February 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2012:0228-1: moderate: Ruby: Update to 1.8,6p357
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: Ruby: Update to 1.8,6p357 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0228-1 Rating: moderate References: #704409 #739122 Cross-References: CVE-2011-2686 CVE-2011-2705 CVE-2011-3009 CVE-2011-4815 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: This update of ruby provides 1.8.7p357, which contains many stability fixes and bug fixes, which are fully compatible with the previous version. You can review the detailed list here: http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_357/ChangeLo g The particularly noteworthy fixes are: - Hash functions are now using a randomized seed to avoid algorithmic complexity attacks (CVE-2011-4815). For this OpenSSL::Random.seed at the SecureRandom.random_bytes is used if available. - mkconfig.rb: fix for continued lines. - Fix Infinity to be greater than any bignum number. - initialize store->ex_data.sk. - some IPv6 related fixes - zlib fixes - reinitialize PRNG when forking children (CVE-2011-2686/CVE-2011-3009) - securerandom fixes (CVE-2011-2705) - uri route_to fixes - fix race condition with variables and autoload Special Instructions and Notes: Please reboot the system after installing this update.This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch ruby-5660 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.8.7.p357]: ruby-1.8.7.p357-0.2.1 ruby-devel-1.8.7.p357-0.2.1 ruby-examples-1.8.7.p357-0.2.1 ruby-test-suite-1.8.7.p357-0.2.1 ruby-tk-1.8.7.p357-0.2.1 - openSUSE 11.4 (noarch) [New Version: 1.8.7.p357]: ruby-doc-html-1.8.7.p357-0.2.1 ruby-doc-ri-1.8.7.p357-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-2686.html http://support.novell.com/security/cve/CVE-2011-2705.html http://support.novell.com/security/cve/CVE-2011-3009.html http://support.novell.com/security/cve/CVE-2011-4815.html https://bugzilla.novell.com/704409 https://bugzilla.novell.com/739122

1 0

openSUSE-SU-2012:0227-1: important: xorg-x11-server
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0227-1 Rating: important References: #722944 Cross-References: CVE-2011-4028 CVE-2011-4029 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The X server had two security issues and one bug that is fixed by this update. CVE-2011-4028: It is possible for a local attacker to deduce if a file exists or not by exploiting the way that Xorg creates its lock files. CVE-2011-4029: It is possible for a non-root local user to set the read permission for all users on any file or directory. Special Instructions and Notes: Please reboot the system after installing this update.This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch xorg-x11-Xvnc-5490 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): xorg-x11-Xvnc-7.5_1.8.0-10.15.2 xorg-x11-server-7.5_1.8.0-10.15.2 xorg-x11-server-extra-7.5_1.8.0-10.15.2 xorg-x11-server-sdk-7.5_1.8.0-10.15.2 References: http://support.novell.com/security/cve/CVE-2011-4028.html http://support.novell.com/security/cve/CVE-2011-4029.html https://bugzilla.novell.com/722944

1 0

openSUSE-RU-2012:0225-1: fail2ban: starts again if fail2ban.sock exists
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Recommended Update: fail2ban: starts again if fail2ban.sock exists ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0225-1 Rating: low References: #537239 #730044 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issue for Fail2ban: - Fail2ban doesn't start if fail2ban.sock exists (bnc #730044, bnc #537239). Special Instructions and Notes: Please reboot the system after installing this update.This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch fail2ban-5492 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): fail2ban-0.8.4-11.14.1 References: https://bugzilla.novell.com/537239 https://bugzilla.novell.com/730044

1 0

openSUSE-YU-2012:0224-1: softwaremgmt: Collective Update 2011/12
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE YOU Update: softwaremgmt: Collective Update 2011/12 ______________________________________________________________________________ Announcement ID: openSUSE-YU-2012:0224-1 Rating: low References: #679650 #709480 #710269 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has three YOU fixes can now be installed. It includes two new package versions. Description: This update for the update stack provides the following fixes: libzypp: - Allow to turn Resolvers upgrade mode on and off - Fix support for nfs4 when checking mount table PackageKit: - Fix crash when dealing with local rpms with simple names (name.rpm instead of name-x.y.arch.rpm) - Fix Packagekit initializing repos taking a long time Special Instructions and Notes: Please reboot the system after installing this update.This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. Patch Instructions: To install this openSUSE YOU Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch softwaremgmt-201112-5521 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 0.6.14 and 8.13.1]: PackageKit-0.6.14-0.8.1 PackageKit-browser-plugin-0.6.14-0.8.1 PackageKit-gstreamer-plugin-0.6.14-0.8.1 PackageKit-gtk-module-0.6.14-0.8.1 libpackagekit-glib2-14-0.6.14-0.8.1 libpackagekit-glib2-devel-0.6.14-0.8.1 libpackagekit-qt-devel-0.6.14-0.8.1 libpackagekit-qt14-0.6.14-0.8.1 libzypp-8.13.1-0.2.3 libzypp-devel-8.13.1-0.2.3 - openSUSE 11.4 (noarch) [New Version: 0.6.14]: PackageKit-branding-upstream-0.6.14-0.8.1 PackageKit-devel-0.6.14-0.8.1 PackageKit-doc-0.6.14-0.8.1 PackageKit-lang-0.6.14-0.8.1 References: https://bugzilla.novell.com/679650 https://bugzilla.novell.com/709480 https://bugzilla.novell.com/710269

