March 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2012:0389-1: jakarta-commons-net: Fix handling of datestamps from February 29th
by maintenance＠opensuse.org 20 Mar '12

20 Mar '12

openSUSE Recommended Update: jakarta-commons-net: Fix handling of datestamps from February 29th ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0389-1 Rating: low References: #749895 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update to jakarta-commons-net fixes handling of FTP actions when remote file is in a sub-directory and has a date of Feb 29. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-167 - openSUSE 11.4: zypper in -t patch openSUSE-2012-167 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (noarch): jakarta-commons-net-1.4.1-12.4.1 jakarta-commons-net-javadoc-1.4.1-12.4.1 - openSUSE 11.4 (noarch): jakarta-commons-net-1.4.1-12.1 jakarta-commons-net-javadoc-1.4.1-12.1 References: https://bugzilla.novell.com/749895

1 0

openSUSE-RU-2012:0388-1: moderate: update for icedtea-web
by maintenance＠opensuse.org 20 Mar '12

20 Mar '12

openSUSE Recommended Update: update for icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0388-1 Rating: moderate References: #737105 #746895 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: - update to 1.2 - New features: * Signed JNLP support * Support for client authentication certificates * Cache size enforcement now supported via itweb-settings * Applet parameter passing through JNLP files now supported * Better icons for access warning dialog * Security Dialog UI revamped to make it look less threatening when appropriate - Fixes (plugin, webstart, common) * PR618: Can't install OpenDJ, JavaWebStart fails with Input stream is null error * PR765: JNLP file with all resource jars marked as 'lazy' fails to validate signature and stops the launch of application * PR788: Elluminate Live! is not working * PR804: javaws launcher incorrectly handles file names with spaces * PR820, bnc#746895: IcedTea-Web 1.1.3 crashing Firefox when loading Citrix XenApp * PR838: IcedTea plugin crashes with chrome browser when javascript is executed * PR852: Classloader not being flushed after last applet from a site is closed * RH586194: Unable to connect to connect with Juniper VPN client * PR771: IcedTea-Web certificate verification code does not use the right API * PR742: IcedTea-Web checks certs only upto 1 level deep before declaring them untrusted. * PR789: typo in jrunscript.sh * PR808: javaws is unable to start, when missing jars are enumerated before main jar * RH738814: Access denied at ssl handshake * Support for authenticating using client certificates - fix bnc#737105/FATE#313084: add Supplements: packageand(broswer(npapi):java-openjdk) ensures the web plugin is pulled in when openjdk and capable browser is installed - enable make check in respective section Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-168 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): icedtea-web-1.2-0.10.1 icedtea-web-debuginfo-1.2-0.10.1 icedtea-web-debugsource-1.2-0.10.1 - openSUSE 11.4 (noarch): icedtea-web-javadoc-1.2-0.10.1 References: https://bugzilla.novell.com/737105 https://bugzilla.novell.com/746895

1 0

openSUSE-SU-2012:0383-1: moderate: update for systemd
by opensuse-security＠opensuse.org 19 Mar '12

19 Mar '12

openSUSE Security Update: update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0383-1 Rating: moderate References: #741590 #752281 Cross-References: CVE-2012-1174 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: local attackers could delete arbitrary system files by exploiting a race condition in systemd-logind Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-166 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): systemd-37-3.11.1 systemd-debuginfo-37-3.11.1 systemd-debugsource-37-3.11.1 systemd-devel-37-3.11.1 systemd-gtk-37-3.11.1 systemd-gtk-debuginfo-37-3.11.1 systemd-gtk-debugsource-37-3.11.1 systemd-sysvinit-37-3.11.1 - openSUSE 12.1 (x86_64): systemd-32bit-37-3.11.1 systemd-debuginfo-32bit-37-3.11.1 References: http://support.novell.com/security/cve/CVE-2012-1174.html https://bugzilla.novell.com/741590 https://bugzilla.novell.com/752281

1 0

openSUSE-SU-2012:0374-1: important: update for chromium, v8
by opensuse-security＠opensuse.org 16 Mar '12

