December 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2012:1635-1: synapse: fixed border painting
by maintenance＠opensuse.org 12 Dec '12

12 Dec '12

openSUSE Recommended Update: synapse: fixed border painting ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:1635-1 Rating: low References: #792215 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This minor fix in synapse fixes the painting of borders. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-847 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): synapse-0.2.10-2.4.1 synapse-debuginfo-0.2.10-2.4.1 synapse-debugsource-0.2.10-2.4.1 - openSUSE 12.2 (noarch): synapse-lang-0.2.10-2.4.1 References: https://bugzilla.novell.com/792215

1 0

openSUSE-SU-2012:1633-1: moderate: wireshark to 1.8.4
by opensuse-security＠opensuse.org 10 Dec '12

10 Dec '12

openSUSE Security Update: wireshark to 1.8.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1633-1 Rating: moderate References: #780669 #792005 Cross-References: CVE-2012-5592 CVE-2012-5593 CVE-2012-5594 CVE-2012-5595 CVE-2012-5596 CVE-2012-5597 CVE-2012-5598 CVE-2012-5599 CVE-2012-5600 CVE-2012-5601 CVE-2012-5602 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update fixes the following issues for wireshark: - Security update to 1.8.4: https://www.wireshark.org/docs/relnotes/wireshark-1.8.4.html http://seclists.org/oss-sec/2012/q4/378 CVE-2012-5592 Wireshark #1 pcap-ng hostname disclosure (wnpa-sec-2012-30) CVE-2012-5593 Wireshark #2 DoS (infinite loop) in the USB dissector (wnpa-sec-2012-31) CVE-2012-5594 Wireshark #3 DoS (infinite loop) in the sFlow dissector (wnpa-sec-2012-32) CVE-2012-5595 Wireshark #4 DoS (infinite loop) in the SCTP dissector (wnpa-sec-2012-33) CVE-2012-5596 Wireshark #5 DoS (infinite loop) in the EIGRP dissector (wnpa-sec-2012-34) CVE-2012-5597 Wireshark #6 DoS (crash) in the ISAKMP dissector (wnpa-sec-2012-35) CVE-2012-5598 Wireshark #7 DoS (infinite loop) in the iSCSI dissector (wnpa-sec-2012-36) CVE-2012-5599 Wireshark #8 DoS (infinite loop) in the WTP dissector (wnpa-sec-2012-37) CVE-2012-5600 Wireshark #9 DoS (infinite loop) in the RTCP dissector (wnpa-sec-2012-38) CVE-2012-5601 Wireshark #10 DoS (infinite loop) in the 3GPP2 A11 dissector (wnpa-sec-2012-39) CVE-2012-5602 Wireshark #11 DoS (infinite loop) in the ICMPv6 dissector (wnpa-sec-2012-40) And also the bugfix: - bnc#780669: change wireshark.spec BuildRequires lua-devel to lua51-devel to fix lua-support in openSUSE 12.2 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-844 - openSUSE 12.1: zypper in -t patch openSUSE-2012-844 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): wireshark-1.8.4-1.15.1 wireshark-debuginfo-1.8.4-1.15.1 wireshark-debugsource-1.8.4-1.15.1 wireshark-devel-1.8.4-1.15.1 - openSUSE 12.1 (i586 x86_64): wireshark-1.8.4-3.33.1 wireshark-debuginfo-1.8.4-3.33.1 wireshark-debugsource-1.8.4-3.33.1 wireshark-devel-1.8.4-3.33.1 References: http://support.novell.com/security/cve/CVE-2012-5592.html http://support.novell.com/security/cve/CVE-2012-5593.html http://support.novell.com/security/cve/CVE-2012-5594.html http://support.novell.com/security/cve/CVE-2012-5595.html http://support.novell.com/security/cve/CVE-2012-5596.html http://support.novell.com/security/cve/CVE-2012-5597.html http://support.novell.com/security/cve/CVE-2012-5598.html http://support.novell.com/security/cve/CVE-2012-5599.html http://support.novell.com/security/cve/CVE-2012-5600.html http://support.novell.com/security/cve/CVE-2012-5601.html http://support.novell.com/security/cve/CVE-2012-5602.html https://bugzilla.novell.com/780669 https://bugzilla.novell.com/792005

1 0

openSUSE-SU-2012:1627-1: Fix PPM overflow
by opensuse-security＠opensuse.org 07 Dec '12

