July 2011 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2011:0854-1: moderate: libsndfile: fixing Integer overflow (CVE-2011-2696) and divide by zero (CVE-2009-4835)
by opensuse-security＠opensuse.org 29 Jul '11

29 Jul '11

openSUSE Security Update: libsndfile: fixing Integer overflow (CVE-2011-2696) and divide by zero (CVE-2009-4835) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0854-1 Rating: moderate References: #631379 #705681 Cross-References: CVE-2009-4835 CVE-2011-2696 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: An integer overflow in libsndfile while processing certain PAF files has been fixed. CVE-2011-2696 has been assigned to this issue. Additionally an divide by zero (CVE-2009-4835) has been fixed. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libsndfile-4901 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libsndfile-1.0.20-8.3.1 libsndfile-devel-1.0.20-8.3.1 - openSUSE 11.3 (x86_64): libsndfile-32bit-1.0.20-8.3.1 References: http://support.novell.com/security/cve/CVE-2009-4835.html http://support.novell.com/security/cve/CVE-2011-2696.html https://bugzilla.novell.com/631379 https://bugzilla.novell.com/705681

1 0

openSUSE-SU-2011:0852-1: important: freetype: Fixed several off-by-one / length checks missing
by opensuse-security＠opensuse.org 27 Jul '11

27 Jul '11

openSUSE Security Update: freetype: Fixed several off-by-one / length checks missing ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0852-1 Rating: important References: #704612 Cross-References: CVE-2011-0226 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This freetype2 update fixes sign extension problems and missing length checks. This issue was used in one of the last jailbreakme exploits for Apple iPhone/iPad products. (CVE-2011-0226) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch freetype2-4915 - openSUSE 11.3: zypper in -t patch freetype2-4915 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): freetype2-devel-2.4.4-7.8.1 libfreetype6-2.4.4-7.8.1 - openSUSE 11.4 (x86_64): freetype2-devel-32bit-2.4.4-7.8.1 libfreetype6-32bit-2.4.4-7.8.1 - openSUSE 11.3 (i586 x86_64): freetype2-devel-2.3.12-7.6.1 libfreetype6-2.3.12-7.6.1 - openSUSE 11.3 (x86_64): freetype2-devel-32bit-2.3.12-7.6.1 libfreetype6-32bit-2.3.12-7.6.1 References: http://support.novell.com/security/cve/CVE-2011-0226.html https://bugzilla.novell.com/704612

1 0

openSUSE-SU-2011:0848-1: moderate: opie
by opensuse-security＠opensuse.org 27 Jul '11

27 Jul '11

openSUSE Security Update: opie ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0848-1 Rating: moderate References: #698772 Cross-References: CVE-2011-2489 CVE-2011-2490 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: This update fixes off-by-one errors in opiesu (CVE-2011-2489) and missing setuid() return value checks in opielogin (CVE-2011-2490). This update also removes the setuid bit from opiesu program. If you rely on the setuid bit on opiesu, add the following line to /etc/permissions.local: /usr/bin/opiesu root:root 4755 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch opie-4812 - openSUSE 11.3: zypper in -t patch opie-4812 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2011.03.07.1608]: opie-2.4-711.714.1 permissions-2011.03.07.1608-1.5.1 - openSUSE 11.4 (x86_64): opie-32bit-2.4-711.714.1 - openSUSE 11.3 (i586 x86_64): opie-2.4-706.5.1 permissions-2010.04.23.1140-2.2.1 - openSUSE 11.3 (x86_64): opie-32bit-2.4-706.5.1 References: http://support.novell.com/security/cve/CVE-2011-2489.html http://support.novell.com/security/cve/CVE-2011-2490.html https://bugzilla.novell.com/698772

1 0

openSUSE-RU-2011:0846-1: cronie: run-parts missing in cronie-anacron
by maintenance＠opensuse.org 27 Jul '11

27 Jul '11

openSUSE Recommended Update: cronie: run-parts missing in cronie-anacron ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0846-1 Rating: low References: #689494 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: run-parts was used instead of run-crons in cronie-anacron. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch cron-4903 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.4.7]: cron-4.2-9.23.1 cronie-1.4.7-9.23.1 cronie-anacron-1.4.7-9.23.1 References: https://bugzilla.novell.com/689494

1 0

openSUSE-SU-2011:0845-1: important: compat-openssl097g
by opensuse-security＠opensuse.org 27 Jul '11

27 Jul '11

openSUSE Security Update: compat-openssl097g ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0845-1 Rating: important References: #707069 Cross-References: CVE-2008-5077 CVE-2009-0590 CVE-2009-0789 CVE-2009-3555 CVE-2010-4180 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update adds openssl patches since 2007 for: - CVE-2008-5077 - CVE-2009-0590 - CVE-2009-0789 - CVE-2009-3555 - CVE-2010-4180 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch compat-openssl097g-4909 - openSUSE 11.3: zypper in -t patch compat-openssl097g-4909 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): compat-openssl097g-0.9.7g-158.159.1 - openSUSE 11.4 (x86_64): compat-openssl097g-32bit-0.9.7g-158.159.1 - openSUSE 11.3 (i586 x86_64): compat-openssl097g-0.9.7g-155.3.1 - openSUSE 11.3 (x86_64): compat-openssl097g-32bit-0.9.7g-155.3.1 References: http://support.novell.com/security/cve/CVE-2008-5077.html http://support.novell.com/security/cve/CVE-2009-0590.html http://support.novell.com/security/cve/CVE-2009-0789.html http://support.novell.com/security/cve/CVE-2009-3555.html http://support.novell.com/security/cve/CVE-2010-4180.html https://bugzilla.novell.com/707069

