March 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2012:0433-1: moderate: update for libreoffice
by opensuse-security＠opensuse.org 30 Mar '12

30 Mar '12

openSUSE Security Update: update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0433-1 Rating: moderate References: #101776 #116448 #117010 #31966 #32861 #35513 #35965 #37129 #37195 #38286 #38391 #38441 #39485 #39510 #39657 #39694 #40298 #40320 #40461 #40701 #41022 #41245 #41681 #417818 #41995 #42073 #42543 #44816 #45560 #46165 #46337 #621739 #653688 #655408 #657909 #667082 #677811 #685123 #693238 #693388 #695479 #699334 #703032 #704274 #705949 #705956 #705977 #705985 #705991 #706138 #706792 #707157 #714787 #715094 #715104 #715115 #715543 #717290 #718227 #718694 #718971 #719656 #719887 #719989 #720443 #720948 #722045 #722644 #722918 #723074 #724087 #726152 #726174 #727504 #728559 #728603 #733864 #734734 #734781 #735533 #736495 #737190 #737921 #738113 #740032 #740117 #740453 #741043 #741182 #742178 #746996 #747471 #748198 #748548 #794679 Cross-References: CVE-2012-0037 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves one vulnerability and has 94 fixes is now available. Description: - updated to libreoffice-3.4.5.4 (SUSE 3.4.5-rc2) * calc * pie charts colors messed in XLS import (fdo#40320) * correctly import data point formats in data series (fdo#40320) * components * crash when parsing XML signatures (fdo#39657) * broken getDataArray (fdo#46165, fdo#38441, i#117010) * don't paint a frame around the list of edit boxes (fdo#42543) * inconsistent compression method for encrypted documents (bnc#653688) * filters * more on bentConnectors (bnc#736495) * wrong text color in smartArt (bnc#746996) * reading of w:textbox contents (bnc#693388) * textbox position and size DOCX import (fdo#45560) * RTF/DOCX import of transparent frames (bnc#695479) * consecutive frames in RTF/DOCX import (bnc#703032) * handling of frame properties in RTF import (bnc#417818) * force imported XLSX active tab to be shown (bnc#748198) * create TableManager for inside shapes (bnc#747471, bnc#693238) * textboxes import with OLE objects inside (bnc#747471, bnc#693238) * impress * do not create an empty slide when printing handouts (fdo#31966) * libs-core * default shortcut for .uno:SearchDialog should be Ctrl+H * crash using instances dialog of dataform navigator (fdo#44816) * libs-extern * disable problematic reading of external entities in raptor * libs-gui * correctly calculate leap year * use proper Indian Rupee currency symbol U+20B9 (rh#794679) * writer * field refreshing (fdo#39694) * more layout crashers (i#101776, fdo#39510) * textbox borders style and width in DOCX import (fdo#45560) * expand all text fields when setting properties (fdo#42073) - updated to libreoffice-3.4.5.3 (SUSE 3.4.5-rc1) * version 3.4.5.3, tag suse-3.4.5.3 (SUSE LO 3.4.5-rc1) * SmartArt import * custom shapes import * Oracle Java 1.7.0 detection * reading AES-encrypted ODF 1.2 documents as generated by LO 3.5 * base * iterator misuse (fdo #44040, bnc#742178) * calc * allow pasting to multiple ranges (bnc#715094) * correctly convert chart data ranges (bnc#727504) * definedName corruption for XLSX export (bnc#741182) * adjust/shrink the ranges while copying (bnc#677811) * extra graph data is displayed for label (bnc#717290) * getCellRangeByName failure for named range (bnc#738113) * graph in XLS file has dates displayed wrong (bnc#720443) * improve performance of large Excel documents (bnc#715104) * display page background color/image properly (bnc#722045) * pivot table output becoming empty on re-save (bnc#715543) * encode virtual paths to local volume correctly (bnc#719887) * avoid adjusting cell-anchored objects on other sheets (bnc#726152) * make sure to adjust the sheet index of drawing objects (bnc#733864) * make the data validation popup more reliable (fdo #36851, bnc#737190) * filters * table style (bnc#705991) * text rotation fixes (bnc#734734) * crash in PPTX import (bnc#706792) * read w:sdt* contents (bnc#705949) * connector shape fixes (bnc#719989) * legacy fragment import (bnc#699334) * non-working Excel macros (bnc#705977) * free drawn curves import (bnc#657909) * group shape transformations (bnc#621739) * extLst of drawings in diagrams import (bnc#655408) * flip properties of custom shapes import (bnc#705985) * line spacing is used from previous values (bnc#734734) * missing ooxml customshape->mso shape name entries (bnc#737921) * word doesn't break the numberings and prefers hiding them (bnc#707157) * impress * undo corruption (bnc#685123) * do not set duplicate master slide names (bnc#735533) * libs-core * handle copy and paste from ConsoleOne (bnc#704274) * VBA control events not working, broken eventattacher (bnc#718227) * "General Error" when double-click graphic in presentation (bnc#720948) * libs-extern-sys * upgrade graphite to 1.0.3 fix surrogate support * libs-gui * crash at exit (bnc#728603) * radial gradient offset (bnc#714787) * horizontal scrollbars with KDE oxygen style (bnc#722918) * rendering of metafiles embedded in EMF+ (updated) (bnc#705956) * postprocess * make the 3D transitions work again (bnc#728559) * ure * make Duden Korrektor 5 and 6 work * writer * frame selection (bnc#740117) * crash when editing index (bnc#726174) * order database properties (bnc#740032) * numbering levels in DOC import (bnc#715115) * image size issue in DOC import (bnc#718971) * pointless forward moving of a table (bnc#706138) * tabs set after the end margin in DOCX import (bnc#693238) * add hyperlinks by default in Table of Contents (bnc#705956) - updated to libreoffice-3.4.4.3 (SUSE 3.4.4-rc1 == final): * base * crash when inserting a constant in a query (fdo#38286) * calc * crash when modifying a named range * speed up range name lookup by index (bnc#715104) * recalculate matrix formula dimension correctly (fdo#39485) * mark all formula cells dirty when appending a new sheet (fdo#35965) * components * handling of SAFEARRAY(s) in olebridge (fdo#38441) * filters * auto fit text VIEWING too small in PPT import (fdo#41245) * impress * hang in slideshow (fdo#32861) * crash while dropping texture (fdo#38391) * libs-core * recognize .svg in ODF container (fdo#41995) * dictionaries lost after LibO upgrade (fdo#37195) * crash when "Find Record" button is clicked in Base (fdo#40701) * fix the drawing of dotted and dashed borders in Calc (fdo#37129) * VBA control events not working; broken eventattacher (bnc#718227) * libs-extern-sys * upgrade graphite to 1.0.3 to fix surrogate support * libs-gui * crash when changing screen resolution * let Qt call XInitThreads() (fdo#40298) * activation order crashes address database (fdo#41022) * drawing of dotted and dashed borders in Calc (fdo#37129) * translations * update translations * writer * leak in PDF export (i#116448) * crash when editing index (bnc#726174) * crash while processing incorrect range of pages (fdo#35513) * crash on closing document with footnotes (fdo#39510, lp#854626) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-187 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libreoffice-3.4.5.5-97.1 libreoffice-base-3.4.5.5-97.1 libreoffice-base-debuginfo-3.4.5.5-97.1 libreoffice-base-drivers-mysql-3.4.5.5-97.1 libreoffice-base-drivers-mysql-debuginfo-3.4.5.5-97.1 libreoffice-base-drivers-postgresql-3.4.5.5-97.1 libreoffice-base-drivers-postgresql-debuginfo-3.4.5.5-97.1 libreoffice-base-extensions-3.4.5.5-97.1 libreoffice-calc-3.4.5.5-97.1 libreoffice-calc-debuginfo-3.4.5.5-97.1 libreoffice-calc-extensions-3.4.5.5-97.1 libreoffice-debuginfo-3.4.5.5-97.1 libreoffice-debugsource-3.4.5.5-97.1 libreoffice-draw-3.4.5.5-97.1 libreoffice-draw-extensions-3.4.5.5-97.1 libreoffice-draw-extensions-debuginfo-3.4.5.5-97.1 libreoffice-filters-optional-3.4.5.5-97.1 libreoffice-filters-optional-debuginfo-3.4.5.5-97.1 libreoffice-gnome-3.4.5.5-97.1 libreoffice-gnome-debuginfo-3.4.5.5-97.1 libreoffice-icon-themes-prebuilt-3.4.5.5-97.1 libreoffice-impress-3.4.5.5-97.1 libreoffice-impress-debuginfo-3.4.5.5-97.1 libreoffice-impress-extensions-3.4.5.5-97.1 libreoffice-impress-extensions-debuginfo-3.4.5.5-97.1 libreoffice-kde-3.4.5.5-97.1 libreoffice-kde-debuginfo-3.4.5.5-97.1 libreoffice-kde4-3.4.5.5-97.1 libreoffice-kde4-debuginfo-3.4.5.5-97.1 libreoffice-l10n-prebuilt-3.4.5.5-97.1 libreoffice-mailmerge-3.4.5.5-97.1 libreoffice-math-3.4.5.5-97.1 libreoffice-math-debuginfo-3.4.5.5-97.1 libreoffice-officebean-3.4.5.5-97.1 libreoffice-officebean-debuginfo-3.4.5.5-97.1 libreoffice-pyuno-3.4.5.5-97.1 libreoffice-pyuno-debuginfo-3.4.5.5-97.1 libreoffice-sdk-3.4.5.5-97.1 libreoffice-sdk-debuginfo-3.4.5.5-97.1 libreoffice-sdk-doc-3.4.5.5-97.1 libreoffice-testtool-3.4.5.5-97.1 libreoffice-testtool-debuginfo-3.4.5.5-97.1 libreoffice-writer-3.4.5.5-97.1 libreoffice-writer-debuginfo-3.4.5.5-97.1 libreoffice-writer-extensions-3.4.5.5-97.1 - openSUSE 11.4 (noarch): libreoffice-branding-upstream-3.4.5.5-97.1 libreoffice-help-cs-3.4.5.5-97.1 libreoffice-help-da-3.4.5.5-97.1 libreoffice-help-de-3.4.5.5-97.1 libreoffice-help-en-GB-3.4.5.5-97.1 libreoffice-help-en-US-3.4.5.5-97.1 libreoffice-help-en-ZA-3.4.5.5-97.1 libreoffice-help-es-3.4.5.5-97.1 libreoffice-help-et-3.4.5.5-97.1 libreoffice-help-fr-3.4.5.5-97.1 libreoffice-help-gl-3.4.5.5-97.1 libreoffice-help-gu-IN-3.4.5.5-97.1 libreoffice-help-hi-IN-3.4.5.5-97.1 libreoffice-help-hu-3.4.5.5-97.1 libreoffice-help-it-3.4.5.5-97.1 libreoffice-help-ja-3.4.5.5-97.1 libreoffice-help-km-3.4.5.5-97.1 libreoffice-help-ko-3.4.5.5-97.1 libreoffice-help-nl-3.4.5.5-97.1 libreoffice-help-pl-3.4.5.5-97.1 libreoffice-help-pt-3.4.5.5-97.1 libreoffice-help-pt-BR-3.4.5.5-97.1 libreoffice-help-ru-3.4.5.5-97.1 libreoffice-help-sl-3.4.5.5-97.1 libreoffice-help-sv-3.4.5.5-97.1 libreoffice-help-zh-CN-3.4.5.5-97.1 libreoffice-help-zh-TW-3.4.5.5-97.1 libreoffice-icon-theme-crystal-3.4.5.5-14.1 libreoffice-icon-theme-galaxy-3.4.5.5-14.1 libreoffice-icon-theme-hicontrast-3.4.5.5-14.1 libreoffice-icon-theme-oxygen-3.4.5.5-14.1 libreoffice-icon-theme-tango-3.4.5.5-14.1 libreoffice-l10n-af-3.4.5.5-122.1 libreoffice-l10n-ar-3.4.5.5-122.1 libreoffice-l10n-be-BY-3.4.5.5-122.1 libreoffice-l10n-bg-3.4.5.5-122.1 libreoffice-l10n-br-3.4.5.5-122.1 libreoffice-l10n-ca-3.4.5.5-122.1 libreoffice-l10n-cs-3.4.5.5-122.1 libreoffice-l10n-cy-3.4.5.5-122.1 libreoffice-l10n-da-3.4.5.5-122.1 libreoffice-l10n-de-3.4.5.5-122.1 libreoffice-l10n-el-3.4.5.5-122.1 libreoffice-l10n-en-GB-3.4.5.5-122.1 libreoffice-l10n-en-ZA-3.4.5.5-122.1 libreoffice-l10n-es-3.4.5.5-122.1 libreoffice-l10n-et-3.4.5.5-122.1 libreoffice-l10n-fi-3.4.5.5-122.1 libreoffice-l10n-fr-3.4.5.5-122.1 libreoffice-l10n-ga-3.4.5.5-122.1 libreoffice-l10n-gl-3.4.5.5-122.1 libreoffice-l10n-gu-IN-3.4.5.5-122.1 libreoffice-l10n-he-3.4.5.5-122.1 libreoffice-l10n-hi-IN-3.4.5.5-122.1 libreoffice-l10n-hr-3.4.5.5-122.1 libreoffice-l10n-hu-3.4.5.5-122.1 libreoffice-l10n-it-3.4.5.5-122.1 libreoffice-l10n-ja-3.4.5.5-122.1 libreoffice-l10n-ka-3.4.5.5-122.1 libreoffice-l10n-km-3.4.5.5-122.1 libreoffice-l10n-ko-3.4.5.5-122.1 libreoffice-l10n-lt-3.4.5.5-122.1 libreoffice-l10n-mk-3.4.5.5-122.1 libreoffice-l10n-nb-3.4.5.5-122.1 libreoffice-l10n-nl-3.4.5.5-122.1 libreoffice-l10n-nn-3.4.5.5-122.1 libreoffice-l10n-nr-3.4.5.5-122.1 libreoffice-l10n-pa-IN-3.4.5.5-122.1 libreoffice-l10n-pl-3.4.5.5-122.1 libreoffice-l10n-pt-3.4.5.5-122.1 libreoffice-l10n-pt-BR-3.4.5.5-122.1 libreoffice-l10n-ru-3.4.5.5-122.1 libreoffice-l10n-rw-3.4.5.5-122.1 libreoffice-l10n-sh-3.4.5.5-122.1 libreoffice-l10n-sk-3.4.5.5-122.1 libreoffice-l10n-sl-3.4.5.5-122.1 libreoffice-l10n-sr-3.4.5.5-122.1 libreoffice-l10n-ss-3.4.5.5-122.1 libreoffice-l10n-st-3.4.5.5-122.1 libreoffice-l10n-sv-3.4.5.5-122.1 libreoffice-l10n-tg-3.4.5.5-122.1 libreoffice-l10n-th-3.4.5.5-122.1 libreoffice-l10n-tr-3.4.5.5-122.1 libreoffice-l10n-ts-3.4.5.5-122.1 libreoffice-l10n-uk-3.4.5.5-122.1 libreoffice-l10n-ve-3.4.5.5-122.1 libreoffice-l10n-vi-3.4.5.5-122.1 libreoffice-l10n-xh-3.4.5.5-122.1 libreoffice-l10n-zh-CN-3.4.5.5-122.1 libreoffice-l10n-zh-TW-3.4.5.5-122.1 libreoffice-l10n-zu-3.4.5.5-122.1 References: http://support.novell.com/security/cve/CVE-2012-0037.html https://bugzilla.novell.com/101776 https://bugzilla.novell.com/116448 https://bugzilla.novell.com/117010 https://bugzilla.novell.com/31966 https://bugzilla.novell.com/32861 https://bugzilla.novell.com/35513 https://bugzilla.novell.com/35965 https://bugzilla.novell.com/37129 https://bugzilla.novell.com/37195 https://bugzilla.novell.com/38286 https://bugzilla.novell.com/38391 https://bugzilla.novell.com/38441 https://bugzilla.novell.com/39485 https://bugzilla.novell.com/39510 https://bugzilla.novell.com/39657 https://bugzilla.novell.com/39694 https://bugzilla.novell.com/40298 https://bugzilla.novell.com/40320 https://bugzilla.novell.com/40461 https://bugzilla.novell.com/40701 https://bugzilla.novell.com/41022 https://bugzilla.novell.com/41245 https://bugzilla.novell.com/41681 https://bugzilla.novell.com/417818 https://bugzilla.novell.com/41995 https://bugzilla.novell.com/42073 https://bugzilla.novell.com/42543 https://bugzilla.novell.com/44816 https://bugzilla.novell.com/45560 https://bugzilla.novell.com/46165 https://bugzilla.novell.com/46337 https://bugzilla.novell.com/621739 https://bugzilla.novell.com/653688 https://bugzilla.novell.com/655408 https://bugzilla.novell.com/657909 https://bugzilla.novell.com/667082 https://bugzilla.novell.com/677811 https://bugzilla.novell.com/685123 https://bugzilla.novell.com/693238 https://bugzilla.novell.com/693388 https://bugzilla.novell.com/695479 https://bugzilla.novell.com/699334 https://bugzilla.novell.com/703032 https://bugzilla.novell.com/704274 https://bugzilla.novell.com/705949 https://bugzilla.novell.com/705956 https://bugzilla.novell.com/705977 https://bugzilla.novell.com/705985 https://bugzilla.novell.com/705991 https://bugzilla.novell.com/706138 https://bugzilla.novell.com/706792 https://bugzilla.novell.com/707157 https://bugzilla.novell.com/714787 https://bugzilla.novell.com/715094 https://bugzilla.novell.com/715104 https://bugzilla.novell.com/715115 https://bugzilla.novell.com/715543 https://bugzilla.novell.com/717290 https://bugzilla.novell.com/718227 https://bugzilla.novell.com/718694 https://bugzilla.novell.com/718971 https://bugzilla.novell.com/719656 https://bugzilla.novell.com/719887 https://bugzilla.novell.com/719989 https://bugzilla.novell.com/720443 https://bugzilla.novell.com/720948 https://bugzilla.novell.com/722045 https://bugzilla.novell.com/722644 https://bugzilla.novell.com/722918 https://bugzilla.novell.com/723074 https://bugzilla.novell.com/724087 https://bugzilla.novell.com/726152 https://bugzilla.novell.com/726174 https://bugzilla.novell.com/727504 https://bugzilla.novell.com/728559 https://bugzilla.novell.com/728603 https://bugzilla.novell.com/733864 https://bugzilla.novell.com/734734 https://bugzilla.novell.com/734781 https://bugzilla.novell.com/735533 https://bugzilla.novell.com/736495 https://bugzilla.novell.com/737190 https://bugzilla.novell.com/737921 https://bugzilla.novell.com/738113 https://bugzilla.novell.com/740032 https://bugzilla.novell.com/740117 https://bugzilla.novell.com/740453 https://bugzilla.novell.com/741043 https://bugzilla.novell.com/741182 https://bugzilla.novell.com/742178 https://bugzilla.novell.com/746996 https://bugzilla.novell.com/747471 https://bugzilla.novell.com/748198 https://bugzilla.novell.com/748548 https://bugzilla.novell.com/794679

