February 2011 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2011:0140-1 (moderate): Fixing AFM font parser vulnerability in t1lib (CVE-2010-2642).
by opensuse-security＠opensuse.org 25 Feb '11

25 Feb '11

openSUSE Security Update: Fixing AFM font parser vulnerability in t1lib (CVE-2010-2642). ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0140-1 Rating: moderate References: #662411 Cross-References: CVE-2010-2642 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A heap overflow in the AFM font parser of DVI files has been fixed in t1lib. CVE-2010-2642 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch t1lib-3788 - openSUSE 11.2: zypper in -t patch t1lib-3788 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): t1lib-5.1.2-6.3.1 t1lib-devel-5.1.2-6.3.1 - openSUSE 11.2 (i586 x86_64): t1lib-5.1.2-2.4.1 t1lib-devel-5.1.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2010-2642.html https://bugzilla.novell.com/662411

1 0

openSUSE-SU-2011:0136-1 (moderate): subversion: Fixing servercrash in SVNParentPath (CVE-2010-4539) and OOM bug (CVE-2010-4644)
by opensuse-security＠opensuse.org 25 Feb '11

25 Feb '11

openSUSE Security Update: subversion: Fixing servercrash in SVNParentPath (CVE-2010-4539) and OOM bug (CVE-2010-4644) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0136-1 Rating: moderate References: #662030 Cross-References: CVE-2010-4539 CVE-2010-4644 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The subversion server could be crashed by clients inside SVNParentPath(). Additionally an Out Of Memory condition via 'blame -g' has been fixed. CVE-2010-4539 and CVE-2010-4644 have been assigned to these issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libsvn_auth_gnome_keyring-1-0-3835 - openSUSE 11.2: zypper in -t patch libsvn_auth_gnome_keyring-1-0-3835 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.6.9-4.5.1 libsvn_auth_kwallet-1-0-1.6.9-4.5.1 subversion-1.6.9-4.5.1 subversion-devel-1.6.9-4.5.1 subversion-perl-1.6.9-4.5.1 subversion-python-1.6.9-4.5.1 subversion-ruby-1.6.9-4.5.1 subversion-server-1.6.9-4.5.1 subversion-tools-1.6.9-4.5.1 - openSUSE 11.2 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.6.6-1.5.1 libsvn_auth_kwallet-1-0-1.6.6-1.5.1 subversion-1.6.6-1.5.1 subversion-devel-1.6.6-1.5.1 subversion-perl-1.6.6-1.5.1 subversion-python-1.6.6-1.5.1 subversion-ruby-1.6.6-1.5.1 subversion-server-1.6.6-1.5.1 subversion-tools-1.6.6-1.5.1 References: http://support.novell.com/security/cve/CVE-2010-4539.html http://support.novell.com/security/cve/CVE-2010-4644.html https://bugzilla.novell.com/662030

1 0

openSUSE-SU-2011:0135-1 (critical): bind: security update
by opensuse-security＠opensuse.org 25 Feb '11

25 Feb '11

openSUSE Security Update: bind: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0135-1 Rating: critical References: #674431 Cross-References: CVE-2011-0414 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This bind update fixes a remote denial of service vulnerability that can be triggered using an IXFR or DDNS update. (CVE-2011-0414: CVSS v2 Base Score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch bind-4020 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 9.7.3]: bind-9.7.3-1.4.1 bind-chrootenv-9.7.3-1.4.1 bind-devel-9.7.3-1.4.1 bind-libs-9.7.3-1.4.1 bind-utils-9.7.3-1.4.1 - openSUSE 11.3 (x86_64) [New Version: 9.7.3]: bind-libs-32bit-9.7.3-1.4.1 - openSUSE 11.3 (noarch) [New Version: 9.7.3]: bind-doc-9.7.3-1.4.1 References: http://support.novell.com/security/cve/CVE-2011-0414.html https://bugzilla.novell.com/674431

1 0

openSUSE-RU-2011:0129-1 (important): libunique-1_0-0: This update fixes a bug, causing multiple instances of application-browser and nautilus
by maintenance＠opensuse.org 23 Feb '11

23 Feb '11

openSUSE Recommended Update: libunique-1_0-0: This update fixes a bug, causing multiple instances of application-browser and nautilus ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0129-1 Rating: important References: #640615 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: libunique is not working right; multiple application-browser and nautilus instances are created. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libunique-1_0-0-3982 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libunique-1_0-0-1.1.6-5.3.1 References: https://bugzilla.novell.com/640615