1 0

openSUSE-RU-2011:0844-1: gimp: Cellspacing in pyslice plugin is broken
by maintenance＠opensuse.org 27 Jul '11

27 Jul '11

openSUSE Recommended Update: gimp: Cellspacing in pyslice plugin is broken ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0844-1 Rating: low References: #698769 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The cellspacing in pyslice plugin is broken. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gimp-4904 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): gimp-2.6.8-7.7.1 gimp-branding-upstream-2.6.8-7.7.1 gimp-devel-2.6.8-7.7.1 gimp-help-browser-2.6.8-7.7.1 gimp-module-hal-2.6.8-7.7.1 gimp-plugins-python-2.6.8-7.7.1 - openSUSE 11.3 (noarch): gimp-lang-2.6.8-7.7.1 References: https://bugzilla.novell.com/698769

1 0

openSUSE-SU-2011:0839-1: moderate: libxml2
by opensuse-security＠opensuse.org 26 Jul '11

26 Jul '11

openSUSE Security Update: libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0839-1 Rating: moderate References: #697372 Cross-References: CVE-2011-1944 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted xml files could crash applications using libxml2 (CVE-2011-1944). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libxml2-4811 - openSUSE 11.3: zypper in -t patch libxml2-4811 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libxml2-2.7.8-16.17.1 libxml2-devel-2.7.8-16.17.1 - openSUSE 11.4 (x86_64): libxml2-32bit-2.7.8-16.17.1 libxml2-devel-32bit-2.7.8-16.17.1 - openSUSE 11.4 (noarch): libxml2-doc-2.7.8-16.17.1 - openSUSE 11.3 (i586 x86_64): libxml2-2.7.7-4.7.1 libxml2-devel-2.7.7-4.7.1 - openSUSE 11.3 (x86_64): libxml2-32bit-2.7.7-4.7.1 libxml2-devel-32bit-2.7.7-4.7.1 - openSUSE 11.3 (noarch): libxml2-doc-2.7.7-4.7.1 References: http://support.novell.com/security/cve/CVE-2011-1944.html https://bugzilla.novell.com/697372

1 0

openSUSE-SU-2011:0836-1: moderate: nagios
by opensuse-security＠opensuse.org 25 Jul '11

25 Jul '11

openSUSE Security Update: nagios ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0836-1 Rating: moderate References: #682966 #697895 Cross-References: CVE-2011-1523 CVE-2011-2179 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: statusmap.cgi and config.cgi were prone to cross-site scripting (XSS) vulnerabilities (CVE-2011-1523, CVE-2011-2179). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch nagios-4839 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): nagios-3.2.3-3.4.1 nagios-devel-3.2.3-3.4.1 nagios-www-3.2.3-3.4.1 References: http://support.novell.com/security/cve/CVE-2011-1523.html http://support.novell.com/security/cve/CVE-2011-2179.html https://bugzilla.novell.com/682966 https://bugzilla.novell.com/697895

1 0

openSUSE-SU-2011:0833-1: moderate: nagios
by opensuse-security＠opensuse.org 25 Jul '11

25 Jul '11

openSUSE Security Update: nagios ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0833-1 Rating: moderate References: #682966 Cross-References: CVE-2011-1523 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: statusmap.cgi was prone to a cross-site scripting (XSS) vulnerability (CVE-2011-1523). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch nagios-4838 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): nagios-3.2.1-4.3.1 nagios-devel-3.2.1-4.3.1 nagios-www-3.2.1-4.3.1 References: http://support.novell.com/security/cve/CVE-2011-1523.html https://bugzilla.novell.com/682966

1 0

openSUSE-SU-2011:0829-1: moderate: icedtea-web
by opensuse-security＠opensuse.org 25 Jul '11

25 Jul '11

openSUSE Security Update: icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0829-1 Rating: moderate References: #704309 Cross-References: CVE-2011-2513 CVE-2011-2514 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of icedtea/icedtea-web fixes two issues: - CVE-2011-2513: CVSS v2 Base Score: 4.3: An information leak allows unsigned Web Start applications to determine the path to the cache directory used to store downloaded class and jar files. - CVE-2011-2514: CVSS v2 Base Score: 5.1 An unsigned Web Start application could manipulate content of the security warning dialog message to show different file name in prompts. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch icedtea-web-4910 - openSUSE 11.3: zypper in -t patch icedtea-web-4910 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): icedtea-web-1.1-0.6.1 - openSUSE 11.4 (noarch): icedtea-web-javadoc-1.1-0.6.1 - openSUSE 11.3 (i586 x86_64): icedtea-web-1.1-0.6.1 - openSUSE 11.3 (noarch): icedtea-web-javadoc-1.1-0.6.1 References: http://support.novell.com/security/cve/CVE-2011-2513.html http://support.novell.com/security/cve/CVE-2011-2514.html https://bugzilla.novell.com/704309

1 0