August 2012 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2012:1000-1: moderate: update for perl-YAML-LibYAML
by opensuse-security＠opensuse.org 17 Aug '12

17 Aug '12

openSUSE Security Update: update for perl-YAML-LibYAML ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1000-1 Rating: moderate References: #751503 Cross-References: CVE-2012-1152 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of perl-YAML-LibYAML fixed multiple format string flaws that could cause a crash or potentially allow the execution of arbitrary code. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-521 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): perl-YAML-LibYAML-0.37-2.4.1 perl-YAML-LibYAML-debuginfo-0.37-2.4.1 perl-YAML-LibYAML-debugsource-0.37-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-1152.html https://bugzilla.novell.com/751503

1 0

openSUSE-RU-2012:0999-1: moderate: MozillaFirefox-branding-openSUSE: move Firefox specific prefs to defaults/preferences
by maintenance＠opensuse.org 17 Aug '12

17 Aug '12

openSUSE Recommended Update: MozillaFirefox-branding-openSUSE: move Firefox specific prefs to defaults/preferences ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0999-1 Rating: moderate References: #737709 #768942 #774914 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: Various updates to MozillaFirefox-branding-openSUSE: - move Firefox specific prefs to defaults/preferences (bnc#774914) - update susefox to snapshot 20120626 * add window controls for Gnome 3 (bnc#768942) - bumped version to 6.0 - support firefox-esr RPM packages - removed MozillaFirefox build dependency and PreReq * everything controlled by Supplements and Requirements from base package - make openSUSE software search version specific (bnc#737709) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-520 - openSUSE 11.4: zypper in -t patch openSUSE-2012-520 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): MozillaFirefox-branding-openSUSE-6.1-7.10.1 - openSUSE 11.4 (i586 x86_64): MozillaFirefox-branding-openSUSE-6.1-13.1 References: https://bugzilla.novell.com/737709 https://bugzilla.novell.com/768942 https://bugzilla.novell.com/774914

1 0

openSUSE-SU-2012:0996-1: critical: flash-player to 11.2.202.238
by opensuse-security＠opensuse.org 16 Aug '12

16 Aug '12

openSUSE Security Update: flash-player to 11.2.202.238 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0996-1 Rating: critical References: #775986 Cross-References: CVE-2012-1535 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.238 fixing various bugs and security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-518 - openSUSE 11.4: zypper in -t patch openSUSE-2012-518 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.238-27.1 flash-player-gnome-11.2.202.238-27.1 flash-player-kde4-11.2.202.238-27.1 - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.238-20.1 flash-player-gnome-11.2.202.238-20.1 flash-player-kde4-11.2.202.238-20.1 References: http://support.novell.com/security/cve/CVE-2012-1535.html https://bugzilla.novell.com/775986

1 0

openSUSE-RU-2012:0994-1: important: Go language - openSUSE 12.1 bugfix and
by maintenance＠opensuse.org 15 Aug '12

15 Aug '12

openSUSE Recommended Update: Go language - openSUSE 12.1 bugfix and ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:0994-1 Rating: important References: #774262 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update brings the core Go language package up to date with the latest bugfixes and supported version. In addition to the numerous smaller bug, documentation and language fixes the following two issues are addressed. - Potential DoS from an algorithmic complexity attack on the hashmap implementation. - Too many successive collisions in the underlying hash algorithm could cause the runtime to skip fields or values in a hashmap. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-517 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): go-1.0.2-2.6.1 go-debuginfo-1.0.2-2.6.1 go-debugsource-1.0.2-2.6.1 go-doc-1.0.2-2.6.1 go-emacs-1.0.2-2.6.1 go-go-gtk-0.0.0+git20120304-1.4.1 go-go-gtk-doc-0.0.0+git20120304-1.4.1 go-goauth2-0.0.0+hg20111205-2.4.1 go-goauth2-doc-0.0.0+hg20111205-2.4.1 go-httplib.go-0.0.0+git20111213-2.4.1 go-httplib.go-doc-0.0.0+git20111213-2.4.1 go-kate-1.0.2-2.6.1 go-mustache.go-0.0.0+git20120208-3.4.1 go-mustache.go-doc-0.0.0+git20120208-3.4.1 go-vim-1.0.2-2.6.1 go-web.go-0.0.0+git20120217-2.4.1 go-web.go-doc-0.0.0+git20120217-2.4.1 References: https://bugzilla.novell.com/774262

