January 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2012:0087-1: important: acroread
by opensuse-security＠opensuse.org 17 Jan '12

17 Jan '12

openSUSE Security Update: acroread ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0087-1 Rating: important References: #735275 Cross-References: CVE-2011-2462 CVE-2011-4369 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: Acrobat Reader was updated to version 9.4.7 to fix security issues (CVE-2011-2462, CVE-2011-4369) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch acroread-5650 - openSUSE 11.3: zypper in -t patch acroread-5650 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586) [New Version: 9.4.7]: acroread-9.4.7-0.3.1 - openSUSE 11.3 (i586) [New Version: 9.4.7]: acroread-9.4.7-0.3.1 References: http://support.novell.com/security/cve/CVE-2011-2462.html http://support.novell.com/security/cve/CVE-2011-4369.html https://bugzilla.novell.com/735275

1 0

openSUSE-SU-2012:0083-1: important: openssl: fixing various security issues
by opensuse-security＠opensuse.org 16 Jan '12

16 Jan '12

openSUSE Security Update: openssl: fixing various security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0083-1 Rating: important References: #739719 Cross-References: CVE-2011-4108 CVE-2011-4576 CVE-2011-4577 CVE-2011-4619 CVE-2012-0027 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: Various security vulnerabilities have been fixed in openssl: - DTLS plaintext recovery attack (CVE-2011-4108) - uninitialized SSL 3.0 padding (CVE-2011-4576) - malformed RFC 3779 data can cause assertion failures (CVE-2011-4577) - SGC restart DoS attack (CVE-2011-4619) - invalid GOST parameters DoS attack (CVE-2012-0027) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libopenssl-devel-5634 - openSUSE 11.3: zypper in -t patch libopenssl-devel-5634 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libopenssl-devel-1.0.0c-18.23.1 libopenssl1_0_0-1.0.0c-18.23.1 openssl-1.0.0c-18.23.1 - openSUSE 11.4 (x86_64): libopenssl1_0_0-32bit-1.0.0c-18.23.1 - openSUSE 11.4 (noarch): openssl-doc-1.0.0c-18.23.1 - openSUSE 11.3 (i586 x86_64): libopenssl-devel-1.0.0-6.13.1 libopenssl1_0_0-1.0.0-6.13.1 openssl-1.0.0-6.13.1 - openSUSE 11.3 (x86_64): libopenssl1_0_0-32bit-1.0.0-6.13.1 - openSUSE 11.3 (noarch): openssl-doc-1.0.0-6.13.1 References: http://support.novell.com/security/cve/CVE-2011-4108.html http://support.novell.com/security/cve/CVE-2011-4576.html http://support.novell.com/security/cve/CVE-2011-4577.html http://support.novell.com/security/cve/CVE-2011-4619.html http://support.novell.com/security/cve/CVE-2012-0027.html https://bugzilla.novell.com/739719

1 0

openSUSE-SU-2011:1331-2: moderate: system-config-printer (CVE-2011-4405, CVE-2011-2899)
by opensuse-security＠opensuse.org 13 Jan '12

13 Jan '12

openSUSE Security Update: system-config-printer (CVE-2011-4405, CVE-2011-2899) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1331-2 Rating: moderate References: #733542 #735322 Cross-References: CVE-2011-2899 CVE-2011-4405 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes a typo from the previous update: system-config-printer used an unauthenticated connection when downloading printer drivers from openprinting.org (CVE-2011-4405). This update disables the printer driver download feature. system-config-printer did not properly quote shell meta characters in SMB server or workgroup names when passing them to the shell (CVE-2011-2899). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch python-cupshelpers-5604 - openSUSE 11.3: zypper in -t patch python-cupshelpers-5604 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): python-cupshelpers-1.2.5-5.10.1 system-config-printer-1.2.5-5.10.1 udev-configure-printer-1.2.5-5.10.1 - openSUSE 11.4 (noarch): system-config-printer-lang-1.2.5-5.10.1 - openSUSE 11.3 (i586 x86_64): python-cupshelpers-1.2.0-2.7.1 system-config-printer-1.2.0-2.7.1 udev-configure-printer-1.2.0-2.7.1 - openSUSE 11.3 (noarch): system-config-printer-lang-1.2.0-2.7.1 References: http://support.novell.com/security/cve/CVE-2011-2899.html http://support.novell.com/security/cve/CVE-2011-4405.html https://bugzilla.novell.com/733542 https://bugzilla.novell.com/735322

