June 2011 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2011:0724-1: important: MozillaThunderbird: Update to Thunderbird 3.1.11
by opensuse-security＠opensuse.org 30 Jun '11

30 Jun '11

openSUSE Security Update: MozillaThunderbird: Update to Thunderbird 3.1.11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0724-1 Rating: important References: #701296 Cross-References: CVE-2011-0083 CVE-2011-0085 CVE-2011-2362 CVE-2011-2363 CVE-2011-2364 CVE-2011-2365 CVE-2011-2371 CVE-2011-2373 CVE-2011-2374 CVE-2011-2376 CVE-2011-2377 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. It includes 5 new package versions. Description: Mozilla Thunderbird was updated to the 3.1.11 release. It has new features, fixes lots of bugs, and also fixes the following security issues: * MFSA 2011-19/CVE-2011-2374 CVE-2011-2376 CVE-2011-2364 CVE-2011-2365 Miscellaneous memory safety hazards * MFSA 2011-20/CVE-2011-2373 (bmo#617247) Use-after-free vulnerability when viewing XUL document with script disabled * MFSA 2011-21/CVE-2011-2377 (bmo#638018, bmo#639303) Memory corruption due to multipart/x-mixed-replace images * MFSA 2011-22/CVE-2011-2371 (bmo#664009) Integer overflow and arbitrary code execution in Array.reduceRight() * MFSA 2011-23/CVE-2011-0083 CVE-2011-0085 CVE-2011-2363 Multiple dangling pointer vulnerabilities * MFSA 2011-24/CVE-2011-2362 (bmo#616264) Cookie isolation error Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch MozillaThunderbird-4800 firefox50-upgrade-4806 mozilla-js192-4771 - openSUSE 11.3: zypper in -t patch MozillaFirefox-4761 MozillaThunderbird-4800 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.9.2.18,3.1.11 and 5.0]: MozillaFirefox-5.0-0.2.1 MozillaFirefox-branding-openSUSE-5.0-2.3.1 MozillaFirefox-buildsymbols-5.0-0.2.1 MozillaFirefox-devel-5.0-0.2.1 MozillaFirefox-translations-common-5.0-0.2.1 MozillaFirefox-translations-other-5.0-0.2.1 MozillaThunderbird-3.1.11-0.7.1 MozillaThunderbird-buildsymbols-3.1.11-0.7.1 MozillaThunderbird-devel-3.1.11-0.7.1 MozillaThunderbird-translations-common-3.1.11-0.7.1 MozillaThunderbird-translations-other-3.1.11-0.7.1 enigmail-1.1.2-9.7.1 mozilla-js192-1.9.2.18-1.2.1 mozilla-xulrunner192-1.9.2.18-1.2.1 mozilla-xulrunner192-buildsymbols-1.9.2.18-1.2.1 mozilla-xulrunner192-devel-1.9.2.18-1.2.1 mozilla-xulrunner192-gnome-1.9.2.18-1.2.1 mozilla-xulrunner192-translations-common-1.9.2.18-1.2.1 mozilla-xulrunner192-translations-other-1.9.2.18-1.2.1 - openSUSE 11.4 (x86_64) [New Version: 1.9.2.18]: mozilla-js192-32bit-1.9.2.18-1.2.1 mozilla-xulrunner192-32bit-1.9.2.18-1.2.1 mozilla-xulrunner192-gnome-32bit-1.9.2.18-1.2.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.18-1.2.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.18-1.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.1.2,1.9.2.18,3.1.11 and 3.6.18]: MozillaFirefox-3.6.18-0.2.1 MozillaFirefox-branding-upstream-3.6.18-0.2.1 MozillaFirefox-translations-common-3.6.18-0.2.1 MozillaFirefox-translations-other-3.6.18-0.2.1 MozillaThunderbird-3.1.11-0.11.1 MozillaThunderbird-devel-3.1.11-0.11.1 MozillaThunderbird-translations-common-3.1.11-0.11.1 MozillaThunderbird-translations-other-3.1.11-0.11.1 enigmail-1.1.2-9.11.1 mozilla-js192-1.9.2.18-1.2.1 mozilla-xulrunner192-1.9.2.18-1.2.1 mozilla-xulrunner192-buildsymbols-1.9.2.18-1.2.1 mozilla-xulrunner192-devel-1.9.2.18-1.2.1 mozilla-xulrunner192-gnome-1.9.2.18-1.2.1 mozilla-xulrunner192-translations-common-1.9.2.18-1.2.1 mozilla-xulrunner192-translations-other-1.9.2.18-1.2.1 - openSUSE 11.3 (x86_64) [New Version: 1.9.2.18]: mozilla-js192-32bit-1.9.2.18-1.2.1 mozilla-xulrunner192-32bit-1.9.2.18-1.2.1 mozilla-xulrunner192-gnome-32bit-1.9.2.18-1.2.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.18-1.2.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.18-1.2.1 References: http://support.novell.com/security/cve/CVE-2011-0083.html http://support.novell.com/security/cve/CVE-2011-0085.html http://support.novell.com/security/cve/CVE-2011-2362.html http://support.novell.com/security/cve/CVE-2011-2363.html http://support.novell.com/security/cve/CVE-2011-2364.html http://support.novell.com/security/cve/CVE-2011-2365.html http://support.novell.com/security/cve/CVE-2011-2371.html http://support.novell.com/security/cve/CVE-2011-2373.html http://support.novell.com/security/cve/CVE-2011-2374.html http://support.novell.com/security/cve/CVE-2011-2376.html http://support.novell.com/security/cve/CVE-2011-2377.html https://bugzilla.novell.com/701296

