011-3148.html http://support.novell.com/security/cve/CVE-2011-3149.html https://bugzilla.novell.com/631802 https://bugzilla.novell.com/724480

1 0

openSUSE-SU-2011:1204-1: important: pam: fixing stack overflow (CVE-2011-3148) and DoS (CVE-2011-3149)
by opensuse-security＠opensuse.org 03 Nov '11

03 Nov '11

openSUSE Security Update: pam: fixing stack overflow (CVE-2011-3148) and DoS (CVE-2011-3149) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1204-1 Rating: important References: #724480 Cross-References: CVE-2011-3148 CVE-2011-3149 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The pam_env module is vulnerable to a stack overflow (CVE-2011-3148) and a DoS condition (CVE-2011-3149) when parsing users .pam_environment files. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch pam-5330 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): pam-1.1.3-4.9.1 pam-devel-1.1.3-4.9.1 pam-doc-1.1.3-4.9.1 - openSUSE 11.4 (x86_64): pam-32bit-1.1.3-4.9.1 pam-devel-32bit-1.1.3-4.9.1 References: http://support.novell.com/security/cve/CVE-2011-3148.html http://support.novell.com/security/cve/CVE-2011-3149.html https://bugzilla.novell.com/724480

1 0

openSUSE-SU-2011:1203-1: important: rpm (CVE-2011-3378)
by opensuse-security＠opensuse.org 03 Nov '11

03 Nov '11

openSUSE Security Update: rpm (CVE-2011-3378) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1203-1 Rating: important References: #720824 Cross-References: CVE-2011-3378 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted rpm packages can cause memory corruption in rpm when verifying signatures (CVE-2011-3378). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch rpm-5255 - openSUSE 11.3: zypper in -t patch rpm-5255 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): rpm-4.8.0-28.29.1 rpm-devel-4.8.0-28.29.1 - openSUSE 11.4 (x86_64): rpm-32bit-4.8.0-28.29.1 - openSUSE 11.3 (i586 x86_64): rpm-4.8.0-5.3.1 rpm-devel-4.8.0-5.3.1 - openSUSE 11.3 (x86_64): rpm-32bit-4.8.0-5.3.1 References: http://support.novell.com/security/cve/CVE-2011-3378.html https://bugzilla.novell.com/720824

1 0

openSUSE-RU-2011:1202-1: libwebkit: Reduce initial vm allocation
by maintenance＠opensuse.org 03 Nov '11

03 Nov '11

openSUSE Recommended Update: libwebkit: Reduce initial vm allocation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:1202-1 Rating: low References: #710242 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update reduces the initial vm allocation to 32MB and increases it only when overcommit is possible (bnc#710242) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libwebkit-5341 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libwebkitgtk-1_0-0-1.3.10-6.7.1 libwebkitgtk-devel-1.3.10-6.7.1 webkit-jsc-1.3.10-6.7.1 - openSUSE 11.4 (x86_64): libwebkitgtk-1_0-0-32bit-1.3.10-6.7.1 - openSUSE 11.4 (noarch): libwebkitgtk2-lang-1.3.10-6.7.1 References: https://bugzilla.novell.com/710242

1 0