1 0

openSUSE-RU-2012:0075-1: iptables: Fix iptables-apply command
by maintenance＠opensuse.org 13 Jan '12

13 Jan '12

openSUSE Recommended Update: iptables: Fix iptables-apply command ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0075-1 Rating: low References: #730161 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for iptables: - 730161: iptables-apply uses unknown command "tempfile" Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch iptables-5592 - openSUSE 11.3: zypper in -t patch iptables-5592 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): iptables-1.4.10-4.5.1 iptables-devel-1.4.10-4.5.1 - openSUSE 11.3 (i586 x86_64): iptables-1.4.8-2.3.1 iptables-devel-1.4.8-2.3.1 References: https://bugzilla.novell.com/730161

1 0

openSUSE-SU-2012:0073-1: libxml2
by opensuse-security＠opensuse.org 12 Jan '12

12 Jan '12

openSUSE Security Update: libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0073-1 Rating: low References: #732787 Cross-References: CVE-2011-2821 CVE-2011-2834 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Specially crafted XPath expressions could allow attackers to cause a denial of service or possibly have unspecified other impact (CVE-2011-2821,CVE-2011-2834). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libxml2-5488 - openSUSE 11.3: zypper in -t patch libxml2-5488 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libxml2-2.7.8-16.19.1 libxml2-devel-2.7.8-16.19.1 - openSUSE 11.4 (x86_64): libxml2-32bit-2.7.8-16.19.1 libxml2-devel-32bit-2.7.8-16.19.1 - openSUSE 11.4 (noarch): libxml2-doc-2.7.8-16.19.1 - openSUSE 11.3 (i586 x86_64): libxml2-2.7.7-4.9.1 libxml2-devel-2.7.7-4.9.1 - openSUSE 11.3 (x86_64): libxml2-32bit-2.7.7-4.9.1 libxml2-devel-32bit-2.7.7-4.9.1 - openSUSE 11.3 (noarch): libxml2-doc-2.7.7-4.9.1 References: http://support.novell.com/security/cve/CVE-2011-2821.html http://support.novell.com/security/cve/CVE-2011-2834.html https://bugzilla.novell.com/732787

1 0

openSUSE-SU-2012:0066-1: moderate: pidgin
by opensuse-security＠opensuse.org 09 Jan '12

09 Jan '12

openSUSE Security Update: pidgin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0066-1 Rating: moderate References: #736147 Cross-References: CVE-2011-1091 CVE-2011-4601 CVE-2011-4602 CVE-2011-4603 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: Remote users could crash pidgin via ICQ, SILC, XMPP and Yahoo protocols (CVE-2011-4601, CVE-2011-4603, CVE-2011-4602, CVE-2011-1091). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch finch-5557 - openSUSE 11.3: zypper in -t patch finch-5557 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): finch-2.7.10-4.7.1 finch-devel-2.7.10-4.7.1 libpurple-2.7.10-4.7.1 libpurple-devel-2.7.10-4.7.1 libpurple-meanwhile-2.7.10-4.7.1 libpurple-tcl-2.7.10-4.7.1 pidgin-2.7.10-4.7.1 pidgin-devel-2.7.10-4.7.1 pidgin-evolution-2.7.10-4.7.1 - openSUSE 11.4 (noarch): libpurple-lang-2.7.10-4.7.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.7.9]: finch-2.7.9-1.6.1 finch-devel-2.7.9-1.6.1 libpurple-2.7.9-1.6.1 libpurple-devel-2.7.9-1.6.1 libpurple-meanwhile-2.7.9-1.6.1 libpurple-mono-2.7.9-1.6.1 libpurple-tcl-2.7.9-1.6.1 pidgin-2.7.9-1.6.1 pidgin-devel-2.7.9-1.6.1 - openSUSE 11.3 (noarch) [New Version: 2.7.9]: libpurple-lang-2.7.9-1.6.1 References: http://support.novell.com/security/cve/CVE-2011-1091.html http://support.novell.com/security/cve/CVE-2011-4601.html http://support.novell.com/security/cve/CVE-2011-4602.html http://support.novell.com/security/cve/CVE-2011-4603.html https://bugzilla.novell.com/736147

