January 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:0172-1: moderate: opera - security and bugfix update
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: opera - security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0172-1 Rating: moderate References: #795061 Affected Products: openSUSE 11.4/standard/i586/patchinfo.34 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: - Update to 12.12 * Fixes and Stability Enhancements - New option 'Delete settings and data for all extensions' option (off by default) in the Delete Private Data dialog - Corrected an issue where using the 'Delete Private Data' dialog could delete extension and settings data - Redesigned the 'Delete Private Data' dialog to be more usable with small screens - Fixed an issue where quitting Opera while in fullscreen mode could cripple the interface on the next start-up - Fixed an issue where malformed GIF images could allow execution of arbitrary code - Fixed an issue where repeated attempts to access a target site could trigger address field spoofing - Fixed an issue where private data could be disclosed to other computer users, or be modified by them * full changelog available at: http://www.opera.com/docs/changelogs/unix/1212 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4/standard/i586/patchinfo.34: zypper in -t patch 2012-23 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4/standard/i586/patchinfo.34 (i586 x86_64): opera-12.12-44.1 opera-gtk-12.12-44.1 opera-kde4-12.12-44.1 References: https://bugzilla.novell.com/795061

1 0

openSUSE-RU-2013:0171-1: moderate: malaga-suomi: Update dictionary for Finnish spell checking
by maintenance＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Recommended Update: malaga-suomi: Update dictionary for Finnish spell checking ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0171-1 Rating: moderate References: #795350 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for malaga-suomi: - bnc#795350: The new dictionary uses Voikko dictionary format 2 that is required by the current Voikko engine. It makes the Finnish voikko spell check working again. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-33 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (noarch): malaga-suomi-1.12-15.4.1 References: https://bugzilla.novell.com/795350

1 0

openSUSE-SU-2013:0170-1: moderate: update for tomcat
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: update for tomcat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0170-1 Rating: moderate References: #794548 Cross-References: CVE-2012-4534 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - fix bnc#794548 - denial of service (CVE-2012-4534) * tomcat-CVE-2012-4534.patch fixes apache#53138, apache#52858 http://svn.apache.org/viewvc?view=rev&rev=1340218 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-24 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (noarch): tomcat-7.0.27-2.13.1 tomcat-admin-webapps-7.0.27-2.13.1 tomcat-docs-webapp-7.0.27-2.13.1 tomcat-el-2_2-api-7.0.27-2.13.1 tomcat-javadoc-7.0.27-2.13.1 tomcat-jsp-2_2-api-7.0.27-2.13.1 tomcat-jsvc-7.0.27-2.13.1 tomcat-lib-7.0.27-2.13.1 tomcat-servlet-3_0-api-7.0.27-2.13.1 tomcat-webapps-7.0.27-2.13.1 References: http://support.novell.com/security/cve/CVE-2012-4534.html https://bugzilla.novell.com/794548

1 0

openSUSE-SU-2013:0169-1: moderate: update for icinga
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: update for icinga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0169-1 Rating: moderate References: #797237 Cross-References: CVE-2012-6096 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - imported upstream version 1.7.4 - bnc#797237 * core: add fix for CVE-2012-6096 - history.cgi remote command execution (Eric Stanley, Markus Frosch) #3532 - MF * core: fix embedded perl segfault #3027 - MF * core: fix duplicated events on check scheduling logic for new events (Andreas Ericsson) #2676 #2993 - MF * core: avoid duplicate events when scheduling forced host|service check (Imri Zvik) #2993 - MF * core: get rid of the instame macro usage while logging alerts and states (Andreas Ericsson) #2665 - MF * core: revamp the detection of embedded perl usage directive "# icinga: +epn" (Andreas Ericsson) #2197 - MF * core: fix whitespaces are not stripped using multiple templates ("use abc, def, ghi") #2701 - MF * core: add hint on icinga.cfg package location, and tip to read Changelog CHANGES on upgrades #2879 - MF * core: bail out early with config error if resource.cfg macros contain NULL values #2879 - MF * core: fix logical bug on icinga.cfg detection on config read #2879 - MF * core: fsync() files before fclose() (Andreas Ericsson) #2948 - MF * core: remove weird switch() statement when scanning checkresult queue (Andreas Ericsson) #2950 - MF * core: fix deleting too old check result files (Andreas Ericsson) #2951 - MF * idoutils: fix IDOUtils on PostgreSQL, recreates service objects in icinga_objects (thx Torsten Fohrer) #3166 - MF * idoutils: fix icinga mysql db creation script grants access to all dbs #2917 - MF * idoutils: fix ignoring mysql password in create_mysqldb.sh #2994 - MF - removed obsolete patches Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-45 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): icinga-1.7.4-3.12.1 icinga-debuginfo-1.7.4-3.12.1 icinga-debugsource-1.7.4-3.12.1 icinga-devel-1.7.4-3.12.1 icinga-doc-1.7.4-3.12.1 icinga-idoutils-1.7.4-3.12.1 icinga-idoutils-debuginfo-1.7.4-3.12.1 icinga-idoutils-mysql-1.7.4-3.12.1 icinga-idoutils-oracle-1.7.4-3.12.1 icinga-idoutils-pgsql-1.7.4-3.12.1 icinga-plugins-downtimes-1.7.4-3.12.1 icinga-plugins-eventhandlers-1.7.4-3.12.1 icinga-www-1.7.4-3.12.1 icinga-www-debuginfo-1.7.4-3.12.1 References: http://support.novell.com/security/cve/CVE-2012-6096.html https://bugzilla.novell.com/797237

