January 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:0162-1: moderate: update for squid3
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: update for squid3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0162-1 Rating: moderate References: #794954 Cross-References: CVE-2012-5643 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - update to 3.1.23 fix for bnc#794954, CVE-2012-5643, SQUID:2012-1 - Additional fixes for CVE-2012-5643 / SQUID:2012-1 * http://www.squid-cache.org/Advisories/SQUID-2012_1.txt * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5643 - removed 3.1.12 config, nobuilddates, swapdir patch - added FSF, config, nobuilddates, swapdir patch - added rpmlintrc, service file - rebase swapdir patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-43 - openSUSE 12.1: zypper in -t patch openSUSE-2013-43 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): squid3-3.1.23-2.4.1 squid3-debuginfo-3.1.23-2.4.1 squid3-debugsource-3.1.23-2.4.1 - openSUSE 12.1 (i586 x86_64): squid3-3.1.23-2.6.1 squid3-debuginfo-3.1.23-2.6.1 squid3-debugsource-3.1.23-2.6.1 References: http://support.novell.com/security/cve/CVE-2012-5643.html https://bugzilla.novell.com/794954

1 0

openSUSE-SU-2013:0161-1: moderate: update for tomcat6
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: update for tomcat6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0161-1 Rating: moderate References: #794548 Cross-References: CVE-2012-4431 CVE-2012-4534 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: - fix bnc#794548 - denial of service (CVE-2012-4534) * apache-tomcat-CVE-2012-4534.patch fixes apache#53138, apache#52858 http://svn.apache.org/viewvc?view=rev&rev=1372035 - fix a minor issue in apache-tomcat-CVE-2012-4431.patch use the already initialized session variable instead of an another call req.getSesssion() Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-23 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libtcnative-1-0-1.3.3-3.11.1 libtcnative-1-0-debuginfo-1.3.3-3.11.1 libtcnative-1-0-debugsource-1.3.3-3.11.1 libtcnative-1-0-devel-1.3.3-3.11.1 - openSUSE 12.1 (noarch): tomcat6-6.0.33-3.11.1 tomcat6-admin-webapps-6.0.33-3.11.1 tomcat6-docs-webapp-6.0.33-3.11.1 tomcat6-el-1_0-api-6.0.33-3.11.1 tomcat6-javadoc-6.0.33-3.11.1 tomcat6-jsp-2_1-api-6.0.33-3.11.1 tomcat6-lib-6.0.33-3.11.1 tomcat6-servlet-2_5-api-6.0.33-3.11.1 tomcat6-webapps-6.0.33-3.11.1 References: http://support.novell.com/security/cve/CVE-2012-4431.html http://support.novell.com/security/cve/CVE-2012-4534.html https://bugzilla.novell.com/794548

1 0

openSUSE-RU-2013:0160-1: obs-service-source_validator: several fixes
by maintenance＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Recommended Update: obs-service-source_validator: several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0160-1 Rating: low References: #724609 #796918 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This udpate fixes the following issues for obs-service-source_validator: - bnc#796918: exit if tmpdir creation fails - bnc#724609: ignore Requires(.*) lines - allow %{nil} just as %nil - use --nodeps with rpmbuild in 20-files-present-and-referenced Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-12 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (noarch): obs-service-source_validator-0.2-3.7.1 References: https://bugzilla.novell.com/724609 https://bugzilla.novell.com/796918

1 0

openSUSE-SU-2013:0159-1: gegl: fix PPM overflow
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: gegl: fix PPM overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0159-1 Rating: low References: #789835 Cross-References: CVE-2012-4433 Affected Products: openSUSE 11.4/standard/i586/patchinfo.26 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Fix integer overflow by parsing PPM image. (bnc#789835, CVE-2012-4433) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4/standard/i586/patchinfo.26: zypper in -t patch 2012-16 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4/standard/i586/patchinfo.26 (i586 x86_64): gegl-0.1.2-10.1 gegl-0_1-0.1.2-10.1 gegl-0_1-debuginfo-0.1.2-10.1 gegl-debuginfo-0.1.2-10.1 gegl-debugsource-0.1.2-10.1 gegl-devel-0.1.2-10.1 gegl-doc-0.1.2-10.1 libgegl-0_1-0-0.1.2-10.1 libgegl-0_1-0-debuginfo-0.1.2-10.1 References: http://support.novell.com/security/cve/CVE-2012-4433.html https://bugzilla.novell.com/789835