1 0

openSUSE-SU-2011:0126-1 (important): java-1_6_0-sun: Sun Java 1.6 updated to update 24
by opensuse-security＠opensuse.org 22 Feb '11

22 Feb '11

openSUSE Security Update: java-1_6_0-sun: Sun Java 1.6 updated to update 24 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0126-1 Rating: important References: #672449 Cross-References: CVE-2010-4422 CVE-2010-4447 CVE-2010-4448 CVE-2010-4450 CVE-2010-4451 CVE-2010-4452 CVE-2010-4454 CVE-2010-4462 CVE-2010-4463 CVE-2010-4465 CVE-2010-4466 CVE-2010-4467 CVE-2010-4468 CVE-2010-4469 CVE-2010-4470 CVE-2010-4471 CVE-2010-4472 CVE-2010-4473 CVE-2010-4474 CVE-2010-4475 CVE-2010-4476 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. It includes one version update. Description: Sun Java 1.6 was updated to Update 24 fixing various bugs and security issues. The update is rated critical by Sun. Following CVEs were addressed: CVE-2010-4452 CVE-2010-4454 CVE-2010-4462 CVE-2010-4463 CVE-2010-4465 CVE-2010-4467 CVE-2010-4469 CVE-2010-4473 CVE-2010-4422 CVE-2010-4451 CVE-2010-4466 CVE-2010-4470 CVE-2010-4471 CVE-2010-4476 CVE-2010-4447 CVE-2010-4475 CVE-2010-4468 CVE-2010-4450 CVE-2010-4448 CVE-2010-4472 CVE-2010-4474 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch java-1_6_0-sun-3969 - openSUSE 11.2: zypper in -t patch java-1_6_0-sun-3969 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 1.6.0.u24]: java-1_6_0-sun-1.6.0.u24-0.2.1 java-1_6_0-sun-alsa-1.6.0.u24-0.2.1 java-1_6_0-sun-devel-1.6.0.u24-0.2.1 java-1_6_0-sun-jdbc-1.6.0.u24-0.2.1 java-1_6_0-sun-plugin-1.6.0.u24-0.2.1 java-1_6_0-sun-src-1.6.0.u24-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.6.0.u24]: java-1_6_0-sun-1.6.0.u24-0.2.1 java-1_6_0-sun-alsa-1.6.0.u24-0.2.1 java-1_6_0-sun-demo-1.6.0.u24-0.2.1 java-1_6_0-sun-devel-1.6.0.u24-0.2.1 java-1_6_0-sun-jdbc-1.6.0.u24-0.2.1 java-1_6_0-sun-plugin-1.6.0.u24-0.2.1 java-1_6_0-sun-src-1.6.0.u24-0.2.1 References: http://support.novell.com/security/cve/CVE-2010-4422.html http://support.novell.com/security/cve/CVE-2010-4447.html http://support.novell.com/security/cve/CVE-2010-4448.html http://support.novell.com/security/cve/CVE-2010-4450.html http://support.novell.com/security/cve/CVE-2010-4451.html http://support.novell.com/security/cve/CVE-2010-4452.html http://support.novell.com/security/cve/CVE-2010-4454.html http://support.novell.com/security/cve/CVE-2010-4462.html http://support.novell.com/security/cve/CVE-2010-4463.html http://support.novell.com/security/cve/CVE-2010-4465.html http://support.novell.com/security/cve/CVE-2010-4466.html http://support.novell.com/security/cve/CVE-2010-4467.html http://support.novell.com/security/cve/CVE-2010-4468.html http://support.novell.com/security/cve/CVE-2010-4469.html http://support.novell.com/security/cve/CVE-2010-4470.html http://support.novell.com/security/cve/CVE-2010-4471.html http://support.novell.com/security/cve/CVE-2010-4472.html http://support.novell.com/security/cve/CVE-2010-4473.html http://support.novell.com/security/cve/CVE-2010-4474.html http://support.novell.com/security/cve/CVE-2010-4475.html http://support.novell.com/security/cve/CVE-2010-4476.html https://bugzilla.novell.com/672449

1 0

openSUSE-RU-2011:0124-1 (low): gcc45: Update to fix compilation issues of Mozilla Firefox 4.0
by maintenance＠opensuse.org 21 Feb '11

