February 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2012:0316-1: important: libpng12: Fixed a heap based buffer overflow
by opensuse-security＠opensuse.org 28 Feb '12

28 Feb '12

openSUSE Security Update: libpng12: Fixed a heap based buffer overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0316-1 Rating: important References: #747311 Cross-References: CVE-2011-3026 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: A heap-based buffer overflow in libpng was fixed that could potentially be exploited by attackers to execute arbitrary code or cause an application to crash (CVE-2011-3026). libpng 1.2 was updated to 1.2.47 to fix this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libpng12-5846 libpng14-5847 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.2.47]: libpng12-0-1.2.47-0.8.1 libpng12-compat-devel-1.2.47-0.8.1 libpng12-devel-1.2.47-0.8.1 libpng14-14-1.4.4-3.6.1 libpng14-compat-devel-1.4.4-3.6.1 libpng14-devel-1.4.4-3.6.1 - openSUSE 11.4 (x86_64) [New Version: 1.2.47]: libpng12-0-32bit-1.2.47-0.8.1 libpng12-compat-devel-32bit-1.2.47-0.8.1 libpng12-devel-32bit-1.2.47-0.8.1 libpng14-14-32bit-1.4.4-3.6.1 libpng14-compat-devel-32bit-1.4.4-3.6.1 libpng14-devel-32bit-1.4.4-3.6.1 References: http://support.novell.com/security/cve/CVE-2011-3026.html https://bugzilla.novell.com/747311

1 0

openSUSE-SU-2012:0315-1: important: csound: fixed two stack based buffer overflows
by opensuse-security＠opensuse.org 28 Feb '12

28 Feb '12

openSUSE Security Update: csound: fixed two stack based buffer overflows ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0315-1 Rating: important References: #749073 Cross-References: CVE-2012-0270 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of csound fixes two stack-based buffer overflows that could be exploited via malformed hetro and pvoc files (CVE-2012-0270). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch csound-5889 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): csound-5.06.0-139.140.1 References: http://support.novell.com/security/cve/CVE-2012-0270.html https://bugzilla.novell.com/749073

1 0

openSUSE-SU-2012:0314-1: important: apache2: fixed various security bugs
by opensuse-security＠opensuse.org 28 Feb '12

28 Feb '12

openSUSE Security Update: apache2: fixed various security bugs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0314-1 Rating: important References: #728876 #738855 #741243 #743743 Cross-References: CVE-2007-6750 CVE-2012-0031 CVE-2012-0053 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update of apache2 fixes regressions and several security problems: bnc#728876, fix graceful reload bnc#741243, CVE-2012-0031: Fixed a scoreboard corruption (shared mem segment) by child causes crash of privileged parent (invalid free()) during shutdown. bnc#743743, CVE-2012-0053: Fixed an issue in error responses that could expose "httpOnly" cookies when no custom ErrorDocument is specified for status code 400". bnc#738855, CVE-2007-6750: The "mod_reqtimeout" module was backported from Apache 2.2.21 to help mitigate the "Slowloris" Denial of Service attack. You need to enable the "mod_reqtimeout" module in your existing apache configuration to make it effective, e.g. in the APACHE_MODULES line in /etc/sysconfig/apache2. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch apache2-201202-5821 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-2.2.17-4.13.1 apache2-devel-2.2.17-4.13.1 apache2-example-certificates-2.2.17-4.13.1 apache2-example-pages-2.2.17-4.13.1 apache2-itk-2.2.17-4.13.1 apache2-prefork-2.2.17-4.13.1 apache2-utils-2.2.17-4.13.1 apache2-worker-2.2.17-4.13.1 - openSUSE 11.4 (noarch): apache2-doc-2.2.17-4.13.1 References: http://support.novell.com/security/cve/CVE-2007-6750.html http://support.novell.com/security/cve/CVE-2012-0031.html http://support.novell.com/security/cve/CVE-2012-0053.html https://bugzilla.novell.com/728876 https://bugzilla.novell.com/738855 https://bugzilla.novell.com/741243 https://bugzilla.novell.com/743743

1 0

openSUSE-SU-2012:0310-1: moderate: No summary available - BOX
by opensuse-security＠opensuse.org 27 Feb '12