1 0

openSUSE-SU-2012:0432-1: moderate: update for libpng12, libpng14
by opensuse-security＠opensuse.org 30 Mar '12

30 Mar '12

openSUSE Security Update: update for libpng12, libpng14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0432-1 Rating: moderate References: #752008 Cross-References: CVE-2011-3045 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: specially crafted png files could cause a buffer overflow in libpng Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-186 - openSUSE 11.4: zypper in -t patch openSUSE-2012-186 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libpng12-0-1.2.48-9.6.1 libpng12-0-debuginfo-1.2.48-9.6.1 libpng12-compat-devel-1.2.48-9.6.1 libpng12-debugsource-1.2.48-9.6.1 libpng12-devel-1.2.48-9.6.1 libpng14-14-1.4.10-3.6.1 libpng14-14-debuginfo-1.4.10-3.6.1 libpng14-compat-devel-1.4.10-3.6.1 libpng14-debugsource-1.4.10-3.6.1 libpng14-devel-1.4.10-3.6.1 - openSUSE 12.1 (x86_64): libpng12-0-32bit-1.2.48-9.6.1 libpng12-0-debuginfo-32bit-1.2.48-9.6.1 libpng12-compat-devel-32bit-1.2.48-9.6.1 libpng12-devel-32bit-1.2.48-9.6.1 libpng14-14-32bit-1.4.10-3.6.1 libpng14-14-debuginfo-32bit-1.4.10-3.6.1 libpng14-compat-devel-32bit-1.4.10-3.6.1 libpng14-devel-32bit-1.4.10-3.6.1 - openSUSE 11.4 (i586 x86_64): libpng12-0-1.2.48-13.1 libpng12-0-debuginfo-1.2.48-13.1 libpng12-compat-devel-1.2.48-13.1 libpng12-debugsource-1.2.48-13.1 libpng12-devel-1.2.48-13.1 libpng14-14-1.4.4-17.1 libpng14-14-debuginfo-1.4.4-17.1 libpng14-compat-devel-1.4.4-17.1 libpng14-debugsource-1.4.4-17.1 libpng14-devel-1.4.4-17.1 - openSUSE 11.4 (x86_64): libpng12-0-32bit-1.2.48-13.1 libpng12-0-debuginfo-32bit-1.2.48-13.1 libpng12-compat-devel-32bit-1.2.48-13.1 libpng12-devel-32bit-1.2.48-13.1 libpng14-14-32bit-1.4.4-17.1 libpng14-14-debuginfo-32bit-1.4.4-17.1 libpng14-compat-devel-32bit-1.4.4-17.1 libpng14-devel-32bit-1.4.4-17.1 References: http://support.novell.com/security/cve/CVE-2011-3045.html https://bugzilla.novell.com/752008

1 0

openSUSE-RU-2012:0429-1: Maintenance update for net-snmp
by maintenance＠opensuse.org 29 Mar '12

29 Mar '12

openSUSE Recommended Update: Maintenance update for net-snmp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0429-1 Rating: low References: #670789 #707636 #712174 #715199 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following bugs: - fix agent crash when reloading a subagent (AgentX) during a query (bnc#670789) - avoid an unnecessary stop/start cycle in the agent after log rotation (bnc#707636) - fix logging option in snmptrapd init script (bnc#712174) - add VxFS, ReiserFS and OCFS2 to the list of known file systems (bnc#715199) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-185 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libsnmp25-5.6.1-4.29.1 libsnmp25-debuginfo-5.6.1-4.29.1 net-snmp-5.6.1-4.29.1 net-snmp-debuginfo-5.6.1-4.29.1 net-snmp-debugsource-5.6.1-4.29.1 net-snmp-devel-5.6.1-4.29.1 perl-SNMP-5.6.1-4.29.1 perl-SNMP-debuginfo-5.6.1-4.29.1 snmp-mibs-5.6.1-4.29.1 - openSUSE 11.4 (x86_64): libsnmp25-32bit-5.6.1-4.29.1 libsnmp25-debuginfo-32bit-5.6.1-4.29.1 References: https://bugzilla.novell.com/670789 https://bugzilla.novell.com/707636 https://bugzilla.novell.com/712174 https://bugzilla.novell.com/715199

1 0

openSUSE-SU-2012:0428-1: moderate: update for libreoffice
by opensuse-security＠opensuse.org 29 Mar '12