1 0

openSUSE-SU-2013:0168-1: moderate: flash-player
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0168-1 Rating: moderate References: #797442:flashplayer Cross-References: CVE-2013-0630 Affected Products: openSUSE 11.4/standard/i586/patchinfo.41 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Update to 11.2.202.261: (bnc#797442) * CVE-2013-0630 More details can be found on https://www.adobe.com/support/security/bulletins/apsb13-01.h tml Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4/standard/i586/patchinfo.41: zypper in -t patch 2013-5 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4/standard/i586/patchinfo.41 (i586 x86_64): flash-player-11.2.202.261-39.1 flash-player-gnome-11.2.202.261-39.1 flash-player-kde4-11.2.202.261-39.1 References: http://support.novell.com/security/cve/CVE-2013-0630.html https://bugzilla.novell.com/797442:flashplayer

1 0

openSUSE-RU-2013:0167-1: moderate: update to Firefox 17.0.1
by maintenance＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Recommended Update: update to Firefox 17.0.1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0167-1 Rating: moderate References: Affected Products: openSUSE 11.4/standard/i586/patchinfo.25 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: - update to Firefox 17.0.1 * revert some useragent changes introduced in 17.0 * leaving private browsing with social enabled doesn't reset all social components (bmo#815042) - fix KDE integration for file dialogs Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4/standard/i586/patchinfo.25: zypper in -t patch 2012-11 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4/standard/i586/patchinfo.25 (i586 x86_64): MozillaFirefox-17.0.1-53.1 MozillaFirefox-branding-upstream-17.0.1-53.1 MozillaFirefox-buildsymbols-17.0.1-53.1 MozillaFirefox-debuginfo-17.0.1-53.1 MozillaFirefox-debugsource-17.0.1-53.1 MozillaFirefox-devel-17.0.1-53.1 MozillaFirefox-translations-common-17.0.1-53.1 MozillaFirefox-translations-other-17.0.1-53.1 References:

1 0

openSUSE-SU-2013:0166-1: important: update for bogofilter
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: update for bogofilter ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0166-1 Rating: important References: #792939 Cross-References: CVE-2010-2494 Affected Products: openSUSE 11.4/standard/i586/patchinfo.28 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Update to version 1.2.3. * Update configure.ac to avoid autoconf 2.68 warnings, by (a) quoting the first AC_RUN_IFELSE argument, an AC_LANG_PROGRAM(), with [ ], and (b) providing an explicit "true" assumption for Berkeley DB capabilities to avoid cross-compilation warnings. * Security bugfix; (bnc#792939), Fix a heap corruption in base64 decoder on invalid input. http://bogofilter.sourceforge.net/security/bogofilter-SA-201 2-01 * Added bogofilter-faq-bg.html, a Bulgarian translation of the FAQ. * Mark "Berkeley DB 5.1.19: (August 27, 2010)" supported. - Update to version 1.2.2. * Use a better PRNG for random sleeps. That is arc4random() where available, and drand48() elsewhere. * Assorted fixes for issues found with clang analyzer: + Fix a potential NULL deference + Fix a potential division by zero + Remove dead assignments and increments * Update Doxyfile and source contrib/bogogrep.c for docs, too. * Security bugfix, CVE-2010-2494: Fix a heap corruption in base64 decoder on invalid input. Analysis and patch by Julius Plenz <plenz(a)cis.fu-berlin.de>. Please see doc/bogofilter-SA-2010-01 for details. * Updated sendmail milter contrib/bogofilter-milter.pl to v1.?????? * Bump supported/minimum SQLite3 versions and warning threshold. See doc/README.sqlite for details. * Mark BerkeleyDB 4.8.26 and 5.0.21 supported. * Make t.maint more robust; ignore .ENCODING token. To fix test failures on, for instance, FreeBSD with unicode enabled. * Fix several compiler warnings "array subscript has type 'char'", by casting the arguments to unsigned char. * Split error messages for ENOENT and EINVAL into new function. * Avoid divison by zero in robx computation by checking if there are at least one ham message and one spam message registered. * contrib/spamitarium.pl updated to version 0.4.0 * Updated and integrated Ted Phelps's "Patch to prevent .ENCODING from being discarded by bogoutil -m" (SourceForge Patch #1743984). - remove call to suse_update_config (very old work around) - Remove redundant tags/sections from specfile - Use %_smp_mflags for parallel build Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4/standard/i586/patchinfo.28: zypper in -t patch 2012-21 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4/standard/i586/patchinfo.28 (i586 x86_64): bogofilter-1.2.3-12.1 bogofilter-debuginfo-1.2.3-12.1 bogofilter-debugsource-1.2.3-12.1 References: http://support.novell.com/security/cve/CVE-2010-2494.html https://bugzilla.novell.com/792939