27 Feb '12

openSUSE Security Update: No summary available - BOX ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0310-1 Rating: moderate References: #744059 Cross-References: CVE-2012-0804 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A heap-based buffer overflow flaw was found in the way CVS read proxy connection HTTP responses. An attacker could exploit this to cause the application to crash or, potentially, execute arbitrary code in the context of the user running the application (CVE-2012-0804). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch cvs-5861 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): cvs-1.12.12-166.169.1 - openSUSE 11.4 (noarch): cvs-doc-1.12.12-166.169.1 References: http://support.novell.com/security/cve/CVE-2012-0804.html https://bugzilla.novell.com/744059

1 0

openSUSE-SU-2012:0309-1: important: java-1_6_0-openjdk: Update to iced tea 1.11.1 b24 security release
by opensuse-security＠opensuse.org 27 Feb '12

27 Feb '12

openSUSE Security Update: java-1_6_0-openjdk: Update to iced tea 1.11.1 b24 security release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0309-1 Rating: important References: #747208 Cross-References: CVE-2011-3563 CVE-2011-3571 CVE-2011-5035 CVE-2012-0497 CVE-2012-0501 CVE-2012-0502 CVE-2012-0503 CVE-2012-0505 CVE-2012-0506 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: java-1_6_0-openjdk was updated to the b24 release, fixing multiple security issues: * Security fixes - S7082299, CVE-2011-3571: Fix inAtomicReferenceArray - S7088367, CVE-2011-3563: Fix issues in java sound - S7110683, CVE-2012-0502: Issues with some KeyboardFocusManager method - S7110687, CVE-2012-0503: Issues with TimeZone class - S7110700, CVE-2012-0505: Enhance exception throwing mechanism in ObjectStreamClass - S7110704, CVE-2012-0506: Issues with some method in corba - S7112642, CVE-2012-0497: Incorrect checking for graphics rendering object - S7118283, CVE-2012-0501: Better input parameter checking in zip file processing - S7126960, CVE-2011-5035: (httpserver) Add property to limit number of request headers to the HTTP Server Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch java-1_6_0-openjdk-5856 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b24.1.11.1-0.3.2 java-1_6_0-openjdk-devel-1.6.0.0_b24.1.11.1-0.3.2 - openSUSE 11.4 (i586): java-1_6_0-openjdk-demo-1.6.0.0_b24.1.11.1-0.3.2 java-1_6_0-openjdk-javadoc-1.6.0.0_b24.1.11.1-0.3.2 java-1_6_0-openjdk-src-1.6.0.0_b24.1.11.1-0.3.2 References: http://support.novell.com/security/cve/CVE-2011-3563.html http://support.novell.com/security/cve/CVE-2011-3571.html http://support.novell.com/security/cve/CVE-2011-5035.html http://support.novell.com/security/cve/CVE-2012-0497.html http://support.novell.com/security/cve/CVE-2012-0501.html http://support.novell.com/security/cve/CVE-2012-0502.html http://support.novell.com/security/cve/CVE-2012-0503.html http://support.novell.com/security/cve/CVE-2012-0505.html http://support.novell.com/security/cve/CVE-2012-0506.html https://bugzilla.novell.com/747208

1 0

openSUSE-SU-2012:0307-1: xorg-x11-server: Fixed boundary checks in the GLX protocol handling
by opensuse-security＠opensuse.org 27 Feb '12

27 Feb '12

openSUSE Security Update: xorg-x11-server: Fixed boundary checks in the GLX protocol handling ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0307-1 Rating: low References: #648287 Cross-References: CVE-2010-4818 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of xorg-x11-server fixes issues that could allow attackers read access to arbitrary memory locations via the GLX protocol (CVE-2010-4818). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch xorg-x11-Xvnc-5766 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): xorg-x11-Xvnc-7.6_1.9.3-15.26.1 xorg-x11-server-7.6_1.9.3-15.26.1 xorg-x11-server-extra-7.6_1.9.3-15.26.1 xorg-x11-server-sdk-7.6_1.9.3-15.26.1 References: http://support.novell.com/security/cve/CVE-2010-4818.html https://bugzilla.novell.com/648287

1 0

openSUSE-RU-2012:0306-1: python-gpgme: Fixed version-check
by maintenance＠opensuse.org 27 Feb '12

