January 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2013:0201-1: gdm: do not ship gdm-fingerprint, it conflicts with pam_fprint
by maintenance＠opensuse.org 28 Jan '13

28 Jan '13

openSUSE Recommended Update: gdm: do not ship gdm-fingerprint, it conflicts with pam_fprint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0201-1 Rating: low References: #772948 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for gdm: - bnc#772948: do not ship gdm-fingerprint PAM config file in main gdm package, it blocks pam_fprint configuration Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-48 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): gdm-3.4.1-4.14.1 gdm-debuginfo-3.4.1-4.14.1 gdm-debugsource-3.4.1-4.14.1 gdm-devel-3.4.1-4.14.1 libgdmgreeter1-3.4.1-4.14.1 libgdmgreeter1-debuginfo-3.4.1-4.14.1 libgdmsimplegreeter1-3.4.1-4.14.1 libgdmsimplegreeter1-debuginfo-3.4.1-4.14.1 typelib-1_0-GdmGreeter-1_0-3.4.1-4.14.1 - openSUSE 12.2 (noarch): gdm-branding-upstream-3.4.1-4.14.1 gdm-lang-3.4.1-4.14.1 gdmflexiserver-3.4.1-4.14.1 References: https://bugzilla.novell.com/772948

1 0

openSUSE-SU-2013:0199-1: critical: java-1_7_0-openjdk: update to icedtea-2.3.4
by opensuse-security＠opensuse.org 25 Jan '13

25 Jan '13

openSUSE Security Update: java-1_7_0-openjdk: update to icedtea-2.3.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0199-1 Rating: critical References: #792951 #798324 #798521 Cross-References: CVE-2012-3174 CVE-2013-0422 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: java-1_7_0-openjdk was updated to icedtea-2.3.4 fixing bugs and also severe security issues: * Security fixes - S8004933, CVE-2012-3174: Improve MethodHandle interaction with libraries - S8006017, CVE-2013-0422: Improve lookup resolutions - S8006125: Update MethodHandles library interactions * Bug fixes - S7197906: BlockOffsetArray::power_to_cards_back() needs to handle > 32 bit shifts - G422525: Fix building with PaX enabled kernels. - use gpg-offline to check the validity of icedtea tarball - use jamvm on %arm - use icedtea package name instead of protected openjdk for jamvm builds - fix armv5 build - update to java access bridge 1.26.2 * bugfix release, mainly 64bit JNI and JVM support - fix a segfault in AWT code - (bnc#792951) * add openjdk-7-src-b147-awt-crasher.patch - turn pulseaudio off on pre 11.4 distros Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-47 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.6-3.20.1 java-1_7_0-openjdk-debuginfo-1.7.0.6-3.20.1 java-1_7_0-openjdk-debugsource-1.7.0.6-3.20.1 java-1_7_0-openjdk-demo-1.7.0.6-3.20.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.6-3.20.1 java-1_7_0-openjdk-devel-1.7.0.6-3.20.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.6-3.20.1 java-1_7_0-openjdk-javadoc-1.7.0.6-3.20.1 java-1_7_0-openjdk-src-1.7.0.6-3.20.1 References: http://support.novell.com/security/cve/CVE-2012-3174.html http://support.novell.com/security/cve/CVE-2013-0422.html https://bugzilla.novell.com/792951 https://bugzilla.novell.com/798324 https://bugzilla.novell.com/798521

