July 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2012:0886-1: critical: xen
by opensuse-security＠opensuse.org 18 Jul '12

18 Jul '12

openSUSE Security Update: xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0886-1 Rating: critical References: #757537 #757970 #764077 Cross-References: CVE-2012-0217 CVE-2012-0218 CVE-2012-2934 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update of XEN fixed multiple security flaws that could be exploited by local attackers to cause a Denial of Service or potentially escalate privileges. Additionally, several other upstream changes were backported. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-403 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): xen-debugsource-4.1.2_17-1.10.1 xen-devel-4.1.2_17-1.10.1 xen-kmp-default-4.1.2_17_k3.1.10_1.16-1.10.1 xen-kmp-default-debuginfo-4.1.2_17_k3.1.10_1.16-1.10.1 xen-kmp-desktop-4.1.2_17_k3.1.10_1.16-1.10.1 xen-kmp-desktop-debuginfo-4.1.2_17_k3.1.10_1.16-1.10.1 xen-libs-4.1.2_17-1.10.1 xen-libs-debuginfo-4.1.2_17-1.10.1 xen-tools-domU-4.1.2_17-1.10.1 xen-tools-domU-debuginfo-4.1.2_17-1.10.1 - openSUSE 12.1 (x86_64): xen-4.1.2_17-1.10.1 xen-doc-html-4.1.2_17-1.10.1 xen-doc-pdf-4.1.2_17-1.10.1 xen-libs-32bit-4.1.2_17-1.10.1 xen-libs-debuginfo-32bit-4.1.2_17-1.10.1 xen-tools-4.1.2_17-1.10.1 xen-tools-debuginfo-4.1.2_17-1.10.1 - openSUSE 12.1 (ia64): xen-libs-debuginfo-x86-4.1.2_17-1.10.1 xen-libs-x86-4.1.2_17-1.10.1 - openSUSE 12.1 (i586): xen-kmp-pae-4.1.2_17_k3.1.10_1.16-1.10.1 xen-kmp-pae-debuginfo-4.1.2_17_k3.1.10_1.16-1.10.1 References: http://support.novell.com/security/cve/CVE-2012-0217.html http://support.novell.com/security/cve/CVE-2012-0218.html http://support.novell.com/security/cve/CVE-2012-2934.html https://bugzilla.novell.com/757537 https://bugzilla.novell.com/757970 https://bugzilla.novell.com/764077

1 0

openSUSE-SU-2012:0884-1: moderate: gypsy (CVE-2011-0523, CVE-2011-0524)
by opensuse-security＠opensuse.org 17 Jul '12

17 Jul '12

openSUSE Security Update: gypsy (CVE-2011-0523, CVE-2011-0524) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0884-1 Rating: moderate References: #666839 Cross-References: CVE-2011-0523 CVE-2011-0524 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The following changes have been made: - Add gypsy-CVE-2011-0523.patch: add config file to restrict the files that can be read. Fix CVE-2011-0523 and bnc#666839. - Add gypsy-CVE-2011-0524.patch: use snprintf() to avoid buffer overflows. Fix CVE-2011-0524 and bnc#666839. - Add gnome-common BuildRequires and call to gnome-autogen.sh for gypsy-CVE-2011-0523.patch, since it touches the build system. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-394 - openSUSE 11.4: zypper in -t patch openSUSE-2012-394 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): gypsy-0.8-7.4.1 gypsy-debuginfo-0.8-7.4.1 gypsy-debugsource-0.8-7.4.1 libgypsy-devel-0.8-7.4.1 libgypsy0-0.8-7.4.1 libgypsy0-debuginfo-0.8-7.4.1 - openSUSE 11.4 (i586 x86_64): gypsy-0.8-5.1 gypsy-debuginfo-0.8-5.1 gypsy-debugsource-0.8-5.1 libgypsy-devel-0.8-5.1 libgypsy0-0.8-5.1 libgypsy0-debuginfo-0.8-5.1 References: http://support.novell.com/security/cve/CVE-2011-0523.html http://support.novell.com/security/cve/CVE-2011-0524.html https://bugzilla.novell.com/666839