27 Feb '12

openSUSE Recommended Update: python-gpgme: Fixed version-check ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0306-1 Rating: low References: #745257 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for python-gpgme: - 745257: fixed error in version-check Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch python-gpgme-5859 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): python-gpgme-0.1-106.107.1 References: https://bugzilla.novell.com/745257

1 0

openSUSE-RU-2012:0305-1: cifs-utils: unable to unmount a cisf share as user in opensuse 11.4
by maintenance＠opensuse.org 27 Feb '12

27 Feb '12

openSUSE Recommended Update: cifs-utils: unable to unmount a cisf share as user in opensuse 11.4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0305-1 Rating: low References: #679949 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update fixes the following issue for cifs-utils: - 679949: unable to unmount a cisf share as user in opensuse 11.4 - makes cifs-utils userspace more compatible with the in-kernel cifs module Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch cifs-utils-5858 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 4.9]: cifs-utils-4.9-1.3.1 References: https://bugzilla.novell.com/679949

1 0

openSUSE-SU-2012:0297-1: important: mozilla-xulrunner192: 1.9.2.27
by opensuse-security＠opensuse.org 24 Feb '12

24 Feb '12

openSUSE Security Update: mozilla-xulrunner192: 1.9.2.27 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0297-1 Rating: important References: #747328 Cross-References: CVE-2011-3026 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes 5 new package versions. Description: Mozilla XULRunner was updated to 1.9.2.27 to fix a security issue with the embedded libpng, where a integer overflow could allow remote attackers to crash the browser or potentially execute code (CVE-2011-3026), Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch MozillaFirefox-5825 MozillaThunderbird-5826 mozilla-js192-5832 seamonkey-5834 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.9.2.27,10.0.2,2.7.2 and 3.1.19]: MozillaFirefox-10.0.2-0.2.1 MozillaFirefox-branding-upstream-10.0.2-0.2.1 MozillaFirefox-buildsymbols-10.0.2-0.2.1 MozillaFirefox-devel-10.0.2-0.2.1 MozillaFirefox-translations-common-10.0.2-0.2.1 MozillaFirefox-translations-other-10.0.2-0.2.1 MozillaThunderbird-3.1.19-0.25.1 MozillaThunderbird-buildsymbols-3.1.19-0.25.1 MozillaThunderbird-devel-3.1.19-0.25.1 MozillaThunderbird-translations-common-3.1.19-0.25.1 MozillaThunderbird-translations-other-3.1.19-0.25.1 enigmail-1.1.2+3.1.19-0.25.1 mozilla-js192-1.9.2.27-0.2.1 mozilla-xulrunner192-1.9.2.27-0.2.1 mozilla-xulrunner192-buildsymbols-1.9.2.27-0.2.1 mozilla-xulrunner192-devel-1.9.2.27-0.2.1 mozilla-xulrunner192-gnome-1.9.2.27-0.2.1 mozilla-xulrunner192-translations-common-1.9.2.27-0.2.1 mozilla-xulrunner192-translations-other-1.9.2.27-0.2.1 seamonkey-2.7.2-0.2.1 seamonkey-dom-inspector-2.7.2-0.2.1 seamonkey-irc-2.7.2-0.2.1 seamonkey-translations-common-2.7.2-0.2.1 seamonkey-translations-other-2.7.2-0.2.1 seamonkey-venkman-2.7.2-0.2.1 - openSUSE 11.4 (x86_64) [New Version: 1.9.2.27]: mozilla-js192-32bit-1.9.2.27-0.2.1 mozilla-xulrunner192-32bit-1.9.2.27-0.2.1 mozilla-xulrunner192-gnome-32bit-1.9.2.27-0.2.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.27-0.2.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.27-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3026.html https://bugzilla.novell.com/747328

1 0

openSUSE-SU-2012:0295-1: moderate: wireshark to 1.4.11
by opensuse-security＠opensuse.org 23 Feb '12

