February 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2012:0215-1: gnutls (CVE-2011-4128)
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: gnutls (CVE-2011-4128) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0215-1 Rating: low References: #729486 Cross-References: CVE-2011-4128 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Large server tickets could crash gnutls clients. CVE-2011-4128 has been assigned to this issue. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch gnutls-5699 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gnutls-2.8.6-5.6.1 libgnutls-devel-2.8.6-5.6.1 libgnutls-extra-devel-2.8.6-5.6.1 libgnutls-extra26-2.8.6-5.6.1 libgnutls26-2.8.6-5.6.1 - openSUSE 11.4 (x86_64): libgnutls26-32bit-2.8.6-5.6.1 References: http://support.novell.com/security/cve/CVE-2011-4128.html https://bugzilla.novell.com/729486

1 0

openSUSE-RU-2012:0214-1: Fix for typo in patch.
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Recommended Update: Fix for typo in patch. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0214-1 Rating: low References: #741737 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixed a typo in a patch for using the command 'xargs'. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch seccheck-5707 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): seccheck-2.0-668.669.1 References: https://bugzilla.novell.com/741737

1 0

openSUSE-SU-2012:0213-1: moderate: squid3
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: squid3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0213-1 Rating: moderate References: #727492 #737905 Cross-References: CVE-2011-4096 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update fixes the following security issue: - 727492: Invalid free by processing CNAME (CVE-2011-4096) This update also fixes the following non-security issue: - 737905: installation creates empty spurious file "/1" Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch squid3-5582 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): squid3-3.1.11-4.9.1 References: http://support.novell.com/security/cve/CVE-2011-4096.html https://bugzilla.novell.com/727492 https://bugzilla.novell.com/737905

1 0

openSUSE-SU-2012:0212-1: moderate: apache2
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0212-1 Rating: moderate References: #722545 #729181 Cross-References: CVE-2011-3368 CVE-2011-3607 CVE-2011-4317 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update fixes several security issues in the Apache2 webserver. CVE-2011-3368, CVE-2011-4317: This update also includes several fixes for a mod_proxy reverse exposure via RewriteRule or ProxyPassMatch directives. CVE-2011-3607: Integer overflow in ap_pregsub function resulting in a heap based buffer overflow could potentially allow local attackers to gain privileges In addition to that the following changes were made: - new template file: /etc/apache2/vhosts.d/vhost-ssl.template allow TLSv1 only, browser match stuff commented out. - rc script /etc/init.d/apache2: handle reload with deleted binaries by message to stdout only, but refrain from sending signals. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch apache2-5520 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-2.2.17-4.11.1 apache2-devel-2.2.17-4.11.1 apache2-example-certificates-2.2.17-4.11.1 apache2-example-pages-2.2.17-4.11.1 apache2-itk-2.2.17-4.11.1 apache2-prefork-2.2.17-4.11.1 apache2-utils-2.2.17-4.11.1 apache2-worker-2.2.17-4.11.1 - openSUSE 11.4 (noarch): apache2-doc-2.2.17-4.11.1 References: http://support.novell.com/security/cve/CVE-2011-3368.html http://support.novell.com/security/cve/CVE-2011-3607.html http://support.novell.com/security/cve/CVE-2011-4317.html https://bugzilla.novell.com/722545 https://bugzilla.novell.com/729181

1 0

openSUSE-RU-2012:0210-1: python: Fix conflict between python3-2to3 and python-base
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Recommended Update: python: Fix conflict between python3-2to3 and python-base ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0210-1 Rating: low References: #739536 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for python: - 739536: Conflict between python3-2to3 and python-base Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libpython2_7-1_0-5678 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libpython2_7-1_0-2.7-8.12.1 python-2.7-9.12.1 python-base-2.7-8.12.1 python-curses-2.7-9.12.1 python-demo-2.7-9.12.1 python-devel-2.7-8.12.1 python-gdbm-2.7-9.12.1 python-idle-2.7-9.12.1 python-tk-2.7-9.12.1 python-xml-2.7-8.12.1 - openSUSE 11.4 (x86_64): libpython2_7-1_0-32bit-2.7-8.12.1 python-32bit-2.7-9.12.1 python-base-32bit-2.7-8.12.1 References: https://bugzilla.novell.com/739536