29 Mar '12

openSUSE Security Update: update for libreoffice ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0428-1 Rating: moderate References: #417818 #621739 #653688 #655408 #657909 #677811 #685123 #693238 #693388 #695479 #699334 #703032 #704274 #705949 #705956 #705977 #705985 #705991 #706138 #706792 #707157 #714787 #715094 #715104 #715115 #715543 #717290 #718227 #718971 #719887 #719989 #720443 #720948 #722045 #722644 #722918 #724087 #726152 #726174 #727504 #728559 #728603 #733864 #734734 #734781 #735533 #736495 #737190 #737921 #738113 #740032 #740117 #740453 #741043 #741182 #742178 #746996 #747471 #748198 #748548 Cross-References: CVE-2012-0037 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves one vulnerability and has 59 fixes is now available. Description: - updated to libreoffice-3.4.5.5 (SUSE 3.4.5-rc3): * extras * add SUSE color palette (fate#312645) * filters * crash when loading embedded elements (bnc#693238) * crash when importing an empty paragraph (rh#667082) * writer * do not use an invalidated iterator (fdo#46337) - updated to libreoffice-3.4.5.4 (SUSE 3.4.5-rc2) * calc * pie charts colors messed in XLS import (fdo#40320) * correctly import data point formats in data series (fdo#40320) * components * crash when parsing XML signatures (fdo#39657) * broken getDataArray (fdo#46165, fdo#38441, i#117010) * don't paint a frame around the list of edit boxes (fdo#42543) * inconsistent compression method for encrypted documents (bnc#653688) * filters * more on bentConnectors (bnc#736495) * wrong text color in smartArt (bnc#746996) * reading of w:textbox contents (bnc#693388) * textbox position and size DOCX import (fdo#45560) * RTF/DOCX import of transparent frames (bnc#695479) * consecutive frames in RTF/DOCX import (bnc#703032) * handling of frame properties in RTF import (bnc#417818) * force imported XLSX active tab to be shown (bnc#748198) * create TableManager for inside shapes (bnc#747471, bnc#693238) * textboxes import with OLE objects inside (bnc#747471, bnc#693238) * impress * do not create an empty slide when printing handouts (fdo#31966) * libs-core * default shortcut for .uno:SearchDialog should be Ctrl+H * crash using instances dialog of dataform navigator (fdo#44816) * libs-extern * disable problematic reading of external entities in raptor * libs-gui * correctly calculate leap year * use proper Indian Rupee currency symbol U+20B9 (rh#794679) * writer * field refreshing (fdo#39694) * more layout crashers (i#101776, fdo#39510) * textbox borders style and width in DOCX import (fdo#45560) * expand all text fields when setting properties (fdo#42073) - updated to libreoffice-3.4.5.3 (SUSE 3.4.5-rc1) * version 3.4.5.3, tag suse-3.4.5.3 (SUSE LO 3.4.5-rc1) * SmartArt import * custom shapes import * Oracle Java 1.7.0 detection * reading AES-encrypted ODF 1.2 documents as generated by LO 3.5 * base * iterator misuse (fdo #44040, bnc#742178) * calc * allow pasting to multiple ranges (bnc#715094) * correctly convert chart data ranges (bnc#727504) * definedName corruption for XLSX export (bnc#741182) * adjust/shrink the ranges while copying (bnc#677811) * extra graph data is displayed for label (bnc#717290) * getCellRangeByName failure for named range (bnc#738113) * graph in XLS file has dates displayed wrong (bnc#720443) * improve performance of large Excel documents (bnc#715104) * display page background color/image properly (bnc#722045) * pivot table output becoming empty on re-save (bnc#715543) * encode virtual paths to local volume correctly (bnc#719887) * avoid adjusting cell-anchored objects on other sheets (bnc#726152) * make sure to adjust the sheet index of drawing objects (bnc#733864) * make the data validation popup more reliable (fdo #36851, bnc#737190) * filters * table style (bnc#705991) * text rotation fixes (bnc#734734) * crash in PPTX import (bnc#706792) * read w:sdt* contents (bnc#705949) * connector shape fixes (bnc#719989) * legacy fragment import (bnc#699334) * non-working Excel macros (bnc#705977) * free drawn curves import (bnc#657909) * group shape transformations (bnc#621739) * extLst of drawings in diagrams import (bnc#655408) * flip properties of custom shapes import (bnc#705985) * line spacing is used from previous values (bnc#734734) * missing ooxml customshape->mso shape name entries (bnc#737921) * word doesn't break the numberings and prefers hiding them (bnc#707157) * impress * undo corruption (bnc#685123) * do not set duplicate master slide names (bnc#735533) * libs-core * handle copy and paste from ConsoleOne (bnc#704274) * VBA control events not working, broken eventattacher (bnc#718227) * "General Error" when double-click graphic in presentation (bnc#720948) * libs-extern-sys * upgrade graphite to 1.0.3 fix surrogate support * libs-gui * crash at exit (bnc#728603) * radial gradient offset (bnc#714787) * horizontal scrollbars with KDE oxygen style (bnc#722918) * rendering of metafiles embedded in EMF+ (updated) (bnc#705956) * postprocess * make the 3D transitions work again (bnc#728559) * ure * make Duden Korrektor 5 and 6 work * writer * frame selection (bnc#740117) * crash when editing index (bnc#726174) * order database properties (bnc#740032) * numbering levels in DOC import (bnc#715115) * image size issue in DOC import (bnc#718971) * pointless forward moving of a table (bnc#706138) * tabs set after the end margin in DOCX import (bnc#693238) * add hyperlinks by default in Table of Contents (bnc#705956) - updated to libreoffice-3.4.4.3 (SUSE 3.4.4-rc1 == final): * base * crash when inserting a constant in a query (fdo#38286) * calc * crash when modifying a named range * speed up range name lookup by index (bnc#715104) * recalculate matrix formula dimension correctly (fdo#39485) * mark all formula cells dirty when appending a new sheet (fdo#35965) * components * handling of SAFEARRAY(s) in olebridge (fdo#38441) * filters * auto fit text VIEWING too small in PPT import (fdo#41245) * impress * hang in slideshow (fdo#32861) * crash while dropping texture (fdo#38391) * libs-core * recognize .svg in ODF container (fdo#41995) * dictionaries lost after LibO upgrade (fdo#37195) * crash when "Find Record" button is clicked in Base (fdo#40701) * fix the drawing of dotted and dashed borders in Calc (fdo#37129) * VBA control events not working; broken eventattacher (bnc#718227) * libs-extern-sys * upgrade graphite to 1.0.3 to fix surrogate support * libs-gui * crash when changing screen resolution * let Qt call XInitThreads() (fdo#40298) * activation order crashes address database (fdo#41022) * drawing of dotted and dashed borders in Calc (fdo#37129) * translations * update translations * writer * leak in PDF export (i#116448) * crash when editing index (bnc#726174) * crash while processing incorrect range of pages (fdo#35513) * crash on closing document with footnotes (fdo#39510, lp#854626) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-183 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libreoffice-3.4.5.5-4.5.1 libreoffice-base-3.4.5.5-4.5.1 libreoffice-base-debuginfo-3.4.5.5-4.5.1 libreoffice-base-drivers-mysql-3.4.5.5-4.5.1 libreoffice-base-drivers-mysql-debuginfo-3.4.5.5-4.5.1 libreoffice-base-drivers-postgresql-3.4.5.5-4.5.1 libreoffice-base-drivers-postgresql-debuginfo-3.4.5.5-4.5.1 libreoffice-base-extensions-3.4.5.5-4.5.1 libreoffice-calc-3.4.5.5-4.5.1 libreoffice-calc-debuginfo-3.4.5.5-4.5.1 libreoffice-calc-extensions-3.4.5.5-4.5.1 libreoffice-debuginfo-3.4.5.5-4.5.1 libreoffice-debugsource-3.4.5.5-4.5.1 libreoffice-draw-3.4.5.5-4.5.1 libreoffice-draw-extensions-3.4.5.5-4.5.1 libreoffice-draw-extensions-debuginfo-3.4.5.5-4.5.1 libreoffice-filters-optional-3.4.5.5-4.5.1 libreoffice-filters-optional-debuginfo-3.4.5.5-4.5.1 libreoffice-gnome-3.4.5.5-4.5.1 libreoffice-gnome-debuginfo-3.4.5.5-4.5.1 libreoffice-icon-themes-prebuilt-3.4.5.5-4.5.1 libreoffice-impress-3.4.5.5-4.5.1 libreoffice-impress-debuginfo-3.4.5.5-4.5.1 libreoffice-impress-extensions-3.4.5.5-4.5.1 libreoffice-impress-extensions-debuginfo-3.4.5.5-4.5.1 libreoffice-kde-3.4.5.5-4.5.1 libreoffice-kde-debuginfo-3.4.5.5-4.5.1 libreoffice-kde4-3.4.5.5-4.5.1 libreoffice-kde4-debuginfo-3.4.5.5-4.5.1 libreoffice-l10n-prebuilt-3.4.5.5-4.5.1 libreoffice-mailmerge-3.4.5.5-4.5.1 libreoffice-math-3.4.5.5-4.5.1 libreoffice-math-debuginfo-3.4.5.5-4.5.1 libreoffice-officebean-3.4.5.5-4.5.1 libreoffice-officebean-debuginfo-3.4.5.5-4.5.1 libreoffice-pyuno-3.4.5.5-4.5.1 libreoffice-pyuno-debuginfo-3.4.5.5-4.5.1 libreoffice-sdk-3.4.5.5-4.5.1 libreoffice-sdk-debuginfo-3.4.5.5-4.5.1 libreoffice-sdk-doc-3.4.5.5-4.5.1 libreoffice-testtool-3.4.5.5-4.5.1 libreoffice-testtool-debuginfo-3.4.5.5-4.5.1 libreoffice-writer-3.4.5.5-4.5.1 libreoffice-writer-debuginfo-3.4.5.5-4.5.1 libreoffice-writer-extensions-3.4.5.5-4.5.1 - openSUSE 12.1 (noarch): libreoffice-branding-upstream-3.4.5.5-4.5.1 libreoffice-help-cs-3.4.5.5-4.5.1 libreoffice-help-da-3.4.5.5-4.5.1 libreoffice-help-de-3.4.5.5-4.5.1 libreoffice-help-en-GB-3.4.5.5-4.5.1 libreoffice-help-en-US-3.4.5.5-4.5.1 libreoffice-help-en-ZA-3.4.5.5-4.5.1 libreoffice-help-es-3.4.5.5-4.5.1 libreoffice-help-et-3.4.5.5-4.5.1 libreoffice-help-fr-3.4.5.5-4.5.1 libreoffice-help-gl-3.4.5.5-4.5.1 libreoffice-help-gu-IN-3.4.5.5-4.5.1 libreoffice-help-hi-IN-3.4.5.5-4.5.1 libreoffice-help-hu-3.4.5.5-4.5.1 libreoffice-help-it-3.4.5.5-4.5.1 libreoffice-help-ja-3.4.5.5-4.5.1 libreoffice-help-km-3.4.5.5-4.5.1 libreoffice-help-ko-3.4.5.5-4.5.1 libreoffice-help-nl-3.4.5.5-4.5.1 libreoffice-help-pl-3.4.5.5-4.5.1 libreoffice-help-pt-3.4.5.5-4.5.1 libreoffice-help-pt-BR-3.4.5.5-4.5.1 libreoffice-help-ru-3.4.5.5-4.5.1 libreoffice-help-sl-3.4.5.5-4.5.1 libreoffice-help-sv-3.4.5.5-4.5.1 libreoffice-help-zh-CN-3.4.5.5-4.5.1 libreoffice-help-zh-TW-3.4.5.5-4.5.1 libreoffice-icon-theme-crystal-3.4.5.5-2.4.1 libreoffice-icon-theme-galaxy-3.4.5.5-2.4.1 libreoffice-icon-theme-hicontrast-3.4.5.5-2.4.1 libreoffice-icon-theme-oxygen-3.4.5.5-2.4.1 libreoffice-icon-theme-tango-3.4.5.5-2.4.1 libreoffice-l10n-af-3.4.5.5-2.4.1 libreoffice-l10n-ar-3.4.5.5-2.4.1 libreoffice-l10n-be-BY-3.4.5.5-2.4.1 libreoffice-l10n-bg-3.4.5.5-2.4.1 libreoffice-l10n-br-3.4.5.5-2.4.1 libreoffice-l10n-ca-3.4.5.5-2.4.1 libreoffice-l10n-cs-3.4.5.5-2.4.1 libreoffice-l10n-cy-3.4.5.5-2.4.1 libreoffice-l10n-da-3.4.5.5-2.4.1 libreoffice-l10n-de-3.4.5.5-2.4.1 libreoffice-l10n-el-3.4.5.5-2.4.1 libreoffice-l10n-en-GB-3.4.5.5-2.4.1 libreoffice-l10n-en-ZA-3.4.5.5-2.4.1 libreoffice-l10n-es-3.4.5.5-2.4.1 libreoffice-l10n-et-3.4.5.5-2.4.1 libreoffice-l10n-fi-3.4.5.5-2.4.1 libreoffice-l10n-fr-3.4.5.5-2.4.1 libreoffice-l10n-ga-3.4.5.5-2.4.1 libreoffice-l10n-gl-3.4.5.5-2.4.1 libreoffice-l10n-gu-IN-3.4.5.5-2.4.1 libreoffice-l10n-he-3.4.5.5-2.4.1 libreoffice-l10n-hi-IN-3.4.5.5-2.4.1 libreoffice-l10n-hr-3.4.5.5-2.4.1 libreoffice-l10n-hu-3.4.5.5-2.4.1 libreoffice-l10n-it-3.4.5.5-2.4.1 libreoffice-l10n-ja-3.4.5.5-2.4.1 libreoffice-l10n-ka-3.4.5.5-2.4.1 libreoffice-l10n-km-3.4.5.5-2.4.1 libreoffice-l10n-ko-3.4.5.5-2.4.1 libreoffice-l10n-lt-3.4.5.5-2.4.1 libreoffice-l10n-mk-3.4.5.5-2.4.1 libreoffice-l10n-nb-3.4.5.5-2.4.1 libreoffice-l10n-nl-3.4.5.5-2.4.1 libreoffice-l10n-nn-3.4.5.5-2.4.1 libreoffice-l10n-nr-3.4.5.5-2.4.1 libreoffice-l10n-pa-IN-3.4.5.5-2.4.1 libreoffice-l10n-pl-3.4.5.5-2.4.1 libreoffice-l10n-pt-3.4.5.5-2.4.1 libreoffice-l10n-pt-BR-3.4.5.5-2.4.1 libreoffice-l10n-ru-3.4.5.5-2.4.1 libreoffice-l10n-rw-3.4.5.5-2.4.1 libreoffice-l10n-sh-3.4.5.5-2.4.1 libreoffice-l10n-sk-3.4.5.5-2.4.1 libreoffice-l10n-sl-3.4.5.5-2.4.1 libreoffice-l10n-sr-3.4.5.5-2.4.1 libreoffice-l10n-ss-3.4.5.5-2.4.1 libreoffice-l10n-st-3.4.5.5-2.4.1 libreoffice-l10n-sv-3.4.5.5-2.4.1 libreoffice-l10n-tg-3.4.5.5-2.4.1 libreoffice-l10n-th-3.4.5.5-2.4.1 libreoffice-l10n-tr-3.4.5.5-2.4.1 libreoffice-l10n-ts-3.4.5.5-2.4.1 libreoffice-l10n-uk-3.4.5.5-2.4.1 libreoffice-l10n-ve-3.4.5.5-2.4.1 libreoffice-l10n-vi-3.4.5.5-2.4.1 libreoffice-l10n-xh-3.4.5.5-2.4.1 libreoffice-l10n-zh-CN-3.4.5.5-2.4.1 libreoffice-l10n-zh-TW-3.4.5.5-2.4.1 libreoffice-l10n-zu-3.4.5.5-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-0037.html https://bugzilla.novell.com/417818 https://bugzilla.novell.com/621739 https://bugzilla.novell.com/653688 https://bugzilla.novell.com/655408 https://bugzilla.novell.com/657909 https://bugzilla.novell.com/677811 https://bugzilla.novell.com/685123 https://bugzilla.novell.com/693238 https://bugzilla.novell.com/693388 https://bugzilla.novell.com/695479 https://bugzilla.novell.com/699334 https://bugzilla.novell.com/703032 https://bugzilla.novell.com/704274 https://bugzilla.novell.com/705949 https://bugzilla.novell.com/705956 https://bugzilla.novell.com/705977 https://bugzilla.novell.com/705985 https://bugzilla.novell.com/705991 https://bugzilla.novell.com/706138 https://bugzilla.novell.com/706792 https://bugzilla.novell.com/707157 https://bugzilla.novell.com/714787 https://bugzilla.novell.com/715094 https://bugzilla.novell.com/715104 https://bugzilla.novell.com/715115 https://bugzilla.novell.com/715543 https://bugzilla.novell.com/717290 https://bugzilla.novell.com/718227 https://bugzilla.novell.com/718971 https://bugzilla.novell.com/719887 https://bugzilla.novell.com/719989 https://bugzilla.novell.com/720443 https://bugzilla.novell.com/720948 https://bugzilla.novell.com/722045 https://bugzilla.novell.com/722644 https://bugzilla.novell.com/722918 https://bugzilla.novell.com/724087 https://bugzilla.novell.com/726152 https://bugzilla.novell.com/726174 https://bugzilla.novell.com/727504 https://bugzilla.novell.com/728559 https://bugzilla.novell.com/728603 https://bugzilla.novell.com/733864 https://bugzilla.novell.com/734734 https://bugzilla.novell.com/734781 https://bugzilla.novell.com/735533 https://bugzilla.novell.com/736495 https://bugzilla.novell.com/737190 https://bugzilla.novell.com/737921 https://bugzilla.novell.com/738113 https://bugzilla.novell.com/740032 https://bugzilla.novell.com/740117 https://bugzilla.novell.com/740453 https://bugzilla.novell.com/741043 https://bugzilla.novell.com/741182 https://bugzilla.novell.com/742178 https://bugzilla.novell.com/746996 https://bugzilla.novell.com/747471 https://bugzilla.novell.com/748198 https://bugzilla.novell.com/748548

