August 2011 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2011:0900-1: moderate: libvirt
by opensuse-security＠opensuse.org 12 Aug '11

12 Aug '11

openSUSE Security Update: libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0900-1 Rating: moderate References: #703084 Cross-References: CVE-2011-2511 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libvirtd could crash if bogus parameters where passed to the VirDomainGetVcpus call (CVE-2011-2511). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libvirt-4836 - openSUSE 11.3: zypper in -t patch libvirt-4836 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libvirt-0.8.8-0.12.1 libvirt-client-0.8.8-0.12.1 libvirt-devel-0.8.8-0.12.1 libvirt-doc-0.8.8-0.12.1 libvirt-python-0.8.8-0.12.1 - openSUSE 11.3 (i586 x86_64): libvirt-0.8.1-4.10.1 libvirt-client-0.8.1-4.10.1 libvirt-devel-0.8.1-4.10.1 libvirt-doc-0.8.1-4.10.1 libvirt-python-0.8.1-4.10.1 References: http://support.novell.com/security/cve/CVE-2011-2511.html https://bugzilla.novell.com/703084

1 0

openSUSE-SU-2011:0897-1: critical: flash-player
by opensuse-security＠opensuse.org 12 Aug '11

12 Aug '11

openSUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0897-1 Rating: critical References: #711427 Cross-References: CVE-2011-2130 CVE-2011-2134 CVE-2011-2135 CVE-2011-2136 CVE-2011-2137 CVE-2011-2138 CVE-2011-2139 CVE-2011-2140 CVE-2011-2414 CVE-2011-2415 CVE-2011-2416 CVE-2011-2417 CVE-2011-2425 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. It includes one version update. Description: The update to Flash-Player 10.3.188.5 fixes various security issues: - CVE-2011-2130: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) - CVE-2011-2134: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) - CVE-2011-2135: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) - CVE-2011-2136: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) - CVE-2011-2137: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) - CVE-2011-2138: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) - CVE-2011-2139: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) - CVE-2011-2140: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) - CVE-2011-2414: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) - CVE-2011-2415: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) - CVE-2011-2416: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) - CVE-2011-2417: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) - CVE-2011-2425: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) This update resolves a buffer overflow vulnerability that could lead to code execution (CVE-2011-2130). This update resolves a buffer overflow vulnerability that could lead to code execution (CVE-2011-2134). This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-2135). This update resolves an integer overflow vulnerability that could lead to code execution (CVE-2011-2136). This update resolves a buffer overflow vulnerability that could lead to code execution (CVE-2011-2137). This update resolves an integer overflow vulnerability that could lead to code execution (CVE-2011-2138). This update resolves a cross-site information disclosure vulnerability that could lead to code execution (CVE-2011-2139). This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-2140). This update resolves a buffer overflow vulnerability that could lead to code execution (CVE-2011-2414). This update resolves a buffer overflow vulnerability that could lead to code execution (CVE-2011-2415). This update resolves an integer overflow vulnerability that could lead to code execution (CVE-2011-2416). This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-2417). This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-2425). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch flash-player-4976 - openSUSE 11.3: zypper in -t patch flash-player-4976 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586) [New Version: 10.3.183.5]: flash-player-10.3.183.5-0.2.1 - openSUSE 11.3 (i586) [New Version: 10.3.183.5]: flash-player-10.3.183.5-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-2130.html http://support.novell.com/security/cve/CVE-2011-2134.html http://support.novell.com/security/cve/CVE-2011-2135.html http://support.novell.com/security/cve/CVE-2011-2136.html http://support.novell.com/security/cve/CVE-2011-2137.html http://support.novell.com/security/cve/CVE-2011-2138.html http://support.novell.com/security/cve/CVE-2011-2139.html http://support.novell.com/security/cve/CVE-2011-2140.html http://support.novell.com/security/cve/CVE-2011-2414.html http://support.novell.com/security/cve/CVE-2011-2415.html http://support.novell.com/security/cve/CVE-2011-2416.html http://support.novell.com/security/cve/CVE-2011-2417.html http://support.novell.com/security/cve/CVE-2011-2425.html https://bugzilla.novell.com/711427

