January 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2012:0030-1: moderate: mozilla-nss to 3.13.1
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: mozilla-nss to 3.13.1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0030-1 Rating: moderate References: #726096 Cross-References: CVE-2011-3389 CVE-2011-3640 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: The Mozilla NSS libraries were updated to version 3.13.1 to fix various bugs and security problems. Following security issues were fixed: * SSL 2.0 is disabled by default * A defense against the SSL 3.0 and TLS 1.0 CBC chosen plaintext attack demonstrated by Rizzo and Duong (CVE-2011-3389) is enabled by default. Set the SSL_CBC_RANDOM_IV SSL option to PR_FALSE to disable it. bnc# * SHA-224 is supported * NSS_NoDB_Init does not try to open /pkcs11.txt and /secmod.db anymore (bmo#641052, bnc#726096) (CVE-2011-3640) Also following bugs were fixed: * fix spec file syntax for qemu-workaround * Added a patch to fix errors in the pkcs11n.h header file. (bmo#702090) * better SHA-224 support (bmo#647706) * SHA-224 is supported * Added PORT_ErrorToString and PORT_ErrorToName to return the error message and symbolic name of an NSS error code * Added NSS_GetVersion to return the NSS version string * Added experimental support of RSA-PSS to the softoken only Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch nss-201112-5564 - openSUSE 11.3: zypper in -t patch nss-201112-5564 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 3.13.1]: libfreebl3-3.13.1-0.2.1 libsoftokn3-3.13.1-0.2.1 mozilla-nss-3.13.1-0.2.1 mozilla-nss-certs-3.13.1-0.2.1 mozilla-nss-devel-3.13.1-0.2.1 mozilla-nss-sysinit-3.13.1-0.2.1 mozilla-nss-tools-3.13.1-0.2.1 - openSUSE 11.4 (x86_64) [New Version: 3.13.1]: libfreebl3-32bit-3.13.1-0.2.1 libsoftokn3-32bit-3.13.1-0.2.1 mozilla-nss-32bit-3.13.1-0.2.1 mozilla-nss-certs-32bit-3.13.1-0.2.1 mozilla-nss-sysinit-32bit-3.13.1-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 3.13.1]: libfreebl3-3.13.1-0.2.1 libsoftokn3-3.13.1-0.2.1 mozilla-nss-3.13.1-0.2.1 mozilla-nss-certs-3.13.1-0.2.1 mozilla-nss-devel-3.13.1-0.2.1 mozilla-nss-sysinit-3.13.1-0.2.1 mozilla-nss-tools-3.13.1-0.2.1 - openSUSE 11.3 (x86_64) [New Version: 3.13.1]: libfreebl3-32bit-3.13.1-0.2.1 libsoftokn3-32bit-3.13.1-0.2.1 mozilla-nss-32bit-3.13.1-0.2.1 mozilla-nss-certs-32bit-3.13.1-0.2.1 mozilla-nss-sysinit-32bit-3.13.1-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3389.html http://support.novell.com/security/cve/CVE-2011-3640.html https://bugzilla.novell.com/726096

1 0

openSUSE-SU-2012:0026-1: moderate: VUL-0: CVE-2011-4000: chasen: buffer overflow
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: VUL-0: CVE-2011-4000: chasen: buffer overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0026-1 Rating: moderate References: #735830 Cross-References: CVE-2011-4000 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A potential buffer overflow in ChaSen that could possibly allow remote attackers to execute arbitrary code via a specially crafted string was fixed (CVE-2011-4000). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch chasen-5599 - openSUSE 11.3: zypper in -t patch chasen-5599 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): chasen-2.4.2-65.66.1 chasen-devel-2.4.2-65.66.1 perl-Text-ChaSen-2.4.2-65.66.1 - openSUSE 11.3 (i586 x86_64): chasen-2.4.2-60.3.1 chasen-devel-2.4.2-60.3.1 perl-Text-ChaSen-2.4.2-60.3.1 References: http://support.novell.com/security/cve/CVE-2011-4000.html https://bugzilla.novell.com/735830