1 0

openSUSE-SU-2012:0427-1: critical: flash-player update
by opensuse-security＠opensuse.org 29 Mar '12

29 Mar '12

openSUSE Security Update: flash-player update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0427-1 Rating: critical References: #754689 Cross-References: CVE-2012-0773 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player 11.1.102.63 fixes a memory corruption vulnerability in the NetStream class that could lead to code execution Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-184 - openSUSE 11.4: zypper in -t patch openSUSE-2012-184 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.228-12.1 flash-player-gnome-11.2.202.228-12.1 flash-player-kde4-11.2.202.228-12.1 - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.228-6.1 flash-player-gnome-11.2.202.228-6.1 flash-player-kde4-11.2.202.228-6.1 References: http://support.novell.com/security/cve/CVE-2012-0773.html https://bugzilla.novell.com/754689

1 0

openSUSE-SU-2012:0426-1: important: update for php5
by opensuse-security＠opensuse.org 29 Mar '12

29 Mar '12

openSUSE Security Update: update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0426-1 Rating: important References: #728671 #733590 #736169 #738221 #741520 #741859 #742273 #742806 #743308 #744966 #746661 #749111 Cross-References: CVE-2011-1466 CVE-2011-4153 CVE-2011-4566 CVE-2011-4885 CVE-2012-0057 CVE-2012-0781 CVE-2012-0788 CVE-2012-0789 CVE-2012-0807 CVE-2012-0830 CVE-2012-0831 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has one errata is now available. Description: php5 security update Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-182 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): apache2-mod_php5-5.3.8-4.9.2 apache2-mod_php5-debuginfo-5.3.8-4.9.2 php5-5.3.8-4.9.2 php5-bcmath-5.3.8-4.9.2 php5-bcmath-debuginfo-5.3.8-4.9.2 php5-bz2-5.3.8-4.9.2 php5-bz2-debuginfo-5.3.8-4.9.2 php5-calendar-5.3.8-4.9.2 php5-calendar-debuginfo-5.3.8-4.9.2 php5-ctype-5.3.8-4.9.2 php5-ctype-debuginfo-5.3.8-4.9.2 php5-curl-5.3.8-4.9.2 php5-curl-debuginfo-5.3.8-4.9.2 php5-dba-5.3.8-4.9.2 php5-dba-debuginfo-5.3.8-4.9.2 php5-debuginfo-5.3.8-4.9.2 php5-debugsource-5.3.8-4.9.2 php5-devel-5.3.8-4.9.2 php5-dom-5.3.8-4.9.2 php5-dom-debuginfo-5.3.8-4.9.2 php5-enchant-5.3.8-4.9.2 php5-enchant-debuginfo-5.3.8-4.9.2 php5-exif-5.3.8-4.9.2 php5-exif-debuginfo-5.3.8-4.9.2 php5-fastcgi-5.3.8-4.9.2 php5-fastcgi-debuginfo-5.3.8-4.9.2 php5-fileinfo-5.3.8-4.9.2 php5-fileinfo-debuginfo-5.3.8-4.9.2 php5-fpm-5.3.8-4.9.2 php5-fpm-debuginfo-5.3.8-4.9.2 php5-ftp-5.3.8-4.9.2 php5-ftp-debuginfo-5.3.8-4.9.2 php5-gd-5.3.8-4.9.2 php5-gd-debuginfo-5.3.8-4.9.2 php5-gettext-5.3.8-4.9.2 php5-gettext-debuginfo-5.3.8-4.9.2 php5-gmp-5.3.8-4.9.2 php5-gmp-debuginfo-5.3.8-4.9.2 php5-iconv-5.3.8-4.9.2 php5-iconv-debuginfo-5.3.8-4.9.2 php5-imap-5.3.8-4.9.2 php5-imap-debuginfo-5.3.8-4.9.2 php5-intl-5.3.8-4.9.2 php5-intl-debuginfo-5.3.8-4.9.2 php5-json-5.3.8-4.9.2 php5-json-debuginfo-5.3.8-4.9.2 php5-ldap-5.3.8-4.9.2 php5-ldap-debuginfo-5.3.8-4.9.2 php5-mbstring-5.3.8-4.9.2 php5-mbstring-debuginfo-5.3.8-4.9.2 php5-mcrypt-5.3.8-4.9.2 php5-mcrypt-debuginfo-5.3.8-4.9.2 php5-mssql-5.3.8-4.9.2 php5-mssql-debuginfo-5.3.8-4.9.2 php5-mysql-5.3.8-4.9.2 php5-mysql-debuginfo-5.3.8-4.9.2 php5-odbc-5.3.8-4.9.2 php5-odbc-debuginfo-5.3.8-4.9.2 php5-openssl-5.3.8-4.9.2 php5-openssl-debuginfo-5.3.8-4.9.2 php5-pcntl-5.3.8-4.9.2 php5-pcntl-debuginfo-5.3.8-4.9.2 php5-pdo-5.3.8-4.9.2 php5-pdo-debuginfo-5.3.8-4.9.2 php5-pgsql-5.3.8-4.9.2 php5-pgsql-debuginfo-5.3.8-4.9.2 php5-phar-5.3.8-4.9.2 php5-phar-debuginfo-5.3.8-4.9.2 php5-posix-5.3.8-4.9.2 php5-posix-debuginfo-5.3.8-4.9.2 php5-pspell-5.3.8-4.9.2 php5-pspell-debuginfo-5.3.8-4.9.2 php5-readline-5.3.8-4.9.2 php5-readline-debuginfo-5.3.8-4.9.2 php5-shmop-5.3.8-4.9.2 php5-shmop-debuginfo-5.3.8-4.9.2 php5-snmp-5.3.8-4.9.2 php5-snmp-debuginfo-5.3.8-4.9.2 php5-soap-5.3.8-4.9.2 php5-soap-debuginfo-5.3.8-4.9.2 php5-sockets-5.3.8-4.9.2 php5-sockets-debuginfo-5.3.8-4.9.2 php5-sqlite-5.3.8-4.9.2 php5-sqlite-debuginfo-5.3.8-4.9.2 php5-suhosin-5.3.8-4.9.2 php5-suhosin-debuginfo-5.3.8-4.9.2 php5-sysvmsg-5.3.8-4.9.2 php5-sysvmsg-debuginfo-5.3.8-4.9.2 php5-sysvsem-5.3.8-4.9.2 php5-sysvsem-debuginfo-5.3.8-4.9.2 php5-sysvshm-5.3.8-4.9.2 php5-sysvshm-debuginfo-5.3.8-4.9.2 php5-tidy-5.3.8-4.9.2 php5-tidy-debuginfo-5.3.8-4.9.2 php5-tokenizer-5.3.8-4.9.2 php5-tokenizer-debuginfo-5.3.8-4.9.2 php5-wddx-5.3.8-4.9.2 php5-wddx-debuginfo-5.3.8-4.9.2 php5-xmlreader-5.3.8-4.9.2 php5-xmlreader-debuginfo-5.3.8-4.9.2 php5-xmlrpc-5.3.8-4.9.2 php5-xmlrpc-debuginfo-5.3.8-4.9.2 php5-xmlwriter-5.3.8-4.9.2 php5-xmlwriter-debuginfo-5.3.8-4.9.2 php5-xsl-5.3.8-4.9.2 php5-xsl-debuginfo-5.3.8-4.9.2 php5-zip-5.3.8-4.9.2 php5-zip-debuginfo-5.3.8-4.9.2 php5-zlib-5.3.8-4.9.2 php5-zlib-debuginfo-5.3.8-4.9.2 - openSUSE 12.1 (noarch): php5-pear-5.3.8-4.9.2 References: http://support.novell.com/security/cve/CVE-2011-1466.html http://support.novell.com/security/cve/CVE-2011-4153.html http://support.novell.com/security/cve/CVE-2011-4566.html http://support.novell.com/security/cve/CVE-2011-4885.html http://support.novell.com/security/cve/CVE-2012-0057.html http://support.novell.com/security/cve/CVE-2012-0781.html http://support.novell.com/security/cve/CVE-2012-0788.html http://support.novell.com/security/cve/CVE-2012-0789.html http://support.novell.com/security/cve/CVE-2012-0807.html http://support.novell.com/security/cve/CVE-2012-0830.html http://support.novell.com/security/cve/CVE-2012-0831.html https://bugzilla.novell.com/728671 https://bugzilla.novell.com/733590 https://bugzilla.novell.com/736169 https://bugzilla.novell.com/738221 https://bugzilla.novell.com/741520 https://bugzilla.novell.com/741859 https://bugzilla.novell.com/742273 https://bugzilla.novell.com/742806 https://bugzilla.novell.com/743308 https://bugzilla.novell.com/744966 https://bugzilla.novell.com/746661 https://bugzilla.novell.com/749111

