December 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2012:1653-1: open-iscsi: accept "<NULL>" as value in sysfs
by maintenance＠opensuse.org 17 Dec '12

17 Dec '12

openSUSE Recommended Update: open-iscsi: accept "<NULL>" as value in sysfs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:1653-1 Rating: low References: #766300 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: open-iscsi was fixed to allow <NULL> in sysfs fields and so to work better. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-857 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): open-iscsi-2.0.870-45.4.1 open-iscsi-debuginfo-2.0.870-45.4.1 open-iscsi-debugsource-2.0.870-45.4.1 References: https://bugzilla.novell.com/766300

1 0

openSUSE-RU-2012:1651-1: moderate: sysconfig: various bugfixes
by maintenance＠opensuse.org 17 Dec '12

17 Dec '12

openSUSE Recommended Update: sysconfig: various bugfixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:1651-1 Rating: moderate References: #716652 #775281 #780644 #784952 #785240 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: The sysconfig network scripts received various updates fixing bugs and improving performance: - Execute netconfig/ntp-runtime update in background, so dhcp post processing works faster when ntpdc needs a while (bnc#780644). - Changed rcnetwork to not report dhcp in background to systemd (bnc#785240,bnc#780644). You may set DHCLIENT_MODIFY_SMB_CONF to "no" in /etc/sysconfig/network/dhcp as the samba/cifs hooks make systemctl calls to reload/restart nmb and other services which block (systemd deadlock) ifup scripts for a long time. - Fixed to not report failure while setting unsupported power management option in ifup-wireless as the support and features depends on the driver (bnc#716652). - Fixed to check and reject too long interface names or names with suspect characters, do not wait when creation of virtual interface name fails (bnc#784952). - Fixed netconfig/ntp-runtime to not use try-restart as its start may block for a while, so just add servers ourself. When ntpd is not running (not yet started), the init script will pickup our servers later (bnc#780644). - Fixed ifup-dhcp to not start dhcp clients too early or they may be unable to send packets and just increase resend time. Instead, load af_packet module early and wait for link ready (bnc#780644). - Check before running a script in netcontrol_services (bnc#775281). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-855 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): sysconfig-0.75.4-2.16.1 sysconfig-debuginfo-0.75.4-2.16.1 sysconfig-debugsource-0.75.4-2.16.1 References: https://bugzilla.novell.com/716652 https://bugzilla.novell.com/775281 https://bugzilla.novell.com/780644 https://bugzilla.novell.com/784952 https://bugzilla.novell.com/785240

1 0

openSUSE-SU-2012:1650-1: important: update for bogofilter
by opensuse-security＠opensuse.org 17 Dec '12

17 Dec '12

openSUSE Security Update: update for bogofilter ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1650-1 Rating: important References: #792939 Cross-References: CVE-2010-2494 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This version upgrade of bogofilter fixed a heap corruption in the base 64 decoding routine as well as several other non-security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-852 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): bogofilter-1.2.3-17.4.1 bogofilter-debuginfo-1.2.3-17.4.1 bogofilter-debugsource-1.2.3-17.4.1 References: http://support.novell.com/security/cve/CVE-2010-2494.html https://bugzilla.novell.com/792939

1 0

openSUSE-SU-2012:1649-1: moderate: bind: security and bugfix updates
by opensuse-security＠opensuse.org 17 Dec '12