1 0

openSUSE-SU-2012:0993-1: important: update for chromium, v8
by opensuse-security＠opensuse.org 15 Aug '12

15 Aug '12

openSUSE Security Update: update for chromium, v8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0993-1 Rating: important References: #760264 #770821 Cross-References: CVE-2011-3084 CVE-2011-3098 CVE-2012-2842 CVE-2012-2843 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Version upgrade of chromium to address multiple security vulnerabilities. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-516 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): chromedriver-22.0.1226.0-1.29.1 chromedriver-debuginfo-22.0.1226.0-1.29.1 chromium-22.0.1226.0-1.29.1 chromium-debuginfo-22.0.1226.0-1.29.1 chromium-debugsource-22.0.1226.0-1.29.1 chromium-desktop-gnome-22.0.1226.0-1.29.1 chromium-desktop-kde-22.0.1226.0-1.29.1 chromium-suid-helper-22.0.1226.0-1.29.1 chromium-suid-helper-debuginfo-22.0.1226.0-1.29.1 libv8-3-3.12.19.1-1.33.1 libv8-3-debuginfo-3.12.19.1-1.33.1 v8-devel-3.12.19.1-1.33.1 v8-private-headers-devel-3.12.19.1-1.33.1 References: http://support.novell.com/security/cve/CVE-2011-3084.html http://support.novell.com/security/cve/CVE-2011-3098.html http://support.novell.com/security/cve/CVE-2012-2842.html http://support.novell.com/security/cve/CVE-2012-2843.html https://bugzilla.novell.com/760264 https://bugzilla.novell.com/770821

1 0

openSUSE-SU-2012:0992-1: important: opera to 12.01
by opensuse-security＠opensuse.org 15 Aug '12

15 Aug '12

openSUSE Security Update: opera to 12.01 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0992-1 Rating: important References: #774191 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Opera was updated to version 12.1, fixing various bugs and security issues. http://www.opera.com/docs/changelogs/unix/1201/ Fixes and Stability Enhancements since Opera 12.00 General and User Interface Several general fixes and stability improvements Website thumbnail memory usage improvements Address bar inline auto-completion no longer prefers shortest domain Corrected an error that could occur after removing the plugin wrapper Resolved an issue where favicons were squeezed too much when many tabs were open Display and Scripting Resolved an error with XHR transfers where content-type was incorrectly determined Improved handling of object literals with numeric duplicate properties Changed behavior of nested/chained comma expressions: now expressing and compiling them as a list rather than a tree Aligned behavior of the #caller property on function code objects in ECMAScript 5 strict mode with the specification Fixed an issue where input type=month would return an incorrect value in its valueAsDate property Resolved an issue with JSON.stringify() that could occur on cached number conversion Fixed a problem with redefining special properties using Object.defineProperty() Network and Site-Specific Fixed an issue where loading would stop at "Document 100%" but the page would still be loading tuenti.com: Corrected behavior when long content was displayed https://twitter.com: Fixed an issue with secure transaction errors Fixed an issue with Google Maps Labs that occured when compiling top-level loops inside strict evals Corrected a problem that could occur with DISQUS Fixed a crash occurring on Lenovo's "Shop now" page Corrected issues when calling window.console.log via a variable at watch4you Resolved an issue with Yahoo! chat Mail, News, Chat Resolved an issue where under certain conditions the mail panel would continuously scroll up Fixed a crash occurring when loading mail databases on startup Security Re-fixed an issue where certain URL constructs could allow arbitrary code execution, as reported by Andrey Stroganov; see our advisory Fixed an issue where certain characters in HTML could incorrectly be ignored, which could facilitate XSS attacks; see our advisory Fixed another issue where small windows could be used to trick users into executing downloads as reported by Jordi Chancel; see our advisory Fixed an issue where an element's HTML content could be incorrectly returned without escaping, bypassing some HTML sanitizers; see our advisory Fixed a low severity issue, details will be disclosed at a later date Advisory links from above: http://www.opera.com/support/kb/view/1016/ http://www.opera.com/support/kb/view/1026/ http://www.opera.com/support/kb/view/1027/ http://www.opera.com/support/kb/view/1025/ Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-515 - openSUSE 11.4: zypper in -t patch openSUSE-2012-515 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): opera-12.01-19.1 opera-gtk-12.01-19.1 opera-kde4-12.01-19.1 - openSUSE 11.4 (i586 x86_64): opera-12.01-25.1 opera-gtk-12.01-25.1 opera-kde4-12.01-25.1 References: https://bugzilla.novell.com/774191

