January 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2012:0107-1: important: libxml2: fixing heap-based buffer overflow (CVE-2011-3919)
by opensuse-security＠opensuse.org 19 Jan '12

19 Jan '12

openSUSE Security Update: libxml2: fixing heap-based buffer overflow (CVE-2011-3919) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0107-1 Rating: important References: #739894 Cross-References: CVE-2011-3919 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A heap-based buffer overflow during decoding of entity references with overly long names has been fixed. CVE-2011-3919 has been assigned. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libxml2-5659 - openSUSE 11.3: zypper in -t patch libxml2-5659 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libxml2-2.7.8-16.21.1 libxml2-devel-2.7.8-16.21.1 - openSUSE 11.4 (x86_64): libxml2-32bit-2.7.8-16.21.1 libxml2-devel-32bit-2.7.8-16.21.1 - openSUSE 11.4 (noarch): libxml2-doc-2.7.8-16.21.1 - openSUSE 11.3 (i586 x86_64): libxml2-2.7.7-4.11.1 libxml2-devel-2.7.7-4.11.1 - openSUSE 11.3 (x86_64): libxml2-32bit-2.7.7-4.11.1 libxml2-devel-32bit-2.7.7-4.11.1 - openSUSE 11.3 (noarch): libxml2-doc-2.7.7-4.11.1 References: http://support.novell.com/security/cve/CVE-2011-3919.html https://bugzilla.novell.com/739894

1 0

openSUSE-SU-2012:0106-1: moderate: ecryptfs-utils to fix umask of /etc/mtab.tmp
by opensuse-security＠opensuse.org 19 Jan '12

19 Jan '12

openSUSE Security Update: ecryptfs-utils to fix umask of /etc/mtab.tmp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0106-1 Rating: moderate References: #735342 Cross-References: CVE-2011-3145 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: mount.ecrpytfs_private did not set correct group ownerships when it modifies mtab (CVE-2011-3145). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch ecryptfs-utils-5541 - openSUSE 11.3: zypper in -t patch ecryptfs-utils-5541 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): ecryptfs-utils-83-6.9.1 - openSUSE 11.4 (x86_64): ecryptfs-utils-32bit-83-6.9.1 - openSUSE 11.3 (i586 x86_64): ecryptfs-utils-83-3.5.1 - openSUSE 11.3 (x86_64): ecryptfs-utils-32bit-83-3.5.1 References: http://support.novell.com/security/cve/CVE-2011-3145.html https://bugzilla.novell.com/735342

1 0

openSUSE-SU-2012:0103-1: moderate: Fixed apache tomcat hash collision vulnerability (CVE-2011-4858)
by opensuse-security＠opensuse.org 19 Jan '12

19 Jan '12

openSUSE Security Update: Fixed apache tomcat hash collision vulnerability (CVE-2011-4858) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0103-1 Rating: moderate References: #712784 #727543 Cross-References: CVE-2011-4858 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The apache tomcat was vulnerable to a hash collision attack which allowed remote attackers to mount DoS attacks. CVE-2011-4858 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch tomcat6-5619 - openSUSE 11.3: zypper in -t patch tomcat6-5619 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): tomcat6-6.0.32-7.12.1 tomcat6-admin-webapps-6.0.32-7.12.1 tomcat6-docs-webapp-6.0.32-7.12.1 tomcat6-el-1_0-api-6.0.32-7.12.1 tomcat6-javadoc-6.0.32-7.12.1 tomcat6-jsp-2_1-api-6.0.32-7.12.1 tomcat6-lib-6.0.32-7.12.1 tomcat6-servlet-2_5-api-6.0.32-7.12.1 tomcat6-webapps-6.0.32-7.12.1 - openSUSE 11.3 (noarch): tomcat6-6.0.24-5.16.1 tomcat6-admin-webapps-6.0.24-5.16.1 tomcat6-docs-webapp-6.0.24-5.16.1 tomcat6-el-1_0-api-6.0.24-5.16.1 tomcat6-javadoc-6.0.24-5.16.1 tomcat6-jsp-2_1-api-6.0.24-5.16.1 tomcat6-lib-6.0.24-5.16.1 tomcat6-servlet-2_5-api-6.0.24-5.16.1 tomcat6-webapps-6.0.24-5.16.1 References: http://support.novell.com/security/cve/CVE-2011-4858.html https://bugzilla.novell.com/712784 https://bugzilla.novell.com/727543

1 0

openSUSE-SU-2012:0102-1: moderate: squid
by opensuse-security＠opensuse.org 19 Jan '12

19 Jan '12

openSUSE Security Update: squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0102-1 Rating: moderate References: #587375 Cross-References: CVE-2010-0639 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issues: - 587375: NULL deref via HTCP request (CVE-2010-0639) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch squid-5580 - openSUSE 11.3: zypper in -t patch squid-5580 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): squid-2.7.STABLE6-10.11.1 - openSUSE 11.3 (i586 x86_64): squid-2.7.STABLE6-7.3.1 References: http://support.novell.com/security/cve/CVE-2010-0639.html https://bugzilla.novell.com/587375

1 0

openSUSE-SU-2012:0101-1: moderate: NetworkManager-gnome
by opensuse-security＠opensuse.org 19 Jan '12

19 Jan '12

openSUSE Security Update: NetworkManager-gnome ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0101-1 Rating: moderate References: #574266 #732700 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network (CVE-2006-7246). Please note that existing WPA2 Enterprise connections need to be deleted and re-created to take advantage of the new security checks. This is a re-release of the previous update to also enable the checks for EAP-TLS. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch NetworkManager-gnome-5627 - openSUSE 11.3: zypper in -t patch NetworkManager-gnome-5627 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): NetworkManager-gnome-0.8.2-9.16.1 - openSUSE 11.4 (noarch): NetworkManager-gnome-lang-0.8.2-9.16.1 - openSUSE 11.3 (i586 x86_64): NetworkManager-gnome-0.8-6.7.2 References: https://bugzilla.novell.com/574266 https://bugzilla.novell.com/732700

1 0

openSUSE-SU-2012:0100-1: moderate: icu (CVE-2011-4599, CVE-2010-4409)
by opensuse-security＠opensuse.org 19 Jan '12