1 0

openSUSE-RU-2012:0065-1: moderate: xfce4-panel-plugin-xkb : Major memory leak
by maintenance＠opensuse.org 09 Jan '12

09 Jan '12

openSUSE Recommended Update: xfce4-panel-plugin-xkb : Major memory leak ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0065-1 Rating: moderate References: #734851 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes two new package versions. Description: This update fixes the following issue for xfce4-panel-plugin-xkb: - 734851: fixed major memory leak with version update to 0.5.4.2 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch xfce4-panel-plugin-battery-5553 - openSUSE 11.3: zypper in -t patch xfce4-panel-plugin-battery-5553 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 0.5.4.2]: xfce4-panel-plugin-battery-1.0.0-2.3.1 xfce4-panel-plugin-cddrive-0.0.1-19.3.1 xfce4-panel-plugin-cellmodem-0.0.5-24.3.1 xfce4-panel-plugin-clipman-1.1.3-18.3.1 xfce4-panel-plugin-clipman-doc-1.1.3-4.3.1 xfce4-panel-plugin-cpufreq-1.0.0-3.3.1 xfce4-panel-plugin-cpugraph-1.0.1-6.3.1 xfce4-panel-plugin-datetime-0.6.1-18.3.1 xfce4-panel-plugin-diskperf-2.3.0-3.3.1 xfce4-panel-plugin-eyes-4.4.1-2.3.1 xfce4-panel-plugin-fsguard-1.0.0-4.3.1 xfce4-panel-plugin-genmon-3.2-24.3.1 xfce4-panel-plugin-mailwatch-1.1.0-6.3.1 xfce4-panel-plugin-mount-0.5.5-18.3.1 xfce4-panel-plugin-mpc-0.3.6-3.3.1 xfce4-panel-plugin-netload-1.0.0-4.3.1 xfce4-panel-plugin-notes-1.7.7-6.3.1 xfce4-panel-plugin-places-1.2.0-17.3.1 xfce4-panel-plugin-quicklauncher-1.9.4-24.3.1 xfce4-panel-plugin-radio-0.4.4-6.3.1 xfce4-panel-plugin-screenshooter-1.7.9.99_git20110203-5.10.1 xfce4-panel-plugin-sensors-1.0.0-4.3.1 xfce4-panel-plugin-sensors-devel-1.0.0-4.3.1 xfce4-panel-plugin-smartbookmark-0.4.2-24.3.1 xfce4-panel-plugin-systemload-1.0.0-4.3.1 xfce4-panel-plugin-timeout-1.0.0-4.3.1 xfce4-panel-plugin-timer-0.6.1-18.3.1 xfce4-panel-plugin-verve-1.0.0-4.3.1 xfce4-panel-plugin-wavelan-0.5.6-6.3.1 xfce4-panel-plugin-weather-0.7.4-3.3.1 xfce4-panel-plugin-xfapplet-0.1.0-24.3.1 xfce4-panel-plugin-xkb-0.5.4.2-0.3.1 xfce4-panel-plugin-xmms-0.5.3-3.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 0.5.4.2]: xfce4-panel-plugin-battery-0.5.0-11.3.1 xfce4-panel-plugin-cddrive-0.0.1-11.3.1 xfce4-panel-plugin-cellmodem-0.0.5-11.3.1 xfce4-panel-plugin-clipman-1.1.3-11.3.1 xfce4-panel-plugin-cpufreq-0.0.1-11.3.1 xfce4-panel-plugin-cpugraph-0.4.0-11.3.1 xfce4-panel-plugin-datetime-0.6.1-11.3.1 xfce4-panel-plugin-diskperf-2.1.0-11.3.1 xfce4-panel-plugin-eyes-4.4.0-11.3.1 xfce4-panel-plugin-fsguard-0.4.2-11.3.1 xfce4-panel-plugin-genmon-3.2-11.3.1 xfce4-panel-plugin-governor-0.1.0-11.3.1 xfce4-panel-plugin-mailwatch-1.0.1-11.3.1 xfce4-panel-plugin-mount-0.5.5-11.3.1 xfce4-panel-plugin-mpc-0.3.4-11.3.1 xfce4-panel-plugin-netload-0.4.0-11.3.1 xfce4-panel-plugin-notes-1.7.2-11.3.1 xfce4-panel-plugin-places-1.2.0-11.3.1 xfce4-panel-plugin-quicklauncher-1.9.4-11.3.1 xfce4-panel-plugin-radio-0.4.2-11.3.1 xfce4-panel-plugin-screenshooter-1.6.0-11.3.1 xfce4-panel-plugin-sensors-0.10.99.6-11.3.1 xfce4-panel-plugin-smartbookmark-0.4.2-11.3.1 xfce4-panel-plugin-smartpm-0.1.2-11.3.1 xfce4-panel-plugin-systemload-0.4.2-11.3.1 xfce4-panel-plugin-timeout-0.1.1-11.3.1 xfce4-panel-plugin-timer-0.6.1-11.3.1 xfce4-panel-plugin-verve-0.3.6-11.3.1 xfce4-panel-plugin-wavelan-0.5.5-11.3.1 xfce4-panel-plugin-weather-0.7.3-11.3.1 xfce4-panel-plugin-xfapplet-0.1.0-11.3.1 xfce4-panel-plugin-xfmedia-remote-0.2.2-11.3.1 xfce4-panel-plugin-xkb-0.5.4.2-0.3.1 xfce4-panel-plugin-xmms-0.5.2-11.3.1 References: https://bugzilla.novell.com/734851