1 0

openSUSE-SU-2012:0991-1: moderate: libvirt to fix remote dos
by opensuse-security＠opensuse.org 15 Aug '12

15 Aug '12

openSUSE Security Update: libvirt to fix remote dos ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0991-1 Rating: moderate References: #773955 Cross-References: CVE-2012-3445 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libvirt was updated to fix a remote denial of service which could lead to crashes in virtd. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-514 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libvirt-0.9.6-3.9.1 libvirt-client-0.9.6-3.9.1 libvirt-client-debuginfo-0.9.6-3.9.1 libvirt-debuginfo-0.9.6-3.9.1 libvirt-debugsource-0.9.6-3.9.1 libvirt-devel-0.9.6-3.9.1 libvirt-doc-0.9.6-3.9.1 libvirt-python-0.9.6-3.9.1 libvirt-python-debuginfo-0.9.6-3.9.1 - openSUSE 12.1 (x86_64): libvirt-client-32bit-0.9.6-3.9.1 libvirt-client-debuginfo-32bit-0.9.6-3.9.1 libvirt-devel-32bit-0.9.6-3.9.1 - openSUSE 12.1 (ia64): libvirt-client-debuginfo-x86-0.9.6-3.9.1 libvirt-client-x86-0.9.6-3.9.1 References: http://support.novell.com/security/cve/CVE-2012-3445.html https://bugzilla.novell.com/773955

1 0

openSUSE-SU-2012:0982-1: important: update for icedtea-web
by opensuse-security＠opensuse.org 13 Aug '12

13 Aug '12

openSUSE Security Update: update for icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0982-1 Rating: important References: #773458 Cross-References: CVE-2012-3422 CVE-2012-3423 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of icedtea-web fixed multiple hewap buffer overflows. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-513 - openSUSE 11.4: zypper in -t patch openSUSE-2012-513 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): icedtea-web-1.2.1-10.1 icedtea-web-debuginfo-1.2.1-10.1 icedtea-web-debugsource-1.2.1-10.1 - openSUSE 12.1 (noarch): icedtea-web-javadoc-1.2.1-10.1 - openSUSE 11.4 (i586 x86_64): icedtea-web-1.2.1-0.17.1 icedtea-web-debuginfo-1.2.1-0.17.1 icedtea-web-debugsource-1.2.1-0.17.1 - openSUSE 11.4 (noarch): icedtea-web-javadoc-1.2.1-0.17.1 References: http://support.novell.com/security/cve/CVE-2012-3422.html http://support.novell.com/security/cve/CVE-2012-3423.html https://bugzilla.novell.com/773458