1 0

openSUSE-RU-2012:0209-1: NetworkManager: KNetworkManager can't start connection
by maintenance＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Recommended Update: NetworkManager: KNetworkManager can't start connection ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0209-1 Rating: low References: #732279 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for NetworkManager: - 732279: Activate the pending connections after checking the authentication Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch NetworkManager-5578 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): NetworkManager-0.8-8.15.1 NetworkManager-devel-0.8-8.15.1 NetworkManager-doc-0.8-8.15.1 NetworkManager-glib-0.8-8.15.1 References: https://bugzilla.novell.com/732279

1 0

openSUSE-SU-2012:0208-1: important: tomcat6: Fix multiple weaknesses in HTTP DIGESTS
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: tomcat6: Fix multiple weaknesses in HTTP DIGESTS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0208-1 Rating: important References: #742477 Cross-References: CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update fixes a regression in parameter passing (in urldecoding of parameters that contain spaces). In addition, multiple weaknesses in HTTP DIGESTS are fixed (CVE-2011-1184). CVE-2011-5062: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33 and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184. CVE-2011-5063: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184. CVE-2011-5064: DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch tomcat6-5765 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): tomcat6-6.0.32-7.14.1 tomcat6-admin-webapps-6.0.32-7.14.1 tomcat6-docs-webapp-6.0.32-7.14.1 tomcat6-el-1_0-api-6.0.32-7.14.1 tomcat6-javadoc-6.0.32-7.14.1 tomcat6-jsp-2_1-api-6.0.32-7.14.1 tomcat6-lib-6.0.32-7.14.1 tomcat6-servlet-2_5-api-6.0.32-7.14.1 tomcat6-webapps-6.0.32-7.14.1 References: http://support.novell.com/security/cve/CVE-2011-1184.html http://support.novell.com/security/cve/CVE-2011-5062.html http://support.novell.com/security/cve/CVE-2011-5063.html http://support.novell.com/security/cve/CVE-2011-5064.html https://bugzilla.novell.com/742477

1 0

openSUSE-SU-2012:0039-2: important: MozillaFirefox
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0039-2 Rating: important References: #737533 Cross-References: CVE-2011-3658 CVE-2011-3660 CVE-2011-3661 CVE-2011-3663 CVE-2011-3665 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. It includes two new package versions. Description: Mozilla Firefox Version 9 fixes several security issues: * MFSA 2011-53/CVE-2011-3660: Miscellaneous memory safety hazards * MFSA 2011-54/CVE-2011-3661: Potentially exploitable crash in the YARR regular expression library * MFSA 2011-55/CVE-2011-3658: nsSVGValue out-of-bounds access * MFSA 2011-56/CVE-2011-3663: Key detection without JavaScript via SVG animation * MFSA 2011-58/CVE-2011-3665: Crash scaling <video> to extreme sizes Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch MozillaFirefox-5577 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.9.2.25 and 9.0]: MozillaFirefox-9.0-0.2.1 MozillaFirefox-branding-upstream-9.0-0.2.1 MozillaFirefox-buildsymbols-9.0-0.2.1 MozillaFirefox-devel-9.0-0.2.1 MozillaFirefox-translations-common-9.0-0.2.1 MozillaFirefox-translations-other-9.0-0.2.1 mozilla-js192-1.9.2.25-0.2.1 mozilla-xulrunner192-1.9.2.25-0.2.1 mozilla-xulrunner192-buildsymbols-1.9.2.25-0.2.1 mozilla-xulrunner192-devel-1.9.2.25-0.2.1 mozilla-xulrunner192-gnome-1.9.2.25-0.2.1 mozilla-xulrunner192-translations-common-1.9.2.25-0.2.1 mozilla-xulrunner192-translations-other-1.9.2.25-0.2.1 - openSUSE 11.4 (x86_64) [New Version: 1.9.2.25]: mozilla-js192-32bit-1.9.2.25-0.2.1 mozilla-xulrunner192-32bit-1.9.2.25-0.2.1 mozilla-xulrunner192-gnome-32bit-1.9.2.25-0.2.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.25-0.2.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.25-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-3658.html http://support.novell.com/security/cve/CVE-2011-3660.html http://support.novell.com/security/cve/CVE-2011-3661.html http://support.novell.com/security/cve/CVE-2011-3663.html http://support.novell.com/security/cve/CVE-2011-3665.html https://bugzilla.novell.com/737533