23 Feb '12

openSUSE Security Update: wireshark to 1.4.11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0295-1 Rating: moderate References: #741187 #741188 #741190 Cross-References: CVE-2012-0041 CVE-2012-0042 CVE-2012-0043 CVE-2012-0066 CVE-2012-0067 CVE-2012-0068 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. It includes one version update. Description: This update fixes the following security issues: - 741187: multiple file parser vulnerabilities (CVE-2012-0041) - 741188: RLC dissector buffer overflow (CVE-2012-0043) - 741190: NULL pointer vulnerabilities (CVE-2012-0042) - CVE-2012-0066: DoS due to too large buffer alloc request - CVE-2012-0067: DoS due to integer underflow and too large buffer alloc. request - CVE-2012-0068: memory corruption due to buffer underflow Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch wireshark-5742 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.4.11]: wireshark-1.4.11-0.2.3 wireshark-devel-1.4.11-0.2.3 References: http://support.novell.com/security/cve/CVE-2012-0041.html http://support.novell.com/security/cve/CVE-2012-0042.html http://support.novell.com/security/cve/CVE-2012-0043.html http://support.novell.com/security/cve/CVE-2012-0066.html http://support.novell.com/security/cve/CVE-2012-0067.html http://support.novell.com/security/cve/CVE-2012-0068.html https://bugzilla.novell.com/741187 https://bugzilla.novell.com/741188 https://bugzilla.novell.com/741190

1 0

openSUSE-RU-2012:0290-1: pm-utils: fixed Sleep/Resume for NetworkManager
by maintenance＠opensuse.org 20 Feb '12

20 Feb '12

openSUSE Recommended Update: pm-utils: fixed Sleep/Resume for NetworkManager ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0290-1 Rating: low References: #735837 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for pm-utils: - 735837: Sleep/Resume for NetworkManager is broken Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch pm-utils-5806 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): pm-utils-1.4.1-5.11.1 pm-utils-ndiswrapper-1.4.1-5.11.1 References: https://bugzilla.novell.com/735837

1 0

openSUSE-RU-2012:0289-1: moderate: grub: Remove MAP_GROWSDOWN flag when allocating scratch mem for the grub shell
by maintenance＠opensuse.org 20 Feb '12

20 Feb '12

openSUSE Recommended Update: grub: Remove MAP_GROWSDOWN flag when allocating scratch mem for the grub shell ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0289-1 Rating: moderate References: #640391 #717836 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issue for grub: - 640391, 717836: Remove MAP_GROWSDOWN flag when allocating scratch mem for the grub shell Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch grub-5822 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): grub-0.97-175.176.1 References: https://bugzilla.novell.com/640391 https://bugzilla.novell.com/717836

1 0

openSUSE-SU-2012:0287-1: important: No summary available - BOX
by opensuse-security＠opensuse.org 20 Feb '12

20 Feb '12

openSUSE Security Update: No summary available - BOX ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0287-1 Rating: important References: #742804 Cross-References: CVE-2012-0791 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This version upgrade of horde3-dimp to 4.3.11 fixes several issues (including security related flaws, CVE-2012-0791) and adds new features. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch horde3-dimp-5829 horde3-imp-5830 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): horde3-dimp-1.1.8-0.3.1 horde3-imp-4.3.11-0.3.1 References: http://support.novell.com/security/cve/CVE-2012-0791.html https://bugzilla.novell.com/742804

1 0

openSUSE-SU-2012:0286-1: important: No summary available - BOX
by opensuse-security＠opensuse.org 20 Feb '12

20 Feb '12

openSUSE Security Update: No summary available - BOX ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0286-1 Rating: important References: #742804 Cross-References: CVE-2012-0909 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This version upgrade of horde3 to 3.3.13 fixes several issues (including a security related flaw, CVE-2012-0909) and adds new features. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch horde3-5831 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): horde3-3.3.13-0.3.2 References: http://support.novell.com/security/cve/CVE-2012-0909.html https://bugzilla.novell.com/742804

1 0

openSUSE-SU-2012:0267-1: No summary available - BOX
by opensuse-security＠opensuse.org 17 Feb '12

17 Feb '12

openSUSE Security Update: No summary available - BOX ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0267-1 Rating: low References: #740165 Cross-References: CVE-2012-0029 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A heap-based buffer overflow in the legacy mode of the e1000 driver device emulation was fixed (CVE-2012-0029). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch qemu-5767 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): qemu-0.14.0_rc1-1.6.1 References: http://support.novell.com/security/cve/CVE-2012-0029.html https://bugzilla.novell.com/740165

