April 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2012:0508-1: critical: update for samba
by opensuse-security＠opensuse.org 16 Apr '12

16 Apr '12

openSUSE Security Update: update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0508-1 Rating: critical References: #752797 Cross-References: CVE-2012-1182 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Samba upgrade to version 3.6.3 fixes the following security issue: - PIDL based autogenerated code allows overwriting beyond of allocated array. Remove attackers could exploit that to execute arbitrary code as root (CVE-2012-1182, bso#8815, bnc#752797) Please see /usr/share/doc/packages/samba/WHATSNEW.txt from the samba-doc package or the package change log (rpm -q --changelog samba) for more details of the version update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-224 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): ldapsmb-1.34b-112.1 libldb-devel-1.0.2-112.1 libldb1-1.0.2-112.1 libldb1-debuginfo-1.0.2-112.1 libnetapi-devel-3.6.3-112.1 libnetapi0-3.6.3-112.1 libnetapi0-debuginfo-3.6.3-112.1 libsmbclient-devel-3.6.3-112.1 libsmbclient0-3.6.3-112.1 libsmbclient0-debuginfo-3.6.3-112.1 libsmbsharemodes-devel-3.6.3-112.1 libsmbsharemodes0-3.6.3-112.1 libsmbsharemodes0-debuginfo-3.6.3-112.1 libtalloc-devel-2.0.5-112.1 libtalloc2-2.0.5-112.1 libtalloc2-debuginfo-2.0.5-112.1 libtdb-devel-1.2.9-112.1 libtdb1-1.2.9-112.1 libtdb1-debuginfo-1.2.9-112.1 libtevent-devel-0.9.11-112.1 libtevent0-0.9.11-112.1 libtevent0-debuginfo-0.9.11-112.1 libwbclient-devel-3.6.3-112.1 libwbclient0-3.6.3-112.1 libwbclient0-debuginfo-3.6.3-112.1 samba-3.6.3-112.1 samba-client-3.6.3-112.1 samba-client-debuginfo-3.6.3-112.1 samba-debuginfo-3.6.3-112.1 samba-debugsource-3.6.3-112.1 samba-devel-3.6.3-112.1 samba-krb-printing-3.6.3-112.1 samba-krb-printing-debuginfo-3.6.3-112.1 samba-winbind-3.6.3-112.1 samba-winbind-debuginfo-3.6.3-112.1 - openSUSE 11.4 (x86_64): libldb1-32bit-1.0.2-112.1 libldb1-debuginfo-32bit-1.0.2-112.1 libsmbclient0-32bit-3.6.3-112.1 libsmbclient0-debuginfo-32bit-3.6.3-112.1 libtalloc2-32bit-2.0.5-112.1 libtalloc2-debuginfo-32bit-2.0.5-112.1 libtdb1-32bit-1.2.9-112.1 libtdb1-debuginfo-32bit-1.2.9-112.1 libtevent0-32bit-0.9.11-112.1 libtevent0-debuginfo-32bit-0.9.11-112.1 libwbclient0-32bit-3.6.3-112.1 libwbclient0-debuginfo-32bit-3.6.3-112.1 samba-32bit-3.6.3-112.1 samba-client-32bit-3.6.3-112.1 samba-client-debuginfo-32bit-3.6.3-112.1 samba-debuginfo-32bit-3.6.3-112.1 samba-winbind-32bit-3.6.3-112.1 samba-winbind-debuginfo-32bit-3.6.3-112.1 - openSUSE 11.4 (noarch): samba-doc-3.6.3-112.1 - openSUSE 11.4 (ia64): libldb1-debuginfo-x86-1.0.2-112.1 libldb1-x86-1.0.2-112.1 libsmbclient0-debuginfo-x86-3.6.3-112.1 libsmbclient0-x86-3.6.3-112.1 libtalloc2-debuginfo-x86-2.0.5-112.1 libtalloc2-x86-2.0.5-112.1 libtdb1-debuginfo-x86-1.2.9-112.1 libtdb1-x86-1.2.9-112.1 libtevent0-debuginfo-x86-0.9.11-112.1 libtevent0-x86-0.9.11-112.1 libwbclient0-debuginfo-x86-3.6.3-112.1 libwbclient0-x86-3.6.3-112.1 samba-client-debuginfo-x86-3.6.3-112.1 samba-client-x86-3.6.3-112.1 samba-debuginfo-x86-3.6.3-112.1 samba-winbind-debuginfo-x86-3.6.3-112.1 samba-winbind-x86-3.6.3-112.1 samba-x86-3.6.3-112.1 References: http://support.novell.com/security/cve/CVE-2012-1182.html https://bugzilla.novell.com/752797