1 0

openSUSE-SU-2013:0193-1: moderate: Sccurity update for acroread
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: Sccurity update for acroread ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0193-1 Rating: moderate References: #757393 #768492 #797529 Cross-References: CVE-2012-1530 CVE-2013-0601 CVE-2013-0602 CVE-2013-0603 CVE-2013-0604 CVE-2013-0605 CVE-2013-0606 CVE-2013-0607 CVE-2013-0608 CVE-2013-0609 CVE-2013-0610 CVE-2013-0611 CVE-2013-0612 CVE-2013-0613 CVE-2013-0614 CVE-2013-0615 CVE-2013-0616 CVE-2013-0617 CVE-2013-0618 CVE-2013-0619 CVE-2013-0620 CVE-2013-0621 CVE-2013-0622 CVE-2013-0623 CVE-2013-0624 CVE-2013-0626 CVE-2013-0627 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: - Update to 9.5.3 (bnc#797529) to fix: CVE-2012-1530, CVE-2013-0601, CVE-2013-0602, CVE-2013-0603, CVE-2013-0604, CVE-2013-0605, CVE-2013-0606, CVE-2013-0607, CVE-2013-0608, CVE-2013-0609, CVE-2013-0610, CVE-2013-0611, CVE-2013-0612, CVE-2013-0613, CVE-2013-0614, CVE-2013-0615, CVE-2013-0616, CVE-2013-0617, CVE-2013-0618, CVE-2013-0619, CVE-2013-0620, CVE-2013-0621, CVE-2013-0622, CVE-2013-0623, CVE-2013-0624, CVE-2013-0626, CVE-2013-0627 - move the browser plugin to a subpackage(bnc#768492, bnc#757393). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-8 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586): acroread-9.5.3-10.1 acroread-browser-plugin-9.5.3-10.1 References: http://support.novell.com/security/cve/CVE-2012-1530.html http://support.novell.com/security/cve/CVE-2013-0601.html http://support.novell.com/security/cve/CVE-2013-0602.html http://support.novell.com/security/cve/CVE-2013-0603.html http://support.novell.com/security/cve/CVE-2013-0604.html http://support.novell.com/security/cve/CVE-2013-0605.html http://support.novell.com/security/cve/CVE-2013-0606.html http://support.novell.com/security/cve/CVE-2013-0607.html http://support.novell.com/security/cve/CVE-2013-0608.html http://support.novell.com/security/cve/CVE-2013-0609.html http://support.novell.com/security/cve/CVE-2013-0610.html http://support.novell.com/security/cve/CVE-2013-0611.html http://support.novell.com/security/cve/CVE-2013-0612.html http://support.novell.com/security/cve/CVE-2013-0613.html http://support.novell.com/security/cve/CVE-2013-0614.html http://support.novell.com/security/cve/CVE-2013-0615.html http://support.novell.com/security/cve/CVE-2013-0616.html http://support.novell.com/security/cve/CVE-2013-0617.html http://support.novell.com/security/cve/CVE-2013-0618.html http://support.novell.com/security/cve/CVE-2013-0619.html http://support.novell.com/security/cve/CVE-2013-0620.html http://support.novell.com/security/cve/CVE-2013-0621.html http://support.novell.com/security/cve/CVE-2013-0622.html http://support.novell.com/security/cve/CVE-2013-0623.html http://support.novell.com/security/cve/CVE-2013-0624.html http://support.novell.com/security/cve/CVE-2013-0626.html http://support.novell.com/security/cve/CVE-2013-0627.html https://bugzilla.novell.com/757393 https://bugzilla.novell.com/768492 https://bugzilla.novell.com/797529

1 0

openSUSE-SU-2013:0192-1: moderate: libtcnative-1-0 and tomcat6
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: libtcnative-1-0 and tomcat6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0192-1 Rating: moderate References: #794548 Cross-References: CVE-2012-4431 CVE-2012-4534 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: - fix bnc#794548 - denial of service (CVE-2012-4534) * apache-tomcat-CVE-2012-4534.patch fixes apache#53138, apache#52858 http://svn.apache.org/viewvc?view=rev&rev=1372035 - fix a minor issue in apache-tomcat-CVE-2012-4431.patch use the already initialized session variable instead of an another call req.getSesssion() Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-11 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): tomcat6-6.0.32-38.1 tomcat6-admin-webapps-6.0.32-38.1 tomcat6-docs-webapp-6.0.32-38.1 tomcat6-el-1_0-api-6.0.32-38.1 tomcat6-javadoc-6.0.32-38.1 tomcat6-jsp-2_1-api-6.0.32-38.1 tomcat6-lib-6.0.32-38.1 tomcat6-servlet-2_5-api-6.0.32-38.1 tomcat6-webapps-6.0.32-38.1 References: http://support.novell.com/security/cve/CVE-2012-4431.html http://support.novell.com/security/cve/CVE-2012-4534.html https://bugzilla.novell.com/794548

1 0

openSUSE-SU-2013:0191-1: moderate: freeradius-server
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: freeradius-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0191-1 Rating: moderate References: #797292 #797313 Cross-References: CVE-2011-4966 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: - fix for CVE-2011-4966 (bnc#797313) (freeradius-server-CVE-2011-4966.patch) - fixed a bug in the logrotate script (bnc#797292) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-9 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): freeradius-server-2.1.10-16.1 freeradius-server-debuginfo-2.1.10-16.1 freeradius-server-debugsource-2.1.10-16.1 freeradius-server-devel-2.1.10-16.1 freeradius-server-dialupadmin-2.1.10-16.1 freeradius-server-doc-2.1.10-16.1 freeradius-server-libs-2.1.10-16.1 freeradius-server-libs-debuginfo-2.1.10-16.1 freeradius-server-utils-2.1.10-16.1 freeradius-server-utils-debuginfo-2.1.10-16.1 References: http://support.novell.com/security/cve/CVE-2011-4966.html https://bugzilla.novell.com/797292 https://bugzilla.novell.com/797313