1 0

openSUSE-SU-2012:0266-1: moderate: VUL-0: recent openssl update introduced DTLS DoS
by opensuse-security＠opensuse.org 17 Feb '12

17 Feb '12

openSUSE Security Update: VUL-0: recent openssl update introduced DTLS DoS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0266-1 Rating: moderate References: #742821 Cross-References: CVE-2012-0050 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of OpenSSL fixes a Denial of Services issue (CVE-2012-0050). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libopenssl-devel-5761 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libopenssl-devel-1.0.0c-18.25.1 libopenssl1_0_0-1.0.0c-18.25.1 openssl-1.0.0c-18.25.1 - openSUSE 11.4 (x86_64): libopenssl1_0_0-32bit-1.0.0c-18.25.1 - openSUSE 11.4 (noarch): openssl-doc-1.0.0c-18.25.1 References: http://support.novell.com/security/cve/CVE-2012-0050.html https://bugzilla.novell.com/742821

1 0

openSUSE-SU-2012:0265-1: critical: flash-player to 11.1.102.62
by opensuse-security＠opensuse.org 17 Feb '12

17 Feb '12

openSUSE Security Update: flash-player to 11.1.102.62 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0265-1 Rating: critical References: #747297 Cross-References: CVE-2012-0751 CVE-2012-0752 CVE-2012-0753 CVE-2012-0754 CVE-2012-0755 CVE-2012-0756 CVE-2012-0767 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. It includes one version update. Description: flash-player was updated to the security update to 11.1.102.62. It fixes lots of security issues, some already exploited in the wild. Details can be found on: https://www.adobe.com/support/security/bulletins/apsb12-03.h tml These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system. This update also resolves a universal cross-site scripting vulnerability that could be used to take actions on a user's behalf on any website or webmail provider, if the user visits a malicious website. There are reports that this vulnerability (CVE-2012-0767) is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message (Internet Explorer on Windows only). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch flash-player-5812 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 11.1.102.62]: flash-player-11.1.102.62-0.7.1 References: http://support.novell.com/security/cve/CVE-2012-0751.html http://support.novell.com/security/cve/CVE-2012-0752.html http://support.novell.com/security/cve/CVE-2012-0753.html http://support.novell.com/security/cve/CVE-2012-0754.html http://support.novell.com/security/cve/CVE-2012-0755.html http://support.novell.com/security/cve/CVE-2012-0756.html http://support.novell.com/security/cve/CVE-2012-0767.html https://bugzilla.novell.com/747297

1 0

openSUSE-SU-2012:0262-1: moderate: No summary available - BOX
by opensuse-security＠opensuse.org 16 Feb '12

16 Feb '12

openSUSE Security Update: No summary available - BOX ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0262-1 Rating: moderate References: #739121 Cross-References: CVE-2011-4461 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: jetty5 was prone to a remotely exploitable Denial of Service flaw via hash collisions (CVE-2011-4461). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch jetty5-5813 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): jetty5-5.1.14-11.12.1 jetty5-demo-5.1.14-11.12.1 jetty5-javadoc-5.1.14-11.12.1 jetty5-manual-5.1.14-11.12.1 References: http://support.novell.com/security/cve/CVE-2011-4461.html https://bugzilla.novell.com/739121

1 0

openSUSE-RU-2012:0259-1: xfce4-panel-plugins: Fix display of alarm in certain locales
by maintenance＠opensuse.org 15 Feb '12