1 0

openSUSE-SU-2011:0892-1: moderate: foomatic-filters
by opensuse-security＠opensuse.org 11 Aug '11

11 Aug '11

openSUSE Security Update: foomatic-filters ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0892-1 Rating: moderate References: #698451 Cross-References: CVE-2011-2697 CVE-2011-2964 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The foomatic print filters of the hplip package contained a remote code execution vulnerability. Remote users, if allowed to access a print server such as CUPS, could execute arbitrary commands as lp system user. CVE-2011-2964: CVSS v2 Base Score: 6.8 (moderate) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Code Injection (CWE-94) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch foomatic-filters-4979 - openSUSE 11.3: zypper in -t patch foomatic-filters-4979 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): foomatic-filters-4.0.6-7.8.1 - openSUSE 11.3 (i586 x86_64): foomatic-filters-4.0.1-7.3.1 References: http://support.novell.com/security/cve/CVE-2011-2697.html http://support.novell.com/security/cve/CVE-2011-2964.html https://bugzilla.novell.com/698451

1 0

openSUSE-SU-2011:0891-1: moderate: cgit
by opensuse-security＠opensuse.org 11 Aug '11

11 Aug '11

openSUSE Security Update: cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0891-1 Rating: moderate References: #707929 Cross-References: CVE-2011-2711 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of cgit fixes a XSS vulnerability. CVE-2011-2711: CVSS v2 Base Score: 3.3 (AV:N/AC:L/Au:M/C:N/I:P/A:N): Cross-Site Scripting (XSS) (CWE-79) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch cgit-4975 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): cgit-0.8.3.3-5.7.1 References: http://support.novell.com/security/cve/CVE-2011-2711.html https://bugzilla.novell.com/707929

1 0

openSUSE-SU-2011:0884-1: important: apache2-mod_fcgid: fixed possible stack overflow due to wrong pointer arithmetic (CVE-2010-3872)
by opensuse-security＠opensuse.org 10 Aug '11

10 Aug '11

openSUSE Security Update: apache2-mod_fcgid: fixed possible stack overflow due to wrong pointer arithmetic (CVE-2010-3872) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0884-1 Rating: important References: #656092 Cross-References: CVE-2010-3872 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A possible stack overflow in apache2-mod_fcgid due to wrong pointer arithmetic has been fixed. CVE-2010-3872 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch apache2-mod_fcgid-4933 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): apache2-mod_fcgid-2.2-101.3.1 References: http://support.novell.com/security/cve/CVE-2010-3872.html https://bugzilla.novell.com/656092

1 0

openSUSE-RU-2011:0882-1: dovecot20: Fix Dovecot20 not starting due to missing ssl_keys
by maintenance＠opensuse.org 09 Aug '11

09 Aug '11

openSUSE Recommended Update: dovecot20: Fix Dovecot20 not starting due to missing ssl_keys ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0882-1 Rating: low References: #696919 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update removes references to non-existent ssl_cert and ssl_key in Dovecot configuration. (bnc#696919) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch dovecot20-4959 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): dovecot20-2.0.13-0.5.1 dovecot20-backend-mysql-2.0.13-0.5.1 dovecot20-backend-pgsql-2.0.13-0.5.1 dovecot20-backend-sqlite-2.0.13-0.5.1 dovecot20-devel-2.0.13-0.5.1 dovecot20-fts-solr-2.0.13-0.5.1 References: https://bugzilla.novell.com/696919

1 0

openSUSE-RU-2011:0812-2: moderate: apcupsd: init check is fixed by this update
by maintenance＠opensuse.org 09 Aug '11

09 Aug '11

openSUSE Recommended Update: apcupsd: init check is fixed by this update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0812-2 Rating: moderate References: #703592 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update improves the last update for apcupsd. It fixes the init check to succeed with unmounted /usr. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch apcupsd-4958 - openSUSE 11.3: zypper in -t patch apcupsd-4958 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apcupsd-3.14.6-13.16.1 apcupsd-gui-3.14.6-13.16.1 - openSUSE 11.3 (i586 x86_64): apcupsd-3.14.6-9.5.1 apcupsd-gui-3.14.6-9.5.1 References: https://bugzilla.novell.com/703592