17 Dec '12

openSUSE Security Update: bind: security and bugfix updates ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1649-1 Rating: moderate References: #792926 Cross-References: CVE-2012-5688 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: bind received updates to fix bugs and security issues. On openSUSE 12.2, bind was updated to 9.9.2-P1. On openSUSE 12.1, bind was updated to 9.8.4-P1. Main security fix: CVE-2012-5688: Prevents named from aborting with a require assertion failure on servers with DNS64 enabled. These crashes might occur as a result of specific queries that are received. (Note that this fix is a subset of a series of updates that will be included in full in BIND 9.8.5 and 9.9.3 as change #3388, RT #30996). [CVE-2012-5688] [RT #30792] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-853 - openSUSE 12.1: zypper in -t patch openSUSE-2012-853 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): bind-9.9.2P1-1.12.1 bind-chrootenv-9.9.2P1-1.12.1 bind-debuginfo-9.9.2P1-1.12.1 bind-debugsource-9.9.2P1-1.12.1 bind-devel-9.9.2P1-1.12.1 bind-libs-9.9.2P1-1.12.1 bind-libs-debuginfo-9.9.2P1-1.12.1 bind-lwresd-9.9.2P1-1.12.1 bind-lwresd-debuginfo-9.9.2P1-1.12.1 bind-utils-9.9.2P1-1.12.1 bind-utils-debuginfo-9.9.2P1-1.12.1 - openSUSE 12.2 (x86_64): bind-libs-32bit-9.9.2P1-1.12.1 bind-libs-debuginfo-32bit-9.9.2P1-1.12.1 - openSUSE 12.2 (noarch): bind-doc-9.9.2P1-1.12.1 - openSUSE 12.1 (i586 x86_64): bind-9.8.4P1-4.28.1 bind-chrootenv-9.8.4P1-4.28.1 bind-debuginfo-9.8.4P1-4.28.1 bind-debugsource-9.8.4P1-4.28.1 bind-devel-9.8.4P1-4.28.1 bind-libs-9.8.4P1-4.28.1 bind-libs-debuginfo-9.8.4P1-4.28.1 bind-lwresd-9.8.4P1-4.28.1 bind-lwresd-debuginfo-9.8.4P1-4.28.1 bind-utils-9.8.4P1-4.28.1 bind-utils-debuginfo-9.8.4P1-4.28.1 - openSUSE 12.1 (x86_64): bind-libs-32bit-9.8.4P1-4.28.1 bind-libs-debuginfo-32bit-9.8.4P1-4.28.1 - openSUSE 12.1 (noarch): bind-doc-9.8.4P1-4.28.1 - openSUSE 12.1 (ia64): bind-libs-debuginfo-x86-9.8.4P1-4.28.1 bind-libs-x86-9.8.4P1-4.28.1 References: http://support.novell.com/security/cve/CVE-2012-5688.html https://bugzilla.novell.com/792926

1 0

openSUSE-SU-2012:1648-1: important: update for bogofilter
by opensuse-security＠opensuse.org 17 Dec '12

17 Dec '12

openSUSE Security Update: update for bogofilter ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1648-1 Rating: important References: #792939 Cross-References: CVE-2010-2494 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This version upgrade of bogofilter fixed a heap corruption in the base 64 decoding routine as well as several other non-security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-851 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): bogofilter-1.2.3-13.4.1 bogofilter-debuginfo-1.2.3-13.4.1 bogofilter-debugsource-1.2.3-13.4.1 References: http://support.novell.com/security/cve/CVE-2010-2494.html https://bugzilla.novell.com/792939

1 0

openSUSE-SU-2012:1647-1: important: libxml2: fixed buffer overflow during decoding entities
by opensuse-security＠opensuse.org 17 Dec '12

17 Dec '12

openSUSE Security Update: libxml2: fixed buffer overflow during decoding entities ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1647-1 Rating: important References: #793334 Cross-References: CVE-2012-5134 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-854 - openSUSE 12.1: zypper in -t patch openSUSE-2012-854 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libxml2-2-2.7.8+git20120223-8.9.1 libxml2-2-debuginfo-2.7.8+git20120223-8.9.1 libxml2-debugsource-2.7.8+git20120223-8.9.1 libxml2-devel-2.7.8+git20120223-8.9.1 libxml2-tools-2.7.8+git20120223-8.9.1 libxml2-tools-debuginfo-2.7.8+git20120223-8.9.1 python-libxml2-2.7.8+git20120223-8.9.1 python-libxml2-debuginfo-2.7.8+git20120223-8.9.1 python-libxml2-debugsource-2.7.8+git20120223-8.9.1 - openSUSE 12.2 (x86_64): libxml2-2-32bit-2.7.8+git20120223-8.9.1 libxml2-2-debuginfo-32bit-2.7.8+git20120223-8.9.1 libxml2-devel-32bit-2.7.8+git20120223-8.9.1 - openSUSE 12.2 (noarch): libxml2-doc-2.7.8+git20120223-8.9.1 - openSUSE 12.1 (i586 x86_64): libxml2-2.7.8+git20110708-3.15.1 libxml2-debuginfo-2.7.8+git20110708-3.15.1 libxml2-debugsource-2.7.8+git20110708-3.15.1 libxml2-devel-2.7.8+git20110708-3.15.1 - openSUSE 12.1 (x86_64): libxml2-32bit-2.7.8+git20110708-3.15.1 libxml2-debuginfo-32bit-2.7.8+git20110708-3.15.1 libxml2-devel-32bit-2.7.8+git20110708-3.15.1 - openSUSE 12.1 (noarch): libxml2-doc-2.7.8+git20110708-3.15.1 - openSUSE 12.1 (ia64): libxml2-debuginfo-x86-2.7.8+git20110708-3.15.1 libxml2-x86-2.7.8+git20110708-3.15.1 References: http://support.novell.com/security/cve/CVE-2012-5134.html https://bugzilla.novell.com/793334