1 0

openSUSE-RU-2012:0223-1: xfce4-session: Screen locking inconsistent between xfce4-power-manager and xfce4-session
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Recommended Update: xfce4-session: Screen locking inconsistent between xfce4-power-manager and xfce4-session ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0223-1 Rating: low References: #740566 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for xfce4-session: - 740566: Screen locking inconsistent between xfce4-power-manager and xfce4-session Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch xfce4-session-5672 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): xfce4-session-4.8.0-7.12.1 xfce4-session-devel-4.8.0-7.12.1 - openSUSE 11.4 (noarch): xfce4-session-branding-upstream-4.8.0-7.12.1 References: https://bugzilla.novell.com/740566

1 0

openSUSE-RU-2012:0222-1: valgrind: fix reading of certain debuginfo
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Recommended Update: valgrind: fix reading of certain debuginfo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0222-1 Rating: low References: #729896 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update adds missing cases for handling certain variants of Dwarf debug info (bnc#729896) Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch valgrind-5418 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 3.6.1]: valgrind-3.6.1-1.14.1 valgrind-devel-3.6.1-1.14.1 References: https://bugzilla.novell.com/729896

1 0

openSUSE-SU-2012:0219-1: moderate: dovecot20
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: dovecot20 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0219-1 Rating: moderate References: #732050 Cross-References: CVE-2011-4318 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: In proxy mode dovecot did not verify that the SSL certificate of the remote actually matched the server name. Dovecot was updated to version 2.0.16 which fixes the problem. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch dovecot20-5546 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.0.16]: dovecot20-2.0.16-0.2.1 dovecot20-backend-mysql-2.0.16-0.2.1 dovecot20-backend-pgsql-2.0.16-0.2.1 dovecot20-backend-sqlite-2.0.16-0.2.1 dovecot20-devel-2.0.16-0.2.1 dovecot20-fts-solr-2.0.16-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-4318.html https://bugzilla.novell.com/732050

1 0

openSUSE-RU-2012:0218-1: postfix: warning output after update the postfix package.
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Recommended Update: postfix: warning output after update the postfix package. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0218-1 Rating: low References: #728308 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for postfix: - 728308: warning output after update the postfix package. Since the post installation script of postfix does not execute the SuSEconfig postfix module the postmaps will not be recreated even the new postfix version modifies this. This couses a lot of warnings in the mail log. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch postfix-5579 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): postfix-2.7.2-13.18.1 postfix-devel-2.7.2-13.18.1 postfix-mysql-2.7.2-13.18.1 postfix-postgresql-2.7.2-13.18.1 - openSUSE 11.4 (noarch): postfix-doc-2.7.2-13.18.1 References: https://bugzilla.novell.com/728308

1 0

openSUSE-RU-2012:0217-1: moderate: xorg-x11: Fix support for kdm3
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Recommended Update: xorg-x11: Fix support for kdm3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0217-1 Rating: moderate References: #728846 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for xorg-x11: - 728846: NTP service disrupts work of other services when started in the same time as kdm3 Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch xorg-x11-5598 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): xorg-x11-7.6-43.46.1 xorg-x11-xauth-7.6-43.46.1 References: https://bugzilla.novell.com/728846

1 0

openSUSE-RU-2012:0216-1: NetworkManager - wrong order of service starts and obviously meaningless service restarts
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Recommended Update: NetworkManager - wrong order of service starts and obviously meaningless service restarts ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0216-1 Rating: low References: #487190 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for hal: - 487190: NetworkManager - wrong order of service starts and obviously meaningless service restarts Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch hal-5549 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): hal-0.5.14-9.3.1 hal-devel-0.5.14-9.3.1 - openSUSE 11.3 (x86_64): hal-32bit-0.5.14-9.3.1 hal-devel-32bit-0.5.14-9.3.1 References: https://bugzilla.novell.com/487190

1 0