1 0

openSUSE-SU-2011:0880-1: moderate: dbus-1
by opensuse-security＠opensuse.org 08 Aug '11

08 Aug '11

openSUSE Security Update: dbus-1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0880-1 Rating: moderate References: #699712 Cross-References: CVE-2011-2200 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: local users could disconnect system daemons from the bus by sending specially crafted messages (CVE-2011-2200). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch dbus-1-4962 - openSUSE 11.3: zypper in -t patch dbus-1-4962 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): dbus-1-1.4.1-7.8.1 dbus-1-devel-1.4.1-7.8.1 - openSUSE 11.4 (x86_64): dbus-1-32bit-1.4.1-7.8.1 dbus-1-devel-32bit-1.4.1-7.8.1 - openSUSE 11.4 (noarch): dbus-1-devel-doc-1.4.1-7.8.1 - openSUSE 11.3 (i586 x86_64): dbus-1-1.2.24-2.5.1 dbus-1-devel-1.2.24-2.5.1 - openSUSE 11.3 (x86_64): dbus-1-32bit-1.2.24-2.5.1 dbus-1-devel-32bit-1.2.24-2.5.1 - openSUSE 11.3 (noarch): dbus-1-devel-doc-1.2.24-2.5.1 References: http://support.novell.com/security/cve/CVE-2011-2200.html https://bugzilla.novell.com/699712

1 0

openSUSE-SU-2011:0875-1: moderate: libsoup
by opensuse-security＠opensuse.org 05 Aug '11

05 Aug '11

openSUSE Security Update: libsoup ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0875-1 Rating: moderate References: #706630 Cross-References: CVE-2011-2524 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of libsoup fixes a directory traversal attack that affect application using the library. CVE-2011-2524: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libsoup-2_4-1-4941 - openSUSE 11.3: zypper in -t patch libsoup-2_4-1-4941 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libsoup-2_4-1-2.32.2-3.4.1 - openSUSE 11.4 (x86_64): libsoup-2_4-1-32bit-2.32.2-3.4.1 - openSUSE 11.3 (i586 x86_64): libsoup-2_4-1-2.30.1-2.3.1 - openSUSE 11.3 (x86_64): libsoup-2_4-1-32bit-2.30.1-2.3.1 References: http://support.novell.com/security/cve/CVE-2011-2524.html https://bugzilla.novell.com/706630

1 0

openSUSE-RU-2011:0874-1: Open Buildservice Toolchain: Release for OBS Maintenance Support
by maintenance＠opensuse.org 04 Aug '11

04 Aug '11

openSUSE Recommended Update: Open Buildservice Toolchain: Release for OBS Maintenance Support ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0874-1 Rating: low References: #704617 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes two new package versions. Description: This update brings OBS Maintenance Support and other new osc features for Factory Submissions in a roll up update. It contains new OBS service file drivers: - format_spec_file: format a spec file according to openSUSE rules - source_validator: source and patch and spec validation before check-in Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch obstools-201107-4878 - openSUSE 11.3: zypper in -t patch obstools-201107-4878 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch) [New Version: 2011.07.01]: build-2011.07.01-2.2.1 build-mkbaselibs-2011.07.01-2.2.1 build-mkdrpms-2011.07.01-2.2.1 obs-service-download_files-0.1-4.2.1 obs-service-format_spec_file-0.1-8.8.1 obs-service-source_validator-0.1-2.2.1 osc-0.132.5-1.3.1 osc-source_validator-0.1-4.5.1 - openSUSE 11.3 (noarch) [New Version: 0.132.5 and 2011.07.01]: build-2011.07.01-2.2.1 build-mkbaselibs-2011.07.01-2.2.1 obs-service-download_files-0.1-4.2.1 obs-service-format_spec_file-0.1-8.8.1 obs-service-source_validator-0.1-2.2.1 osc-0.132.5-1.3.2 osc-source_validator-0.1-19.17.1 References: https://bugzilla.novell.com/704617

1 0