07 Dec '12

openSUSE Security Update: Fix PPM overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1627-1 Rating: low References: Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Fix integer overflow by parsing PPM image. (bnc#789835, CVE-2012-4433) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-841 - openSUSE 12.1: zypper in -t patch openSUSE-2012-841 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): gegl-0.2.0-3.6.1 gegl-0_2-0.2.0-3.6.1 gegl-0_2-debuginfo-0.2.0-3.6.1 gegl-debuginfo-0.2.0-3.6.1 gegl-debugsource-0.2.0-3.6.1 gegl-devel-0.2.0-3.6.1 gegl-doc-0.2.0-3.6.1 libgegl-0_2-0-0.2.0-3.6.1 libgegl-0_2-0-debuginfo-0.2.0-3.6.1 - openSUSE 12.2 (noarch): gegl-0_2-lang-0.2.0-3.6.1 - openSUSE 12.1 (i586 x86_64): gegl-0.1.2-12.6.1 gegl-0_1-0.1.2-12.6.1 gegl-0_1-debuginfo-0.1.2-12.6.1 gegl-debuginfo-0.1.2-12.6.1 gegl-debugsource-0.1.2-12.6.1 gegl-devel-0.1.2-12.6.1 gegl-doc-0.1.2-12.6.1 libgegl-0_1-0-0.1.2-12.6.1 libgegl-0_1-0-debuginfo-0.1.2-12.6.1 References:

1 0

openSUSE-SU-2012:1626-1: moderate: update for horde4-imp
by opensuse-security＠opensuse.org 07 Dec '12

07 Dec '12

openSUSE Security Update: update for horde4-imp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1626-1 Rating: moderate References: #791179 Cross-References: CVE-2012-5565 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This version update to version 5.0.24 addresses CVE-2012-5565 (bnc#791179) to fix XSS vulnerabilities on the compose page (traditional view), the contacts popup window, and with certain IMAP mailbox names. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-843 - openSUSE 12.1: zypper in -t patch openSUSE-2012-843 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (noarch): horde4-imp-5.0.24-2.4.1 - openSUSE 12.1 (noarch): horde4-imp-5.0.24-2.6.1 References: http://support.novell.com/security/cve/CVE-2012-5565.html https://bugzilla.novell.com/791179

1 0

openSUSE-SU-2012:1625-1: moderate: horde4-kronolith
by opensuse-security＠opensuse.org 07 Dec '12

07 Dec '12

openSUSE Security Update: horde4-kronolith ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1625-1 Rating: moderate References: #791184 Cross-References: CVE-2012-5566 CVE-2012-5567 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This version update to version 3.0.18 addresses bnc#791184: Two sets (3.0.17 and 3.0.18) of XSS flaws (CVE-2012-5566 and CVE-2012-5567) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-837 - openSUSE 12.1: zypper in -t patch openSUSE-2012-837 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (noarch): horde4-kronolith-3.0.18-2.4.1 - openSUSE 12.1 (noarch): horde4-kronolith-3.0.18-3.4.1 References: http://support.novell.com/security/cve/CVE-2012-5566.html http://support.novell.com/security/cve/CVE-2012-5567.html https://bugzilla.novell.com/791184

1 0

openSUSE-SU-2012:1624-1: moderate: tor
by opensuse-security＠opensuse.org 07 Dec '12

07 Dec '12

openSUSE Security Update: tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1624-1 Rating: moderate References: #791374 Cross-References: CVE-2012-5573 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Tear down the circuit when receiving an unexpected SENDME cell. Prevents circumvention of the network's flow control, exhaustion of network resources and possible denial-of-service attacks on entry nodes [bnc#791374] CVE-2012-5573, adding tor-0.2.2.39-SENDME-DOS.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-835 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): tor-0.2.2.39-3.13.1 tor-debuginfo-0.2.2.39-3.13.1 tor-debugsource-0.2.2.39-3.13.1 References: http://support.novell.com/security/cve/CVE-2012-5573.html https://bugzilla.novell.com/791374

1 0

openSUSE-SU-2012:1623-1: moderate: gimp
by opensuse-security＠opensuse.org 07 Dec '12