21 Feb '11

openSUSE Recommended Update: gcc45: Update to fix compilation issues of Mozilla Firefox 4.0 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0124-1 Rating: low References: #636118 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This patch fixes a bug in gcc45 that leads to a miscompilation of some Mozilla Firefox components, in particular Sync. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch cpp45-3959 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): cpp45-4.5.0_20100604-2.3.1 gcc45-4.5.0_20100604-2.3.1 gcc45-ada-4.5.0_20100604-2.3.1 gcc45-c++-4.5.0_20100604-2.3.1 gcc45-fortran-4.5.0_20100604-2.3.1 gcc45-locale-4.5.0_20100604-2.3.1 gcc45-obj-c++-4.5.0_20100604-2.3.1 gcc45-objc-4.5.0_20100604-2.3.1 libada45-4.5.0_20100604-2.3.1 libgcc45-4.5.0_20100604-2.3.1 libgfortran45-4.5.0_20100604-2.3.1 libgomp45-4.5.0_20100604-2.3.1 libobjc45-4.5.0_20100604-2.3.1 libstdc++45-4.5.0_20100604-2.3.1 libstdc++45-devel-4.5.0_20100604-2.3.1 - openSUSE 11.3 (x86_64): gcc45-32bit-4.5.0_20100604-2.3.1 gcc45-ada-32bit-4.5.0_20100604-2.3.1 gcc45-fortran-32bit-4.5.0_20100604-2.3.1 gcc45-objc-32bit-4.5.0_20100604-2.3.1 libada45-32bit-4.5.0_20100604-2.3.1 libgcc45-32bit-4.5.0_20100604-2.3.1 libgfortran45-32bit-4.5.0_20100604-2.3.1 libgomp45-32bit-4.5.0_20100604-2.3.1 libobjc45-32bit-4.5.0_20100604-2.3.1 libstdc++45-32bit-4.5.0_20100604-2.3.1 libstdc++45-devel-32bit-4.5.0_20100604-2.3.1 - openSUSE 11.3 (noarch): gcc45-info-4.5.0_20100604-2.3.1 libstdc++45-doc-4.5.0_20100604-2.3.1 References: https://bugzilla.novell.com/636118

1 0

openSUSE-RU-2011:0122-1 (critical): update-alternatives: This update fixes a database corruption that can occur after an openjdk update
by maintenance＠opensuse.org 21 Feb '11

21 Feb '11

openSUSE Recommended Update: update-alternatives: This update fixes a database corruption that can occur after an openjdk update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0122-1 Rating: critical References: #669716 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: openjdk update breaks Sun java alternative under some circumstances. This ends in unusable java (both Sun and openjdk). This update fixes the broken /var/lib/rpm/alternatives/java and prevent from those failures in the future. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch update-alternatives-3983 - openSUSE 11.2: zypper in -t patch update-alternatives-3983 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch): update-alternatives-1.14.19-27.3.1 - openSUSE 11.2 (noarch): update-alternatives-1.14.19-23.4.1 References: https://bugzilla.novell.com/669716

1 0

openSUSE-RU-2011:0119-1 (low): opensuse-manuals_en: Online update for the openSUSE Start-Up and Reference Guide
by maintenance＠opensuse.org 17 Feb '11

17 Feb '11

openSUSE Recommended Update: opensuse-manuals_en: Online update for the openSUSE Start-Up and Reference Guide ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0119-1 Rating: low References: #661476 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Collective update for the openSUSE manuals. It also adds some new translations. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch opensuse-apparmor-quick_en-pdf-3940 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch): opensuse-apparmor-quick_en-pdf-11.3-6.3.1 opensuse-apps_en-pdf-11.3-6.3.1 opensuse-gnomequick_en-pdf-11.3-6.3.1 opensuse-gnomeuser_en-pdf-11.3-6.3.1 opensuse-installquick_en-pdf-11.3-6.3.1 opensuse-kdequick_en-pdf-11.3-6.3.1 opensuse-kdeuser_en-pdf-11.3-6.3.1 opensuse-manuals_en-11.3-6.3.1 opensuse-manuals_hu-11.3-1.2.1 opensuse-manuals_ja-11.3-0.2.1 opensuse-manuals_pt_BR-11.3-0.2.1 opensuse-reference_en-pdf-11.3-6.3.1 opensuse-reference_hu-pdf-11.3-1.2.1 opensuse-security_en-pdf-11.3-6.3.1 opensuse-startup_en-pdf-11.3-6.3.1 References: https://bugzilla.novell.com/661476