1 0

openSUSE-SU-2012:0507-1: critical: update for samba
by opensuse-security＠opensuse.org 16 Apr '12

16 Apr '12

openSUSE Security Update: update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0507-1 Rating: critical References: #741854 #746825 #747934 #751454 #752797 Cross-References: CVE-2012-0870 CVE-2012-1182 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: - Add the ldapsmb sources as else patches against them have no chance to apply. - Samba pre-3.6.4 are affected by a vulnerability that allows remote code exe- cution as the "root" user; PIDL based autogenerated code allows overwriting beyond of allocated array; CVE-2012-1182; (bso#8815); (bnc#752797). - s3-winbindd: Only use SamLogonEx when we can get unencrypted session keys; (bso#8599). - Correctly handle DENY ACEs when privileges apply; (bso#8797). - s3:smb2_server: fix a logic error, we should sign non guest sessions; (bso8749). - Allow vfs_aio_pthread to build as a static module; (bso#8723). - s3:dbwrap_ctdb: return the number of records in db_ctdb_traverse() for persistent dbs; (#bso8527). - s3: segfault in dom_sid_compare(bso#8567). - Honor SeTakeOwnershiPrivilege when client asks for SEC_STD_WRITE_OWNER; (bso#8768). - s3-winbindd: Close netlogon connection if the status returned by the NetrSamLogonEx call is timeout in the pam_auth_crap path; (bso#8771). - s3-winbindd: set the can_do_validation6 also for trusted domain; (bso#8599). - Fix problem when calculating the share security mask, take priviliges into account for the connecting user; (bso#8784). - Fix crash in dcerpc_lsa_lookup_sids_noalloc() with over 1000 groups; (bso#8807); (bnc#751454). - Remove obsoleted Authors lines from spec file for post-11.2 systems. - Make ldapsmb build with Fedora 15 and 16; (bso#8783). - BuildRequire libuuid-devel for post-11.0 and other systems. - Define missing python macros for non SUSE systems. - PreReq to fillup_prereq and insserv_prereq only on SUSE systems. - Always use cifstab instead of smbfstab on non SUSE systems. - Ensure AndX offsets are increasing strictly monotonically in pre-3.4 versions; CVE-2012-0870; (bnc#747934). - Add SERVERID_UNIQUE_ID_NOT_TO_VERIFY; (bso#8760); (bnc#741854). - s3-printing: fix crash in printer_list_set_printer(); (bso#8762); (bnc#746825). