April 2011 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2011:0326-1 (moderate): rsyslog security update
by opensuse-security＠opensuse.org 12 Apr '11

12 Apr '11

openSUSE Security Update: rsyslog security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0326-1 Rating: moderate References: #676041 #679030 #681568 Cross-References: CVE-2011-1488 CVE-2011-1489 CVE-2011-1490 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes one version update. Description: rsyslog was updated to version 5.6.5 to fix a number of memory leaks that could crash the syslog daemon (CVE-2011-1488, CVE-2011-1489, CVE-2011-1490). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch rsyslog-4322 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 5.6.5]: rsyslog-5.6.5-1.3.1 rsyslog-diag-tools-5.6.5-1.3.1 rsyslog-doc-5.6.5-1.3.1 rsyslog-module-dbi-5.6.5-1.3.1 rsyslog-module-gssapi-5.6.5-1.3.1 rsyslog-module-gtls-5.6.5-1.3.1 rsyslog-module-mysql-5.6.5-1.3.1 rsyslog-module-pgsql-5.6.5-1.3.1 rsyslog-module-relp-5.6.5-1.3.1 rsyslog-module-snmp-5.6.5-1.3.1 rsyslog-module-udpspoof-5.6.5-1.3.1 References: http://support.novell.com/security/cve/CVE-2011-1488.html http://support.novell.com/security/cve/CVE-2011-1489.html http://support.novell.com/security/cve/CVE-2011-1490.html https://bugzilla.novell.com/676041 https://bugzilla.novell.com/679030 https://bugzilla.novell.com/681568

1 0

openSUSE-SU-2011:0321-1 (important): dhcp security update
by opensuse-security＠opensuse.org 08 Apr '11

08 Apr '11

openSUSE Security Update: dhcp security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0321-1 Rating: important References: #668194 #673792 #675052 #680298 Cross-References: CVE-2011-0997 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. It includes one version update. Description: A rogue dhcp server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the dhcp client needs to sanitize the host name offered by the server (CVE-2011-0997). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch dhcp-4313 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 4.2.1]: dhcp-4.2.1-0.5.1 dhcp-client-4.2.1-0.5.1 dhcp-devel-4.2.1-0.5.1 dhcp-doc-4.2.1-0.5.1 dhcp-relay-4.2.1-0.5.1 dhcp-server-4.2.1-0.5.1 References: http://support.novell.com/security/cve/CVE-2011-0997.html https://bugzilla.novell.com/668194 https://bugzilla.novell.com/673792 https://bugzilla.novell.com/675052 https://bugzilla.novell.com/680298

1 0

openSUSE-SU-2011:0320-1 (important): dhcp security update
by opensuse-security＠opensuse.org 08 Apr '11

08 Apr '11

openSUSE Security Update: dhcp security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0320-1 Rating: important References: #673792 #675052 Cross-References: CVE-2011-0997 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. It includes one version update. Description: A rogue dhcp server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the dhcp client needs to sanitize the host name offered by the server (CVE-2011-0997). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch dhcp-4314 - openSUSE 11.2: zypper in -t patch dhcp-4314 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 4.1.2.ESV.1]: dhcp-4.1.2.ESV.1-0.6.1 dhcp-client-4.1.2.ESV.1-0.6.1 dhcp-devel-4.1.2.ESV.1-0.6.1 dhcp-doc-4.1.2.ESV.1-0.6.1 dhcp-relay-4.1.2.ESV.1-0.6.1 dhcp-server-4.1.2.ESV.1-0.6.1 - openSUSE 11.2 (i586 x86_64): dhcp-3.1.2p1-4.10.1 dhcp-client-3.1.2p1-4.10.1 dhcp-devel-3.1.2p1-4.10.1 dhcp-relay-3.1.2p1-4.10.1 dhcp-server-3.1.2p1-4.10.1 References: http://support.novell.com/security/cve/CVE-2011-0997.html https://bugzilla.novell.com/673792 https://bugzilla.novell.com/675052

1 0

openSUSE-RU-2011:0319-1 (low): insserv: Fixed insserv not working for smpppd
by maintenance＠opensuse.org 08 Apr '11