19 Jan '12

openSUSE Security Update: icu (CVE-2011-4599, CVE-2010-4409) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0100-1 Rating: moderate References: #657910 #736146 Cross-References: CVE-2010-4409 CVE-2011-4599 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Specially crafted strings could cause a buffer overflow in icu (CVE-2011-4599). An integer overflow in the getSymbol() function could crash applications using icu (CVE-2010-4409) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch icu-5658 - openSUSE 11.3: zypper in -t patch icu-5658 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): icu-4.4.2-4.5.1 icu-data-4.4.2-4.5.1 libicu-4.4.2-4.5.1 libicu-devel-4.4.2-4.5.1 libicu-doc-4.4.2-4.5.1 - openSUSE 11.4 (x86_64): libicu-32bit-4.4.2-4.5.1 libicu-devel-32bit-4.4.2-4.5.1 - openSUSE 11.3 (i586 x86_64): icu-4.2-7.3.1 icu-data-4.2-7.3.1 libicu-4.2-7.3.1 libicu-devel-4.2-7.3.1 libicu-doc-4.2-7.3.1 - openSUSE 11.3 (x86_64): libicu-32bit-4.2-7.3.1 libicu-devel-32bit-4.2-7.3.1 References: http://support.novell.com/security/cve/CVE-2010-4409.html http://support.novell.com/security/cve/CVE-2011-4599.html https://bugzilla.novell.com/657910 https://bugzilla.novell.com/736146

1 0

openSUSE-SU-2012:0091-1: important: libqt4: fixed stack-based buffer overflow in glyph handling (CVE-2011-3922)
by opensuse-security＠opensuse.org 19 Jan '12

19 Jan '12

openSUSE Security Update: libqt4: fixed stack-based buffer overflow in glyph handling (CVE-2011-3922) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0091-1 Rating: important References: #739904 Cross-References: CVE-2011-3922 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A stack-based buffer overflow in the glyph handling of libqt4's harfbuzz has been fixed. CVE-2011-3922 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libQtWebKit-devel-5628 - openSUSE 11.3: zypper in -t patch libQtWebKit-devel-5628 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libQtWebKit-devel-4.7.1-8.17.1 libQtWebKit4-4.7.1-8.17.1 libqt4-4.7.1-8.17.1 libqt4-devel-4.7.1-8.17.1 libqt4-qt3support-4.7.1-8.17.1 libqt4-sql-4.7.1-8.17.1 libqt4-sql-sqlite-4.7.1-8.17.1 libqt4-x11-4.7.1-8.17.1 - openSUSE 11.4 (x86_64): libQtWebKit4-32bit-4.7.1-8.17.1 libqt4-32bit-4.7.1-8.17.1 libqt4-qt3support-32bit-4.7.1-8.17.1 libqt4-sql-32bit-4.7.1-8.17.1 libqt4-sql-sqlite-32bit-4.7.1-8.17.1 libqt4-x11-32bit-4.7.1-8.17.1 - openSUSE 11.3 (i586 x86_64): libQtWebKit-devel-4.6.3-2.7.1 libQtWebKit4-4.6.3-2.7.1 libqt4-4.6.3-2.7.1 libqt4-devel-4.6.3-2.7.1 libqt4-qt3support-4.6.3-2.7.1 libqt4-sql-4.6.3-2.7.1 libqt4-sql-sqlite-4.6.3-2.7.1 libqt4-x11-4.6.3-2.7.1 - openSUSE 11.3 (x86_64): libQtWebKit4-32bit-4.6.3-2.7.1 libqt4-32bit-4.6.3-2.7.1 libqt4-qt3support-32bit-4.6.3-2.7.1 libqt4-sql-32bit-4.6.3-2.7.1 libqt4-sql-sqlite-32bit-4.6.3-2.7.1 libqt4-x11-32bit-4.6.3-2.7.1 References: http://support.novell.com/security/cve/CVE-2011-3922.html https://bugzilla.novell.com/739904

1 0

openSUSE-RU-2012:0090-1: moderate: atftpd: Sorcerer's Apprentice Syndrome
by maintenance＠opensuse.org 18 Jan '12

18 Jan '12

openSUSE Recommended Update: atftpd: Sorcerer's Apprentice Syndrome ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0090-1 Rating: moderate References: #727843 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for atftp: - 727843: provides stability enhancements for tftp usage in packet loss situations ("Sorcerer's Apprentice Syndrome") Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch atftp-5483 - openSUSE 11.3: zypper in -t patch atftp-5483 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): atftp-0.7.0-143.146.1 - openSUSE 11.3 (i586 x86_64): atftp-0.7.0-137.3.1 References: https://bugzilla.novell.com/727843

1 0

openSUSE-RU-2012:0089-1: mawk: mawk RE matching can return invalid results causing unexpected behavior and crashes
by maintenance＠opensuse.org 18 Jan '12

18 Jan '12

openSUSE Recommended Update: mawk: mawk RE matching can return invalid results causing unexpected behavior and crashes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0089-1 Rating: low References: #740484 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for mawk: - 740484: mawk RE matching can return invalid results causing unexpected behavior and crashes Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch mawk-5644 - openSUSE 11.3: zypper in -t patch mawk-5644 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): mawk-1.3.4-7.8.1 - openSUSE 11.3 (i586 x86_64): mawk-1.3.4-4.3.1 References: https://bugzilla.novell.com/740484

1 0

openSUSE-RU-2012:0088-1: xarchiver: thunar-plugin-archive doesn't package a file with spaces in its name
by maintenance＠opensuse.org 18 Jan '12

18 Jan '12

openSUSE Recommended Update: xarchiver: thunar-plugin-archive doesn't package a file with spaces in its name ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0088-1 Rating: low References: #723170 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for xarchiver: - 723170: thunar-plugin-archive doesn't package a file with spaces in its name Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch xarchiver-5647 - openSUSE 11.3: zypper in -t patch xarchiver-5647 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): xarchiver-0.5.2+20090319-9.14.1 - openSUSE 11.3 (i586 x86_64): xarchiver-0.5.2+20090319-2.3.1 References: https://bugzilla.novell.com/723170

1 0

openSUSE-SU-2012:0087-1: important: acroread
by opensuse-security＠opensuse.org 17 Jan '12

17 Jan '12

openSUSE Security Update: acroread ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0087-1 Rating: important References: #735275 Cross-References: CVE-2011-2462 CVE-2011-4369 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: Acrobat Reader was updated to version 9.4.7 to fix security issues (CVE-2011-2462, CVE-2011-4369) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch acroread-5650 - openSUSE 11.3: zypper in -t patch acroread-5650 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586) [New Version: 9.4.7]: acroread-9.4.7-0.3.1 - openSUSE 11.3 (i586) [New Version: 9.4.7]: acroread-9.4.7-0.3.1 References: http://support.novell.com/security/cve/CVE-2011-2462.html http://support.novell.com/security/cve/CVE-2011-4369.html https://bugzilla.novell.com/735275

1 0

openSUSE-SU-2012:0083-1: important: openssl: fixing various security issues
by opensuse-security＠opensuse.org 16 Jan '12