1 0

openSUSE-RU-2011:0723-1: libopenraw: Nautilus crashes if folder contains Olympus raw (.orf) files
by maintenance＠opensuse.org 30 Jun '11

30 Jun '11

openSUSE Recommended Update: libopenraw: Nautilus crashes if folder contains Olympus raw (.orf) files ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0723-1 Rating: low References: #561232 #699678 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: The following bugs are fixed by this update: - bnc#561232: Fix nautilus crash when browsing the folder contains Olympus raw (.orf) files - bnc#699678: Load and decompress Olympus raw files to generate thumbnails Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch gdk-pixbuf-loader-libopenraw-4724 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gdk-pixbuf-loader-libopenraw-0.0.8-11.12.1 libopenraw-devel-0.0.8-11.12.1 libopenraw1-0.0.8-11.12.1 - openSUSE 11.4 (x86_64): gdk-pixbuf-loader-libopenraw-32bit-0.0.8-11.12.1 libopenraw1-32bit-0.0.8-11.12.1 References: https://bugzilla.novell.com/561232 https://bugzilla.novell.com/699678

1 0

openSUSE-RU-2011:0722-1: yast2-network: linux-atm-lib doesn't exist anymore
by maintenance＠opensuse.org 30 Jun '11

30 Jun '11

openSUSE Recommended Update: yast2-network: linux-atm-lib doesn't exist anymore ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0722-1 Rating: low References: #655571 #668586 #675844 #694283 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. It includes one version update. Description: The DSL module wrongly required linux-atm-lib after the package had been renamed to libatm1.rpm (bnc#668586). WebYaST: also update /etc/hosts, for hostname -f (bnc#694283#c8). AutoYaST: networking/start_immediately was ignored (bnc#655571, bnc#675844). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch yast2-network-4773 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.20.12]: yast2-network-2.20.12-0.3.1 yast2-network-devel-doc-2.20.12-0.3.1 References: https://bugzilla.novell.com/655571 https://bugzilla.novell.com/668586 https://bugzilla.novell.com/675844 https://bugzilla.novell.com/694283