1 0

openSUSE-SU-2013:0189-1: moderate: update for freetype2
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: update for freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0189-1 Rating: moderate References: Cross-References: CVE-2012-5668 CVE-2012-5669 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: - new license string. - BNC#795826, CVE-2012-5668.patch - BNC#795826, CVE-2012-5669.patch [bdf] Fix Savannah bug #37906. * src/bdf/bdflib.c (_bdf_parse_glyphs): Use correct array size for checking `glyph_enc'. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-12 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): freetype2-debugsource-2.4.4-7.27.1 freetype2-devel-2.4.4-7.27.1 libfreetype6-2.4.4-7.27.1 libfreetype6-debuginfo-2.4.4-7.27.1 - openSUSE 11.4 (x86_64): freetype2-devel-32bit-2.4.4-7.27.1 libfreetype6-32bit-2.4.4-7.27.1 libfreetype6-debuginfo-32bit-2.4.4-7.27.1 - openSUSE 11.4 (ia64): libfreetype6-debuginfo-x86-2.4.4-7.27.1 libfreetype6-x86-2.4.4-7.27.1 References: http://support.novell.com/security/cve/CVE-2012-5668.html http://support.novell.com/security/cve/CVE-2012-5669.html

1 0

openSUSE-SU-2013:0188-1: moderate: update for nagios
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: update for nagios ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0188-1 Rating: moderate References: #797237 Cross-References: CVE-2012-6096 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - avoid stack based buffer overflow in web interface (history): added nagios-history_buffer_overflow.patch - (bnc#797237) fixes CVE-2012-6096 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-13 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): nagios-3.2.3-3.18.1 nagios-debuginfo-3.2.3-3.18.1 nagios-debugsource-3.2.3-3.18.1 nagios-devel-3.2.3-3.18.1 nagios-www-3.2.3-3.18.1 References: http://support.novell.com/security/cve/CVE-2012-6096.html https://bugzilla.novell.com/797237

1 0

openSUSE-SU-2013:0187-1: moderate: tiff
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0187-1 Rating: moderate References: #781995 #787892 #791607 Cross-References: CVE-2012-4447 CVE-2012-4564 CVE-2012-5581 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Tiff package was updates fixing following security issues: * CVE-2012-4447 * CVE-2012-4564 * CVE-2012-5581 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-14 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libtiff-devel-3.9.4-34.1 libtiff3-3.9.4-34.1 libtiff3-debuginfo-3.9.4-34.1 tiff-3.9.4-34.1 tiff-debuginfo-3.9.4-34.1 tiff-debugsource-3.9.4-34.1 - openSUSE 11.4 (x86_64): libtiff-devel-32bit-3.9.4-34.1 libtiff3-32bit-3.9.4-34.1 libtiff3-debuginfo-32bit-3.9.4-34.1 - openSUSE 11.4 (ia64): libtiff3-debuginfo-x86-3.9.4-34.1 libtiff3-x86-3.9.4-34.1 References: http://support.novell.com/security/cve/CVE-2012-4447.html http://support.novell.com/security/cve/CVE-2012-4564.html http://support.novell.com/security/cve/CVE-2012-5581.html https://bugzilla.novell.com/781995 https://bugzilla.novell.com/787892 https://bugzilla.novell.com/791607

1 0

openSUSE-SU-2013:0186-1: moderate: squid3
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: squid3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0186-1 Rating: moderate References: #794954 Cross-References: CVE-2012-5643 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: fix for bnc#794954, CVE-2012-5643, SQUID:2012-1 - Additional fixes for CVE-2012-5643 / SQUID:2012-1 * http://www.squid-cache.org/Advisories/SQUID-2012_1.txt * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5643 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-10 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): squid3-3.1.23-15.1 squid3-debuginfo-3.1.23-15.1 squid3-debugsource-3.1.23-15.1 References: http://support.novell.com/security/cve/CVE-2012-5643.html https://bugzilla.novell.com/794954

1 0

openSUSE-RU-2013:0183-1: important: xorg-x11-server: fix mouse pointer jumping to edge of screen inside virtual machines
by maintenance＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Recommended Update: xorg-x11-server: fix mouse pointer jumping to edge of screen inside virtual machines ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0183-1 Rating: important References: #776385 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for xorg-x11-server: - bnc#776385: The mouse pointer keeps jumping to upper left corner in the GNOME desktop which causes the 'Activities' menu to show up. This happens in virtual machines hosted on Xen, Hyper-V and VirtualBox. It will most likely also happen in other desktop enviroments and in a virtual machine hosted on KVM. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-20 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): xorg-x11-Xvnc-7.6_1.12.3-1.21.1 xorg-x11-Xvnc-debuginfo-7.6_1.12.3-1.21.1 xorg-x11-server-7.6_1.12.3-1.21.1 xorg-x11-server-debuginfo-7.6_1.12.3-1.21.1 xorg-x11-server-debugsource-7.6_1.12.3-1.21.1 xorg-x11-server-extra-7.6_1.12.3-1.21.1 xorg-x11-server-extra-debuginfo-7.6_1.12.3-1.21.1 xorg-x11-server-sdk-7.6_1.12.3-1.21.1 References: https://bugzilla.novell.com/776385

1 0