16 Jan '12

openSUSE Security Update: openssl: fixing various security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0083-1 Rating: important References: #739719 Cross-References: CVE-2011-4108 CVE-2011-4576 CVE-2011-4577 CVE-2011-4619 CVE-2012-0027 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: Various security vulnerabilities have been fixed in openssl: - DTLS plaintext recovery attack (CVE-2011-4108) - uninitialized SSL 3.0 padding (CVE-2011-4576) - malformed RFC 3779 data can cause assertion failures (CVE-2011-4577) - SGC restart DoS attack (CVE-2011-4619) - invalid GOST parameters DoS attack (CVE-2012-0027) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libopenssl-devel-5634 - openSUSE 11.3: zypper in -t patch libopenssl-devel-5634 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libopenssl-devel-1.0.0c-18.23.1 libopenssl1_0_0-1.0.0c-18.23.1 openssl-1.0.0c-18.23.1 - openSUSE 11.4 (x86_64): libopenssl1_0_0-32bit-1.0.0c-18.23.1 - openSUSE 11.4 (noarch): openssl-doc-1.0.0c-18.23.1 - openSUSE 11.3 (i586 x86_64): libopenssl-devel-1.0.0-6.13.1 libopenssl1_0_0-1.0.0-6.13.1 openssl-1.0.0-6.13.1 - openSUSE 11.3 (x86_64): libopenssl1_0_0-32bit-1.0.0-6.13.1 - openSUSE 11.3 (noarch): openssl-doc-1.0.0-6.13.1 References: http://support.novell.com/security/cve/CVE-2011-4108.html http://support.novell.com/security/cve/CVE-2011-4576.html http://support.novell.com/security/cve/CVE-2011-4577.html http://support.novell.com/security/cve/CVE-2011-4619.html http://support.novell.com/security/cve/CVE-2012-0027.html https://bugzilla.novell.com/739719

1 0

openSUSE-SU-2011:1331-2: moderate: system-config-printer (CVE-2011-4405, CVE-2011-2899)
by opensuse-security＠opensuse.org 13 Jan '12

13 Jan '12

openSUSE Security Update: system-config-printer (CVE-2011-4405, CVE-2011-2899) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1331-2 Rating: moderate References: #733542 #735322 Cross-References: CVE-2011-2899 CVE-2011-4405 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes a typo from the previous update: system-config-printer used an unauthenticated connection when downloading printer drivers from openprinting.org (CVE-2011-4405). This update disables the printer driver download feature. system-config-printer did not properly quote shell meta characters in SMB server or workgroup names when passing them to the shell (CVE-2011-2899). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch python-cupshelpers-5604 - openSUSE 11.3: zypper in -t patch python-cupshelpers-5604 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): python-cupshelpers-1.2.5-5.10.1 system-config-printer-1.2.5-5.10.1 udev-configure-printer-1.2.5-5.10.1 - openSUSE 11.4 (noarch): system-config-printer-lang-1.2.5-5.10.1 - openSUSE 11.3 (i586 x86_64): python-cupshelpers-1.2.0-2.7.1 system-config-printer-1.2.0-2.7.1 udev-configure-printer-1.2.0-2.7.1 - openSUSE 11.3 (noarch): system-config-printer-lang-1.2.0-2.7.1 References: http://support.novell.com/security/cve/CVE-2011-2899.html http://support.novell.com/security/cve/CVE-2011-4405.html https://bugzilla.novell.com/733542 https://bugzilla.novell.com/735322

1 0

openSUSE-RU-2012:0075-1: iptables: Fix iptables-apply command
by maintenance＠opensuse.org 13 Jan '12

13 Jan '12

openSUSE Recommended Update: iptables: Fix iptables-apply command ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0075-1 Rating: low References: #730161 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for iptables: - 730161: iptables-apply uses unknown command "tempfile" Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch iptables-5592 - openSUSE 11.3: zypper in -t patch iptables-5592 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): iptables-1.4.10-4.5.1 iptables-devel-1.4.10-4.5.1 - openSUSE 11.3 (i586 x86_64): iptables-1.4.8-2.3.1 iptables-devel-1.4.8-2.3.1 References: https://bugzilla.novell.com/730161

1 0

openSUSE-SU-2012:0073-1: libxml2
by opensuse-security＠opensuse.org 12 Jan '12

12 Jan '12

openSUSE Security Update: libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0073-1 Rating: low References: #732787 Cross-References: CVE-2011-2821 CVE-2011-2834 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Specially crafted XPath expressions could allow attackers to cause a denial of service or possibly have unspecified other impact (CVE-2011-2821,CVE-2011-2834). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libxml2-5488 - openSUSE 11.3: zypper in -t patch libxml2-5488 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libxml2-2.7.8-16.19.1 libxml2-devel-2.7.8-16.19.1 - openSUSE 11.4 (x86_64): libxml2-32bit-2.7.8-16.19.1 libxml2-devel-32bit-2.7.8-16.19.1 - openSUSE 11.4 (noarch): libxml2-doc-2.7.8-16.19.1 - openSUSE 11.3 (i586 x86_64): libxml2-2.7.7-4.9.1 libxml2-devel-2.7.7-4.9.1 - openSUSE 11.3 (x86_64): libxml2-32bit-2.7.7-4.9.1 libxml2-devel-32bit-2.7.7-4.9.1 - openSUSE 11.3 (noarch): libxml2-doc-2.7.7-4.9.1 References: http://support.novell.com/security/cve/CVE-2011-2821.html http://support.novell.com/security/cve/CVE-2011-2834.html https://bugzilla.novell.com/732787

1 0

openSUSE-SU-2012:0066-1: moderate: pidgin
by opensuse-security＠opensuse.org 09 Jan '12

09 Jan '12

openSUSE Security Update: pidgin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0066-1 Rating: moderate References: #736147 Cross-References: CVE-2011-1091 CVE-2011-4601 CVE-2011-4602 CVE-2011-4603 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: Remote users could crash pidgin via ICQ, SILC, XMPP and Yahoo protocols (CVE-2011-4601, CVE-2011-4603, CVE-2011-4602, CVE-2011-1091). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch finch-5557 - openSUSE 11.3: zypper in -t patch finch-5557 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): finch-2.7.10-4.7.1 finch-devel-2.7.10-4.7.1 libpurple-2.7.10-4.7.1 libpurple-devel-2.7.10-4.7.1 libpurple-meanwhile-2.7.10-4.7.1 libpurple-tcl-2.7.10-4.7.1 pidgin-2.7.10-4.7.1 pidgin-devel-2.7.10-4.7.1 pidgin-evolution-2.7.10-4.7.1 - openSUSE 11.4 (noarch): libpurple-lang-2.7.10-4.7.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.7.9]: finch-2.7.9-1.6.1 finch-devel-2.7.9-1.6.1 libpurple-2.7.9-1.6.1 libpurple-devel-2.7.9-1.6.1 libpurple-meanwhile-2.7.9-1.6.1 libpurple-mono-2.7.9-1.6.1 libpurple-tcl-2.7.9-1.6.1 pidgin-2.7.9-1.6.1 pidgin-devel-2.7.9-1.6.1 - openSUSE 11.3 (noarch) [New Version: 2.7.9]: libpurple-lang-2.7.9-1.6.1 References: http://support.novell.com/security/cve/CVE-2011-1091.html http://support.novell.com/security/cve/CVE-2011-4601.html http://support.novell.com/security/cve/CVE-2011-4602.html http://support.novell.com/security/cve/CVE-2011-4603.html https://bugzilla.novell.com/736147