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-223 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): ldapsmb-1.34b-34.11.1 libldb-devel-1.0.2-34.11.1 libldb1-1.0.2-34.11.1 libldb1-debuginfo-1.0.2-34.11.1 libnetapi-devel-3.6.3-34.11.1 libnetapi0-3.6.3-34.11.1 libnetapi0-debuginfo-3.6.3-34.11.1 libsmbclient-devel-3.6.3-34.11.1 libsmbclient0-3.6.3-34.11.1 libsmbclient0-debuginfo-3.6.3-34.11.1 libsmbsharemodes-devel-3.6.3-34.11.1 libsmbsharemodes0-3.6.3-34.11.1 libsmbsharemodes0-debuginfo-3.6.3-34.11.1 libtalloc-devel-2.0.5-34.11.1 libtalloc2-2.0.5-34.11.1 libtalloc2-debuginfo-2.0.5-34.11.1 libtdb-devel-1.2.9-34.11.1 libtdb1-1.2.9-34.11.1 libtdb1-debuginfo-1.2.9-34.11.1 libtevent-devel-0.9.11-34.11.1 libtevent0-0.9.11-34.11.1 libtevent0-debuginfo-0.9.11-34.11.1 libwbclient-devel-3.6.3-34.11.1 libwbclient0-3.6.3-34.11.1 libwbclient0-debuginfo-3.6.3-34.11.1 samba-3.6.3-34.11.1 samba-client-3.6.3-34.11.1 samba-client-debuginfo-3.6.3-34.11.1 samba-debuginfo-3.6.3-34.11.1 samba-debugsource-3.6.3-34.11.1 samba-devel-3.6.3-34.11.1 samba-krb-printing-3.6.3-34.11.1 samba-krb-printing-debuginfo-3.6.3-34.11.1 samba-winbind-3.6.3-34.11.1 samba-winbind-debuginfo-3.6.3-34.11.1 - openSUSE 12.1 (x86_64): libldb1-32bit-1.0.2-34.11.1 libldb1-debuginfo-32bit-1.0.2-34.11.1 libsmbclient0-32bit-3.6.3-34.11.1 libsmbclient0-debuginfo-32bit-3.6.3-34.11.1 libtalloc2-32bit-2.0.5-34.11.1 libtalloc2-debuginfo-32bit-2.0.5-34.11.1 libtdb1-32bit-1.2.9-34.11.1 libtdb1-debuginfo-32bit-1.2.9-34.11.1 libtevent0-32bit-0.9.11-34.11.1 libtevent0-debuginfo-32bit-0.9.11-34.11.1 libwbclient0-32bit-3.6.3-34.11.1 libwbclient0-debuginfo-32bit-3.6.3-34.11.1 samba-32bit-3.6.3-34.11.1 samba-client-32bit-3.6.3-34.11.1 samba-client-debuginfo-32bit-3.6.3-34.11.1 samba-debuginfo-32bit-3.6.3-34.11.1 samba-winbind-32bit-3.6.3-34.11.1 samba-winbind-debuginfo-32bit-3.6.3-34.11.1 - openSUSE 12.1 (noarch): samba-doc-3.6.3-34.11.1 - openSUSE 12.1 (ia64): libldb1-debuginfo-x86-1.0.2-34.11.1 libldb1-x86-1.0.2-34.11.1 libsmbclient0-debuginfo-x86-3.6.3-34.11.1 libsmbclient0-x86-3.6.3-34.11.1 libtalloc2-debuginfo-x86-2.0.5-34.11.1 libtalloc2-x86-2.0.5-34.11.1 libtdb1-debuginfo-x86-1.2.9-34.11.1 libtdb1-x86-1.2.9-34.11.1 libtevent0-debuginfo-x86-0.9.11-34.11.1 libtevent0-x86-0.9.11-34.11.1 libwbclient0-debuginfo-x86-3.6.3-34.11.1 libwbclient0-x86-3.6.3-34.11.1 samba-client-debuginfo-x86-3.6.3-34.11.1 samba-client-x86-3.6.3-34.11.1 samba-debuginfo-x86-3.6.3-34.11.1 samba-winbind-debuginfo-x86-3.6.3-34.11.1 samba-winbind-x86-3.6.3-34.11.1 samba-x86-3.6.3-34.11.1 References: http://support.novell.com/security/cve/CVE-2012-0870.html http://support.novell.com/security/cve/CVE-2012-1182.html https://bugzilla.novell.com/741854 https://bugzilla.novell.com/746825 https://bugzilla.novell.com/747934 https://bugzilla.novell.com/751454 https://bugzilla.novell.com/752797