08 Apr '11

openSUSE Recommended Update: insserv: Fixed insserv not working for smpppd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0319-1 Rating: low References: #682861 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: insserv was updated to be less strict on checking, to fix the bug: - #682861: insserv does not work for unclean boot scripts like smpppd Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch insserv-4270 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): insserv-1.14.0-20.24.1 References: https://bugzilla.novell.com/682861

1 0

openSUSE-RU-2011:0318-1 (low): yast2-bootloader: Fixed that GRUB does not put other openSUSE installations into the menu
by maintenance＠opensuse.org 08 Apr '11

08 Apr '11

openSUSE Recommended Update: yast2-bootloader: Fixed that GRUB does not put other openSUSE installations into the menu ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0318-1 Rating: low References: #675224 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update fixes a bug in the GRUB bootloader generation: - #675224: GRUB does not put other openSUSE installations into the menu Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch yast2-bootloader-4272 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.20.2]: yast2-bootloader-2.20.2-0.3.1 References: https://bugzilla.novell.com/675224

1 0

openSUSE-SU-2011:0317-1 (moderate): libvirt security update
by opensuse-security＠opensuse.org 08 Apr '11

08 Apr '11

openSUSE Security Update: libvirt security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0317-1 Rating: moderate References: #684877 Cross-References: CVE-2011-1486 Affected Products: openSUSE 11.4 openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libvirtd could mix errors from several threads leading to a crash (CVE-2011-1486). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libvirt-4321 - openSUSE 11.3: zypper in -t patch libvirt-4321 - openSUSE 11.2: zypper in -t patch libvirt-4321 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libvirt-0.8.8-0.8.1 libvirt-client-0.8.8-0.8.1 libvirt-devel-0.8.8-0.8.1 libvirt-doc-0.8.8-0.8.1 libvirt-python-0.8.8-0.8.1 - openSUSE 11.3 (i586 x86_64): libvirt-0.8.1-4.8.1 libvirt-client-0.8.1-4.8.1 libvirt-devel-0.8.1-4.8.1 libvirt-doc-0.8.1-4.8.1 libvirt-python-0.8.1-4.8.1 - openSUSE 11.2 (i586 x86_64): libvirt-0.7.2-1.1.7.1 libvirt-devel-0.7.2-1.1.7.1 libvirt-doc-0.7.2-1.1.7.1 libvirt-python-0.7.2-1.1.7.1 References: http://support.novell.com/security/cve/CVE-2011-1486.html https://bugzilla.novell.com/684877

1 0

openSUSE-SU-2011:0316-1 (important): libcgroup1: Fixed heap-based buffer overflow in libcgroup
by opensuse-security＠opensuse.org 08 Apr '11

08 Apr '11

openSUSE Security Update: libcgroup1: Fixed heap-based buffer overflow in libcgroup ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0316-1 Rating: important References: #675048 #675506 Cross-References: CVE-2011-1006 CVE-2011-1022 Affected Products: openSUSE 11.4 openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Two security bugfixes in libcgroup1 were done: libcgroup suffered from a heap based buffer overflow (CVE-2011-1006). The cgrulesengd daemon did not verify the origin of netlink messages, allowing local users to spoof events (CVE-2011-1022). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libcgroup-devel-4148 - openSUSE 11.3: zypper in -t patch libcgroup-devel-4087 - openSUSE 11.2: zypper in -t patch libcgroup-devel-4087 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libcgroup-devel-0.36.2-6.3.1 libcgroup1-0.36.2-6.3.1 - openSUSE 11.4 (x86_64): libcgroup1-32bit-0.36.2-6.3.1 - openSUSE 11.3 (i586 x86_64): libcgroup-devel-0.36.2-2.3.1 libcgroup1-0.36.2-2.3.1 - openSUSE 11.3 (x86_64): libcgroup1-32bit-0.36.2-2.3.1 - openSUSE 11.2 (i586 x86_64): libcgroup-devel-0.34-3.3.1 libcgroup1-0.34-3.3.1 - openSUSE 11.2 (x86_64): libcgroup1-32bit-0.34-3.3.1 References: http://support.novell.com/security/cve/CVE-2011-1006.html http://support.novell.com/security/cve/CVE-2011-1022.html https://bugzilla.novell.com/675048 https://bugzilla.novell.com/675506