16 Mar '12

openSUSE Security Update: update for chromium, v8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0374-1 Rating: important References: #750407 #751466 #751738 Cross-References: CVE-2011-3031 CVE-2011-3032 CVE-2011-3033 CVE-2011-3034 CVE-2011-3035 CVE-2011-3036 CVE-2011-3037 CVE-2011-3038 CVE-2011-3039 CVE-2011-3040 CVE-2011-3041 CVE-2011-3042 CVE-2011-3043 CVE-2011-3044 CVE-2011-3046 CVE-2011-3047 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: Changes in chromium: - Update to 19.0.1066 * Fixed Chrome install/update resets Google search preferences (Issue: 105390) * Don't trigger accelerated compositing on 3D CSS when using swiftshader (Issue: 116401) * Fixed a GPU crash (Issue: 116096) * More fixes for Back button frequently hangs (Issue: 93427) * Bastion now works (Issue: 116285) * Fixed Composited layer sorting irregularity with accelerated canvas (Issue: 102943) * Fixed Composited layer sorting irregularity with accelerated canvas (Issue: 102943) * Fixed Google Feedback causes render process to use too much memory (Issue: 114489) * Fixed after upgrade, some pages are rendered as blank (Issue: 109888) * Fixed Pasting text into a single-line text field shouldn't keep literal newlines (Issue: 106551) - Security Fixes: * Critical CVE-2011-3047: Errant plug-in load and GPU process memory corruption * Critical CVE-2011-3046: UXSS and bad history navigation. - Update to 19.0.1060 * Fixed NTP signed in state is missing (Issue: 112676) * Fixed gmail seems to redraw itself (all white) occasionally (Issue: 111263) * Focus "OK" button on Javascript dialogs (Issue: 111015) * Fixed Back button frequently hangs (Issue: 93427) * Increase the buffer size to fix muted playback rate (Issue: 108239) * Fixed Empty span with line-height renders with non-zero height (Issue: 109811) * Marked the Certum Trusted Network CA as an issuer of extended-validation (EV) certificates. * Fixed importing of bookmarks, history, etc. from Firefox 10+. * Fixed issues - 114001, 110785, 114168, 114598, 111663, 113636, 112676 * Fixed several crashes (Issues: 111376, 108688, 114391) * Fixed Firefox browser in Import Bookmarks and Settings drop-down (Issue: 114476) * Sync: Sessions aren't associating pre-existing tabs (Issue: 113319) * Fixed All "Extensions" make an entry under the "NTP Apps" page (Issue: 113672) - Security Fixes (bnc#750407): * High CVE-2011-3031: Use-after-free in v8 element wrapper. * High CVE-2011-3032: Use-after-free in SVG value handling. * High CVE-2011-3033: Buffer overflow in the Skia drawing library. * High CVE-2011-3034: Use-after-free in SVG document handling. * High CVE-2011-3035: Use-after-free in SVG use handling. * High CVE-2011-3036: Bad cast in line box handling. * High CVE-2011-3037: Bad casts in anonymous block splitting. * High CVE-2011-3038: Use-after-free in multi-column handling. * High CVE-2011-3039: Use-after-free in quote handling. * High CVE-2011-3040: Out-of-bounds read in text handling. * High CVE-2011-3041: Use-after-free in class attribute handling. * High CVE-2011-3042: Use-after-free in table section handling. * High CVE-2011-3043: Use-after-free in flexbox with floats. * High CVE-2011-3044: Use-after-free with SVG animation elements. Changes in v8: - Update to 3.9.13.0 * Add code kind check before preparing for OSR. (issue 1900, 115073) * Pass zone explicitly to zone-allocation on x64 and ARM. (issue 1802) * Port string construct stub to x64. (issue 849) * Performance and stability improvements on all platforms. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-165 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): chromium-19.0.1066.0-1.11.2 chromium-debuginfo-19.0.1066.0-1.11.2 chromium-debugsource-19.0.1066.0-1.11.2 chromium-desktop-gnome-19.0.1066.0-1.11.2 chromium-desktop-kde-19.0.1066.0-1.11.2 chromium-suid-helper-19.0.1066.0-1.11.2 chromium-suid-helper-debuginfo-19.0.1066.0-1.11.2 libv8-3-3.9.13.0-1.15.1 libv8-3-debuginfo-3.9.13.0-1.15.1 v8-debugsource-3.9.13.0-1.15.1 v8-devel-3.9.13.0-1.15.1 v8-private-headers-devel-3.9.13.0-1.15.1 References: http://support.novell.com/security/cve/CVE-2011-3031.html http://support.novell.com/security/cve/CVE-2011-3032.html http://support.novell.com/security/cve/CVE-2011-3033.html http://support.novell.com/security/cve/CVE-2011-3034.html http://support.novell.com/security/cve/CVE-2011-3035.html http://support.novell.com/security/cve/CVE-2011-3036.html http://support.novell.com/security/cve/CVE-2011-3037.html http://support.novell.com/security/cve/CVE-2011-3038.html http://support.novell.com/security/cve/CVE-2011-3039.html http://support.novell.com/security/cve/CVE-2011-3040.html http://support.novell.com/security/cve/CVE-2011-3041.html http://support.novell.com/security/cve/CVE-2011-3042.html http://support.novell.com/security/cve/CVE-2011-3043.html http://support.novell.com/security/cve/CVE-2011-3044.html http://support.novell.com/security/cve/CVE-2011-3046.html http://support.novell.com/security/cve/CVE-2011-3047.html https://bugzilla.novell.com/750407 https://bugzilla.novell.com/751466 https://bugzilla.novell.com/751738