1 0

openSUSE-SU-2012:0494-1: moderate: update for phpMyAdmin
by opensuse-security＠opensuse.org 12 Apr '12

12 Apr '12

openSUSE Security Update: update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0494-1 Rating: moderate References: #755211 Cross-References: CVE-2012-1902 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - update to 3.4.10.2 - [security] Fixed local path disclosure vulnerability, see PMASA-2012-2 http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.ph p Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-216 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (noarch): phpMyAdmin-3.4.10.2-1.24.1 References: http://support.novell.com/security/cve/CVE-2012-1902.html https://bugzilla.novell.com/755211

1 0

openSUSE-SU-2012:0493-1: update to 5.0.4, fix for bnc#754694 (CVE-2012-1600)
by opensuse-security＠opensuse.org 12 Apr '12

12 Apr '12

openSUSE Security Update: update to 5.0.4, fix for bnc#754694 (CVE-2012-1600) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0493-1 Rating: low References: #721976 #754694 Cross-References: CVE-2008-5587 CVE-2011-3598 CVE-2012-1600 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: update to 5.0.4, fix for bnc#754694 (CVE-2012-1600) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-219 - openSUSE 11.4: zypper in -t patch openSUSE-2012-219 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (noarch): phpPgAdmin-5.0.4-4.1 - openSUSE 11.4 (noarch): phpPgAdmin-5.0.4-66.1 References: http://support.novell.com/security/cve/CVE-2008-5587.html http://support.novell.com/security/cve/CVE-2011-3598.html http://support.novell.com/security/cve/CVE-2012-1600.html https://bugzilla.novell.com/721976 https://bugzilla.novell.com/754694

1 0

openSUSE-SU-2012:0492-1: moderate: chromium for Chromium and V8 to 18.0.1025.142
by opensuse-security＠opensuse.org 12 Apr '12

12 Apr '12

openSUSE Security Update: chromium for Chromium and V8 to 18.0.1025.142 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0492-1 Rating: moderate References: Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Security update for Chromium and V8 to 18.0.1025.142. Following bugs are listed in the Chrome changelog: - [$500] [109574<https://code.google.com/p/chromium/issues/detail?id= 109574>] Medium CVE-2011-3058: Bad interaction possibly leading to XSS in EUC-JP. Credit to Masato Kinugawa. - [$500] [112317<https://code.google.com/p/chromium/issues/detail?id= 112317>] Medium CVE-2011-3059: Out-of-bounds read in SVG text handling. Credit to Arthur Gerkis. - [$500] [114056<https://code.google.com/p/chromium/issues/detail?id= 114056>] Medium CVE-2011-3060: Out-of-bounds read in text fragment handling. Credit to miaubiz. - [116398 <https://code.google.com/p/chromium/issues/detail?id=116398> ] Medium CVE-2011-3061: SPDY proxy certificate checking error. Credit to Leonidas Kontothanassis of Google. - [116524 <https://code.google.com/p/chromium/issues/detail?id=116524> ] High CVE-2011-3062: Off-by-one in OpenType Sanitizer. Credit to Mateusz Jurczyk of the Google Security Team. - [117417 <https://code.google.com/p/chromium/issues/detail?id=117417> ] Low CVE-2011-3063: Validate navigation requests from the renderer more carefully. Credit to kuzzcc, Sergey Glazunov, PinkiePie and scarybeasts (Google Chrome Security Team). - [$1000] [117471<https://code.google.com/p/chromium/issues/detail?id= 117471>] High CVE-2011-3064: Use-after-free in SVG clipping. Credit to Atte Kettunen of OUSPG. - [$1000] [117588<https://code.google.com/p/chromium/issues/detail?id= 117588>] High CVE-2011-3065: Memory corruption in Skia. Credit to Omair. - [$500] [117794<https://code.google.com/p/chromium/issues/detail?id= 117794>] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian Holler. The bugs [112317<https://code.google.com/p/chromium/issues/detail?id= 112317>], [114056 <https://code.google.com/p/chromium/issues/detail?id=114056> ] and [ 117471 <https://code.google.com/p/chromium/issues/detail?id=117471> ] were detected using AddressSanitizer<http://code.google.com/p/address-sanitizer/ wiki/AddressSanitizer> . We'd also like to thank miaubiz, Chamal de Silva, Atte Kettunen of OUSPG, Aki Helin of OUSPG and Arthur Gerkis for working with us during the development cycle and preventing security regressions from ever reaching the stable channel. $8000 of additional rewards were issued for this awesomeness Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-215 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): chromium-20.0.1094.0-1.17.2 chromium-debuginfo-20.0.1094.0-1.17.2 chromium-debugsource-20.0.1094.0-1.17.2 chromium-desktop-gnome-20.0.1094.0-1.17.2 chromium-desktop-kde-20.0.1094.0-1.17.2 chromium-suid-helper-20.0.1094.0-1.17.2 chromium-suid-helper-debuginfo-20.0.1094.0-1.17.2 libv8-3-3.10.0.5-1.21.1 libv8-3-debuginfo-3.10.0.5-1.21.1 v8-debugsource-3.10.0.5-1.21.1 v8-devel-3.10.0.5-1.21.1 v8-private-headers-devel-3.10.0.5-1.21.1 References:

1 0

openSUSE-SU-2012:0491-1: moderate: update for libpng
by opensuse-security＠opensuse.org 12 Apr '12

12 Apr '12

openSUSE Security Update: update for libpng ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0491-1 Rating: moderate References: #754745 Cross-References: CVE-2011-3048 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: specially crafted png files could cause a memory corruption in libpng's png_set_text_2() Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-217 - openSUSE 11.4: zypper in -t patch openSUSE-2012-217 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libpng12-0-1.2.49-9.9.1 libpng12-0-debuginfo-1.2.49-9.9.1 libpng12-compat-devel-1.2.49-9.9.1 libpng12-debugsource-1.2.49-9.9.1 libpng12-devel-1.2.49-9.9.1 libpng14-14-1.4.11-3.9.1 libpng14-14-debuginfo-1.4.11-3.9.1 libpng14-compat-devel-1.4.11-3.9.1 libpng14-debugsource-1.4.11-3.9.1 libpng14-devel-1.4.11-3.9.1 - openSUSE 12.1 (x86_64): libpng12-0-32bit-1.2.49-9.9.1 libpng12-0-debuginfo-32bit-1.2.49-9.9.1 libpng12-compat-devel-32bit-1.2.49-9.9.1 libpng12-devel-32bit-1.2.49-9.9.1 libpng14-14-32bit-1.4.11-3.9.1 libpng14-14-debuginfo-32bit-1.4.11-3.9.1 libpng14-compat-devel-32bit-1.4.11-3.9.1 libpng14-devel-32bit-1.4.11-3.9.1 - openSUSE 12.1 (ia64): libpng12-0-debuginfo-x86-1.2.49-9.9.1 libpng12-0-x86-1.2.49-9.9.1 libpng14-14-debuginfo-x86-1.4.11-3.9.1 libpng14-14-x86-1.4.11-3.9.1 - openSUSE 11.4 (i586 x86_64): libpng12-0-1.2.49-16.1 libpng12-0-debuginfo-1.2.49-16.1 libpng12-compat-devel-1.2.49-16.1 libpng12-debugsource-1.2.49-16.1 libpng12-devel-1.2.49-16.1 libpng14-14-1.4.4-20.1 libpng14-14-debuginfo-1.4.4-20.1 libpng14-compat-devel-1.4.4-20.1 libpng14-debugsource-1.4.4-20.1 libpng14-devel-1.4.4-20.1 - openSUSE 11.4 (x86_64): libpng12-0-32bit-1.2.49-16.1 libpng12-0-debuginfo-32bit-1.2.49-16.1 libpng12-compat-devel-32bit-1.2.49-16.1 libpng12-devel-32bit-1.2.49-16.1 libpng14-14-32bit-1.4.4-20.1 libpng14-14-debuginfo-32bit-1.4.4-20.1 libpng14-compat-devel-32bit-1.4.4-20.1 libpng14-devel-32bit-1.4.4-20.1 - openSUSE 11.4 (ia64): libpng12-0-debuginfo-x86-1.2.49-16.1 libpng12-0-x86-1.2.49-16.1 libpng14-14-debuginfo-x86-1.4.4-20.1 libpng14-14-x86-1.4.4-20.1 References: http://support.novell.com/security/cve/CVE-2011-3048.html https://bugzilla.novell.com/754745