1 0

openSUSE-RU-2012:0065-1: moderate: xfce4-panel-plugin-xkb : Major memory leak
by maintenance＠opensuse.org 09 Jan '12

09 Jan '12

openSUSE Recommended Update: xfce4-panel-plugin-xkb : Major memory leak ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0065-1 Rating: moderate References: #734851 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes two new package versions. Description: This update fixes the following issue for xfce4-panel-plugin-xkb: - 734851: fixed major memory leak with version update to 0.5.4.2 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch xfce4-panel-plugin-battery-5553 - openSUSE 11.3: zypper in -t patch xfce4-panel-plugin-battery-5553 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 0.5.4.2]: xfce4-panel-plugin-battery-1.0.0-2.3.1 xfce4-panel-plugin-cddrive-0.0.1-19.3.1 xfce4-panel-plugin-cellmodem-0.0.5-24.3.1 xfce4-panel-plugin-clipman-1.1.3-18.3.1 xfce4-panel-plugin-clipman-doc-1.1.3-4.3.1 xfce4-panel-plugin-cpufreq-1.0.0-3.3.1 xfce4-panel-plugin-cpugraph-1.0.1-6.3.1 xfce4-panel-plugin-datetime-0.6.1-18.3.1 xfce4-panel-plugin-diskperf-2.3.0-3.3.1 xfce4-panel-plugin-eyes-4.4.1-2.3.1 xfce4-panel-plugin-fsguard-1.0.0-4.3.1 xfce4-panel-plugin-genmon-3.2-24.3.1 xfce4-panel-plugin-mailwatch-1.1.0-6.3.1 xfce4-panel-plugin-mount-0.5.5-18.3.1 xfce4-panel-plugin-mpc-0.3.6-3.3.1 xfce4-panel-plugin-netload-1.0.0-4.3.1 xfce4-panel-plugin-notes-1.7.7-6.3.1 xfce4-panel-plugin-places-1.2.0-17.3.1 xfce4-panel-plugin-quicklauncher-1.9.4-24.3.1 xfce4-panel-plugin-radio-0.4.4-6.3.1 xfce4-panel-plugin-screenshooter-1.7.9.99_git20110203-5.10.1 xfce4-panel-plugin-sensors-1.0.0-4.3.1 xfce4-panel-plugin-sensors-devel-1.0.0-4.3.1 xfce4-panel-plugin-smartbookmark-0.4.2-24.3.1 xfce4-panel-plugin-systemload-1.0.0-4.3.1 xfce4-panel-plugin-timeout-1.0.0-4.3.1 xfce4-panel-plugin-timer-0.6.1-18.3.1 xfce4-panel-plugin-verve-1.0.0-4.3.1 xfce4-panel-plugin-wavelan-0.5.6-6.3.1 xfce4-panel-plugin-weather-0.7.4-3.3.1 xfce4-panel-plugin-xfapplet-0.1.0-24.3.1 xfce4-panel-plugin-xkb-0.5.4.2-0.3.1 xfce4-panel-plugin-xmms-0.5.3-3.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 0.5.4.2]: xfce4-panel-plugin-battery-0.5.0-11.3.1 xfce4-panel-plugin-cddrive-0.0.1-11.3.1 xfce4-panel-plugin-cellmodem-0.0.5-11.3.1 xfce4-panel-plugin-clipman-1.1.3-11.3.1 xfce4-panel-plugin-cpufreq-0.0.1-11.3.1 xfce4-panel-plugin-cpugraph-0.4.0-11.3.1 xfce4-panel-plugin-datetime-0.6.1-11.3.1 xfce4-panel-plugin-diskperf-2.1.0-11.3.1 xfce4-panel-plugin-eyes-4.4.0-11.3.1 xfce4-panel-plugin-fsguard-0.4.2-11.3.1 xfce4-panel-plugin-genmon-3.2-11.3.1 xfce4-panel-plugin-governor-0.1.0-11.3.1 xfce4-panel-plugin-mailwatch-1.0.1-11.3.1 xfce4-panel-plugin-mount-0.5.5-11.3.1 xfce4-panel-plugin-mpc-0.3.4-11.3.1 xfce4-panel-plugin-netload-0.4.0-11.3.1 xfce4-panel-plugin-notes-1.7.2-11.3.1 xfce4-panel-plugin-places-1.2.0-11.3.1 xfce4-panel-plugin-quicklauncher-1.9.4-11.3.1 xfce4-panel-plugin-radio-0.4.2-11.3.1 xfce4-panel-plugin-screenshooter-1.6.0-11.3.1 xfce4-panel-plugin-sensors-0.10.99.6-11.3.1 xfce4-panel-plugin-smartbookmark-0.4.2-11.3.1 xfce4-panel-plugin-smartpm-0.1.2-11.3.1 xfce4-panel-plugin-systemload-0.4.2-11.3.1 xfce4-panel-plugin-timeout-0.1.1-11.3.1 xfce4-panel-plugin-timer-0.6.1-11.3.1 xfce4-panel-plugin-verve-0.3.6-11.3.1 xfce4-panel-plugin-wavelan-0.5.5-11.3.1 xfce4-panel-plugin-weather-0.7.3-11.3.1 xfce4-panel-plugin-xfapplet-0.1.0-11.3.1 xfce4-panel-plugin-xfmedia-remote-0.2.2-11.3.1 xfce4-panel-plugin-xkb-0.5.4.2-0.3.1 xfce4-panel-plugin-xmms-0.5.2-11.3.1 References: https://bugzilla.novell.com/734851