1 0

openSUSE-SU-2012:0064-1: important: glibc
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0064-1 Rating: important References: #735850 Cross-References: CVE-2009-5029 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted time zone files could cause a heap overflow in glibc (CVE-2009-5029). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch glibc-5554 - openSUSE 11.3: zypper in -t patch glibc-5554 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 i686 x86_64): glibc-2.11.3-12.21.1 glibc-devel-2.11.3-12.21.1 - openSUSE 11.4 (i586 x86_64): glibc-html-2.11.3-12.21.1 glibc-i18ndata-2.11.3-12.21.1 glibc-info-2.11.3-12.21.1 glibc-locale-2.11.3-12.21.1 glibc-obsolete-2.11.3-12.21.1 glibc-profile-2.11.3-12.21.1 nscd-2.11.3-12.21.1 - openSUSE 11.4 (x86_64): glibc-32bit-2.11.3-12.21.1 glibc-devel-32bit-2.11.3-12.21.1 glibc-locale-32bit-2.11.3-12.21.1 glibc-profile-32bit-2.11.3-12.21.1 - openSUSE 11.3 (i586 i686 x86_64): glibc-2.11.2-3.7.1 glibc-devel-2.11.2-3.7.1 - openSUSE 11.3 (i586 x86_64): glibc-html-2.11.2-3.7.1 glibc-i18ndata-2.11.2-3.7.1 glibc-info-2.11.2-3.7.1 glibc-locale-2.11.2-3.7.1 glibc-obsolete-2.11.2-3.7.1 glibc-profile-2.11.2-3.7.1 nscd-2.11.2-3.7.1 - openSUSE 11.3 (x86_64): glibc-32bit-2.11.2-3.7.1 glibc-devel-32bit-2.11.2-3.7.1 glibc-locale-32bit-2.11.2-3.7.1 glibc-profile-32bit-2.11.2-3.7.1 References: http://support.novell.com/security/cve/CVE-2009-5029.html https://bugzilla.novell.com/735850