1 0

openSUSE-SU-2012:0490-1: moderate: update for taglib
by opensuse-security＠opensuse.org 12 Apr '12

12 Apr '12

openSUSE Security Update: update for taglib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0490-1 Rating: moderate References: #750689 #750690 #750691 #750693 Cross-References: CVE-2012-1107 CVE-2012-1108 CVE-2012-1584 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: Specially crafted ogg files could crash taglib Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-218 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libtag-devel-1.7-8.4.1 libtag1-1.7-8.4.1 libtag1-debuginfo-1.7-8.4.1 libtag_c0-1.7-8.4.1 libtag_c0-debuginfo-1.7-8.4.1 taglib-1.7-8.4.1 taglib-debugsource-1.7-8.4.1 - openSUSE 12.1 (x86_64): libtag1-32bit-1.7-8.4.1 libtag1-debuginfo-32bit-1.7-8.4.1 libtag_c0-32bit-1.7-8.4.1 libtag_c0-debuginfo-32bit-1.7-8.4.1 - openSUSE 12.1 (ia64): libtag1-debuginfo-x86-1.7-8.4.1 libtag1-x86-1.7-8.4.1 libtag_c0-debuginfo-x86-1.7-8.4.1 libtag_c0-x86-1.7-8.4.1 References: http://support.novell.com/security/cve/CVE-2012-1107.html http://support.novell.com/security/cve/CVE-2012-1108.html http://support.novell.com/security/cve/CVE-2012-1584.html https://bugzilla.novell.com/750689 https://bugzilla.novell.com/750690 https://bugzilla.novell.com/750691 https://bugzilla.novell.com/750693

1 0

openSUSE-SU-2012:0489-1: important: freetype2 update
by opensuse-security＠opensuse.org 12 Apr '12