1 0

openSUSE-SU-2012:0423-1: moderate: update for expat
by opensuse-security＠opensuse.org 28 Mar '12

28 Mar '12

openSUSE Security Update: update for expat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0423-1 Rating: moderate References: #750914 #751464 #751465 Cross-References: CVE-2012-0876 CVE-2012-1147 CVE-2012-1148 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: expat was prone to a hash collision attack that could lead to exessive CPU usage and resource leaks Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-181 - openSUSE 11.4: zypper in -t patch openSUSE-2012-181 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): expat-2.0.1-109.4.1 expat-debuginfo-2.0.1-109.4.1 expat-debugsource-2.0.1-109.4.1 libexpat-devel-2.0.1-109.4.1 libexpat1-2.0.1-109.4.1 libexpat1-debuginfo-2.0.1-109.4.1 - openSUSE 12.1 (x86_64): expat-debuginfo-32bit-2.0.1-109.4.1 libexpat-devel-32bit-2.0.1-109.4.1 libexpat1-32bit-2.0.1-109.4.1 libexpat1-debuginfo-32bit-2.0.1-109.4.1 - openSUSE 11.4 (i586 x86_64): expat-2.0.1-102.105.1 expat-debuginfo-2.0.1-102.105.1 expat-debugsource-2.0.1-102.105.1 libexpat-devel-2.0.1-102.105.1 libexpat1-2.0.1-102.105.1 libexpat1-debuginfo-2.0.1-102.105.1 - openSUSE 11.4 (x86_64): expat-debuginfo-32bit-2.0.1-102.105.1 libexpat-devel-32bit-2.0.1-102.105.1 libexpat1-32bit-2.0.1-102.105.1 libexpat1-debuginfo-32bit-2.0.1-102.105.1 References: http://support.novell.com/security/cve/CVE-2012-0876.html http://support.novell.com/security/cve/CVE-2012-1147.html http://support.novell.com/security/cve/CVE-2012-1148.html https://bugzilla.novell.com/750914 https://bugzilla.novell.com/751464 https://bugzilla.novell.com/751465

1 0

openSUSE-SU-2012:0422-1: update for perl-DBD-Pg
by opensuse-security＠opensuse.org 28 Mar '12

28 Mar '12

openSUSE Security Update: update for perl-DBD-Pg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0422-1 Rating: low References: #751500 Cross-References: CVE-2012-1151 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: perl-DBD-Pg was prone to format string errors which could crash applications Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-180 - openSUSE 11.4: zypper in -t patch openSUSE-2012-180 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): perl-DBD-Pg-2.18.0-3.4.1 perl-DBD-Pg-debuginfo-2.18.0-3.4.1 perl-DBD-Pg-debugsource-2.18.0-3.4.1 - openSUSE 11.4 (i586 x86_64): perl-DBD-Pg-2.17.2-8.1 perl-DBD-Pg-debuginfo-2.17.2-8.1 perl-DBD-Pg-debugsource-2.17.2-8.1 References: http://support.novell.com/security/cve/CVE-2012-1151.html https://bugzilla.novell.com/751500

1 0

openSUSE-SU-2012:0421-1: moderate: update for libxml2
by opensuse-security＠opensuse.org 28 Mar '12

28 Mar '12

openSUSE Security Update: update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0421-1 Rating: moderate References: #748561 Cross-References: CVE-2012-0841 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - add fix for hash table collisions CVE-2012-0841 (bnc#748561) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-179 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libxml2-2.7.8+git20110708-3.5.1 libxml2-debuginfo-2.7.8+git20110708-3.5.1 libxml2-debugsource-2.7.8+git20110708-3.5.1 libxml2-devel-2.7.8+git20110708-3.5.1 - openSUSE 12.1 (x86_64): libxml2-32bit-2.7.8+git20110708-3.5.1 libxml2-debuginfo-32bit-2.7.8+git20110708-3.5.1 libxml2-devel-32bit-2.7.8+git20110708-3.5.1 - openSUSE 12.1 (noarch): libxml2-doc-2.7.8+git20110708-3.5.1 References: http://support.novell.com/security/cve/CVE-2012-0841.html https://bugzilla.novell.com/748561

1 0

openSUSE-RU-2012:0420-1: - Update resolves bnc#752031
by maintenance＠opensuse.org 28 Mar '12

28 Mar '12

openSUSE Recommended Update: - Update resolves bnc#752031 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0420-1 Rating: low References: #752031 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: - Update resolves bnc#752031 - Update the tarball to revision 3032, which seems to be what all other distributions are using; this is needed by some apps like smuxi. Note that it's still version 0.4.0 somehow, since there was no official release. - Add notify-sharp-fix-app-name-derivation.patch: fixes an issue with notification naming with banshee. Taken from Debian. - Replace notify-sharp-use-dbus-sharp.patch with patch from https://github.com/hyperair/notify-sharp. - Add autoconf and automake BuildRequires, needed for the autoreconf call. - Add notify-sharp-use-dbus-sharp.patch - uses dbus-sharp instead of deprecated ndesk-dbus. - Spec changes: + Add devel sub-package. + Add pkgconfig() calls for >= 1130. + Package is noarch, installs on %{_libexecdir} and .pc file goes to %{_datadir} (compliant with other mono packages). + Removed %clean section (not required) anymore. + Minor cleanups. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-178 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (noarch): notify-sharp-0.4.0.r3032-220.4.1 notify-sharp-devel-0.4.0.r3032-220.4.1 References: https://bugzilla.novell.com/752031

1 0

openSUSE-SU-2012:0417-1: moderate: update for MozillaFirefox, MozillaThunderbird
by opensuse-security＠opensuse.org 27 Mar '12