1 0

openSUSE-SU-2012:0064-1: important: glibc
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0064-1 Rating: important References: #735850 Cross-References: CVE-2009-5029 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted time zone files could cause a heap overflow in glibc (CVE-2009-5029). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch glibc-5554 - openSUSE 11.3: zypper in -t patch glibc-5554 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 i686 x86_64): glibc-2.11.3-12.21.1 glibc-devel-2.11.3-12.21.1 - openSUSE 11.4 (i586 x86_64): glibc-html-2.11.3-12.21.1 glibc-i18ndata-2.11.3-12.21.1 glibc-info-2.11.3-12.21.1 glibc-locale-2.11.3-12.21.1 glibc-obsolete-2.11.3-12.21.1 glibc-profile-2.11.3-12.21.1 nscd-2.11.3-12.21.1 - openSUSE 11.4 (x86_64): glibc-32bit-2.11.3-12.21.1 glibc-devel-32bit-2.11.3-12.21.1 glibc-locale-32bit-2.11.3-12.21.1 glibc-profile-32bit-2.11.3-12.21.1 - openSUSE 11.3 (i586 i686 x86_64): glibc-2.11.2-3.7.1 glibc-devel-2.11.2-3.7.1 - openSUSE 11.3 (i586 x86_64): glibc-html-2.11.2-3.7.1 glibc-i18ndata-2.11.2-3.7.1 glibc-info-2.11.2-3.7.1 glibc-locale-2.11.2-3.7.1 glibc-obsolete-2.11.2-3.7.1 glibc-profile-2.11.2-3.7.1 nscd-2.11.2-3.7.1 - openSUSE 11.3 (x86_64): glibc-32bit-2.11.2-3.7.1 glibc-devel-32bit-2.11.2-3.7.1 glibc-locale-32bit-2.11.2-3.7.1 glibc-profile-32bit-2.11.2-3.7.1 References: http://support.novell.com/security/cve/CVE-2009-5029.html https://bugzilla.novell.com/735850

1 0

openSUSE-SU-2012:0063-1: moderate: mozilla-nss to 3.13.1
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: mozilla-nss to 3.13.1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0063-1 Rating: moderate References: #726096 Cross-References: CVE-2011-3389 CVE-2011-3640 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: The Mozilla NSS libraries were updated to version 3.13.1 to fix various bugs and security problems. Following security issues were fixed: * SSL 2.0 is disabled by default * A defense against the SSL 3.0 and TLS 1.0 CBC chosen plaintext attack demonstrated by Rizzo and Duong (CVE-2011-3389) is enabled by default. Set the SSL_CBC_RANDOM_IV SSL option to PR_FALSE to disable it. bnc# * SHA-224 is supported * NSS_NoDB_Init does not try to open /pkcs11.txt and /secmod.db anymore (bmo#641052, bnc#726096) (CVE-2011-3640) Also following bugs were fixed: * fix spec file syntax for qemu-workaround * Added a patch to fix errors in the pkcs11n.h header file. (bmo#702090) * better SHA-224 support (bmo#647706) * SHA-224 is supported * Added PORT_ErrorToString and PORT_ErrorToName to return the error message and symbolic name of an NSS error code * Added NSS_GetVersion to return the NSS version string * Added experimental support of RSA-PSS to the softoken only Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch nss-201112-5564 - openSUSE 11.3: zypper in -t patch nss-201112-5564 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 3.13.1]: libfreebl3-3.13.1-0.2.1 libsoftokn3-3.13.1-0.2.1 mozilla-nss-3.13.1-0.2.1 mozilla-nss-certs-3.13.1-0.2.1 mozilla-nss-devel-3.13.1-0.2.1 mozilla-nss-sysinit-3.13.1-0.2.1 mozilla-nss-tools-3.13.1-0.2.1 - openSUSE 11.4 (x86_64) [New Version: 3.13.1]: libfreebl3-32bit-3.13.1-0.2.1 libsoftokn3-32bit-3.13.1-0.2.1 mozilla-nss-32bit-3.13.1-0.2.1 mozilla-nss-certs-32bit-3.13.1-0.2.1 mozilla-nss-sysinit-32bit-3.13.1-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 3.13.1]: libfreebl3-3.13.1-0.2.1 libsoftokn3-3.13.1-0.2.1 mozilla-nss-3.13.1-0.2.1 mozilla-nss-certs-3.13.1-0.2.1 mozilla-nss-devel-3.13.1-0.2.1 mozilla-nss-sysinit-3.13.1-0.2.1 mozilla-nss-tools-3.13.1-0.2.1 - openSUSE 11.3 (x86_64) [New Version: 3.13.1]: libfreebl3-32bit-3.13.1-0.2.1 libsoftokn3-32bit-3.13.1-0.2.1 mozilla-nss-32bit-3.13.1-0.2.1 mozilla-nss-certs-32bit-3.13.1-0.2.1 mozilla-nss-sysinit-32bit-3.13.1-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3389.html http://support.novell.com/security/cve/CVE-2011-3640.html https://bugzilla.novell.com/726096

1 0

openSUSE-RU-2012:0062-1: sudo -i unsets $DISPLAY - but manpage says it doesn't
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: sudo -i unsets $DISPLAY - but manpage says it doesn't ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0062-1 Rating: low References: #720181 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update fixes the following issue for sudo: - 720181: manpage-fix sudo -i unsets $DISPLAY Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch sudo-5544 - openSUSE 11.3: zypper in -t patch sudo-5544 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.7.6p2]: sudo-1.7.6p2-0.5.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.7.6p2]: sudo-1.7.6p2-0.5.1 References: https://bugzilla.novell.com/720181

1 0

openSUSE-SU-2012:0058-1: moderate: VUL-0: CVE-2011-4000: chasen: buffer overflow
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: VUL-0: CVE-2011-4000: chasen: buffer overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0058-1 Rating: moderate References: #735830 Cross-References: CVE-2011-4000 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A potential buffer overflow in ChaSen that could possibly allow remote attackers to execute arbitrary code via a specially crafted string was fixed (CVE-2011-4000). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch chasen-5599 - openSUSE 11.3: zypper in -t patch chasen-5599 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): chasen-2.4.2-65.66.1 chasen-devel-2.4.2-65.66.1 perl-Text-ChaSen-2.4.2-65.66.1 - openSUSE 11.3 (i586 x86_64): chasen-2.4.2-60.3.1 chasen-devel-2.4.2-60.3.1 perl-Text-ChaSen-2.4.2-60.3.1 References: http://support.novell.com/security/cve/CVE-2011-4000.html https://bugzilla.novell.com/735830

1 0

openSUSE-RU-2012:0057-1: important: pam crashes in multi-threaded environment
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: pam crashes in multi-threaded environment ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0057-1 Rating: important References: #735220 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: The previous pam-modules update introduced a regression that could lead to crashes with pam authentication in multi-threaded programs. - 735220: pam crashes in multi-threaded environment Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch pam-modules-5556 - openSUSE 11.3: zypper in -t patch pam-modules-5556 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): pam-modules-11.4-3.6.1 - openSUSE 11.4 (x86_64): pam-modules-32bit-11.4-3.6.1 - openSUSE 11.3 (i586 x86_64) [New Version: 11.3]: pam-modules-11.3-0.5.1 - openSUSE 11.3 (x86_64) [New Version: 11.3]: pam-modules-32bit-11.3-0.5.1 References: https://bugzilla.novell.com/735220