12 Apr '12

openSUSE Security Update: freetype2 update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0489-1 Rating: important References: Cross-References: CVE-2012-1126 CVE-2012-1127 CVE-2012-1128 CVE-2012-1129 CVE-2012-1130 CVE-2012-1131 CVE-2012-1132 CVE-2012-1133 CVE-2012-1134 CVE-2012-1135 CVE-2012-1136 CVE-2012-1137 CVE-2012-1138 CVE-2012-1139 CVE-2012-1140 CVE-2012-1141 CVE-2012-1142 CVE-2012-1143 CVE-2012-1144 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: Specially crafted font files could cause buffer overflows in freetype Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-220 - openSUSE 11.4: zypper in -t patch openSUSE-2012-220 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): freetype2-debugsource-2.4.7-6.1 freetype2-devel-2.4.7-6.1 libfreetype6-2.4.7-6.1 libfreetype6-debuginfo-2.4.7-6.1 - openSUSE 12.1 (x86_64): freetype2-devel-32bit-2.4.7-6.1 libfreetype6-32bit-2.4.7-6.1 libfreetype6-debuginfo-32bit-2.4.7-6.1 - openSUSE 12.1 (ia64): libfreetype6-debuginfo-x86-2.4.7-6.1 libfreetype6-x86-2.4.7-6.1 - openSUSE 11.4 (i586 x86_64): freetype2-debugsource-2.4.4-7.24.1 freetype2-devel-2.4.4-7.24.1 libfreetype6-2.4.4-7.24.1 libfreetype6-debuginfo-2.4.4-7.24.1 - openSUSE 11.4 (x86_64): freetype2-devel-32bit-2.4.4-7.24.1 libfreetype6-32bit-2.4.4-7.24.1 libfreetype6-debuginfo-32bit-2.4.4-7.24.1 - openSUSE 11.4 (ia64): libfreetype6-debuginfo-x86-2.4.4-7.24.1 libfreetype6-x86-2.4.4-7.24.1 References: http://support.novell.com/security/cve/CVE-2012-1126.html http://support.novell.com/security/cve/CVE-2012-1127.html http://support.novell.com/security/cve/CVE-2012-1128.html http://support.novell.com/security/cve/CVE-2012-1129.html http://support.novell.com/security/cve/CVE-2012-1130.html http://support.novell.com/security/cve/CVE-2012-1131.html http://support.novell.com/security/cve/CVE-2012-1132.html http://support.novell.com/security/cve/CVE-2012-1133.html http://support.novell.com/security/cve/CVE-2012-1134.html http://support.novell.com/security/cve/CVE-2012-1135.html http://support.novell.com/security/cve/CVE-2012-1136.html http://support.novell.com/security/cve/CVE-2012-1137.html http://support.novell.com/security/cve/CVE-2012-1138.html http://support.novell.com/security/cve/CVE-2012-1139.html http://support.novell.com/security/cve/CVE-2012-1140.html http://support.novell.com/security/cve/CVE-2012-1141.html http://support.novell.com/security/cve/CVE-2012-1142.html http://support.novell.com/security/cve/CVE-2012-1143.html http://support.novell.com/security/cve/CVE-2012-1144.html

1 0

openSUSE-SU-2012:0488-1: update for file
by opensuse-security＠opensuse.org 12 Apr '12

12 Apr '12

openSUSE Security Update: update for file ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0488-1 Rating: low References: #753303 Cross-References: CVE-2012-1571 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: specially crafted CDF files could crash the "file" program Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-221 - openSUSE 11.4: zypper in -t patch openSUSE-2012-221 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): file-5.08-7.4.1 file-debuginfo-5.08-7.4.1 file-debugsource-5.08-7.4.1 file-devel-5.08-7.4.1 python-magic-5.08-7.4.1 - openSUSE 12.1 (x86_64): file-32bit-5.08-7.4.1 file-debuginfo-32bit-5.08-7.4.1 - openSUSE 11.4 (i586 x86_64): file-5.04-13.1 file-debuginfo-5.04-13.1 file-debugsource-5.04-13.1 file-devel-5.04-13.1 python-magic-5.04-13.1 python-magic-debuginfo-5.04-13.1 python-magic-debugsource-5.04-13.1 - openSUSE 11.4 (x86_64): file-32bit-5.04-13.1 file-debuginfo-32bit-5.04-13.1 References: http://support.novell.com/security/cve/CVE-2012-1571.html https://bugzilla.novell.com/753303

1 0

openSUSE-SU-2012:0487-1: update for python-pam
by opensuse-security＠opensuse.org 12 Apr '12

12 Apr '12

openSUSE Security Update: update for python-pam ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0487-1 Rating: low References: #751005 Cross-References: CVE-2012-1502 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: python-pam was prone to a double-free issue Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-222 - openSUSE 11.4: zypper in -t patch openSUSE-2012-222 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): python-pam-0.5.0-79.12.1 python-pam-debuginfo-0.5.0-79.12.1 python-pam-debugsource-0.5.0-79.12.1 - openSUSE 11.4 (i586 x86_64): python-pam-0.5.0-79.1 python-pam-debuginfo-0.5.0-79.1 python-pam-debugsource-0.5.0-79.1 References: http://support.novell.com/security/cve/CVE-2012-1502.html https://bugzilla.novell.com/751005

1 0