1 0

openSUSE-SU-2012:0883-1: moderate: update for libxslt, libxslt-python (CVE-2012-2825)
by opensuse-security＠opensuse.org 17 Jul '12

17 Jul '12

openSUSE Security Update: update for libxslt, libxslt-python (CVE-2012-2825) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0883-1 Rating: moderate References: #769182 Cross-References: CVE-2012-2825 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Changes in libxslt, libxslt-python: - fixing an incorrect read operation in the XSL implementation (CVE-2012-2825, bnc#769182) that could cause a DoS condition Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-393 - openSUSE 11.4: zypper in -t patch openSUSE-2012-393 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libxslt-debugsource-1.1.26-15.8.1 libxslt-devel-1.1.26-15.8.1 libxslt-python-1.1.26-15.8.1 libxslt-python-debuginfo-1.1.26-15.8.1 libxslt-python-debugsource-1.1.26-15.8.1 libxslt1-1.1.26-15.8.1 libxslt1-debuginfo-1.1.26-15.8.1 - openSUSE 12.1 (x86_64): libxslt-devel-32bit-1.1.26-15.8.1 libxslt1-32bit-1.1.26-15.8.1 libxslt1-debuginfo-32bit-1.1.26-15.8.1 - openSUSE 12.1 (ia64): libxslt1-debuginfo-x86-1.1.26-15.8.1 libxslt1-x86-1.1.26-15.8.1 - openSUSE 11.4 (i586 x86_64): libxslt-1.1.26-3.14.1 libxslt-debuginfo-1.1.26-3.14.1 libxslt-debugsource-1.1.26-3.14.1 libxslt-devel-1.1.26-3.14.1 - openSUSE 11.4 (x86_64): libxslt-32bit-1.1.26-3.14.1 libxslt-debuginfo-32bit-1.1.26-3.14.1 libxslt-devel-32bit-1.1.26-3.14.1 - openSUSE 11.4 (ia64): libxslt-debuginfo-x86-1.1.26-3.14.1 libxslt-x86-1.1.26-3.14.1 References: http://support.novell.com/security/cve/CVE-2012-2825.html https://bugzilla.novell.com/769182

1 0

openSUSE-RU-2012:0879-1: at-spi2-atk: Fixed tempdirectory misuse in atk-adaptor
by maintenance＠opensuse.org 16 Jul '12

16 Jul '12

openSUSE Recommended Update: at-spi2-atk: Fixed tempdirectory misuse in atk-adaptor ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0879-1 Rating: low References: #770177 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This fixes a world writeable temp directory usage in the atk-adaptor. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-392 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): at-spi2-atk-common-2.2.1-2.4.1 at-spi2-atk-debugsource-2.2.1-2.4.1 at-spi2-atk-gtk2-2.2.1-2.4.1 at-spi2-atk-gtk2-debuginfo-2.2.1-2.4.1 at-spi2-atk-gtk3-2.2.1-2.4.1 at-spi2-atk-gtk3-debuginfo-2.2.1-2.4.1 - openSUSE 12.1 (noarch): at-spi2-atk-lang-2.2.1-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-3378.html https://bugzilla.novell.com/770177

1 0

openSUSE-RU-2012:0878-1: seccheck: fixed several bugs
by maintenance＠opensuse.org 16 Jul '12

16 Jul '12

openSUSE Recommended Update: seccheck: fixed several bugs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0878-1 Rating: low References: #746042 #769770 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: - fixed bnc#769770 to improve reporting of account names with equal UIDs. - change tmp fie handling and removed obsolete code - bnc#746042 handle new "rpm -Va" output for md5 sums and don't limit the mount point detection to special filesystems Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-390 - openSUSE 11.4: zypper in -t patch openSUSE-2012-390 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (noarch): seccheck-2.0-670.6.1 - openSUSE 11.4 (noarch): seccheck-2.0-668.673.1 References: https://bugzilla.novell.com/746042 https://bugzilla.novell.com/769770