1 0

openSUSE-RU-2012:0025-1: important: pam crashes in multi-threaded environment
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: pam crashes in multi-threaded environment ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0025-1 Rating: important References: #735220 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: The previous pam-modules update introduced a regression that could lead to crashes with pam authentication in multi-threaded programs. - 735220: pam crashes in multi-threaded environment Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch pam-modules-5556 - openSUSE 11.3: zypper in -t patch pam-modules-5556 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): pam-modules-11.4-3.6.1 - openSUSE 11.4 (x86_64): pam-modules-32bit-11.4-3.6.1 - openSUSE 11.3 (i586 x86_64) [New Version: 11.3]: pam-modules-11.3-0.5.1 - openSUSE 11.3 (x86_64) [New Version: 11.3]: pam-modules-32bit-11.3-0.5.1 References: https://bugzilla.novell.com/735220

1 0

openSUSE-SU-2012:0019-1: important: krb5-appl: Fixed remote buffer overflow in ktelnetd
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: krb5-appl: Fixed remote buffer overflow in ktelnetd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0019-1 Rating: important References: #698471 #738632 Cross-References: CVE-2011-4862 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of krb5 applications fixes two security issues. CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE.) CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file access problems. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch krb5-appl-5593 - openSUSE 11.3: zypper in -t patch krb5-appl-5593 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): krb5-appl-clients-1.0-7.12.1 krb5-appl-servers-1.0-7.12.1 - openSUSE 11.3 (i586 x86_64): krb5-appl-clients-1.0-4.5.1 krb5-appl-servers-1.0-4.5.1 References: http://support.novell.com/security/cve/CVE-2011-4862.html https://bugzilla.novell.com/698471 https://bugzilla.novell.com/738632

1 0

openSUSE-SU-2012:0015-1: important: freetype2
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0015-1 Rating: important References: #730124 Cross-References: CVE-2011-3256 CVE-2011-3439 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of freetype2 fixes multiple security flaws that could allow attackers to cause a denial of service or to execute arbitrary code via specially crafted fonts (CVE-2011-3256, CVE-2011-3439). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch freetype2-5548 - openSUSE 11.3: zypper in -t patch freetype2-5548 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): freetype2-devel-2.4.4-7.10.1 libfreetype6-2.4.4-7.10.1 - openSUSE 11.4 (x86_64): freetype2-devel-32bit-2.4.4-7.10.1 libfreetype6-32bit-2.4.4-7.10.1 - openSUSE 11.3 (i586 x86_64): freetype2-devel-2.3.12-7.8.1 libfreetype6-2.3.12-7.8.1 - openSUSE 11.3 (x86_64): freetype2-devel-32bit-2.3.12-7.8.1 libfreetype6-32bit-2.3.12-7.8.1 References: http://support.novell.com/security/cve/CVE-2011-3256.html http://support.novell.com/security/cve/CVE-2011-3439.html https://bugzilla.novell.com/730124

1 0

openSUSE-RU-2012:0013-1: moderate: eject: a double free causes SEGFAULT
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: eject: a double free causes SEGFAULT ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0013-1 Rating: moderate References: #716644 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for eject: - 716644: eject SEGFAULT in libc Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch eject-5542 - openSUSE 11.3: zypper in -t patch eject-5542 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): eject-2.1.0-152.153.1 - openSUSE 11.3 (i586 x86_64): eject-2.1.0-149.3.1 References: https://bugzilla.novell.com/716644

1 0

openSUSE-RU-2012:0011-1: moderate: device-mapper: fixed mkinitrd fails to recognize root on lvm on md
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: device-mapper: fixed mkinitrd fails to recognize root on lvm on md ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0011-1 Rating: moderate References: #662053 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update fixes the following issue for device-mapper: - 662053: mkinitrd fails to recognize root on lvm on md Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch device-mapper-5596 - openSUSE 11.3: zypper in -t patch device-mapper-5596 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): device-mapper-1.02.49-19.20.1 device-mapper-devel-1.02.49-19.20.1 lvm2-2.02.67-13.20.1 lvm2-clvm-2.02.67-11.20.1 - openSUSE 11.4 (x86_64): device-mapper-32bit-1.02.49-19.20.1 device-mapper-devel-32bit-1.02.49-19.20.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.02.67]: device-mapper-1.02.49-4.8.1 device-mapper-devel-1.02.49-4.8.1 lvm2-2.02.67-4.8.1 lvm2-clvm-2.02.67-4.8.1 - openSUSE 11.3 (x86_64): device-mapper-32bit-1.02.49-4.8.1 References: https://bugzilla.novell.com/662053