1 0

openSUSE-SU-2011:0115-1 (moderate): Fixing two git vulnerabilities (CVE-2010-3906, CVE-2010-2542).
by opensuse-security＠opensuse.org 16 Feb '11

16 Feb '11

openSUSE Security Update: Fixing two git vulnerabilities (CVE-2010-3906, CVE-2010-2542). ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0115-1 Rating: moderate References: #624586 #659281 Cross-References: CVE-2010-2542 CVE-2010-3906 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes two vulnerabilities: XSS vulnerability in gitweb; a remote attacker could craft an URL such that arbitrary content would be inserted to the generated web page. Stack overflow vulnerability that can lead to arbitrary code execution if user runs any git command on a specially crafted git working copy. Security Issue references: - [CVE-2010-3906](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-3906) - [CVE-2010-2542](http://cve.mitre.org/cgi-bin/cvename.cgi?nam e=CVE-2010-2542) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch git-3832 - openSUSE 11.2: zypper in -t patch git-3831 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): git-1.7.1-2.3.1 git-arch-1.7.1-2.3.1 git-core-1.7.1-2.3.1 git-cvs-1.7.1-2.3.1 git-daemon-1.7.1-2.3.1 git-email-1.7.1-2.3.1 git-gui-1.7.1-2.3.1 git-remote-helpers-1.7.1-2.3.1 git-svn-1.7.1-2.3.1 git-web-1.7.1-2.3.1 gitk-1.7.1-2.3.1 - openSUSE 11.2 (i586 x86_64): git-1.6.4.2-3.5.1 git-arch-1.6.4.2-3.5.1 git-core-1.6.4.2-3.5.1 git-cvs-1.6.4.2-3.5.1 git-daemon-1.6.4.2-3.5.1 git-email-1.6.4.2-3.5.1 git-gui-1.6.4.2-3.5.1 git-svn-1.6.4.2-3.5.1 git-web-1.6.4.2-3.5.1 gitk-1.6.4.2-3.5.1 References: http://support.novell.com/security/cve/CVE-2010-2542.html http://support.novell.com/security/cve/CVE-2010-3906.html https://bugzilla.novell.com/624586 https://bugzilla.novell.com/659281

1 0

openSUSE-SU-2011:0111-1 (moderate): krb5: security update
by opensuse-security＠opensuse.org 14 Feb '11

14 Feb '11

openSUSE Security Update: krb5: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0111-1 Rating: moderate References: #612890 #663619 Cross-References: CVE-2010-4022 CVE-2011-0281 CVE-2011-0282 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Multiple KDC DoS vulnerabilities if used with LDAP backends have been fixed in krb5. CVE-2011-0281 and CVE-2011-0282 have been assigned. Additionally a DoS vulnerability in kpropd has been fixed. CVE-2010-4022 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch krb5-3942 - openSUSE 11.2: zypper in -t patch krb5-3942 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): krb5-1.8.1-5.5.1 krb5-client-1.8.1-5.5.1 krb5-devel-1.8.1-5.5.1 krb5-plugin-kdb-ldap-1.8.1-5.5.1 krb5-plugin-preauth-pkinit-1.8.1-5.5.1 krb5-server-1.8.1-5.5.1 - openSUSE 11.3 (x86_64): krb5-32bit-1.8.1-5.5.1 krb5-devel-32bit-1.8.1-5.5.1 - openSUSE 11.2 (i586 x86_64): krb5-1.7-6.10.1 krb5-apps-clients-1.7-6.10.1 krb5-apps-servers-1.7-6.10.1 krb5-client-1.7-6.10.1 krb5-devel-1.7-6.10.1 krb5-plugin-kdb-ldap-1.7-6.10.1 krb5-plugin-preauth-pkinit-1.7-6.10.1 krb5-server-1.7-6.10.1 - openSUSE 11.2 (x86_64): krb5-32bit-1.7-6.10.1 krb5-devel-32bit-1.7-6.10.1 References: http://support.novell.com/security/cve/CVE-2010-4022.html http://support.novell.com/security/cve/CVE-2011-0281.html http://support.novell.com/security/cve/CVE-2011-0282.html https://bugzilla.novell.com/612890 https://bugzilla.novell.com/663619

1 0