1 0

openSUSE-SU-2012:0371-1: moderate: update for icedtea-web
by opensuse-security＠opensuse.org 14 Mar '12

14 Mar '12

openSUSE Security Update: update for icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0371-1 Rating: moderate References: #729870 #737105 #746895 Cross-References: CVE-2011-3377 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: - update to 1.2 - New features: * Signed JNLP support * Support for client authentication certificates * Cache size enforcement now supported via itweb-settings * Applet parameter passing through JNLP files now supported * Better icons for access warning dialog * Security Dialog UI revamped to make it look less threatening when appropriate - Fixes (plugin, webstart, common) * PR618: Can't install OpenDJ, JavaWebStart fails with Input stream is null error * PR765: JNLP file with all resource jars marked as 'lazy' fails to validate signature and stops the launch of application * PR788: Elluminate Live! is not working * PR804: javaws launcher incorrectly handles file names with spaces * PR820, bnc#746895: IcedTea-Web 1.1.3 crashing Firefox when loading Citrix XenApp * PR838: IcedTea plugin crashes with chrome browser when javascript is executed * PR852: Classloader not being flushed after last applet from a site is closed * RH586194: Unable to connect to connect with Juniper VPN client * PR771: IcedTea-Web certificate verification code does not use the right API * PR742: IcedTea-Web checks certs only upto 1 level deep before declaring them untrusted. * PR789: typo in jrunscript.sh * PR808: javaws is unable to start, when missing jars are enumerated before main jar * RH738814: Access denied at ssl handshake * Support for authenticating using client certificates - fix bnc#737105/FATE#313084: add Supplements: packageand(broswer(npapi):java-openjdk) ensures the web plugin is pulled in when openjdk and capable browser is installed - enable make check in respective section - update to 1.1.4 (fixes bnc#729870) - RH742515, CVE-2011-3377: IcedTea-Web: second-level domain subdomains and suffix domain SOP bypass - PR778: Jar download and server certificate verification deadlock Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-163 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): icedtea-web-1.2-3.1 icedtea-web-debuginfo-1.2-3.1 icedtea-web-debugsource-1.2-3.1 - openSUSE 12.1 (noarch): icedtea-web-javadoc-1.2-3.1 References: http://support.novell.com/security/cve/CVE-2011-3377.html https://bugzilla.novell.com/729870 https://bugzilla.novell.com/737105 https://bugzilla.novell.com/746895

1 0

openSUSE-SU-2012:0370-1: moderate: update for csound
by opensuse-security＠opensuse.org 14 Mar '12

14 Mar '12

openSUSE Security Update: update for csound ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0370-1 Rating: moderate References: #749073 Cross-References: CVE-2012-0270 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: specially crafted hetro and pvoc files could cause buffer overflows in csound Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-162 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): csound-5.06.0-142.3.2 References: http://support.novell.com/security/cve/CVE-2012-0270.html https://bugzilla.novell.com/749073

1 0

openSUSE-SU-2012:0369-1: moderate: update for gnash
by opensuse-security＠opensuse.org 14 Mar '12