1 0

openSUSE-SU-2011:0314-1 (moderate): python-feedparser security update
by opensuse-security＠opensuse.org 08 Apr '11

08 Apr '11

openSUSE Security Update: python-feedparser security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0314-1 Rating: moderate References: #680074 Cross-References: CVE-2009-5065 CVE-2011-1156 CVE-2011-1157 CVE-2011-1158 Affected Products: openSUSE 11.4 openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Various issues in python-feedparser have been fixed, including fixes for crashes due to missing input sanitizaion and a XSS vulnerability. CVE-2011-1156, CVE-2011-1157, CVE-2011-1158 and CVE-2009-5065 have been assigned to these issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch python-feedparser-4320 - openSUSE 11.3: zypper in -t patch python-feedparser-4320 - openSUSE 11.2: zypper in -t patch python-feedparser-4320 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): python-feedparser-4.1-9.10.1 - openSUSE 11.3 (noarch): python-feedparser-4.1-6.3.1 - openSUSE 11.2 (noarch): python-feedparser-4.1-2.3.1 References: http://support.novell.com/security/cve/CVE-2009-5065.html http://support.novell.com/security/cve/CVE-2011-1156.html http://support.novell.com/security/cve/CVE-2011-1157.html http://support.novell.com/security/cve/CVE-2011-1158.html https://bugzilla.novell.com/680074

1 0

openSUSE-SU-2011:0300-2 (moderate): NetworkManager security update (CVE-2010-1172).
by opensuse-security＠opensuse.org 08 Apr '11

08 Apr '11

openSUSE Security Update: NetworkManager security update (CVE-2010-1172). ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0300-2 Rating: moderate References: #628607 Cross-References: CVE-2010-1172 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: dbus-glib allowed local users to write properties that were exported read-only via dbus (CVE-2010-1172). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch NetworkManager-4312 - openSUSE 11.2: zypper in -t patch NetworkManager-4312 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): NetworkManager-0.8-8.2.3 NetworkManager-devel-0.8-8.2.3 NetworkManager-doc-0.8-8.2.3 NetworkManager-glib-0.8-8.2.3 - openSUSE 11.2 (i586 x86_64): NetworkManager-0.7.1_git20090811-4.3.3 NetworkManager-devel-0.7.1_git20090811-4.3.3 NetworkManager-doc-0.7.1_git20090811-4.3.3 NetworkManager-glib-0.7.1_git20090811-4.3.3 References: http://support.novell.com/security/cve/CVE-2010-1172.html https://bugzilla.novell.com/628607

1 0

openSUSE-SU-2011:0313-1 (critical): moonlight security update
by opensuse-security＠opensuse.org 08 Apr '11

08 Apr '11

openSUSE Security Update: moonlight security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0313-1 Rating: critical References: #667077 Cross-References: CVE-2011-0989 CVE-2011-0990 CVE-2011-0991 CVE-2011-0992 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: Moonlight was prone to several security problems: CVE-2011-0989: modification of read-only values via RuntimeHelpers.InitializeArray CVE-2011-0990: buffer overflow due to race condition in in Array.FastCopy CVE-2011-0991: use-after-free due to DynamicMethod resurrection CVE-2011-0992: information leak due to improper thread finalization Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libmoon-devel-4318 - openSUSE 11.3: zypper in -t patch libmoon-devel-4318 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.4.1]: libmoon-devel-2.4.1-0.3.1 libmoon0-2.4.1-0.3.1 moonlight-desktop-2.4.1-0.3.1 moonlight-desktop-devel-2.4.1-0.3.1 moonlight-plugin-2.4.1-0.3.1 moonlight-tools-2.4.1-0.3.1 moonlight-web-devel-2.4.1-0.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.4.1]: libmoon-devel-2.4.1-0.2.1 libmoon0-2.4.1-0.2.1 moonlight-desktop-2.4.1-0.2.1 moonlight-desktop-devel-2.4.1-0.2.1 moonlight-plugin-2.4.1-0.2.1 moonlight-tools-2.4.1-0.2.1 moonlight-web-devel-2.4.1-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-0989.html http://support.novell.com/security/cve/CVE-2011-0990.html http://support.novell.com/security/cve/CVE-2011-0991.html http://support.novell.com/security/cve/CVE-2011-0992.html https://bugzilla.novell.com/667077

1 0