1 0

openSUSE-SU-2012:0008-1: moderate: net6
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: net6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0008-1 Rating: moderate References: #727708 #727710 Cross-References: CVE-2011-4091 CVE-2011-4093 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: this update fixes an information disclosure and a connection hijacking vulnerability (CVE-2011-4091, CVE-2011-4093). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch net6-5585 - openSUSE 11.3: zypper in -t patch net6-5585 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): net6-1.3.14-0.3.1 net6-devel-1.3.14-0.3.1 - openSUSE 11.4 (noarch): net6-lang-1.3.14-0.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.3.14]: net6-1.3.14-0.3.1 net6-devel-1.3.14-0.3.1 - openSUSE 11.3 (noarch) [New Version: 1.3.14]: net6-lang-1.3.14-0.3.1 References: http://support.novell.com/security/cve/CVE-2011-4091.html http://support.novell.com/security/cve/CVE-2011-4093.html https://bugzilla.novell.com/727708 https://bugzilla.novell.com/727710

1 0

openSUSE-SU-2012:0007-1: important: seamonkey
by opensuse-security＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Security Update: seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0007-1 Rating: important References: #737533 Cross-References: CVE-2011-3658 CVE-2011-3660 CVE-2011-3661 CVE-2011-3663 CVE-2011-3665 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. It includes one version update. Description: seamonkey version 2.6 fixes several security issues: * MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety hazards * MFSA 2011-54/CVE-2011-3661: Potentially exploitable crash in the YARR regular expression library * MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds access * MFSA 2011-56/CVE-2011-3663: Key detection without JavaScript via SVG animation * MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to extreme sizes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch seamonkey-5574 - openSUSE 11.3: zypper in -t patch seamonkey-5574 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.6]: seamonkey-2.6-0.2.1 seamonkey-dom-inspector-2.6-0.2.1 seamonkey-irc-2.6-0.2.1 seamonkey-translations-common-2.6-0.2.1 seamonkey-translations-other-2.6-0.2.1 seamonkey-venkman-2.6-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.6]: seamonkey-2.6-0.2.1 seamonkey-dom-inspector-2.6-0.2.1 seamonkey-irc-2.6-0.2.1 seamonkey-translations-common-2.6-0.2.1 seamonkey-translations-other-2.6-0.2.1 seamonkey-venkman-2.6-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3658.html http://support.novell.com/security/cve/CVE-2011-3660.html http://support.novell.com/security/cve/CVE-2011-3661.html http://support.novell.com/security/cve/CVE-2011-3663.html http://support.novell.com/security/cve/CVE-2011-3665.html https://bugzilla.novell.com/737533

1 0

openSUSE-RU-2012:0006-1: moderate: nspluginwrapper: Fix support for private browsing mode
by maintenance＠opensuse.org 05 Jan '12

05 Jan '12

openSUSE Recommended Update: nspluginwrapper: Fix support for private browsing mode ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0006-1 Rating: moderate References: #702034 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update of nspluginwrapper to version 1.4.4 provides support for private browsing mode in Plugins (bnc#702034, CVE-2011-2486) and many compatibility fixes with various plugins. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch nspluginwrapper-5499 - openSUSE 11.3: zypper in -t patch nspluginwrapper-5499 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.4.4.0.15]: nspluginwrapper-1.4.4.0.15-0.3.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.4.4.0.15]: nspluginwrapper-1.4.4.0.15-0.3.1 References: http://support.novell.com/security/cve/CVE-2011-2486.html https://bugzilla.novell.com/702034

1 0