1 0

openSUSE-RU-2011:0721-1: moderate: xfig: Fails to load second eps file
by maintenance＠opensuse.org 30 Jun '11

30 Jun '11

openSUSE Recommended Update: xfig: Fails to load second eps file ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0721-1 Rating: moderate References: #696368 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: xfig fails to load the second eps file. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch xfig-4727 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): xfig-3.2.5b-14.15.1 References: https://bugzilla.novell.com/696368

1 0

openSUSE-RU-2011:0720-1: nut-classic: This update fixes a UPS control problem during hibernation
by maintenance＠opensuse.org 30 Jun '11

30 Jun '11

openSUSE Recommended Update: nut-classic: This update fixes a UPS control problem during hibernation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0720-1 Rating: low References: #660236 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The following bug is fixed by this update: Command order in /usr/lib/pm-utils/sleep.d/99nut is wrong, which may let system off when power is back or cause nut failures after resume. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch nut-classic-4737 - openSUSE 11.3: zypper in -t patch nut-classic-4737 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): nut-classic-2.6.0-4.5.1 - openSUSE 11.3 (i586 x86_64): nut-classic-2.4.1-6.3.1 References: https://bugzilla.novell.com/660236

1 0

openSUSE-RU-2011:0714-1: libslab: Fix segfault starting yast2
by maintenance＠opensuse.org 30 Jun '11

30 Jun '11

openSUSE Recommended Update: libslab: Fix segfault starting yast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0714-1 Rating: low References: #650196 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a yast2 segfault when starting yast2 in the locales cs_CZ, hu_HU and tr_TR (bnc#650196) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libslab-4675 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libslab-devel-2.30.0-12.3.1 libslab0-2.30.0-12.3.1 - openSUSE 11.4 (noarch): libslab-lang-2.30.0-12.3.1 References: https://bugzilla.novell.com/650196

1 0

openSUSE-RU-2011:0713-1: coreutils: 'cp -al' does not preserve timestamps of symlinks
by maintenance＠opensuse.org 29 Jun '11

29 Jun '11

openSUSE Recommended Update: coreutils: 'cp -al' does not preserve timestamps of symlinks ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0713-1 Rating: low References: #696389 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: cp -a --link would not create a hardlink to a symlink, instead copying the symlink and then not preserving its timestamp. Bug introduced in coreutils-8.0. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch coreutils-4777 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): coreutils-8.9-7.1 - openSUSE 11.4 (noarch): coreutils-lang-8.9-7.1 References: https://bugzilla.novell.com/696389

1 0

openSUSE-RU-2011:0709-1: lensfun: Crash in lensfun 0.2.5
by maintenance＠opensuse.org 28 Jun '11

28 Jun '11

openSUSE Recommended Update: lensfun: Crash in lensfun 0.2.5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0709-1 Rating: low References: #699568 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: lensfun 0.2.5 was crashing on some hardware, when lens correction are being applied on photo taken with a lens in lensfun camera database (when using either ufraw, darktable or digikam). It could also crash when incorrect lens database was used. This update fixes this issue. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch lensfun-4759 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): lensfun-0.2.5-8.9.1 lensfun-devel-0.2.5-8.9.1 lensfun-doc-0.2.5-8.9.1 liblensfun0-0.2.5-8.9.1 References: https://bugzilla.novell.com/699568

1 0

openSUSE-SU-2011:0706-1: important: java-1_6_0-openjdk
by opensuse-security＠opensuse.org 28 Jun '11