1 0

openSUSE-SU-2012:1643-1: critical: update for flash-player
by opensuse-security＠opensuse.org 14 Dec '12

14 Dec '12

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1643-1 Rating: critical References: #794062 Cross-References: CVE-2012-5676 CVE-2012-5677 CVE-2012-5678 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This version upgrade of flash-player fixed multiple unspecified code execution vulnerabiliies. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-850 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.258-38.1 flash-player-gnome-11.2.202.258-38.1 flash-player-kde4-11.2.202.258-38.1 References: http://support.novell.com/security/cve/CVE-2012-5676.html http://support.novell.com/security/cve/CVE-2012-5677.html http://support.novell.com/security/cve/CVE-2012-5678.html https://bugzilla.novell.com/794062

1 0

openSUSE-RU-2012:1639-1: glibc: fix <fenv.h> with -m32
by maintenance＠opensuse.org 12 Dec '12

12 Dec '12

openSUSE Recommended Update: glibc: fix <fenv.h> with -m32 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:1639-1 Rating: low References: #680125 #791676 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues for glibc: - <fenv.h> fails with -m32 on x86-64 - wrong reference counting can cause modules not to be unloaded when closed Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-848 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 i686 x86_64): glibc-2.15-22.9.1 glibc-debuginfo-2.15-22.9.1 glibc-debugsource-2.15-22.9.1 glibc-devel-2.15-22.9.1 glibc-devel-debuginfo-2.15-22.9.1 glibc-devel-static-2.15-22.9.1 glibc-extra-2.15-22.9.1 glibc-extra-debuginfo-2.15-22.9.1 glibc-locale-2.15-22.9.1 glibc-locale-debuginfo-2.15-22.9.1 glibc-utils-2.15-22.9.1 glibc-utils-debuginfo-2.15-22.9.1 nscd-2.15-22.9.1 nscd-debuginfo-2.15-22.9.1 - openSUSE 12.2 (i586 x86_64): glibc-profile-2.15-22.9.1 - openSUSE 12.2 (i586 i686): glibc-obsolete-2.15-22.9.1 glibc-obsolete-debuginfo-2.15-22.9.1 - openSUSE 12.2 (x86_64): glibc-32bit-2.15-22.9.1 glibc-debuginfo-32bit-2.15-22.9.1 glibc-devel-32bit-2.15-22.9.1 glibc-devel-debuginfo-32bit-2.15-22.9.1 glibc-devel-static-32bit-2.15-22.9.1 glibc-locale-32bit-2.15-22.9.1 glibc-locale-debuginfo-32bit-2.15-22.9.1 glibc-utils-32bit-2.15-22.9.1 glibc-utils-debuginfo-32bit-2.15-22.9.1 - openSUSE 12.2 (noarch): glibc-html-2.15-22.9.1 glibc-i18ndata-2.15-22.9.1 glibc-info-2.15-22.9.1 References: https://bugzilla.novell.com/680125 https://bugzilla.novell.com/791676

1 0

openSUSE-RU-2012:1638-1: kdeenlive: allow versioned melt binaries
by maintenance＠opensuse.org 12 Dec '12

12 Dec '12

openSUSE Recommended Update: kdeenlive: allow versioned melt binaries ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:1638-1 Rating: low References: #778807 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Allow versioned "melt" binaries in kdeenlive for multiple different versions of libmlt/melt. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-846 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): kdenlive-0.9.2-2.8.1 kdenlive-debuginfo-0.9.2-2.8.1 kdenlive-debugsource-0.9.2-2.8.1 libmlt++-devel-0.7.8-2.8.1 libmlt++3-0.7.8-2.8.1 libmlt++3-debuginfo-0.7.8-2.8.1 libmlt-debugsource-0.7.8-2.8.1 libmlt-devel-0.7.8-2.8.1 libmlt4-0.7.8-2.8.1 libmlt4-debuginfo-0.7.8-2.8.1 libmlt4-modules-0.7.8-2.8.1 libmlt4-modules-debuginfo-0.7.8-2.8.1 melt-0.7.8-2.8.1 melt4-0.7.8-2.8.1 melt4-debuginfo-0.7.8-2.8.1 python-mlt-0.7.8-2.8.1 python-mlt-debuginfo-0.7.8-2.8.1 - openSUSE 12.2 (noarch): libmlt4-data-0.7.8-2.8.1 References: https://bugzilla.novell.com/778807