15 Feb '12

openSUSE Recommended Update: xfce4-panel-plugins: Fix display of alarm in certain locales ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0259-1 Rating: low References: #742788 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: * make the add/edit dialog transient for the main configuration window and to make the notification dialog modal * use a dynamically allocated string to hold timer data in order to prevent truncation in some locales (bnc#742788) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch xfce4-panel-plugin-battery-5786 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 0.5.4.2]: xfce4-panel-plugin-battery-1.0.0-2.5.1 xfce4-panel-plugin-cddrive-0.0.1-19.5.1 xfce4-panel-plugin-cellmodem-0.0.5-24.5.1 xfce4-panel-plugin-clipman-1.1.3-18.5.1 xfce4-panel-plugin-clipman-doc-1.1.3-4.5.1 xfce4-panel-plugin-cpufreq-1.0.0-3.5.1 xfce4-panel-plugin-cpugraph-1.0.1-6.5.1 xfce4-panel-plugin-datetime-0.6.1-18.5.1 xfce4-panel-plugin-diskperf-2.3.0-3.5.1 xfce4-panel-plugin-eyes-4.4.1-2.5.1 xfce4-panel-plugin-fsguard-1.0.0-4.5.1 xfce4-panel-plugin-genmon-3.2-24.5.1 xfce4-panel-plugin-mailwatch-1.1.0-6.5.1 xfce4-panel-plugin-mount-0.5.5-18.5.1 xfce4-panel-plugin-mpc-0.3.6-3.5.1 xfce4-panel-plugin-netload-1.0.0-4.5.1 xfce4-panel-plugin-notes-1.7.7-6.5.1 xfce4-panel-plugin-places-1.2.0-17.5.1 xfce4-panel-plugin-quicklauncher-1.9.4-24.5.1 xfce4-panel-plugin-radio-0.4.4-6.5.1 xfce4-panel-plugin-sensors-1.0.0-4.5.1 xfce4-panel-plugin-sensors-devel-1.0.0-4.5.1 xfce4-panel-plugin-smartbookmark-0.4.2-24.5.1 xfce4-panel-plugin-systemload-1.0.0-4.5.1 xfce4-panel-plugin-timeout-1.0.0-4.5.1 xfce4-panel-plugin-timer-0.6.1-18.5.1 xfce4-panel-plugin-verve-1.0.0-4.5.1 xfce4-panel-plugin-wavelan-0.5.6-6.5.1 xfce4-panel-plugin-weather-0.7.4-3.5.1 xfce4-panel-plugin-xfapplet-0.1.0-24.5.1 xfce4-panel-plugin-xkb-0.5.4.2-0.5.1 xfce4-panel-plugin-xmms-0.5.3-3.5.1 References: https://bugzilla.novell.com/742788

1 0

openSUSE-SU-2012:0258-1: critical: MozillaFirefox to 10.0.1
by opensuse-security＠opensuse.org 14 Feb '12

14 Feb '12

openSUSE Security Update: MozillaFirefox to 10.0.1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0258-1 Rating: critical References: #746616 Cross-References: CVE-2012-0452 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes two new package versions. Description: MozillaFirefox was updated to 10.0.1 to fix critical bugs and security issue. Following security issue was fixed: CVE-2012-0452: Mozilla developers Andrew McCreight and Olli Pettay found that ReadPrototypeBindings will leave a XBL binding in a hash table even when the function fails. If this occurs, when the cycle collector reads this hash table and attempts to do a virtual method on this binding a crash will occur. This crash may be potentially exploitable. Firefox 9 and earlier are not affected by this vulnerability. https://www.mozilla.org/security/announce/2012/mfsa2012-10.h tml Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch MozillaFirefox-5799 seamonkey-5804 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 10.0.1 and 2.7.1]: MozillaFirefox-10.0.1-0.2.1 MozillaFirefox-branding-upstream-10.0.1-0.2.1 MozillaFirefox-buildsymbols-10.0.1-0.2.1 MozillaFirefox-devel-10.0.1-0.2.1 MozillaFirefox-translations-common-10.0.1-0.2.1 MozillaFirefox-translations-other-10.0.1-0.2.1 seamonkey-2.7.1-0.2.1 seamonkey-dom-inspector-2.7.1-0.2.1 seamonkey-irc-2.7.1-0.2.1 seamonkey-translations-common-2.7.1-0.2.1 seamonkey-translations-other-2.7.1-0.2.1 seamonkey-venkman-2.7.1-0.2.1 References: http://support.novell.com/security/cve/CVE-2012-0452.html https://bugzilla.novell.com/746616