1 0

openSUSE-SU-2012:0207-1: moderate: kvm: fixing initgroups bug and e1000 emulation overflow (CVE-2011-2527,CVE-2012-0029)
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: kvm: fixing initgroups bug and e1000 emulation overflow (CVE-2011-2527,CVE-2012-0029) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0207-1 Rating: moderate References: #705304 #740165 Cross-References: CVE-2011-2527 CVE-2012-0029 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: A missing initgroups() call for the -runas option has been fixed in kvm (CVE-2011-2527) as well as a buffer overflow in the e1000 device emulation (CVE-2012-0029). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch kvm-5706 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): kvm-0.14.0.0-1.14.2 References: http://support.novell.com/security/cve/CVE-2011-2527.html http://support.novell.com/security/cve/CVE-2012-0029.html https://bugzilla.novell.com/705304 https://bugzilla.novell.com/740165

1 0

openSUSE-SU-2012:0206-1: important: kernel: security and bugfix update.
by opensuse-security＠opensuse.org 09 Feb '12

09 Feb '12

openSUSE Security Update: kernel: security and bugfix update. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0206-1 Rating: important References: #691052 #692498 #698450 #699709 #700879 #702037 #707288 #709764 #710235 #726788 #728661 #735612 #736149 Cross-References: CVE-2011-1576 CVE-2011-1770 CVE-2011-2203 CVE-2011-2213 CVE-2011-2525 CVE-2011-2534 CVE-2011-2699 CVE-2011-2723 CVE-2011-2898 CVE-2011-4081 CVE-2011-4604 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has two fixes is now available. It includes one version update. Description: The openSUSE 11.3 kernel was updated to fix various bugs and security issues. Following security issues have been fixed: CVE-2011-4604: If root does read() on a specific socket, it's possible to corrupt (kernel) memory over network, with an ICMP packet, if the B.A.T.M.A.N. mesh protocol is used. CVE-2011-2525: A flaw allowed the tc_fill_qdisc() function in the Linux kernels packet scheduler API implementation to be called on built-in qdisc structures. A local, unprivileged user could have used this flaw to trigger a NULL pointer dereference, resulting in a denial of service. CVE-2011-2699: Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. A remote attacker could exploit this to exhaust network resources, leading to a denial of service. CVE-2011-2213: The inet_diag_bc_audit function in net/ipv4/inet_diag.c in the Linux kernel did not properly audit INET_DIAG bytecode, which allowed local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message, as demonstrated by an INET_DIAG_BC_JMP instruction with a zero yes value, a different vulnerability than CVE-2010-3880. CVE-2011-1576: The Generic Receive Offload (GRO) implementation in the Linux kernel allowed remote attackers to cause a denial of service via crafted VLAN packets that are processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a different vulnerability than CVE-2011-1478. CVE-2011-2534: Buffer overflow in the clusterip_proc_write function in net/ipv4/netfilter/ipt_CLUSTERIP.c in the Linux kernel might have allowed local users to cause a denial of service or have unspecified other impact via a crafted write operation, related to string data that lacks a terminating '\0' character. CVE-2011-1770: Integer underflow in the dccp_parse_options