14 Mar '12

openSUSE Security Update: update for gnash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0369-1 Rating: moderate References: #732324 Cross-References: CVE-2011-4328 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gnash used predictable and world readable temporary file names to store HTTP cookies Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-164 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): gnash-0.8.8-9.3.1 gnash-debuginfo-0.8.8-9.3.1 gnash-debugsource-0.8.8-9.3.1 gnash-devel-0.8.8-9.3.1 References: http://support.novell.com/security/cve/CVE-2011-4328.html https://bugzilla.novell.com/732324

1 0

openSUSE-RU-2012:0362-1: moderate: sysconfig: collective update
by maintenance＠opensuse.org 13 Mar '12

13 Mar '12

openSUSE Recommended Update: sysconfig: collective update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0362-1 Rating: moderate References: #737636 #741453 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues for sysconfig: - 737636: Enabled to always enable the -o boot under systemd, improved to use PID in log messages and extradebug outputs - 741453: Filter out labeled ipv4 addresses in get_ipv4address used to fetch the 1st address from the TUNNEL_DEVICE interface. Allows to configure a label for each address that should be skipped. - Updated ifcfg-tunnel.5 man page. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-158 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): sysconfig-0.75.4-2.7.1 sysconfig-debuginfo-0.75.4-2.7.1 sysconfig-debugsource-0.75.4-2.7.1 References: https://bugzilla.novell.com/737636 https://bugzilla.novell.com/741453

1 0

openSUSE-RU-2012:0361-1: moderate: nemiver: update to 0.9.1
by maintenance＠opensuse.org 13 Mar '12

13 Mar '12

openSUSE Recommended Update: nemiver: update to 0.9.1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0361-1 Rating: moderate References: #750099 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues for nemiver: - Update to version 0.9.1: + Handle deprecated functions on glibmm-2.4 2.30.0 and glib-2.0 2.31.0 + Bye bye gziped tarballs, welcome xz + Source code tab label completely ellipsized [bgo#664385] + Allow shrinking of the memory view widget + Relax the fixed minimum sizes preventing shrinking [bnc#750099] + Allow selecting current frame twice consecutively + Add cmd line option to choose the gdb binary [bgo#646698] + Handle plural form of a string [bgo#659462] + Use local time instead of UTC time + Updated translations. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-161 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): nemiver-0.9.1-3.3.1 nemiver-debuginfo-0.9.1-3.3.1 nemiver-debugsource-0.9.1-3.3.1 nemiver-devel-0.9.1-3.3.1 - openSUSE 12.1 (noarch): nemiver-lang-0.9.1-3.3.1 References: https://bugzilla.novell.com/750099

1 0

openSUSE-RU-2012:0360-1: moderate: glibc: fix clock_gettime call
by maintenance＠opensuse.org 13 Mar '12

13 Mar '12

openSUSE Recommended Update: glibc: fix clock_gettime call ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0360-1 Rating: moderate References: #747768 #749126 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update fixes the following issues in glibc: - 747768: format string protection bypass via "nargs" integer overflow - 749126: Fix clock_gettime call Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-160 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): glibc-2.14.1-14.25.1 glibc-debuginfo-2.14.1-14.25.1 glibc-debugsource-2.14.1-14.25.1 glibc-devel-2.14.1-14.25.1 glibc-devel-debuginfo-2.14.1-14.25.1 glibc-devel-static-2.14.1-14.25.1 glibc-locale-2.14.1-14.25.1 glibc-locale-debuginfo-2.14.1-14.25.1 glibc-profile-2.14.1-14.25.1 glibc-utils-2.14.1-14.25.1 glibc-utils-debuginfo-2.14.1-14.25.1 nscd-2.14.1-14.25.1 nscd-debuginfo-2.14.1-14.25.1 - openSUSE 12.1 (noarch): glibc-html-2.14.1-14.25.1 glibc-i18ndata-2.14.1-14.25.1 glibc-info-2.14.1-14.25.1 - openSUSE 12.1 (i586): glibc-obsolete-2.14.1-14.25.1 glibc-obsolete-debuginfo-2.14.1-14.25.1 References: http://support.novell.com/security/cve/CVE-2012-0864.html https://bugzilla.novell.com/747768 https://bugzilla.novell.com/749126

1 0