27 Mar '12

openSUSE Security Update: update for MozillaFirefox, MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0417-1 Rating: moderate References: #745303 #746591 #747320 #749440 #750044 #750673 Cross-References: CVE-2011-3658 CVE-2012-0451 CVE-2012-0455 CVE-2012-0456 CVE-2012-0457 CVE-2012-0458 CVE-2012-0459 CVE-2012-0460 CVE-2012-0461 CVE-2012-0462 CVE-2012-0463 CVE-2012-0464 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: Changes in MozillaThunderbird: - update to Thunderbird 11.0 (bnc#750044) * MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag and Drop and Javascript: URL * MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653, #720103) SVG issues found with Address Sanitizer * MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with multiple Content Security Policy headers * MFSA 2012-16/CVE-2012-0458 Escalation of privilege with Javascript: URL as home page * MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when accessing keyframe cssText after dynamic modification * MFSA 2012-18/CVE-2012-0460 (bmo#727303) window.fullScreen writeable by untrusted content * MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/ CVE-2012-0463 Miscellaneous memory safety hazards Changes in mozilla-xulrunner192: - security update to 1.9.2.28 (bnc#750044) * MFSA 2011-55/CVE-2011-3658 (bmo#708186) nsSVGValue out-of-bounds access * MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag and Drop and Javascript: URL * MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653, #720103) SVG issues found with Address Sanitizer * MFSA 2012-16/CVE-2012-0458 Escalation of privilege with Javascript: URL as home page * MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/ CVE-2012-0463 Miscellaneous memory safety hazards Changes in MozillaFirefox: - update to Firefox 11.0 (bnc#750044) * MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag and Drop and Javascript: URL * MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653, #720103) SVG issues found with Address Sanitizer * MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with multiple Content Security Policy headers * MFSA 2012-16/CVE-2012-0458 Escalation of privilege with Javascript: URL as home page * MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when accessing keyframe cssText after dynamic modification * MFSA 2012-18/CVE-2012-0460 (bmo#727303) window.fullScreen writeable by untrusted content * MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/ CVE-2012-0463 Miscellaneous memory safety hazards Changes in seamonkey: - update to Seamonkey 2.8 (bnc#750044) * MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag and Drop and Javascript: URL * MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653, #720103) SVG issues found with Address Sanitizer * MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with multiple Content Security Policy headers * MFSA 2012-16/CVE-2012-0458 Escalation of privilege with Javascript: URL as home page * MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when accessing keyframe cssText after dynamic modification * MFSA 2012-18/CVE-2012-0460 (bmo#727303) window.fullScreen writeable by untrusted content * MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/ CVE-2012-0463 Miscellaneous memory safety hazards Changes in chmsee: - Update to version 1.99.08 Changes in mozilla-nss: - update to 3.13.3 RTM - distrust Trustwave's MITM certificates (bmo#724929) - fix generic blacklisting mechanism (bmo#727204) Changes in mozilla-nspr: - update to version 4.9 RTM Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-175 - openSUSE 11.4: zypper in -t patch openSUSE-2012-175 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): MozillaFirefox-11.0-2.23.1 MozillaFirefox-branding-upstream-11.0-2.23.1 MozillaFirefox-buildsymbols-11.0-2.23.1 MozillaFirefox-debuginfo-11.0-2.23.1 MozillaFirefox-debugsource-11.0-2.23.1 MozillaFirefox-devel-11.0-2.23.1 MozillaFirefox-translations-common-11.0-2.23.1 MozillaFirefox-translations-other-11.0-2.23.1 MozillaThunderbird-11.0-33.14.1 MozillaThunderbird-buildsymbols-11.0-33.14.1 MozillaThunderbird-debuginfo-11.0-33.14.1 MozillaThunderbird-debugsource-11.0-33.14.1 MozillaThunderbird-devel-11.0-33.14.1 MozillaThunderbird-translations-common-11.0-33.14.1 MozillaThunderbird-translations-other-11.0-33.14.1 chmsee-1.99.08-2.15.2 chmsee-debuginfo-1.99.08-2.15.2 chmsee-debugsource-1.99.08-2.15.2 enigmail-1.4.0+11.0-33.14.1 enigmail-debuginfo-1.4.0+11.0-33.14.1 libfreebl3-3.13.3-9.13.1 libfreebl3-debuginfo-3.13.3-9.13.1 libsoftokn3-3.13.3-9.13.1 libsoftokn3-debuginfo-3.13.3-9.13.1 mozilla-js-11.0-2.23.1 mozilla-js-debuginfo-11.0-2.23.1 mozilla-js192-1.9.2.28-2.12.2 mozilla-js192-debuginfo-1.9.2.28-2.12.2 mozilla-nspr-4.9.0-3.3.1 mozilla-nspr-debuginfo-4.9.0-3.3.1 mozilla-nspr-debugsource-4.9.0-3.3.1 mozilla-nspr-devel-4.9.0-3.3.1 mozilla-nss-3.13.3-9.13.1 mozilla-nss-certs-3.13.3-9.13.1 mozilla-nss-certs-debuginfo-3.13.3-9.13.1 mozilla-nss-debuginfo-3.13.3-9.13.1 mozilla-nss-debugsource-3.13.3-9.13.1 mozilla-nss-devel-3.13.3-9.13.1 mozilla-nss-sysinit-3.13.3-9.13.1 mozilla-nss-sysinit-debuginfo-3.13.3-9.13.1 mozilla-nss-tools-3.13.3-9.13.1 mozilla-nss-tools-debuginfo-3.13.3-9.13.1 mozilla-xulrunner192-1.9.2.28-2.12.2 mozilla-xulrunner192-buildsymbols-1.9.2.28-2.12.2 mozilla-xulrunner192-debuginfo-1.9.2.28-2.12.2 mozilla-xulrunner192-debugsource-1.9.2.28-2.12.2 mozilla-xulrunner192-devel-1.9.2.28-2.12.2 mozilla-xulrunner192-devel-debuginfo-1.9.2.28-2.12.2 mozilla-xulrunner192-gnome-1.9.2.28-2.12.2 mozilla-xulrunner192-gnome-debuginfo-1.9.2.28-2.12.2 mozilla-xulrunner192-translations-common-1.9.2.28-2.12.2 mozilla-xulrunner192-translations-other-1.9.2.28-2.12.2 seamonkey-2.8-2.15.1 seamonkey-debuginfo-2.8-2.15.1 seamonkey-debugsource-2.8-2.15.1 seamonkey-dom-inspector-2.8-2.15.1 seamonkey-irc-2.8-2.15.1 seamonkey-translations-common-2.8-2.15.1 seamonkey-translations-other-2.8-2.15.1 seamonkey-venkman-2.8-2.15.1 xulrunner-11.0-2.23.1 xulrunner-buildsymbols-11.0-2.23.1 xulrunner-debuginfo-11.0-2.23.1 xulrunner-debugsource-11.0-2.23.1 xulrunner-devel-11.0-2.23.1 xulrunner-devel-debuginfo-11.0-2.23.1 - openSUSE 12.1 (x86_64): libfreebl3-32bit-3.13.3-9.13.1 libfreebl3-debuginfo-32bit-3.13.3-9.13.1 libsoftokn3-32bit-3.13.3-9.13.1 libsoftokn3-debuginfo-32bit-3.13.3-9.13.1 mozilla-js-32bit-11.0-2.23.1 mozilla-js-debuginfo-32bit-11.0-2.23.1 mozilla-js192-32bit-1.9.2.28-2.12.2 mozilla-js192-debuginfo-32bit-1.9.2.28-2.12.2 mozilla-nspr-32bit-4.9.0-3.3.1 mozilla-nspr-debuginfo-32bit-4.9.0-3.3.1 mozilla-nss-32bit-3.13.3-9.13.1 mozilla-nss-certs-32bit-3.13.3-9.13.1 mozilla-nss-certs-debuginfo-32bit-3.13.3-9.13.1 mozilla-nss-debuginfo-32bit-3.13.3-9.13.1 mozilla-nss-sysinit-32bit-3.13.3-9.13.1 mozilla-nss-sysinit-debuginfo-32bit-3.13.3-9.13.1 mozilla-xulrunner192-32bit-1.9.2.28-2.12.2 mozilla-xulrunner192-debuginfo-32bit-1.9.2.28-2.12.2 mozilla-xulrunner192-gnome-32bit-1.9.2.28-2.12.2 mozilla-xulrunner192-gnome-debuginfo-32bit-1.9.2.28-2.12.2 mozilla-xulrunner192-translations-common-32bit-1.9.2.28-2.12.2 mozilla-xulrunner192-translations-other-32bit-1.9.2.28-2.12.2 xulrunner-32bit-11.0-2.23.1 xulrunner-debuginfo-32bit-11.0-2.23.1 - openSUSE 11.4 (i586 x86_64): MozillaFirefox-11.0-0.15.2 MozillaFirefox-branding-upstream-11.0-0.15.2 MozillaFirefox-buildsymbols-11.0-0.15.2 MozillaFirefox-debuginfo-11.0-0.15.2 MozillaFirefox-debugsource-11.0-0.15.2 MozillaFirefox-devel-11.0-0.15.2 MozillaFirefox-translations-common-11.0-0.15.2 MozillaFirefox-translations-other-11.0-0.15.2 MozillaThunderbird-3.1.20-0.15.4 MozillaThunderbird-buildsymbols-3.1.20-0.15.4 MozillaThunderbird-debuginfo-3.1.20-0.15.4 MozillaThunderbird-debugsource-3.1.20-0.15.4 MozillaThunderbird-devel-3.1.20-0.15.4 MozillaThunderbird-devel-debuginfo-3.1.20-0.15.4 MozillaThunderbird-translations-common-3.1.20-0.15.4 MozillaThunderbird-translations-other-3.1.20-0.15.4 enigmail-1.1.2+3.1.20-0.15.4 enigmail-debuginfo-1.1.2+3.1.20-0.15.4 libfreebl3-3.13.3-0.41.2 libfreebl3-debuginfo-3.13.3-0.41.2 libsoftokn3-3.13.3-0.41.2 libsoftokn3-debuginfo-3.13.3-0.41.2 mozilla-js192-1.9.2.28-0.22.2 mozilla-js192-debuginfo-1.9.2.28-0.22.2 mozilla-nspr-4.9.0-0.13.1 mozilla-nspr-debuginfo-4.9.0-0.13.1 mozilla-nspr-debugsource-4.9.0-0.13.1 mozilla-nspr-devel-4.9.0-0.13.1 mozilla-nss-3.13.3-0.41.2 mozilla-nss-certs-3.13.3-0.41.2 mozilla-nss-certs-debuginfo-3.13.3-0.41.2 mozilla-nss-debuginfo-3.13.3-0.41.2 mozilla-nss-debugsource-3.13.3-0.41.2 mozilla-nss-devel-3.13.3-0.41.2 mozilla-nss-sysinit-3.13.3-0.41.2 mozilla-nss-sysinit-debuginfo-3.13.3-0.41.2 mozilla-nss-tools-3.13.3-0.41.2 mozilla-nss-tools-debuginfo-3.13.3-0.41.2 mozilla-xulrunner192-1.9.2.28-0.22.2 mozilla-xulrunner192-buildsymbols-1.9.2.28-0.22.2 mozilla-xulrunner192-debuginfo-1.9.2.28-0.22.2 mozilla-xulrunner192-debugsource-1.9.2.28-0.22.2 mozilla-xulrunner192-devel-1.9.2.28-0.22.2 mozilla-xulrunner192-devel-debuginfo-1.9.2.28-0.22.2 mozilla-xulrunner192-gnome-1.9.2.28-0.22.2 mozilla-xulrunner192-gnome-debuginfo-1.9.2.28-0.22.2 mozilla-xulrunner192-translations-common-1.9.2.28-0.22.2 mozilla-xulrunner192-translations-other-1.9.2.28-0.22.2 seamonkey-2.8-0.15.1 seamonkey-debuginfo-2.8-0.15.1 seamonkey-debugsource-2.8-0.15.1 seamonkey-dom-inspector-2.8-0.15.1 seamonkey-irc-2.8-0.15.1 seamonkey-translations-common-2.8-0.15.1 seamonkey-translations-other-2.8-0.15.1 seamonkey-venkman-2.8-0.15.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.13.3-0.41.2 libfreebl3-debuginfo-32bit-3.13.3-0.41.2 libsoftokn3-32bit-3.13.3-0.41.2 libsoftokn3-debuginfo-32bit-3.13.3-0.41.2 mozilla-js192-32bit-1.9.2.28-0.22.2 mozilla-js192-debuginfo-32bit-1.9.2.28-0.22.2 mozilla-nspr-32bit-4.9.0-0.13.1 mozilla-nspr-debuginfo-32bit-4.9.0-0.13.1 mozilla-nss-32bit-3.13.3-0.41.2 mozilla-nss-certs-32bit-3.13.3-0.41.2 mozilla-nss-certs-debuginfo-32bit-3.13.3-0.41.2 mozilla-nss-debuginfo-32bit-3.13.3-0.41.2 mozilla-nss-sysinit-32bit-3.13.3-0.41.2 mozilla-nss-sysinit-debuginfo-32bit-3.13.3-0.41.2 mozilla-xulrunner192-32bit-1.9.2.28-0.22.2 mozilla-xulrunner192-debuginfo-32bit-1.9.2.28-0.22.2 mozilla-xulrunner192-gnome-32bit-1.9.2.28-0.22.2 mozilla-xulrunner192-gnome-debuginfo-32bit-1.9.2.28-0.22.2 mozilla-xulrunner192-translations-common-32bit-1.9.2.28-0.22.2 mozilla-xulrunner192-translations-other-32bit-1.9.2.28-0.22.2 References: http://support.novell.com/security/cve/CVE-2011-3658.html http://support.novell.com/security/cve/CVE-2012-0451.html http://support.novell.com/security/cve/CVE-2012-0455.html http://support.novell.com/security/cve/CVE-2012-0456.html http://support.novell.com/security/cve/CVE-2012-0457.html http://support.novell.com/security/cve/CVE-2012-0458.html http://support.novell.com/security/cve/CVE-2012-0459.html http://support.novell.com/security/cve/CVE-2012-0460.html http://support.novell.com/security/cve/CVE-2012-0461.html http://support.novell.com/security/cve/CVE-2012-0462.html http://support.novell.com/security/cve/CVE-2012-0463.html http://support.novell.com/security/cve/CVE-2012-0464.html https://bugzilla.novell.com/745303 https://bugzilla.novell.com/746591 https://bugzilla.novell.com/747320 https://bugzilla.novell.com/749440 https://bugzilla.novell.com/750044 https://bugzilla.novell.com/750673

1 0

openSUSE-SU-2012:0416-1: moderate: update for libzip
by opensuse-security＠opensuse.org 27 Mar '12