1 0

openSUSE-SU-2012:0051-1: important: krb5-appl: Fixed remote buffer overflow in ktelnetd
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: krb5-appl: Fixed remote buffer overflow in ktelnetd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0051-1 Rating: important References: #698471 #738632 Cross-References: CVE-2011-4862 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of krb5 applications fixes two security issues. CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE.) CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file access problems. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch krb5-appl-5593 - openSUSE 11.3: zypper in -t patch krb5-appl-5593 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): krb5-appl-clients-1.0-7.12.1 krb5-appl-servers-1.0-7.12.1 - openSUSE 11.3 (i586 x86_64): krb5-appl-clients-1.0-4.5.1 krb5-appl-servers-1.0-4.5.1 References: http://support.novell.com/security/cve/CVE-2011-4862.html https://bugzilla.novell.com/698471 https://bugzilla.novell.com/738632

1 0

openSUSE-SU-2012:0047-1: important: freetype2
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0047-1 Rating: important References: #730124 Cross-References: CVE-2011-3256 CVE-2011-3439 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of freetype2 fixes multiple security flaws that could allow attackers to cause a denial of service or to execute arbitrary code via specially crafted fonts (CVE-2011-3256, CVE-2011-3439). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch freetype2-5548 - openSUSE 11.3: zypper in -t patch freetype2-5548 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): freetype2-devel-2.4.4-7.10.1 libfreetype6-2.4.4-7.10.1 - openSUSE 11.4 (x86_64): freetype2-devel-32bit-2.4.4-7.10.1 libfreetype6-32bit-2.4.4-7.10.1 - openSUSE 11.3 (i586 x86_64): freetype2-devel-2.3.12-7.8.1 libfreetype6-2.3.12-7.8.1 - openSUSE 11.3 (x86_64): freetype2-devel-32bit-2.3.12-7.8.1 libfreetype6-32bit-2.3.12-7.8.1 References: http://support.novell.com/security/cve/CVE-2011-3256.html http://support.novell.com/security/cve/CVE-2011-3439.html https://bugzilla.novell.com/730124

1 0

openSUSE-RU-2012:0045-1: moderate: eject: a double free causes SEGFAULT
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: eject: a double free causes SEGFAULT ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0045-1 Rating: moderate References: #716644 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for eject: - 716644: eject SEGFAULT in libc Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch eject-5542 - openSUSE 11.3: zypper in -t patch eject-5542 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): eject-2.1.0-152.153.1 - openSUSE 11.3 (i586 x86_64): eject-2.1.0-149.3.1 References: https://bugzilla.novell.com/716644

1 0

openSUSE-RU-2012:0043-1: moderate: device-mapper: fixed mkinitrd fails to recognize root on lvm on md
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: device-mapper: fixed mkinitrd fails to recognize root on lvm on md ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0043-1 Rating: moderate References: #662053 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update fixes the following issue for device-mapper: - 662053: mkinitrd fails to recognize root on lvm on md Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch device-mapper-5596 - openSUSE 11.3: zypper in -t patch device-mapper-5596 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): device-mapper-1.02.49-19.20.1 device-mapper-devel-1.02.49-19.20.1 lvm2-2.02.67-13.20.1 lvm2-clvm-2.02.67-11.20.1 - openSUSE 11.4 (x86_64): device-mapper-32bit-1.02.49-19.20.1 device-mapper-devel-32bit-1.02.49-19.20.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.02.67]: device-mapper-1.02.49-4.8.1 device-mapper-devel-1.02.49-4.8.1 lvm2-2.02.67-4.8.1 lvm2-clvm-2.02.67-4.8.1 - openSUSE 11.3 (x86_64): device-mapper-32bit-1.02.49-4.8.1 References: https://bugzilla.novell.com/662053

1 0

openSUSE-SU-2012:0040-1: moderate: net6
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: net6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0040-1 Rating: moderate References: #727708 #727710 Cross-References: CVE-2011-4091 CVE-2011-4093 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: this update fixes an information disclosure and a connection hijacking vulnerability (CVE-2011-4091, CVE-2011-4093). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch net6-5585 - openSUSE 11.3: zypper in -t patch net6-5585 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): net6-1.3.14-0.3.1 net6-devel-1.3.14-0.3.1 - openSUSE 11.4 (noarch): net6-lang-1.3.14-0.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.3.14]: net6-1.3.14-0.3.1 net6-devel-1.3.14-0.3.1 - openSUSE 11.3 (noarch) [New Version: 1.3.14]: net6-lang-1.3.14-0.3.1 References: http://support.novell.com/security/cve/CVE-2011-4091.html http://support.novell.com/security/cve/CVE-2011-4093.html https://bugzilla.novell.com/727708 https://bugzilla.novell.com/727710

1 0

openSUSE-SU-2012:0039-1: important: seamonkey
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0039-1 Rating: important References: #737533 Cross-References: CVE-2011-3658 CVE-2011-3660 CVE-2011-3661 CVE-2011-3663 CVE-2011-3665 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. It includes one version update. Description: seamonkey version 2.6 fixes several security issues: * MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety hazards * MFSA 2011-54/CVE-2011-3661: Potentially exploitable crash in the YARR regular expression library * MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds access * MFSA 2011-56/CVE-2011-3663: Key detection without JavaScript via SVG animation * MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to extreme sizes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch seamonkey-5574 - openSUSE 11.3: zypper in -t patch seamonkey-5574 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.6]: seamonkey-2.6-0.2.1 seamonkey-dom-inspector-2.6-0.2.1 seamonkey-irc-2.6-0.2.1 seamonkey-translations-common-2.6-0.2.1 seamonkey-translations-other-2.6-0.2.1 seamonkey-venkman-2.6-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.6]: seamonkey-2.6-0.2.1 seamonkey-dom-inspector-2.6-0.2.1 seamonkey-irc-2.6-0.2.1 seamonkey-translations-common-2.6-0.2.1 seamonkey-translations-other-2.6-0.2.1 seamonkey-venkman-2.6-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3658.html http://support.novell.com/security/cve/CVE-2011-3660.html http://support.novell.com/security/cve/CVE-2011-3661.html http://support.novell.com/security/cve/CVE-2011-3663.html http://support.novell.com/security/cve/CVE-2011-3665.html https://bugzilla.novell.com/737533

1 0

openSUSE-RU-2012:0038-1: moderate: nspluginwrapper: Fix support for private browsing mode
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: nspluginwrapper: Fix support for private browsing mode ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0038-1 Rating: moderate References: #702034 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update of nspluginwrapper to version 1.4.4 provides support for private browsing mode in Plugins (bnc#702034, CVE-2011-2486) and many compatibility fixes with various plugins. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch nspluginwrapper-5499 - openSUSE 11.3: zypper in -t patch nspluginwrapper-5499 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.4.4.0.15]: nspluginwrapper-1.4.4.0.15-0.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.4.4.0.15]: nspluginwrapper-1.4.4.0.15-0.3.1 References: http://support.novell.com/security/cve/CVE-2011-2486.html https://bugzilla.novell.com/702034