1 0

openSUSE-RU-2013:0158-1: osc-plugin-collab: Update to version 0.96
by maintenance＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Recommended Update: osc-plugin-collab: Update to version 0.96 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0158-1 Rating: low References: #797034 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Update to version 0.96 of osc-plugin-collab (bnc#797034): - Use new collab-server Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-19 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): osc-plugin-collab-0.96-2.4.1 References: https://bugzilla.novell.com/797034

1 0

openSUSE-SU-2013:0157-1: moderate: libqt4: security fixes for XMLHttpRequest redirect and ssl compression
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: libqt4: security fixes for XMLHttpRequest redirect and ssl compression ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0157-1 Rating: moderate References: #793194 Cross-References: CVE-2012-4929 CVE-2012-5624 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: libqt4 received security fixes for: - XMLHttpRequest could redirect to a file: URL (CVE-2012-5624, bnc#793194) - Disable SSL compression by default to mitigate CRIME attack (CVE-2012-4929) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-10 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libqt4-4.7.4-19.13.1 libqt4-debuginfo-4.7.4-19.13.1 libqt4-debugsource-4.7.4-19.13.1 libqt4-devel-4.7.4-19.13.1 libqt4-devel-debuginfo-4.7.4-19.13.1 libqt4-private-headers-devel-4.7.4-19.13.1 libqt4-qt3support-4.7.4-19.13.1 libqt4-qt3support-debuginfo-4.7.4-19.13.1 libqt4-sql-4.7.4-19.13.1 libqt4-sql-debuginfo-4.7.4-19.13.1 libqt4-sql-sqlite-4.7.4-19.13.1 libqt4-sql-sqlite-debuginfo-4.7.4-19.13.1 libqt4-x11-4.7.4-19.13.1 libqt4-x11-debuginfo-4.7.4-19.13.1 - openSUSE 12.1 (x86_64): libqt4-32bit-4.7.4-19.13.1 libqt4-debuginfo-32bit-4.7.4-19.13.1 libqt4-qt3support-32bit-4.7.4-19.13.1 libqt4-qt3support-debuginfo-32bit-4.7.4-19.13.1 libqt4-sql-32bit-4.7.4-19.13.1 libqt4-sql-debuginfo-32bit-4.7.4-19.13.1 libqt4-sql-sqlite-32bit-4.7.4-19.13.1 libqt4-sql-sqlite-debuginfo-32bit-4.7.4-19.13.1 libqt4-x11-32bit-4.7.4-19.13.1 libqt4-x11-debuginfo-32bit-4.7.4-19.13.1 - openSUSE 12.1 (ia64): libqt4-debuginfo-x86-4.7.4-19.13.1 libqt4-qt3support-debuginfo-x86-4.7.4-19.13.1 libqt4-qt3support-x86-4.7.4-19.13.1 libqt4-sql-debuginfo-x86-4.7.4-19.13.1 libqt4-sql-sqlite-debuginfo-x86-4.7.4-19.13.1 libqt4-sql-sqlite-x86-4.7.4-19.13.1 libqt4-sql-x86-4.7.4-19.13.1 libqt4-x11-debuginfo-x86-4.7.4-19.13.1 libqt4-x11-x86-4.7.4-19.13.1 libqt4-x86-4.7.4-19.13.1 References: http://support.novell.com/security/cve/CVE-2012-4929.html http://support.novell.com/security/cve/CVE-2012-5624.html https://bugzilla.novell.com/793194