27 Mar '12

openSUSE Security Update: update for libzip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0416-1 Rating: moderate References: #751829 #751830 Cross-References: CVE-2012-1162 CVE-2012-1163 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: No description available. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-176 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libzip-0.10-28.3.1 libzip-debuginfo-0.10-28.3.1 libzip-debugsource-0.10-28.3.1 libzip-devel-0.10-28.3.1 libzip2-0.10-28.3.1 libzip2-debuginfo-0.10-28.3.1 References: http://support.novell.com/security/cve/CVE-2012-1162.html http://support.novell.com/security/cve/CVE-2012-1163.html https://bugzilla.novell.com/751829 https://bugzilla.novell.com/751830

1 0

openSUSE-SU-2012:0415-1: moderate: update for gnash
by opensuse-security＠opensuse.org 27 Mar '12

27 Mar '12

openSUSE Security Update: update for gnash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0415-1 Rating: moderate References: #752373 Cross-References: CVE-2012-1175 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: specially crafted swf files could cause an integer overflow in gnash Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-177 - openSUSE 11.4: zypper in -t patch openSUSE-2012-177 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): gnash-0.8.8-9.6.1 gnash-debuginfo-0.8.8-9.6.1 gnash-debugsource-0.8.8-9.6.1 gnash-devel-0.8.8-9.6.1 - openSUSE 11.4 (i586 x86_64): gnash-0.8.8-6.13.1 gnash-debuginfo-0.8.8-6.13.1 gnash-debugsource-0.8.8-6.13.1 gnash-devel-0.8.8-6.13.1 References: http://support.novell.com/security/cve/CVE-2012-1175.html https://bugzilla.novell.com/752373

1 0

openSUSE-SU-2012:0414-1: moderate: update for openssl
by opensuse-security＠opensuse.org 26 Mar '12

26 Mar '12

openSUSE Security Update: update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0414-1 Rating: moderate References: #748738 Cross-References: CVE-2006-7250 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted MIME headers could crash openssl's ASN.1 parser Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-174 - openSUSE 11.4: zypper in -t patch openSUSE-2012-174 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libopenssl-devel-1.0.0e-34.7.1 libopenssl1_0_0-1.0.0e-34.7.1 libopenssl1_0_0-debuginfo-1.0.0e-34.7.1 openssl-1.0.0e-34.7.1 openssl-debuginfo-1.0.0e-34.7.1 openssl-debugsource-1.0.0e-34.7.1 - openSUSE 12.1 (x86_64): libopenssl-devel-32bit-1.0.0e-34.7.1 libopenssl1_0_0-32bit-1.0.0e-34.7.1 libopenssl1_0_0-debuginfo-32bit-1.0.0e-34.7.1 - openSUSE 12.1 (noarch): openssl-doc-1.0.0e-34.7.1 - openSUSE 11.4 (i586 x86_64): libopenssl-devel-1.0.0c-18.34.1 libopenssl1_0_0-1.0.0c-18.34.1 libopenssl1_0_0-debuginfo-1.0.0c-18.34.1 openssl-1.0.0c-18.34.1 openssl-debuginfo-1.0.0c-18.34.1 openssl-debugsource-1.0.0c-18.34.1 - openSUSE 11.4 (x86_64): libopenssl1_0_0-32bit-1.0.0c-18.34.1 libopenssl1_0_0-debuginfo-32bit-1.0.0c-18.34.1 - openSUSE 11.4 (noarch): openssl-doc-1.0.0c-18.34.1 References: http://support.novell.com/security/cve/CVE-2006-7250.html https://bugzilla.novell.com/748738

1 0

openSUSE-RU-2012:0403-1: moderate: python: fix regression in acceptance of unicode strings in add_option calls
by maintenance＠opensuse.org 22 Mar '12

22 Mar '12

openSUSE Recommended Update: python: fix regression in acceptance of unicode strings in add_option calls ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0403-1 Rating: moderate References: Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issue for python: - Fix regression in acceptance of unicode strings in add_option calls (http://bugs.python.org/issue9161) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-173 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): python-2.7-9.40.1 python-curses-2.7-9.40.1 python-curses-debuginfo-2.7-9.40.1 python-debuginfo-2.7-9.40.1 python-debugsource-2.7-9.40.1 python-demo-2.7-9.40.1 python-gdbm-2.7-9.40.1 python-gdbm-debuginfo-2.7-9.40.1 python-idle-2.7-9.40.1 python-tk-2.7-9.40.1 python-tk-debuginfo-2.7-9.40.1 - openSUSE 11.4 (x86_64): python-32bit-2.7-9.40.1 python-debuginfo-32bit-2.7-9.40.1 References:

1 0

openSUSE-RU-2012:0402-1: moderate: update for logrotate
by maintenance＠opensuse.org 22 Mar '12

22 Mar '12

openSUSE Recommended Update: update for logrotate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0402-1 Rating: moderate References: #751358 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: the previous logrotate introduced a regression that made logrotate fail in some cases Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-172 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): logrotate-3.7.9-6.12.1 logrotate-debuginfo-3.7.9-6.12.1 logrotate-debugsource-3.7.9-6.12.1 References: https://bugzilla.novell.com/751358

1 0

openSUSE-RU-2012:0401-1: moderate: update for postfix
by maintenance＠opensuse.org 22 Mar '12

22 Mar '12

openSUSE Recommended Update: update for postfix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0401-1 Rating: moderate References: #743369 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: - rcpostfix now updates the aliases too - update to 2.8.8 Bugfixes: tlsproxy(8) stored TLS sessions with a serverID of "tlsproxy" instead of "smtpd", wasting an opportunity for session reuse. File: tlsproxy/tlsproxy.c. missing lookup table entry and terminator, causing proxymap server segfault when postscreen(8) or verify(8) attempted to access their cache via the proxymap server. This could never have worked anyway, because the Postfix 2.8 proxymap protocol does not support cache cleanup. File util/dict.c. the Postfix client sqlite quoting routine returned the unquoted result instead of the quoted text. The opportunities for misuse are limited, because Postfix sqlite files are usually owned by root, and Postfix daemons usually run with non-root privileges so they can't corrupt the database. Problem reported by Rob McGee (rob0). File: global/dict_sqlite.c. the trace service did not distinguish between notifications for a non-bounce or a bounce message. This code pre-dates DSN support and should have been updated when it was re-purposed to handle DSN SUCCESS notifications. Problem reported by Sabahattin Gucukoglu. File: bounce/bounce_trace_service.c. - use latest VDA patch (2.8.5) - bnc#743369 - yast2 mail module does not open the firewall - Set MD5DIR in SuSEconfig.postfix to avoid warnings - bnc738693 - upgrade from 11.4 enables mysql service for systemd Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-171 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): postfix-2.8.8-3.10.1 postfix-debuginfo-2.8.8-3.10.1 postfix-debugsource-2.8.8-3.10.1 postfix-devel-2.8.8-3.10.1 postfix-mysql-2.8.8-3.10.1 postfix-mysql-debuginfo-2.8.8-3.10.1 postfix-postgresql-2.8.8-3.10.1 postfix-postgresql-debuginfo-2.8.8-3.10.1 - openSUSE 12.1 (noarch): postfix-doc-2.8.8-3.10.1 References: https://bugzilla.novell.com/743369

1 0

openSUSE-SU-2012:0400-1: osc: Update to 0.134.1
by opensuse-security＠opensuse.org 22 Mar '12

22 Mar '12

openSUSE Security Update: osc: Update to 0.134.1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0400-1 Rating: low References: #624980 #679980 #711770 #749335 Cross-References: CVE-2012-1095 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update of osc to 0.134.1 provides the following changes: * adding unlock command * maintenance_incident requests get created with source revision of package * Enables new maintenance submissions for new OBS 2.3 maintenance model * Fixes srcmd5 revisions in submit request, when link target != submission target * patchinfo call can work without checked out copy now * use qemu as fallback for building not directly supported architectures * "results --watch" option to watch build results until they finished building * fixes injection of terminal control chars (bnc#749335)(CVE-2012-1095) * support dryrun of branching to preview the expected result. "osc sm" is doing this now by default. * maintenance requests accept package lists as source and target incidents to be merged in * add "setincident" command to "request" to re-direct a maintenance request * ask user to create "maintenance incident" request when submit request is failing at release project * "osc my patchinfos" is showing patchinfos where any open bug is assigned to user * "osc my" or "osc my work" is including assigned patchinfos * "osc branch --maintenance" is creating setups for maintenance * removed debug code lead to warning message (fix by Marcus_H) * add --meta option also to "list", "cat" and "less" commands * project checkout is skipping packages linking to project local packages by default * add --keep-link option to copypac command * source validators are not called by default anymore: * support source services using OBS project or package name * support updateing _patchinfo file with new issues just by calling "osc patchinfo" again * branch --add-repositories can be used to add repos from source project to target project * branch --extend-package-names can be used to do mbranch like branch of a single package * branch --new-package can be used to do branch from a not yet existing package (to define later submit target) * show declined requests which created by user Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-170 - openSUSE 11.4: zypper in -t patch openSUSE-2012-170 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): build-initvm-2012.03.06-2.4.1 build-initvm-debuginfo-2012.03.06-2.4.1 - openSUSE 12.1 (x86_64): build-initvm-debuginfo-32bit-2012.03.06-2.4.1 build-initvm-debuginfo-i586-2012.03.06-2.4.1 build-initvm-i586-2012.03.06-2.4.1 - openSUSE 12.1 (noarch): build-2012.03.06-2.4.1 build-mkbaselibs-2012.03.06-2.4.1 build-mkbaselibs-sle-2012.03.06-2.4.1 build-mkdrpms-2012.03.06-2.4.1 obs-service-download_files-0.3-5.4.1 obs-service-format_spec_file-0.4.1-13.4.1 obs-service-source_validator-0.2-3.5.1 osc-0.134.1-2.4.1 - openSUSE 12.1 (ia64): build-initvm-debuginfo-x86-2012.03.06-2.4.1 - openSUSE 11.4 (i586 x86_64): build-initvm-2012.03.06-10.1 build-initvm-debuginfo-2012.03.06-10.1 - openSUSE 11.4 (x86_64): build-initvm-debuginfo-32bit-2012.03.06-10.1 build-initvm-debuginfo-i586-2012.03.06-10.1 build-initvm-i586-2012.03.06-10.1 - openSUSE 11.4 (noarch): build-2012.03.06-10.1 build-mkbaselibs-2012.03.06-10.1 build-mkbaselibs-sle-2012.03.06-10.1 build-mkdrpms-2012.03.06-10.1 obs-service-download_files-0.3-6.1 obs-service-format_spec_file-0.4.1-6.1 obs-service-source_validator-0.2-7.1 osc-0.134.1-6.1 - openSUSE 11.4 (ia64): build-initvm-debuginfo-x86-2012.03.06-10.1 References: http://support.novell.com/security/cve/CVE-2012-1095.html https://bugzilla.novell.com/624980 https://bugzilla.novell.com/679980 https://bugzilla.novell.com/711770 https://bugzilla.novell.com/749335

1 0

openSUSE-RU-2012:0397-1: moderate: ddclient: fix issue with updating ip on renewal
by maintenance＠opensuse.org 21 Mar '12

21 Mar '12

openSUSE Recommended Update: ddclient: fix issue with updating ip on renewal ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0397-1 Rating: moderate References: #730519 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for ddclient: - 730519: fix issue with updating ip on renewal Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-169 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): ddclient-3.8.0-19.17.1 References: https://bugzilla.novell.com/730519

1 0

openSUSE-RU-2012:0396-1: moderate: ddclient: fix issue with updating ip on renewal
by maintenance＠opensuse.org 21 Mar '12

21 Mar '12

openSUSE Recommended Update: ddclient: fix issue with updating ip on renewal ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0396-1 Rating: moderate References: #730519 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for ddclient: - 730519: fix issue with updating ip on renewal Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-169 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): ddclient-3.8.0-19.17.1 References: https://bugzilla.novell.com/730519