1 0

openSUSE-SU-2012:0036-1: FastCGI
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: FastCGI ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0036-1 Rating: low References: #735882 Cross-References: CVE-2011-2766 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issues: - 735882: FastCGI: bypass authentication (CVE-2011-2766) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch FastCGI-5575 - openSUSE 11.3: zypper in -t patch FastCGI-5575 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): FastCGI-2.4.0-149.150.1 FastCGI-devel-2.4.0-149.150.1 perl-FastCGI-2.4.0-149.150.1 - openSUSE 11.3 (i586 x86_64): FastCGI-2.4.0-144.3.1 FastCGI-devel-2.4.0-144.3.1 perl-FastCGI-2.4.0-144.3.1 References: http://support.novell.com/security/cve/CVE-2011-2766.html https://bugzilla.novell.com/735882

1 0

openSUSE-SU-2012:0030-1: moderate: mozilla-nss to 3.13.1
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: mozilla-nss to 3.13.1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0030-1 Rating: moderate References: #726096 Cross-References: CVE-2011-3389 CVE-2011-3640 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: The Mozilla NSS libraries were updated to version 3.13.1 to fix various bugs and security problems. Following security issues were fixed: * SSL 2.0 is disabled by default * A defense against the SSL 3.0 and TLS 1.0 CBC chosen plaintext attack demonstrated by Rizzo and Duong (CVE-2011-3389) is enabled by default. Set the SSL_CBC_RANDOM_IV SSL option to PR_FALSE to disable it. bnc# * SHA-224 is supported * NSS_NoDB_Init does not try to open /pkcs11.txt and /secmod.db anymore (bmo#641052, bnc#726096) (CVE-2011-3640) Also following bugs were fixed: * fix spec file syntax for qemu-workaround * Added a patch to fix errors in the pkcs11n.h header file. (bmo#702090) * better SHA-224 support (bmo#647706) * SHA-224 is supported * Added PORT_ErrorToString and PORT_ErrorToName to return the error message and symbolic name of an NSS error code * Added NSS_GetVersion to return the NSS version string * Added experimental support of RSA-PSS to the softoken only Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch nss-201112-5564 - openSUSE 11.3: zypper in -t patch nss-201112-5564 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 3.13.1]: libfreebl3-3.13.1-0.2.1 libsoftokn3-3.13.1-0.2.1 mozilla-nss-3.13.1-0.2.1 mozilla-nss-certs-3.13.1-0.2.1 mozilla-nss-devel-3.13.1-0.2.1 mozilla-nss-sysinit-3.13.1-0.2.1 mozilla-nss-tools-3.13.1-0.2.1 - openSUSE 11.4 (x86_64) [New Version: 3.13.1]: libfreebl3-32bit-3.13.1-0.2.1 libsoftokn3-32bit-3.13.1-0.2.1 mozilla-nss-32bit-3.13.1-0.2.1 mozilla-nss-certs-32bit-3.13.1-0.2.1 mozilla-nss-sysinit-32bit-3.13.1-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 3.13.1]: libfreebl3-3.13.1-0.2.1 libsoftokn3-3.13.1-0.2.1 mozilla-nss-3.13.1-0.2.1 mozilla-nss-certs-3.13.1-0.2.1 mozilla-nss-devel-3.13.1-0.2.1 mozilla-nss-sysinit-3.13.1-0.2.1 mozilla-nss-tools-3.13.1-0.2.1 - openSUSE 11.3 (x86_64) [New Version: 3.13.1]: libfreebl3-32bit-3.13.1-0.2.1 libsoftokn3-32bit-3.13.1-0.2.1 mozilla-nss-32bit-3.13.1-0.2.1 mozilla-nss-certs-32bit-3.13.1-0.2.1 mozilla-nss-sysinit-32bit-3.13.1-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3389.html http://support.novell.com/security/cve/CVE-2011-3640.html https://bugzilla.novell.com/726096

1 0

openSUSE-SU-2012:0026-1: moderate: VUL-0: CVE-2011-4000: chasen: buffer overflow
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: VUL-0: CVE-2011-4000: chasen: buffer overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0026-1 Rating: moderate References: #735830 Cross-References: CVE-2011-4000 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A potential buffer overflow in ChaSen that could possibly allow remote attackers to execute arbitrary code via a specially crafted string was fixed (CVE-2011-4000). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch chasen-5599 - openSUSE 11.3: zypper in -t patch chasen-5599 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): chasen-2.4.2-65.66.1 chasen-devel-2.4.2-65.66.1 perl-Text-ChaSen-2.4.2-65.66.1 - openSUSE 11.3 (i586 x86_64): chasen-2.4.2-60.3.1 chasen-devel-2.4.2-60.3.1 perl-Text-ChaSen-2.4.2-60.3.1 References: http://support.novell.com/security/cve/CVE-2011-4000.html https://bugzilla.novell.com/735830

1 0

openSUSE-RU-2012:0025-1: important: pam crashes in multi-threaded environment
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: pam crashes in multi-threaded environment ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0025-1 Rating: important References: #735220 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: The previous pam-modules update introduced a regression that could lead to crashes with pam authentication in multi-threaded programs. - 735220: pam crashes in multi-threaded environment Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch pam-modules-5556 - openSUSE 11.3: zypper in -t patch pam-modules-5556 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): pam-modules-11.4-3.6.1 - openSUSE 11.4 (x86_64): pam-modules-32bit-11.4-3.6.1 - openSUSE 11.3 (i586 x86_64) [New Version: 11.3]: pam-modules-11.3-0.5.1 - openSUSE 11.3 (x86_64) [New Version: 11.3]: pam-modules-32bit-11.3-0.5.1 References: https://bugzilla.novell.com/735220

1 0

openSUSE-SU-2012:0019-1: important: krb5-appl: Fixed remote buffer overflow in ktelnetd
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: krb5-appl: Fixed remote buffer overflow in ktelnetd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0019-1 Rating: important References: #698471 #738632 Cross-References: CVE-2011-4862 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of krb5 applications fixes two security issues. CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE.) CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file access problems. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch krb5-appl-5593 - openSUSE 11.3: zypper in -t patch krb5-appl-5593 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): krb5-appl-clients-1.0-7.12.1 krb5-appl-servers-1.0-7.12.1 - openSUSE 11.3 (i586 x86_64): krb5-appl-clients-1.0-4.5.1 krb5-appl-servers-1.0-4.5.1 References: http://support.novell.com/security/cve/CVE-2011-4862.html https://bugzilla.novell.com/698471 https://bugzilla.novell.com/738632