1 0

openSUSE-SU-2013:0165-1: moderate: update for freetype2
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: update for freetype2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0165-1 Rating: moderate References: Cross-References: CVE-2012-5668 CVE-2012-5669 CVE-2012-5670 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: - BNC#795826, CVE-2012-5668.patch [bdf] Fix Savannah bug #37905. * src/bdf/bdflib.c (_bdf_parse_start): Reset `props_size' to zero in case of allocation error; this value gets used in a loop in - BNC#795826, CVE-2012-5669.patch [bdf] Fix Savannah bug #37906. * src/bdf/bdflib.c (_bdf_parse_glyphs): Use correct array size for checking `glyph_enc'. - BNC#795826, CVE-2012-5670.patch [bdf] Fix Savannah bug #37907. * src/bdf/bdflib.c (_bdf_parse_glyphs) <ENCODING>: Normalize negative second parameter of `ENCODING' field also. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-44 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): freetype2-debugsource-2.4.9-4.4.1 freetype2-devel-2.4.9-4.4.1 ft2demos-2.4.9-4.4.1 ft2demos-debuginfo-2.4.9-4.4.1 ft2demos-debugsource-2.4.9-4.4.1 libfreetype6-2.4.9-4.4.1 libfreetype6-debuginfo-2.4.9-4.4.1 - openSUSE 12.2 (x86_64): freetype2-devel-32bit-2.4.9-4.4.1 libfreetype6-32bit-2.4.9-4.4.1 libfreetype6-debuginfo-32bit-2.4.9-4.4.1 References: http://support.novell.com/security/cve/CVE-2012-5668.html http://support.novell.com/security/cve/CVE-2012-5669.html http://support.novell.com/security/cve/CVE-2012-5670.html

1 0

openSUSE-RU-2013:0164-1: ruby19: Fixes stack boundary issues when embedding ruby into threaded C code
by maintenance＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Recommended Update: ruby19: Fixes stack boundary issues when embedding ruby into threaded C code ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0164-1 Rating: low References: #796757 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Thsi udpate fixes the following issue for ruby19: - bnc#796757: Fixes stack boundary issues when embedding Ruby into threaded C code (Ruby bug #2294) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-21 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): ruby19-1.9.3.p194-3.8.1 ruby19-debuginfo-1.9.3.p194-3.8.1 ruby19-debugsource-1.9.3.p194-3.8.1 ruby19-devel-1.9.3.p194-3.8.1 ruby19-tk-1.9.3.p194-3.8.1 ruby19-tk-debuginfo-1.9.3.p194-3.8.1 - openSUSE 12.2 (noarch): ruby19-doc-ri-1.9.3.p194-3.8.1 References: https://bugzilla.novell.com/796757

1 0

openSUSE-RU-2013:0163-1: moderate: systemd: Two bugfixes
by maintenance＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Recommended Update: systemd: Two bugfixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0163-1 Rating: moderate References: #787424 #796525 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues for systemd: - bnc#796525: Restart journal when updating from release without fix-forward-to-journal.patch included - bnc#787424: fix crash when using kill-session or kill-user Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-9 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): systemd-44-10.8.1 systemd-analyze-44-10.8.1 systemd-debuginfo-44-10.8.1 systemd-debugsource-44-10.8.1 systemd-devel-44-10.8.1 systemd-gtk-44-10.8.1 systemd-gtk-debuginfo-44-10.8.1 systemd-gtk-debugsource-44-10.8.1 systemd-sysvinit-44-10.8.1 - openSUSE 12.2 (x86_64): systemd-32bit-44-10.8.1 systemd-debuginfo-32bit-44-10.8.1 References: https://bugzilla.novell.com/787424 https://bugzilla.novell.com/796525

1 0