07 Dec '12

openSUSE Security Update: gimp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1623-1 Rating: moderate References: #791372 Cross-References: CVE-2012-5576 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Add gimp-CVE-2012-5576.patch: fix memory corruption vulnerability when reading XWD files (bnc#791372, bgo#687392, CVE-2012-5576). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-842 - openSUSE 12.1: zypper in -t patch openSUSE-2012-842 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): gimp-2.8.0-3.9.1 gimp-debuginfo-2.8.0-3.9.1 gimp-debugsource-2.8.0-3.9.1 gimp-devel-2.8.0-3.9.1 gimp-devel-debuginfo-2.8.0-3.9.1 gimp-help-browser-2.8.0-3.9.1 gimp-help-browser-debuginfo-2.8.0-3.9.1 gimp-plugins-python-2.8.0-3.9.1 gimp-plugins-python-debuginfo-2.8.0-3.9.1 libgimp-2_0-0-2.8.0-3.9.1 libgimp-2_0-0-debuginfo-2.8.0-3.9.1 libgimpui-2_0-0-2.8.0-3.9.1 libgimpui-2_0-0-debuginfo-2.8.0-3.9.1 - openSUSE 12.2 (x86_64): libgimp-2_0-0-32bit-2.8.0-3.9.1 libgimp-2_0-0-debuginfo-32bit-2.8.0-3.9.1 libgimpui-2_0-0-32bit-2.8.0-3.9.1 libgimpui-2_0-0-debuginfo-32bit-2.8.0-3.9.1 - openSUSE 12.2 (noarch): gimp-branding-upstream-2.8.0-3.9.1 gimp-lang-2.8.0-3.9.1 - openSUSE 12.1 (i586 x86_64): gimp-2.6.11-28.30.1 gimp-debuginfo-2.6.11-28.30.1 gimp-debugsource-2.6.11-28.30.1 gimp-devel-2.6.11-28.30.1 gimp-devel-debuginfo-2.6.11-28.30.1 gimp-help-browser-2.6.11-28.30.1 gimp-help-browser-debuginfo-2.6.11-28.30.1 gimp-plugins-python-2.6.11-28.30.1 gimp-plugins-python-debuginfo-2.6.11-28.30.1 libgimp-2_0-0-2.6.11-28.30.1 libgimp-2_0-0-debuginfo-2.6.11-28.30.1 libgimpui-2_0-0-2.6.11-28.30.1 libgimpui-2_0-0-debuginfo-2.6.11-28.30.1 - openSUSE 12.1 (x86_64): libgimp-2_0-0-32bit-2.6.11-28.30.1 libgimp-2_0-0-debuginfo-32bit-2.6.11-28.30.1 libgimpui-2_0-0-32bit-2.6.11-28.30.1 libgimpui-2_0-0-debuginfo-32bit-2.6.11-28.30.1 - openSUSE 12.1 (noarch): gimp-branding-upstream-2.6.11-28.30.1 gimp-lang-2.6.11-28.30.1 - openSUSE 12.1 (ia64): libgimp-2_0-0-debuginfo-x86-2.6.11-28.30.1 libgimp-2_0-0-x86-2.6.11-28.30.1 libgimpui-2_0-0-debuginfo-x86-2.6.11-28.30.1 libgimpui-2_0-0-x86-2.6.11-28.30.1 References: http://support.novell.com/security/cve/CVE-2012-5576.html https://bugzilla.novell.com/791372

1 0

openSUSE-SU-2012:1622-1: moderate: update for libssh
by opensuse-security＠opensuse.org 07 Dec '12

07 Dec '12

openSUSE Security Update: update for libssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1622-1 Rating: moderate References: #789827 Cross-References: CVE-2012-4559 CVE-2012-4560 CVE-2012-4561 CVE-2012-4562 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update of libssh fixed various memory management issues that could have security implications (Code execution, Denial of Service). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-836 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libssh-debugsource-0.5.1-3.4.1 libssh-devel-0.5.1-3.4.1 libssh-devel-doc-0.5.1-3.4.1 libssh4-0.5.1-3.4.1 libssh4-debuginfo-0.5.1-3.4.1 References: http://support.novell.com/security/cve/CVE-2012-4559.html http://support.novell.com/security/cve/CVE-2012-4560.html http://support.novell.com/security/cve/CVE-2012-4561.html http://support.novell.com/security/cve/CVE-2012-4562.html https://bugzilla.novell.com/789827

1 0

openSUSE-SU-2012:1621-1: moderate: update for sblim-cim-client2
by opensuse-security＠opensuse.org 07 Dec '12

07 Dec '12

openSUSE Security Update: update for sblim-cim-client2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1621-1 Rating: moderate References: #768128 Cross-References: CVE-2012-2328 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of sblim-cim-client2 fixed a Denial of Service (via hash table collision) issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-839 - openSUSE 12.1: zypper in -t patch openSUSE-2012-839 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (noarch): sblim-cim-client2-2.1.12-2.4.2 sblim-cim-client2-javadoc-2.1.12-2.4.2 sblim-cim-client2-manual-2.1.12-2.4.2 - openSUSE 12.1 (noarch): sblim-cim-client2-2.1.10-2.4.1 sblim-cim-client2-javadoc-2.1.10-2.4.1 sblim-cim-client2-manual-2.1.10-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-2328.html https://bugzilla.novell.com/768128

1 0

openSUSE-SU-2012:1620-1: important: update for libssh
by opensuse-security＠opensuse.org 07 Dec '12

07 Dec '12

openSUSE Security Update: update for libssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1620-1 Rating: important References: #789827 Cross-References: CVE-2012-4559 CVE-2012-4560 CVE-2012-4561 CVE-2012-4562 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update of libssh fixed various memory management issues that could have security implications (Code execution, Denial of Service). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-840 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libssh-debugsource-0.5.2-2.4.1 libssh-devel-0.5.2-2.4.1 libssh-devel-doc-0.5.2-2.4.1 libssh4-0.5.2-2.4.1 libssh4-debuginfo-0.5.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-4559.html http://support.novell.com/security/cve/CVE-2012-4560.html http://support.novell.com/security/cve/CVE-2012-4561.html http://support.novell.com/security/cve/CVE-2012-4562.html https://bugzilla.novell.com/789827

1 0