1 0

openSUSE-SU-2012:0015-1: important: freetype2
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0015-1 Rating: important References: #730124 Cross-References: CVE-2011-3256 CVE-2011-3439 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of freetype2 fixes multiple security flaws that could allow attackers to cause a denial of service or to execute arbitrary code via specially crafted fonts (CVE-2011-3256, CVE-2011-3439). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch freetype2-5548 - openSUSE 11.3: zypper in -t patch freetype2-5548 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): freetype2-devel-2.4.4-7.10.1 libfreetype6-2.4.4-7.10.1 - openSUSE 11.4 (x86_64): freetype2-devel-32bit-2.4.4-7.10.1 libfreetype6-32bit-2.4.4-7.10.1 - openSUSE 11.3 (i586 x86_64): freetype2-devel-2.3.12-7.8.1 libfreetype6-2.3.12-7.8.1 - openSUSE 11.3 (x86_64): freetype2-devel-32bit-2.3.12-7.8.1 libfreetype6-32bit-2.3.12-7.8.1 References: http://support.novell.com/security/cve/CVE-2011-3256.html http://support.novell.com/security/cve/CVE-2011-3439.html https://bugzilla.novell.com/730124

1 0

openSUSE-RU-2012:0013-1: moderate: eject: a double free causes SEGFAULT
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: eject: a double free causes SEGFAULT ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0013-1 Rating: moderate References: #716644 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for eject: - 716644: eject SEGFAULT in libc Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch eject-5542 - openSUSE 11.3: zypper in -t patch eject-5542 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): eject-2.1.0-152.153.1 - openSUSE 11.3 (i586 x86_64): eject-2.1.0-149.3.1 References: https://bugzilla.novell.com/716644

1 0

openSUSE-RU-2012:0011-1: moderate: device-mapper: fixed mkinitrd fails to recognize root on lvm on md
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: device-mapper: fixed mkinitrd fails to recognize root on lvm on md ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0011-1 Rating: moderate References: #662053 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update fixes the following issue for device-mapper: - 662053: mkinitrd fails to recognize root on lvm on md Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch device-mapper-5596 - openSUSE 11.3: zypper in -t patch device-mapper-5596 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): device-mapper-1.02.49-19.20.1 device-mapper-devel-1.02.49-19.20.1 lvm2-2.02.67-13.20.1 lvm2-clvm-2.02.67-11.20.1 - openSUSE 11.4 (x86_64): device-mapper-32bit-1.02.49-19.20.1 device-mapper-devel-32bit-1.02.49-19.20.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.02.67]: device-mapper-1.02.49-4.8.1 device-mapper-devel-1.02.49-4.8.1 lvm2-2.02.67-4.8.1 lvm2-clvm-2.02.67-4.8.1 - openSUSE 11.3 (x86_64): device-mapper-32bit-1.02.49-4.8.1 References: https://bugzilla.novell.com/662053

1 0

openSUSE-SU-2012:0008-1: moderate: net6
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: net6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0008-1 Rating: moderate References: #727708 #727710 Cross-References: CVE-2011-4091 CVE-2011-4093 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: this update fixes an information disclosure and a connection hijacking vulnerability (CVE-2011-4091, CVE-2011-4093). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch net6-5585 - openSUSE 11.3: zypper in -t patch net6-5585 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): net6-1.3.14-0.3.1 net6-devel-1.3.14-0.3.1 - openSUSE 11.4 (noarch): net6-lang-1.3.14-0.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.3.14]: net6-1.3.14-0.3.1 net6-devel-1.3.14-0.3.1 - openSUSE 11.3 (noarch) [New Version: 1.3.14]: net6-lang-1.3.14-0.3.1 References: http://support.novell.com/security/cve/CVE-2011-4091.html http://support.novell.com/security/cve/CVE-2011-4093.html https://bugzilla.novell.com/727708 https://bugzilla.novell.com/727710

1 0

openSUSE-SU-2012:0007-1: important: seamonkey
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0007-1 Rating: important References: #737533 Cross-References: CVE-2011-3658 CVE-2011-3660 CVE-2011-3661 CVE-2011-3663 CVE-2011-3665 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. It includes one version update. Description: seamonkey version 2.6 fixes several security issues: * MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety hazards * MFSA 2011-54/CVE-2011-3661: Potentially exploitable crash in the YARR regular expression library * MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds access * MFSA 2011-56/CVE-2011-3663: Key detection without JavaScript via SVG animation * MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to extreme sizes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch seamonkey-5574 - openSUSE 11.3: zypper in -t patch seamonkey-5574 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.6]: seamonkey-2.6-0.2.1 seamonkey-dom-inspector-2.6-0.2.1 seamonkey-irc-2.6-0.2.1 seamonkey-translations-common-2.6-0.2.1 seamonkey-translations-other-2.6-0.2.1 seamonkey-venkman-2.6-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.6]: seamonkey-2.6-0.2.1 seamonkey-dom-inspector-2.6-0.2.1 seamonkey-irc-2.6-0.2.1 seamonkey-translations-common-2.6-0.2.1 seamonkey-translations-other-2.6-0.2.1 seamonkey-venkman-2.6-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3658.html http://support.novell.com/security/cve/CVE-2011-3660.html http://support.novell.com/security/cve/CVE-2011-3661.html http://support.novell.com/security/cve/CVE-2011-3663.html http://support.novell.com/security/cve/CVE-2011-3665.html https://bugzilla.novell.com/737533

1 0

openSUSE-RU-2012:0006-1: moderate: nspluginwrapper: Fix support for private browsing mode
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: nspluginwrapper: Fix support for private browsing mode ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0006-1 Rating: moderate References: #702034 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update of nspluginwrapper to version 1.4.4 provides support for private browsing mode in Plugins (bnc#702034, CVE-2011-2486) and many compatibility fixes with various plugins. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch nspluginwrapper-5499 - openSUSE 11.3: zypper in -t patch nspluginwrapper-5499 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.4.4.0.15]: nspluginwrapper-1.4.4.0.15-0.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.4.4.0.15]: nspluginwrapper-1.4.4.0.15-0.3.1 References: http://support.novell.com/security/cve/CVE-2011-2486.html https://bugzilla.novell.com/702034

1 0

openSUSE-SU-2012:0004-1: FastCGI
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: FastCGI ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0004-1 Rating: low References: #735882 Cross-References: CVE-2011-2766 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issues: - 735882: FastCGI: bypass authentication (CVE-2011-2766) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch FastCGI-5575 - openSUSE 11.3: zypper in -t patch FastCGI-5575 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): FastCGI-2.4.0-149.150.1 FastCGI-devel-2.4.0-149.150.1 perl-FastCGI-2.4.0-149.150.1 - openSUSE 11.3 (i586 x86_64): FastCGI-2.4.0-144.3.1 FastCGI-devel-2.4.0-144.3.1 perl-FastCGI-2.4.0-144.3.1 References: http://support.novell.com/security/cve/CVE-2011-2766.html https://bugzilla.novell.com/735882

1 0