1 0

openSUSE-SU-2012:0981-1: important: icedtea-web: Update to 1.2.1 (bnc#)
by opensuse-security＠opensuse.org 10 Aug '12

10 Aug '12

openSUSE Security Update: icedtea-web: Update to 1.2.1 (bnc#) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0981-1 Rating: important References: #773458 Cross-References: CVE-2012-3422 CVE-2012-3423 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: - update to 1.2.1 (bnc#773458) - Security Updates * CVE-2012-3422, RH840592: Potential read from an uninitialized memory location * CVE-2012-3423, RH841345: Incorrect handling of not 0-terminated strings - NetX * PR898: signed applications with big jnlp-file doesn't start (webstart affect like "frozen") * PR811: javaws is not handling urls with spaces (and other characters needing encoding) correctly * 816592: icedtea-web not loading GeoGebra java applets in Firefox or Chrome - Plugin * PR863: Error passing strings to applet methods in Chromium * PR895: IcedTea-Web searches for missing classes on each loadClass or findClass * PR518: NPString.utf8characters not guaranteed to be nul-terminated - Common * RH838417: Disambiguate signed applet security prompt from certificate warning * RH838559: Disambiguate signed applet security prompt from certificate warning Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-512 - openSUSE 11.4: zypper in -t patch openSUSE-2012-512 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): icedtea-web-1.2.1-6.1 icedtea-web-debuginfo-1.2.1-6.1 icedtea-web-debugsource-1.2.1-6.1 - openSUSE 12.1 (noarch): icedtea-web-javadoc-1.2.1-6.1 - openSUSE 11.4 (i586 x86_64): icedtea-web-1.2.1-0.13.1 icedtea-web-debuginfo-1.2.1-0.13.1 icedtea-web-debugsource-1.2.1-0.13.1 - openSUSE 11.4 (noarch): icedtea-web-javadoc-1.2.1-0.13.1 References: http://support.novell.com/security/cve/CVE-2012-3422.html http://support.novell.com/security/cve/CVE-2012-3423.html https://bugzilla.novell.com/773458

1 0

openSUSE-SU-2012:0978-1: important: rubygem-actionpack/activerecord-2_3
by opensuse-security＠opensuse.org 09 Aug '12

09 Aug '12

openSUSE Security Update: rubygem-actionpack/activerecord-2_3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0978-1 Rating: important References: #765097 #766792 Cross-References: CVE-2012-2660 CVE-2012-2694 CVE-2012-2695 Affected Products: openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: 3 Security issues were fixed in rails 2.3 core components. 2 NULL query issues where fixed in the actionpack gem. 1 SQL injection was fixed in the activerecord gem. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-508 - openSUSE 11.4: zypper in -t patch openSUSE-2012-508 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): rubygem-actionpack-2_3-2.3.14-3.8.1 rubygem-actionpack-2_3-doc-2.3.14-3.8.1 rubygem-actionpack-2_3-testsuite-2.3.14-3.8.1 rubygem-activerecord-2_3-2.3.14-3.8.1 rubygem-activerecord-2_3-doc-2.3.14-3.8.1 rubygem-activerecord-2_3-testsuite-2.3.14-3.8.1 - openSUSE 11.4 (i586 x86_64): rubygem-actionpack-2_3-2.3.14-0.16.1 rubygem-actionpack-2_3-doc-2.3.14-0.16.1 rubygem-actionpack-2_3-testsuite-2.3.14-0.16.1 rubygem-activerecord-2_3-2.3.14-0.16.1 rubygem-activerecord-2_3-doc-2.3.14-0.16.1 rubygem-activerecord-2_3-testsuite-2.3.14-0.16.1 References: http://support.novell.com/security/cve/CVE-2012-2660.html http://support.novell.com/security/cve/CVE-2012-2694.html http://support.novell.com/security/cve/CVE-2012-2695.html https://bugzilla.novell.com/765097 https://bugzilla.novell.com/766792

1 0