1 0

openSUSE-RU-2012:0252-1: perl: missing NDBM_File module
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Recommended Update: perl: missing NDBM_File module ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0252-1 Rating: low References: #732929 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for perl: - 732929: The NDBM_File module was not included in the perl package due to a change in perl's Configure script. This update restores the module. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch perl-5740 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): perl-5.12.3-11.20.1 perl-base-5.12.3-11.20.1 - openSUSE 11.4 (x86_64): perl-32bit-5.12.3-11.20.1 perl-base-32bit-5.12.3-11.20.1 - openSUSE 11.4 (noarch): perl-doc-5.12.3-11.20.1 References: https://bugzilla.novell.com/732929

1 0

openSUSE-RU-2012:0251-1: moderate: autofs: Collective update
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Recommended Update: autofs: Collective update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0251-1 Rating: moderate References: #707715 #727392 #730245 #742846 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following issues for AutoFS: - 742846: disable "--as-needed" to make sure automount will be linked against libtirpc - 730245: fix LDAP result leaks on error paths - 727392: fix segfault caused by an use after free in st_queue_handler() - 707715: fix result null check in read_one_map() Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch autofs-5769 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): autofs-5.0.5-14.21.1 References: https://bugzilla.novell.com/707715 https://bugzilla.novell.com/727392 https://bugzilla.novell.com/730245 https://bugzilla.novell.com/742846

1 0

openSUSE-RU-2012:0249-1: yast2-hardware-detection: smbios missing in yast hwprobe
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Recommended Update: yast2-hardware-detection: smbios missing in yast hwprobe ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0249-1 Rating: low References: #425059 #716081 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. It includes one version update. Description: This update fixes the following issues for yast2-hardware-detection: - 716081: smbios missing in yast hwprobe - 425059: Use pr_bios for .probe.bios so that smbios info is included Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch yast2-hardware-detection-5662 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.17.2]: yast2-hardware-detection-2.17.2-2.3.1 References: https://bugzilla.novell.com/425059 https://bugzilla.novell.com/716081

1 0

openSUSE-SU-2012:0248-1: moderate: apache2
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0248-1 Rating: moderate References: #722545 #727071 #729181 Cross-References: CVE-2011-3368 CVE-2011-3607 CVE-2011-4317 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update fixes several security issues in the Apache2 webserver. CVE-2011-3368, CVE-2011-4317: This update also includes several fixes for a mod_proxy reverse exposure via RewriteRule or ProxyPassMatch directives. CVE-2011-3607: Integer overflow in ap_pregsub function resulting in a heap based buffer overflow could potentially allow local attackers to gain privileges In addition to that the following changes were made: - new template file: /etc/apache2/vhosts.d/vhost-ssl.template allow TLSv1 only, browser match stuff commented out. - rc script /etc/init.d/apache2: handle reload with deleted binaries by message to stdout only, but refrain from sending signals. - httpd-2.2.x-bnc727071-mod_authnz_ldap-utf8.diff: make non-ascii eg UTF8 passwords work with mod_authnz_ldap. [bnc#727071] Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch apache2-5519 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): apache2-2.2.15-4.9.1 apache2-devel-2.2.15-4.9.1 apache2-example-certificates-2.2.15-4.9.1 apache2-example-pages-2.2.15-4.9.1 apache2-itk-2.2.15-4.9.1 apache2-prefork-2.2.15-4.9.1 apache2-utils-2.2.15-4.9.1 apache2-worker-2.2.15-4.9.1 - openSUSE 11.3 (noarch): apache2-doc-2.2.15-4.9.1 References: http://support.novell.com/security/cve/CVE-2011-3368.html http://support.novell.com/security/cve/CVE-2011-3607.html http://support.novell.com/security/cve/CVE-2011-4317.html https://bugzilla.novell.com/722545 https://bugzilla.novell.com/727071 https://bugzilla.novell.com/729181

1 0

openSUSE-SU-2012:0247-1: moderate: opera: Release 11.61
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: opera: Release 11.61 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0247-1 Rating: moderate References: #743079 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: Opera was updated to release 11.61, fixing various bugs and security issues. http://www.opera.com/support/kb/view/1007/ http://www.opera.com/support/kb/view/1008/ and the changelog for 11.61 release at: http://www.opera.com/docs/changelogs/unix/1161/ Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch opera-5762 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 11.61]: opera-11.61-0.3.1 opera-gtk-11.61-0.3.1 opera-kde4-11.61-0.3.1 References: https://bugzilla.novell.com/743079

1 0