28 Jun '11

openSUSE Security Update: java-1_6_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0706-1 Rating: important References: #596177 #698739 Cross-References: CVE-2011-0815 CVE-2011-0822 CVE-2011-0862 CVE-2011-0864 CVE-2011-0865 CVE-2011-0867 CVE-2011-0868 CVE-2011-0869 CVE-2011-0870 CVE-2011-0871 CVE-2011-0872 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: Icedtea as included in java-1_6_0-openjdk was updated to fix several security issues: * S6213702, CVE-2011-0872: (so) non-blocking sockets with TCP urgent disabled get still selected for read ops (win) * S6618658, CVE-2011-0865: Vulnerability in deserialization * S7012520, CVE-2011-0815: Heap overflow vulnerability in FileDialog.show() * S7013519, CVE-2011-0822, CVE-2011-0862: Integer overflows in 2D code * S7013969, CVE-2011-0867: NetworkInterface.toString can reveal bindings * S7013971, CVE-2011-0869: Vulnerability in SAAJ * S7016340, CVE-2011-0870: Vulnerability in SAAJ * S7016495, CVE-2011-0868: Crash in Java 2D transforming an image with scale close to zero * S7020198, CVE-2011-0871: ImageIcon creates Component with null acc * S7020373, CVE-2011-0864: JSR rewriting can overflow memory address size Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch icedtea-web-4788 - openSUSE 11.3: zypper in -t patch icedtea-web-4788 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): icedtea-web-1.1-0.2.1 java-1_6_0-openjdk-1.6.0.0_b22.1.10.2-4.3.1 java-1_6_0-openjdk-devel-1.6.0.0_b22.1.10.2-4.3.1 - openSUSE 11.4 (noarch): icedtea-web-javadoc-1.1-0.2.1 java-1_6_0-openjdk-demo-1.6.0.0_b22.1.10.2-4.3.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b22.1.10.2-4.3.1 java-1_6_0-openjdk-src-1.6.0.0_b22.1.10.2-4.3.1 - openSUSE 11.3 (i586 x86_64): icedtea-web-1.1-0.2.1 java-1_6_0-openjdk-1.6.0.0_b22.1.10.2-4.2.1 java-1_6_0-openjdk-devel-1.6.0.0_b22.1.10.2-4.2.1 - openSUSE 11.3 (noarch): icedtea-web-javadoc-1.1-0.2.1 java-1_6_0-openjdk-demo-1.6.0.0_b22.1.10.2-4.2.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b22.1.10.2-4.2.1 java-1_6_0-openjdk-src-1.6.0.0_b22.1.10.2-4.2.1 References: http://support.novell.com/security/cve/CVE-2011-0815.html http://support.novell.com/security/cve/CVE-2011-0822.html http://support.novell.com/security/cve/CVE-2011-0862.html http://support.novell.com/security/cve/CVE-2011-0864.html http://support.novell.com/security/cve/CVE-2011-0865.html http://support.novell.com/security/cve/CVE-2011-0867.html http://support.novell.com/security/cve/CVE-2011-0868.html http://support.novell.com/security/cve/CVE-2011-0869.html http://support.novell.com/security/cve/CVE-2011-0870.html http://support.novell.com/security/cve/CVE-2011-0871.html http://support.novell.com/security/cve/CVE-2011-0872.html https://bugzilla.novell.com/596177 https://bugzilla.novell.com/698739

1 0

openSUSE-SU-2011:0705-1: VUL-1: git-web xss
by opensuse-security＠opensuse.org 28 Jun '11

28 Jun '11

openSUSE Security Update: VUL-1: git-web xss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0705-1 Rating: low References: #698456 Cross-References: CVE-2011-2186 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Users with commit access to repos served by git-web could cause cross site scripting (XSS) issues with XML files (CVE-2011-2186). Due to a differently formatted /etc/mime.types openSUSE is not affected by default. This update nevertheless turns on git-web's XSS protection mechanism to avoid similar problems in the future. To turn XSS protection off again put the following line in /etc/gitweb.conf: $prevent_xss = 0; Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch git-web-4756 - openSUSE 11.3: zypper in -t patch git-web-4756 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): git-web-1.7.3.4-4.5.1 - openSUSE 11.3 (i586 x86_64): git-web-1.7.1-2.5.1 References: http://support.novell.com/security/cve/CVE-2011-2186.html https://bugzilla.novell.com/698456

1 0