function (net/dccp/options.c) in the Linux kernel allowed remote attackers to cause a denial of service via a Datagram Congestion Control Protocol (DCCP) packet with an invalid feature options length, which triggered a buffer over-read. CVE-2011-2723: The skb_gro_header_slow function in include/linux/netdevice.h in the Linux kernel, when Generic Receive Offload (GRO) is enabled, reset certain fields in incorrect situations, which allowed remote attackers to cause a denial of service (system crash) via crafted network traffic. CVE-2011-2898: A kernel information leak in the AF_PACKET protocol was fixed which might have allowed local attackers to read kernel memory. CVE-2011-2203: A NULL ptr dereference on mounting corrupt hfs filesystems was fixed which could be used by local attackers to crash the kernel. CVE-2011-4081: Using the crypto interface a local user could Oops the kernel by writing to a AF_ALG socket. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch kernel-5605 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.6.34.10]: kernel-debug-2.6.34.10-0.6.1 kernel-debug-base-2.6.34.10-0.6.1 kernel-debug-devel-2.6.34.10-0.6.1 kernel-default-2.6.34.10-0.6.1 kernel-default-base-2.6.34.10-0.6.1 kernel-default-devel-2.6.34.10-0.6.1 kernel-desktop-2.6.34.10-0.6.1 kernel-desktop-base-2.6.34.10-0.6.1 kernel-desktop-devel-2.6.34.10-0.6.1 kernel-ec2-2.6.34.10-0.6.1 kernel-ec2-base-2.6.34.10-0.6.1 kernel-ec2-devel-2.6.34.10-0.6.1 kernel-ec2-extra-2.6.34.10-0.6.1 kernel-syms-2.6.34.10-0.6.1 kernel-trace-2.6.34.10-0.6.1 kernel-trace-base-2.6.34.10-0.6.1 kernel-trace-devel-2.6.34.10-0.6.1 kernel-vanilla-2.6.34.10-0.6.1 kernel-vanilla-base-2.6.34.10-0.6.1 kernel-vanilla-devel-2.6.34.10-0.6.1 kernel-xen-2.6.34.10-0.6.1 kernel-xen-base-2.6.34.10-0.6.1 kernel-xen-devel-2.6.34.10-0.6.1 preload-kmp-default-1.1_k2.6.34.10_0.6-19.1.37 preload-kmp-desktop-1.1_k2.6.34.10_0.6-19.1.37 - openSUSE 11.3 (noarch) [New Version: 2.6.34.10]: kernel-devel-2.6.34.10-0.6.1 kernel-source-2.6.34.10-0.6.1 kernel-source-vanilla-2.6.34.10-0.6.1 - openSUSE 11.3 (i586) [New Version: 2.6.34.10]: kernel-pae-2.6.34.10-0.6.1 kernel-pae-base-2.6.34.10-0.6.1 kernel-pae-devel-2.6.34.10-0.6.1 kernel-vmi-2.6.34.10-0.6.1 kernel-vmi-base-2.6.34.10-0.6.1 kernel-vmi-devel-2.6.34.10-0.6.1 References: http://support.novell.com/security/cve/CVE-2011-1576.html http://support.novell.com/security/cve/CVE-2011-1770.html http://support.novell.com/security/cve/CVE-2011-2203.html http://support.novell.com/security/cve/CVE-2011-2213.html http://support.novell.com/security/cve/CVE-2011-2525.html http://support.novell.com/security/cve/CVE-2011-2534.html http://support.novell.com/security/cve/CVE-2011-2699.html http://support.novell.com/security/cve/CVE-2011-2723.html http://support.novell.com/security/cve/CVE-2011-2898.html http://support.novell.com/security/cve/CVE-2011-4081.html http://support.novell.com/security/cve/CVE-2011-4604.html https://bugzilla.novell.com/691052 https://bugzilla.novell.com/692498 https://bugzilla.novell.com/698450 https://bugzilla.novell.com/699709 https://bugzilla.novell.com/700879 https://bugzilla.novell.com/702037 https://bugzilla.novell.com/707288 https://bugzilla.novell.com/709764 https://bugzilla.novell.com/710235 https://bugzilla.novell.com/726788 https://bugzilla.novell.com/728661 https://bugzilla.novell.com/735612 https://bugzilla.novell.com/736149

1 0