1 0

openSUSE-RU-2012:0877-1: spamassassin: Collective update
by maintenance＠opensuse.org 16 Jul '12

16 Jul '12

openSUSE Recommended Update: spamassassin: Collective update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0877-1 Rating: low References: #737637 #768581 #768582 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update fixes the following issues for spamassassin: - 768582: suse.cron-sa-update should allow to restart spamd after a successful run of sa-update - killproc can not stop spamd - 768581: Add systemd service files for spamd and spampd - 737637: Fixed IPv6 support in spamassassin Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-391 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): perl-Mail-SpamAssassin-3.3.2-21.4.1 perl-Mail-SpamAssassin-Plugin-iXhash-1.5.5-21.4.1 spamassassin-3.3.2-21.4.1 spamassassin-debuginfo-3.3.2-21.4.1 spamassassin-debugsource-3.3.2-21.4.1 References: https://bugzilla.novell.com/737637 https://bugzilla.novell.com/768581 https://bugzilla.novell.com/768582

1 0

openSUSE-RU-2012:0876-1: glibc: Fix tls initialization with dlopen
by maintenance＠opensuse.org 16 Jul '12

16 Jul '12

openSUSE Recommended Update: glibc: Fix tls initialization with dlopen ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0876-1 Rating: low References: #770060 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for glibc: - 770060: Fix tls initialization with dlopen Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2012-389 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 i686 x86_64): glibc-2.11.3-12.59.1 glibc-debuginfo-2.11.3-12.59.1 glibc-debugsource-2.11.3-12.59.1 glibc-devel-2.11.3-12.59.1 glibc-devel-debuginfo-2.11.3-12.59.1 glibc-html-2.11.3-12.59.1 glibc-i18ndata-2.11.3-12.59.1 glibc-info-2.11.3-12.59.1 glibc-locale-2.11.3-12.59.1 glibc-locale-debuginfo-2.11.3-12.59.1 glibc-obsolete-2.11.3-12.59.1 glibc-profile-2.11.3-12.59.1 nscd-2.11.3-12.59.1 nscd-debuginfo-2.11.3-12.59.1 - openSUSE 11.4 (i586 i686): glibc-obsolete-debuginfo-2.11.3-12.59.1 - openSUSE 11.4 (x86_64): glibc-32bit-2.11.3-12.59.1 glibc-debuginfo-32bit-2.11.3-12.59.1 glibc-devel-32bit-2.11.3-12.59.1 glibc-devel-debuginfo-32bit-2.11.3-12.59.1 glibc-locale-32bit-2.11.3-12.59.1 glibc-locale-debuginfo-32bit-2.11.3-12.59.1 glibc-profile-32bit-2.11.3-12.59.1 - openSUSE 11.4 (ia64): glibc-debuginfo-x86-2.11.3-12.59.1 glibc-devel-debuginfo-x86-2.11.3-12.59.1 glibc-locale-debuginfo-x86-2.11.3-12.59.1 glibc-locale-x86-2.11.3-12.59.1 glibc-profile-x86-2.11.3-12.59.1 glibc-x86-2.11.3-12.59.1 References: https://bugzilla.novell.com/770060

1 0

openSUSE-RU-2012:0868-1: moderate: empathy: Update to version 3.2.2
by maintenance＠opensuse.org 12 Jul '12

