May 2011 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2011:0540-1: dovecot security update
by opensuse-security＠opensuse.org 25 May '11

25 May '11

openSUSE Security Update: dovecot security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0540-1 Rating: low References: #694778 Cross-References: CVE-2011-1929 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: dovecot crash when parsing mail headers that contain NUL characters (CVE-2011-1929) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch dovecot12-4609 dovecot20-4610 - openSUSE 11.3: zypper in -t patch dovecot12-4609 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.2.17]: dovecot12-1.2.17-2.3.1 dovecot12-backend-mysql-1.2.17-2.3.1 dovecot12-backend-pgsql-1.2.17-2.3.1 dovecot12-backend-sqlite-1.2.17-2.3.1 dovecot12-devel-1.2.17-2.3.1 dovecot12-fts-lucene-1.2.17-2.3.1 dovecot12-fts-solr-1.2.17-2.3.1 dovecot20-2.0.13-0.3.1 dovecot20-backend-mysql-2.0.13-0.3.1 dovecot20-backend-pgsql-2.0.13-0.3.1 dovecot20-backend-sqlite-2.0.13-0.3.1 dovecot20-devel-2.0.13-0.3.1 dovecot20-fts-solr-2.0.13-0.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.2.17]: dovecot12-1.2.17-2.2.1 dovecot12-backend-mysql-1.2.17-2.2.1 dovecot12-backend-pgsql-1.2.17-2.2.1 dovecot12-backend-sqlite-1.2.17-2.2.1 dovecot12-devel-1.2.17-2.2.1 dovecot12-fts-lucene-1.2.17-2.2.1 dovecot12-fts-solr-1.2.17-2.2.1 References: http://support.novell.com/security/cve/CVE-2011-1929.html https://bugzilla.novell.com/694778

1 0

openSUSE-SU-2011:0536-1: moderate: logrotate: Multiple security fixes
by opensuse-security＠opensuse.org 25 May '11

25 May '11

openSUSE Security Update: logrotate: Multiple security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0536-1 Rating: moderate References: #677336 #679661 #679662 Cross-References: CVE-2011-1098 CVE-2011-1154 CVE-2011-1155 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for logrotate provides the following fixes: * The shred_file function in logrotate might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1154) (bnc#679661) * Race condition in the createOutputFile function in logrotate allows local users to read log data by opening a file before the intended permissions are in place (CVE-2011-1098) (bnc#677336) * The writeState function in logrotate might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name (CVE-2011-1155) (bnc#679662) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch logrotate-4580 - openSUSE 11.3: zypper in -t patch logrotate-4580 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): logrotate-3.7.9-6.7.1 - openSUSE 11.3 (i586 x86_64): logrotate-3.7.8-7.3.1 References: http://support.novell.com/security/cve/CVE-2011-1098.html http://support.novell.com/security/cve/CVE-2011-1154.html http://support.novell.com/security/cve/CVE-2011-1155.html https://bugzilla.novell.com/677336 https://bugzilla.novell.com/679661 https://bugzilla.novell.com/679662

1 0

openSUSE-SU-2011:0535-1: important: exim: Fixed a remote security issues
by opensuse-security＠opensuse.org 25 May '11

25 May '11

openSUSE Security Update: exim: Fixed a remote security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0535-1 Rating: important References: #694798 #695144 Cross-References: CVE-2011-1407 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update fixes a security issues: - exim remote code exection (CVE-2011-1407) also some safety improvements regarding STARTTLS. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch exim-4604 - openSUSE 11.3: zypper in -t patch exim-4604 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): exim-4.74-6.9.1 eximon-4.74-6.9.1 eximstats-html-4.74-6.9.1 - openSUSE 11.3 (i586 x86_64): exim-4.71-4.9.1 eximon-4.71-4.9.1 eximstats-html-4.71-4.9.1 References: http://support.novell.com/security/cve/CVE-2011-1407.html https://bugzilla.novell.com/694798 https://bugzilla.novell.com/695144

1 0

openSUSE-SU-2011:0530-1: moderate: rdesktop security update
by opensuse-security＠opensuse.org 24 May '11