1 0

openSUSE-SU-2012:1637-1: important: Chromium to 25.0.1343
by opensuse-security＠opensuse.org 12 Dec '12

12 Dec '12

openSUSE Security Update: Chromium to 25.0.1343 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1637-1 Rating: important References: #791234 #792154 Cross-References: CVE-2012-5130 CVE-2012-5131 CVE-2012-5132 CVE-2012-5133 CVE-2012-5134 CVE-2012-5135 CVE-2012-5136 CVE-2012-5137 CVE-2012-5138 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Chromium was updated to 25.0.1343 * Security Fixes (bnc#791234 and bnc#792154): - CVE-2012-5131: Corrupt rendering in the Apple OSX driver for Intel GPUs - CVE-2012-5133: Use-after-free in SVG filters. - CVE-2012-5130: Out-of-bounds read in Skia - CVE-2012-5132: Browser crash with chunked encoding - CVE-2012-5134: Buffer underflow in libxml. - CVE-2012-5135: Use-after-free with printing. - CVE-2012-5136: Bad cast in input element handling. - CVE-2012-5138: Incorrect file path handling - CVE-2012-5137: Use-after-free in media source handling - Correct build so that proprietary codecs can be used when the chromium-ffmpeg package is installed - Update to 25.0.1335 * {gtk} Fixed <input> selection renders white text on white background in apps. (Issue: 158422) * Fixed translate infobar button to show selected language. (Issue: 155350) * Fixed broken Arabic language. (Issue: 158978) * Fixed pre-rendering if the preference is disabled at start up. (Issue: 159393) * Fixed JavaScript rendering issue. (Issue: 159655) * No further indications in the ChangeLog * Updated V8 - 3.14.5.0 * Bookmarks are now searched by their title while typing into the omnibox with matching bookmarks being shown in the autocomplete suggestions pop-down list. Matching is done by prefix. * Fixed chromium issues 155871, 154173, 155133. - Removed patch chomium-ffmpeg-no-pkgconfig.patch - Building now internal libffmpegsumo.so based on the standard chromium ffmpeg codecs - Add a configuration file (/etc/default/chromium) where we can indicate flags for the chromium-browser. - add explicit buildrequire on libbz2-devel Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-845 - openSUSE 12.1: zypper in -t patch openSUSE-2012-845 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): chromedriver-25.0.1343.0-1.23.1 chromedriver-debuginfo-25.0.1343.0-1.23.1 chromium-25.0.1343.0-1.23.1 chromium-debuginfo-25.0.1343.0-1.23.1 chromium-debugsource-25.0.1343.0-1.23.1 chromium-desktop-gnome-25.0.1343.0-1.23.1 chromium-desktop-kde-25.0.1343.0-1.23.1 chromium-ffmpegsumo-25.0.1343.0-1.23.1 chromium-ffmpegsumo-debuginfo-25.0.1343.0-1.23.1 chromium-suid-helper-25.0.1343.0-1.23.1 chromium-suid-helper-debuginfo-25.0.1343.0-1.23.1 - openSUSE 12.1 (i586 x86_64): chromedriver-25.0.1343.0-1.43.1 chromedriver-debuginfo-25.0.1343.0-1.43.1 chromium-25.0.1343.0-1.43.1 chromium-debuginfo-25.0.1343.0-1.43.1 chromium-debugsource-25.0.1343.0-1.43.1 chromium-desktop-gnome-25.0.1343.0-1.43.1 chromium-desktop-kde-25.0.1343.0-1.43.1 chromium-ffmpegsumo-25.0.1343.0-1.43.1 chromium-ffmpegsumo-debuginfo-25.0.1343.0-1.43.1 chromium-suid-helper-25.0.1343.0-1.43.1 chromium-suid-helper-debuginfo-25.0.1343.0-1.43.1 References: http://support.novell.com/security/cve/CVE-2012-5130.html http://support.novell.com/security/cve/CVE-2012-5131.html http://support.novell.com/security/cve/CVE-2012-5132.html http://support.novell.com/security/cve/CVE-2012-5133.html http://support.novell.com/security/cve/CVE-2012-5134.html http://support.novell.com/security/cve/CVE-2012-5135.html http://support.novell.com/security/cve/CVE-2012-5136.html http://support.novell.com/security/cve/CVE-2012-5137.html http://support.novell.com/security/cve/CVE-2012-5138.html https://bugzilla.novell.com/791234 https://bugzilla.novell.com/792154

1 0