1 0

openSUSE-SU-2012:0063-1: moderate: mozilla-nss to 3.13.1
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: mozilla-nss to 3.13.1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0063-1 Rating: moderate References: #726096 Cross-References: CVE-2011-3389 CVE-2011-3640 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: The Mozilla NSS libraries were updated to version 3.13.1 to fix various bugs and security problems. Following security issues were fixed: * SSL 2.0 is disabled by default * A defense against the SSL 3.0 and TLS 1.0 CBC chosen plaintext attack demonstrated by Rizzo and Duong (CVE-2011-3389) is enabled by default. Set the SSL_CBC_RANDOM_IV SSL option to PR_FALSE to disable it. bnc# * SHA-224 is supported * NSS_NoDB_Init does not try to open /pkcs11.txt and /secmod.db anymore (bmo#641052, bnc#726096) (CVE-2011-3640) Also following bugs were fixed: * fix spec file syntax for qemu-workaround * Added a patch to fix errors in the pkcs11n.h header file. (bmo#702090) * better SHA-224 support (bmo#647706) * SHA-224 is supported * Added PORT_ErrorToString and PORT_ErrorToName to return the error message and symbolic name of an NSS error code * Added NSS_GetVersion to return the NSS version string * Added experimental support of RSA-PSS to the softoken only Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch nss-201112-5564 - openSUSE 11.3: zypper in -t patch nss-201112-5564 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 3.13.1]: libfreebl3-3.13.1-0.2.1 libsoftokn3-3.13.1-0.2.1 mozilla-nss-3.13.1-0.2.1 mozilla-nss-certs-3.13.1-0.2.1 mozilla-nss-devel-3.13.1-0.2.1 mozilla-nss-sysinit-3.13.1-0.2.1 mozilla-nss-tools-3.13.1-0.2.1 - openSUSE 11.4 (x86_64) [New Version: 3.13.1]: libfreebl3-32bit-3.13.1-0.2.1 libsoftokn3-32bit-3.13.1-0.2.1 mozilla-nss-32bit-3.13.1-0.2.1 mozilla-nss-certs-32bit-3.13.1-0.2.1 mozilla-nss-sysinit-32bit-3.13.1-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 3.13.1]: libfreebl3-3.13.1-0.2.1 libsoftokn3-3.13.1-0.2.1 mozilla-nss-3.13.1-0.2.1 mozilla-nss-certs-3.13.1-0.2.1 mozilla-nss-devel-3.13.1-0.2.1 mozilla-nss-sysinit-3.13.1-0.2.1 mozilla-nss-tools-3.13.1-0.2.1 - openSUSE 11.3 (x86_64) [New Version: 3.13.1]: libfreebl3-32bit-3.13.1-0.2.1 libsoftokn3-32bit-3.13.1-0.2.1 mozilla-nss-32bit-3.13.1-0.2.1 mozilla-nss-certs-32bit-3.13.1-0.2.1 mozilla-nss-sysinit-32bit-3.13.1-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3389.html http://support.novell.com/security/cve/CVE-2011-3640.html https://bugzilla.novell.com/726096

1 0

openSUSE-RU-2012:0062-1: sudo -i unsets $DISPLAY - but manpage says it doesn't
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: sudo -i unsets $DISPLAY - but manpage says it doesn't ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0062-1 Rating: low References: #720181 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update fixes the following issue for sudo: - 720181: manpage-fix sudo -i unsets $DISPLAY Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch sudo-5544 - openSUSE 11.3: zypper in -t patch sudo-5544 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.7.6p2]: sudo-1.7.6p2-0.5.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.7.6p2]: sudo-1.7.6p2-0.5.1 References: https://bugzilla.novell.com/720181

1 0