24 May '11

openSUSE Security Update: rdesktop security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0530-1 Rating: moderate References: #689029 Cross-References: CVE-2011-1595 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A malicious server could access any file on clients connecting to it if the client shared some ressource (CVE-2011-1595). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch rdesktop-4544 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): rdesktop-1.6.0-43.2.1 References: http://support.novell.com/security/cve/CVE-2011-1595.html https://bugzilla.novell.com/689029

1 0

openSUSE-SU-2011:0529-1: viewvc security update
by opensuse-security＠opensuse.org 24 May '11

24 May '11

openSUSE Security Update: viewvc security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0529-1 Rating: low References: #694785 Cross-References: CVE-2009-5024 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: cvsdb.py in viewvc did not honor an admin defined row limit which could cause high load on the database server. viewvc was updated to version 1.1.11 which fixes the issue (CVE-2009-5024). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch viewvc-4599 - openSUSE 11.3: zypper in -t patch viewvc-4599 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): viewvc-1.1.11-1.3.1 - openSUSE 11.3 (noarch) [New Version: 1.1.11]: viewvc-1.1.11-1.3.1 References: http://support.novell.com/security/cve/CVE-2009-5024.html https://bugzilla.novell.com/694785

1 0

openSUSE-SU-2011:0528-1: moderate: rdesktop security update
by opensuse-security＠opensuse.org 24 May '11

24 May '11

openSUSE Security Update: rdesktop security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0528-1 Rating: moderate References: #578859 #689029 Cross-References: CVE-2011-1595 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: A malicious server could access any file on clients connecting to it if the client shared some ressource (CVE-2011-1595). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch rdesktop-4545 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): rdesktop-1.6.0-46.47.1 References: http://support.novell.com/security/cve/CVE-2011-1595.html https://bugzilla.novell.com/578859 https://bugzilla.novell.com/689029

1 0

openSUSE-RU-2011:0527-1: bpython: This update adds a missing rpm requirement
by maintenance＠opensuse.org 23 May '11

23 May '11

openSUSE Recommended Update: bpython: This update adds a missing rpm requirement ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0527-1 Rating: low References: #693545 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: bpython needs python-curses but did not require it. So a freshly installed bpython would fail to run. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch bpython-4568 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): bpython-0.9.7.1-4.5.1 References: https://bugzilla.novell.com/693545

1 0

openSUSE-RU-2011:0526-1: cronie: This update fixes a broken output from cron to syslog
by maintenance＠opensuse.org 23 May '11

23 May '11

openSUSE Recommended Update: cronie: This update fixes a broken output from cron to syslog ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0526-1 Rating: low References: #692871 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: The following bug is fixed by this update: - #692871: Cron doesn't write job output to syslog correctly Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch cron-4562 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.4.7]: cron-4.2-9.21.1 cronie-1.4.7-9.21.1 cronie-anacron-1.4.7-9.21.1 References: https://bugzilla.novell.com/692871

1 0

openSUSE-RU-2011:0525-1: rrdtool: This update fixes problem with the Tcl bindings.
by maintenance＠opensuse.org 23 May '11

23 May '11

openSUSE Recommended Update: rrdtool: This update fixes problem with the Tcl bindings. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0525-1 Rating: low References: #693085 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The following bug is fixed by this update: - #693085: rrdtool's Tcl binding rejects the Tcl version it was compiled against Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch lua-rrdtool-4564 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): lua-rrdtool-1.4.5-4.5.1 python-rrdtool-1.4.5-4.5.1 rrdtool-1.4.5-4.5.1 rrdtool-devel-1.4.5-4.5.1 References: https://bugzilla.novell.com/693085

1 0

openSUSE-SU-2011:0518-1: moderate: thunar security update
by opensuse-security＠opensuse.org 20 May '11

20 May '11

openSUSE Security Update: thunar security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0518-1 Rating: moderate References: #687874 Cross-References: CVE-2011-1588 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Due to a format string error thunar could crash when copy&pasting a file name with format characters (CVE-2011-1588). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libthunarx-2-0-4590 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libthunarx-2-0-1.3.0-1.4.1 thunar-1.3.0-1.4.1 thunar-devel-1.3.0-1.4.1 - openSUSE 11.4 (noarch): thunar-devel-doc-1.3.0-1.4.1 thunar-doc-1.3.0-1.4.1 thunar-lang-1.3.0-1.4.1 References: http://support.novell.com/security/cve/CVE-2011-1588.html https://bugzilla.novell.com/687874

1 0