1 0

openSUSE-SU-2013:0156-1: important: mariadb to 5.1.66
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: mariadb to 5.1.66 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0156-1 Rating: important References: #779476 #792444 Cross-References: CVE-2012-4414 CVE-2012-5611 Affected Products: openSUSE 11.4/standard/i586/patchinfo.37 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: MariaDB was updated to 5.1.66: https://kb.askmonty.org/en/mariadb-5166-release-notes/ https://kb.askmonty.org/en/mariadb-5166-changelog/ Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4/standard/i586/patchinfo.37: zypper in -t patch 2013-2 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4/standard/i586/patchinfo.37 (i586 x86_64): libmariadbclient16-5.1.66-42.1 libmariadbclient16-debuginfo-5.1.66-42.1 libmariadbclient_r16-5.1.66-42.1 libmariadbclient_r16-debuginfo-5.1.66-42.1 mariadb-5.1.66-42.1 mariadb-bench-5.1.66-42.1 mariadb-bench-debuginfo-5.1.66-42.1 mariadb-client-5.1.66-42.1 mariadb-client-debuginfo-5.1.66-42.1 mariadb-debug-5.1.66-42.1 mariadb-debug-debuginfo-5.1.66-42.1 mariadb-debuginfo-5.1.66-42.1 mariadb-debugsource-5.1.66-42.1 mariadb-test-5.1.66-42.1 mariadb-test-debuginfo-5.1.66-42.1 mariadb-tools-5.1.66-42.1 mariadb-tools-debuginfo-5.1.66-42.1 References: http://support.novell.com/security/cve/CVE-2012-4414.html http://support.novell.com/security/cve/CVE-2012-5611.html https://bugzilla.novell.com/779476 https://bugzilla.novell.com/792444

1 0

openSUSE-SU-2013:0155-1: important: update for libotr
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: update for libotr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0155-1 Rating: important References: #789190 Cross-References: CVE-2012-3461 Affected Products: openSUSE 11.4/standard/i586/patchinfo.12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of libotr fixed multiple buffer overflows. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4/standard/i586/patchinfo.12: zypper in -t patch 2012-8 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4/standard/i586/patchinfo.12 (i586 x86_64): libotr-debugsource-3.2.1-11.1 libotr-devel-3.2.1-11.1 libotr-tools-3.2.1-11.1 libotr-tools-debuginfo-3.2.1-11.1 libotr2-3.2.1-11.1 libotr2-debuginfo-3.2.1-11.1 References: http://support.novell.com/security/cve/CVE-2012-3461.html https://bugzilla.novell.com/789190

1 0

openSUSE-SU-2013:0154-1: moderate: libqt4: fixed XMLHttpRequest redirect to file:
by opensuse-security＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Security Update: libqt4: fixed XMLHttpRequest redirect to file: ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0154-1 Rating: moderate References: #793194 Cross-References: CVE-2012-5624 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libqt4 received a fix for a security issue: - avoid redirect to file url scheme in XMLHttpRequests (bnc#793194, CVE-2012-5624) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-11 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libqt4-4.8.1-2.8.1 libqt4-debuginfo-4.8.1-2.8.1 libqt4-debugsource-4.8.1-2.8.1 libqt4-devel-4.8.1-2.8.1 libqt4-devel-debuginfo-4.8.1-2.8.1 libqt4-devel-doc-4.8.1-2.8.2 libqt4-devel-doc-debuginfo-4.8.1-2.8.2 libqt4-devel-doc-debugsource-4.8.1-2.8.2 libqt4-private-headers-devel-4.8.1-2.8.1 libqt4-qt3support-4.8.1-2.8.1 libqt4-qt3support-debuginfo-4.8.1-2.8.1 libqt4-sql-4.8.1-2.8.1 libqt4-sql-debuginfo-4.8.1-2.8.1 libqt4-sql-mysql-4.8.1-2.8.1 libqt4-sql-mysql-debuginfo-4.8.1-2.8.1 libqt4-sql-plugins-debugsource-4.8.1-2.8.1 libqt4-sql-postgresql-4.8.1-2.8.1 libqt4-sql-postgresql-debuginfo-4.8.1-2.8.1 libqt4-sql-sqlite-4.8.1-2.8.1 libqt4-sql-sqlite-debuginfo-4.8.1-2.8.1 libqt4-sql-unixODBC-4.8.1-2.8.1 libqt4-sql-unixODBC-debuginfo-4.8.1-2.8.1 libqt4-x11-4.8.1-2.8.1 libqt4-x11-debuginfo-4.8.1-2.8.1 qt4-x11-tools-4.8.1-2.8.2 qt4-x11-tools-debuginfo-4.8.1-2.8.2 - openSUSE 12.2 (x86_64): libqt4-32bit-4.8.1-2.8.1 libqt4-debuginfo-32bit-4.8.1-2.8.1 libqt4-qt3support-32bit-4.8.1-2.8.1 libqt4-qt3support-debuginfo-32bit-4.8.1-2.8.1 libqt4-sql-32bit-4.8.1-2.8.1 libqt4-sql-debuginfo-32bit-4.8.1-2.8.1 libqt4-sql-mysql-32bit-4.8.1-2.8.1 libqt4-sql-mysql-debuginfo-32bit-4.8.1-2.8.1 libqt4-sql-postgresql-32bit-4.8.1-2.8.1 libqt4-sql-postgresql-debuginfo-32bit-4.8.1-2.8.1 libqt4-sql-sqlite-32bit-4.8.1-2.8.1 libqt4-sql-sqlite-debuginfo-32bit-4.8.1-2.8.1 libqt4-sql-unixODBC-32bit-4.8.1-2.8.1 libqt4-sql-unixODBC-debuginfo-32bit-4.8.1-2.8.1 libqt4-x11-32bit-4.8.1-2.8.1 libqt4-x11-debuginfo-32bit-4.8.1-2.8.1 - openSUSE 12.2 (noarch): libqt4-devel-doc-data-4.8.1-2.8.2 References: http://support.novell.com/security/cve/CVE-2012-5624.html https://bugzilla.novell.com/793194