12 Jul '12

openSUSE Recommended Update: empathy: Update to version 3.2.2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0868-1 Rating: moderate References: #749149 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues for empathy: - Update to version 3.2.2: + This stable release fixes a bunch of memory leaks in the log viewer and a packing issue in the accounts dialog [bnc#749149] + Status icon is miss aligned in infobar[bgo#663567] - Changes from version 3.2.1.2: + Cannot quit empathy [bgo#662504] + Fix for misaligned 16x16 app icon [bgo#662995] + new-call/new-convo dialogs should listen to capabilities changes [bgo#662727] Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-385 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): empathy-3.2.2-1.5.1 empathy-debuginfo-3.2.2-1.5.1 empathy-debugsource-3.2.2-1.5.1 nautilus-sendto-plugin-empathy-3.2.2-1.5.1 nautilus-sendto-plugin-empathy-debuginfo-3.2.2-1.5.1 telepathy-mission-control-plugin-goa-3.2.2-1.5.1 telepathy-mission-control-plugin-goa-debuginfo-3.2.2-1.5.1 - openSUSE 12.1 (noarch): empathy-lang-3.2.2-1.5.1 References: https://bugzilla.novell.com/749149

1 0

openSUSE-SU-2012:0866-1: moderate: update for pidgin (CVE-2012-2318)
by opensuse-security＠opensuse.org 11 Jul '12

11 Jul '12

openSUSE Security Update: update for pidgin (CVE-2012-2318) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0866-1 Rating: moderate References: #761155 Cross-References: CVE-2012-2318 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Changes in pidgin: - bnc#761155, CVE-2012-2318, remote crash via specially-crafted MSN notification message Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-384 - openSUSE 11.4: zypper in -t patch openSUSE-2012-384 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): finch-2.10.1-8.12.1 finch-debuginfo-2.10.1-8.12.1 finch-devel-2.10.1-8.12.1 libpurple-2.10.1-8.12.1 libpurple-debuginfo-2.10.1-8.12.1 libpurple-devel-2.10.1-8.12.1 libpurple-meanwhile-2.10.1-8.12.1 libpurple-meanwhile-debuginfo-2.10.1-8.12.1 libpurple-tcl-2.10.1-8.12.1 libpurple-tcl-debuginfo-2.10.1-8.12.1 pidgin-2.10.1-8.12.1 pidgin-debuginfo-2.10.1-8.12.1 pidgin-debugsource-2.10.1-8.12.1 pidgin-devel-2.10.1-8.12.1 pidgin-evolution-2.10.1-8.12.1 pidgin-evolution-debuginfo-2.10.1-8.12.1 - openSUSE 12.1 (noarch): libpurple-branding-upstream-2.10.1-8.12.1 libpurple-lang-2.10.1-8.12.1 - openSUSE 11.4 (i586 x86_64): finch-2.7.10-4.47.1 finch-debuginfo-2.7.10-4.47.1 finch-devel-2.7.10-4.47.1 libpurple-2.7.10-4.47.1 libpurple-debuginfo-2.7.10-4.47.1 libpurple-devel-2.7.10-4.47.1 libpurple-meanwhile-2.7.10-4.47.1 libpurple-meanwhile-debuginfo-2.7.10-4.47.1 libpurple-tcl-2.7.10-4.47.1 libpurple-tcl-debuginfo-2.7.10-4.47.1 pidgin-2.7.10-4.47.1 pidgin-debuginfo-2.7.10-4.47.1 pidgin-debugsource-2.7.10-4.47.1 pidgin-devel-2.7.10-4.47.1 pidgin-evolution-2.7.10-4.47.1 pidgin-evolution-debuginfo-2.7.10-4.47.1 - openSUSE 11.4 (noarch): libpurple-lang-2.7.10-4.47.1 References: http://support.novell.com/security/cve/CVE-2012-2318.html https://bugzilla.novell.com/761155

1 0

openSUSE-SU-2012:0865-1: important: update for opera
by opensuse-security＠opensuse.org 11 Jul '12

11 Jul '12

openSUSE Security Update: update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0865-1 Rating: important References: #767045 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: - update to 12.00 * full changelog available at: http://www.opera.com/docs/changelogs/unix/1120/ - fixes [bnc#767045] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-379 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): opera-12.00-16.1 opera-gtk-12.00-16.1 opera-kde4-12.00-16.1 References: https://bugzilla.novell.com/767045

1 0