1 0

openSUSE-RU-2012:0389-1: jakarta-commons-net: Fix handling of datestamps from February 29th
by maintenance＠opensuse.org 20 Mar '12

20 Mar '12

openSUSE Recommended Update: jakarta-commons-net: Fix handling of datestamps from February 29th ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0389-1 Rating: low References: #749895 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update to jakarta-commons-net fixes handling of FTP actions when remote file is in a sub-directory and has a date of Feb 29. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-167 - openSUSE 11.4: zypper in -t patch openSUSE-2012-167 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (noarch): jakarta-commons-net-1.4.1-12.4.1 jakarta-commons-net-javadoc-1.4.1-12.4.1 - openSUSE 11.4 (noarch): jakarta-commons-net-1.4.1-12.1 jakarta-commons-net-javadoc-1.4.1-12.1 References: https://bugzilla.novell.com/749895

1 0

openSUSE-RU-2012:0388-1: moderate: update for icedtea-web
by maintenance＠opensuse.org 20 Mar '12

20 Mar '12

openSUSE Recommended Update: update for icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0388-1 Rating: moderate References: #737105 #746895 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: - update to 1.2 - New features: * Signed JNLP support * Support for client authentication certificates * Cache size enforcement now supported via itweb-settings * Applet parameter passing through JNLP files now supported * Better icons for access warning dialog * Security Dialog UI revamped to make it look less threatening when appropriate - Fixes (plugin, webstart, common) * PR618: Can't install OpenDJ, JavaWebStart fails with Input stream is null error * PR765: JNLP file with all resource jars marked as 'lazy' fails to validate signature and stops the launch of application * PR788: Elluminate Live! is not working * PR804: javaws launcher incorrectly handles file names with spaces * PR820, bnc#746895: IcedTea-Web 1.1.3 crashing Firefox when loading Citrix XenApp * PR838: IcedTea plugin crashes with chrome browser when javascript is executed * PR852: Classloader not being flushed after last applet from a site is closed * RH586194: Unable to connect to connect with Juniper VPN client * PR771: IcedTea-Web certificate verification code does not use the right API * PR742: IcedTea-Web checks certs only upto 1 level deep before declaring them untrusted. * PR789: typo in jrunscript.sh * PR808: javaws is unable to start, when missing jars are enumerated before main jar * RH738814: Access denied at ssl handshake * Support for authenticating using client certificates - fix bnc#737105/FATE#313084: add Supplements: packageand(broswer(npapi):java-openjdk) ensures the web plugin is pulled in when openjdk and capable browser is installed - enable make check in respective section Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-168 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): icedtea-web-1.2-0.10.1 icedtea-web-debuginfo-1.2-0.10.1 icedtea-web-debugsource-1.2-0.10.1 - openSUSE 11.4 (noarch): icedtea-web-javadoc-1.2-0.10.1 References: https://bugzilla.novell.com/737105 https://bugzilla.novell.com/746895

1 0

openSUSE-SU-2012:0383-1: moderate: update for systemd
by opensuse-security＠opensuse.org 19 Mar '12

19 Mar '12

openSUSE Security Update: update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0383-1 Rating: moderate References: #741590 #752281 Cross-References: CVE-2012-1174 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: local attackers could delete arbitrary system files by exploiting a race condition in systemd-logind Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-166 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): systemd-37-3.11.1 systemd-debuginfo-37-3.11.1 systemd-debugsource-37-3.11.1 systemd-devel-37-3.11.1 systemd-gtk-37-3.11.1 systemd-gtk-debuginfo-37-3.11.1 systemd-gtk-debugsource-37-3.11.1 systemd-sysvinit-37-3.11.1 - openSUSE 12.1 (x86_64): systemd-32bit-37-3.11.1 systemd-debuginfo-32bit-37-3.11.1 References: http://support.novell.com/security/cve/CVE-2012-1174.html https://bugzilla.novell.com/741590 https://bugzilla.novell.com/752281

1 0

openSUSE-SU-2012:0374-1: important: update for chromium, v8
by opensuse-security＠opensuse.org 16 Mar '12

16 Mar '12

openSUSE Security Update: update for chromium, v8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0374-1 Rating: important References: #750407 #751466 #751738 Cross-References: CVE-2011-3031 CVE-2011-3032 CVE-2011-3033 CVE-2011-3034 CVE-2011-3035 CVE-2011-3036 CVE-2011-3037 CVE-2011-3038 CVE-2011-3039 CVE-2011-3040 CVE-2011-3041 CVE-2011-3042 CVE-2011-3043 CVE-2011-3044 CVE-2011-3046 CVE-2011-3047 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: Changes in chromium: - Update to 19.0.1066 * Fixed Chrome install/update resets Google search preferences (Issue: 105390) * Don't trigger accelerated compositing on 3D CSS when using swiftshader (Issue: 116401) * Fixed a GPU crash (Issue: 116096) * More fixes for Back button frequently hangs (Issue: 93427) * Bastion now works (Issue: 116285) * Fixed Composited layer sorting irregularity with accelerated canvas (Issue: 102943) * Fixed Composited layer sorting irregularity with accelerated canvas (Issue: 102943) * Fixed Google Feedback causes render process to use too much memory (Issue: 114489) * Fixed after upgrade, some pages are rendered as blank (Issue: 109888) * Fixed Pasting text into a single-line text field shouldn't keep literal newlines (Issue: 106551) - Security Fixes: * Critical CVE-2011-3047: Errant plug-in load and GPU process memory corruption * Critical CVE-2011-3046: UXSS and bad history navigation. - Update to 19.0.1060 * Fixed NTP signed in state is missing (Issue: 112676) * Fixed gmail seems to redraw itself (all white) occasionally (Issue: 111263) * Focus "OK" button on Javascript dialogs (Issue: 111015) * Fixed Back button frequently hangs (Issue: 93427) * Increase the buffer size to fix muted playback rate (Issue: 108239) * Fixed Empty span with line-height renders with non-zero height (Issue: 109811) * Marked the Certum Trusted Network CA as an issuer of extended-validation (EV) certificates. * Fixed importing of bookmarks, history, etc. from Firefox 10+. * Fixed issues - 114001, 110785, 114168, 114598, 111663, 113636, 112676 * Fixed several crashes (Issues: 111376, 108688, 114391) * Fixed Firefox browser in Import Bookmarks and Settings drop-down (Issue: 114476) * Sync: Sessions aren't associating pre-existing tabs (Issue: 113319) * Fixed All "Extensions" make an entry under the "NTP Apps" page (Issue: 113672) - Security Fixes (bnc#750407): * High CVE-2011-3031: Use-after-free in v8 element wrapper. * High CVE-2011-3032: Use-after-free in SVG value handling. * High CVE-2011-3033: Buffer overflow in the Skia drawing library. * High CVE-2011-3034: Use-after-free in SVG document handling. * High CVE-2011-3035: Use-after-free in SVG use handling. * High CVE-2011-3036: Bad cast in line box handling. * High CVE-2011-3037: Bad casts in anonymous block splitting. * High CVE-2011-3038: Use-after-free in multi-column handling. * High CVE-2011-3039: Use-after-free in quote handling. * High CVE-2011-3040: Out-of-bounds read in text handling. * High CVE-2011-3041: Use-after-free in class attribute handling. * High CVE-2011-3042: Use-after-free in table section handling. * High CVE-2011-3043: Use-after-free in flexbox with floats. * High CVE-2011-3044: Use-after-free with SVG animation elements. Changes in v8: - Update to 3.9.13.0 * Add code kind check before preparing for OSR. (issue 1900, 115073) * Pass zone explicitly to zone-allocation on x64 and ARM. (issue 1802) * Port string construct stub to x64. (issue 849) * Performance and stability improvements on all platforms. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-165 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): chromium-19.0.1066.0-1.11.2 chromium-debuginfo-19.0.1066.0-1.11.2 chromium-debugsource-19.0.1066.0-1.11.2 chromium-desktop-gnome-19.0.1066.0-1.11.2 chromium-desktop-kde-19.0.1066.0-1.11.2 chromium-suid-helper-19.0.1066.0-1.11.2 chromium-suid-helper-debuginfo-19.0.1066.0-1.11.2 libv8-3-3.9.13.0-1.15.1 libv8-3-debuginfo-3.9.13.0-1.15.1 v8-debugsource-3.9.13.0-1.15.1 v8-devel-3.9.13.0-1.15.1 v8-private-headers-devel-3.9.13.0-1.15.1 References: http://support.novell.com/security/cve/CVE-2011-3031.html http://support.novell.com/security/cve/CVE-2011-3032.html http://support.novell.com/security/cve/CVE-2011-3033.html http://support.novell.com/security/cve/CVE-2011-3034.html http://support.novell.com/security/cve/CVE-2011-3035.html http://support.novell.com/security/cve/CVE-2011-3036.html http://support.novell.com/security/cve/CVE-2011-3037.html http://support.novell.com/security/cve/CVE-2011-3038.html http://support.novell.com/security/cve/CVE-2011-3039.html http://support.novell.com/security/cve/CVE-2011-3040.html http://support.novell.com/security/cve/CVE-2011-3041.html http://support.novell.com/security/cve/CVE-2011-3042.html http://support.novell.com/security/cve/CVE-2011-3043.html http://support.novell.com/security/cve/CVE-2011-3044.html http://support.novell.com/security/cve/CVE-2011-3046.html http://support.novell.com/security/cve/CVE-2011-3047.html https://bugzilla.novell.com/750407 https://bugzilla.novell.com/751466 https://bugzilla.novell.com/751738

1 0

openSUSE-SU-2012:0371-1: moderate: update for icedtea-web
by opensuse-security＠opensuse.org 14 Mar '12

14 Mar '12

openSUSE Security Update: update for icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0371-1 Rating: moderate References: #729870 #737105 #746895 Cross-References: CVE-2011-3377 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: - update to 1.2 - New features: * Signed JNLP support * Support for client authentication certificates * Cache size enforcement now supported via itweb-settings * Applet parameter passing through JNLP files now supported * Better icons for access warning dialog * Security Dialog UI revamped to make it look less threatening when appropriate - Fixes (plugin, webstart, common) * PR618: Can't install OpenDJ, JavaWebStart fails with Input stream is null error * PR765: JNLP file with all resource jars marked as 'lazy' fails to validate signature and stops the launch of application * PR788: Elluminate Live! is not working * PR804: javaws launcher incorrectly handles file names with spaces * PR820, bnc#746895: IcedTea-Web 1.1.3 crashing Firefox when loading Citrix XenApp * PR838: IcedTea plugin crashes with chrome browser when javascript is executed * PR852: Classloader not being flushed after last applet from a site is closed * RH586194: Unable to connect to connect with Juniper VPN client * PR771: IcedTea-Web certificate verification code does not use the right API * PR742: IcedTea-Web checks certs only upto 1 level deep before declaring them untrusted. * PR789: typo in jrunscript.sh * PR808: javaws is unable to start, when missing jars are enumerated before main jar * RH738814: Access denied at ssl handshake * Support for authenticating using client certificates - fix bnc#737105/FATE#313084: add Supplements: packageand(broswer(npapi):java-openjdk) ensures the web plugin is pulled in when openjdk and capable browser is installed - enable make check in respective section - update to 1.1.4 (fixes bnc#729870) - RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass - PR778: Jar download and server certificate verification deadlock Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-163 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): icedtea-web-1.2-3.1 icedtea-web-debuginfo-1.2-3.1 icedtea-web-debugsource-1.2-3.1 - openSUSE 12.1 (noarch): icedtea-web-javadoc-1.2-3.1 References: http://support.novell.com/security/cve/CVE-2011-3377.html https://bugzilla.novell.com/729870 https://bugzilla.novell.com/737105 https://bugzilla.novell.com/746895

1 0