1 0

openSUSE-RU-2013:0153-1: postgres - bugfix update
by maintenance＠opensuse.org 23 Jan '13

23 Jan '13

openSUSE Recommended Update: postgres - bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0153-1 Rating: low References: #794766 Affected Products: openSUSE 11.4/standard/i586/patchinfo.33 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This release fixes a significant page ordering issue with Hot Standby which could cause index corruption on the standby under some circumstances. In addition, this update patches timing issues with checkpoint and transaction ID wraparound which could cause data corruption in some cases. This update also fixes multiple issues with CREATE INDEX CONCURRENTLY and DROP INDEX CONCURRENTLY, which can cause those commands to fail or produce corrupt indexes. Users who use this feature may want to REINDEX or recreate affected indexes Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4/standard/i586/patchinfo.33: zypper in -t patch 2013-7 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4/standard/i586/patchinfo.33 (i586 x86_64): libecpg6-9.0.11-21.1 libecpg6-debuginfo-9.0.11-21.1 libpq5-9.0.11-21.1 libpq5-debuginfo-9.0.11-21.1 postgresql-9.0.11-21.1 postgresql-contrib-9.0.11-21.1 postgresql-contrib-debuginfo-9.0.11-21.1 postgresql-debuginfo-9.0.11-21.1 postgresql-debugsource-9.0.11-21.1 postgresql-devel-9.0.11-21.1 postgresql-devel-debuginfo-9.0.11-21.1 postgresql-libs-debugsource-9.0.11-21.1 postgresql-plperl-9.0.11-21.1 postgresql-plperl-debuginfo-9.0.11-21.1 postgresql-plpython-9.0.11-21.1 postgresql-plpython-debuginfo-9.0.11-21.1 postgresql-pltcl-9.0.11-21.1 postgresql-pltcl-debuginfo-9.0.11-21.1 postgresql-server-9.0.11-21.1 postgresql-server-debuginfo-9.0.11-21.1 - openSUSE 11.4/standard/i586/patchinfo.33 (x86_64): libpq5-32bit-9.0.11-21.1 libpq5-debuginfo-32bit-9.0.11-21.1 - openSUSE 11.4/standard/i586/patchinfo.33 (noarch): postgresql-docs-9.0.11-21.1 - openSUSE 11.4/standard/i586/patchinfo.33 (ia64): libpq5-debuginfo-x86-9.0.11-21.1 libpq5-x86-9.0.11-21.1 References: https://bugzilla.novell.com/794766

1 0