October 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1619-1: moderate: kernel: security and bugfix update to 3.4.63
by opensuse-security＠opensuse.org 31 Oct '13

31 Oct '13

openSUSE Security Update: kernel: security and bugfix update to 3.4.63 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1619-1 Rating: moderate References: #783858 #785542 #787649 #789598 #794988 #801178 #806976 #807153 #807471 #814336 #815320 #817377 #818053 #821560 #821612 #822575 #823342 #823517 #824171 #824295 #827749 #827750 #828119 #828714 #831055 #831058 #833321 #835414 #838346 Cross-References: CVE-2013-0231 CVE-2013-1774 CVE-2013-1819 CVE-2013-2148 CVE-2013-2164 CVE-2013-2232 CVE-2013-2234 CVE-2013-2237 CVE-2013-2850 CVE-2013-2851 CVE-2013-4162 CVE-2013-4163 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has 17 fixes is now available. Description: The Linux kernel was updated to 3.4.63, fixing various bugs and security issues. - Linux 3.4.59 (CVE-2013-2237 bnc#828119). - Linux 3.4.57 (CVE-2013-2148 bnc#823517). - Linux 3.4.55 (CVE-2013-2232 CVE-2013-2234 CVE-2013-4162 CVE-2013-4163 bnc#827749 bnc#827750 bnc#831055 bnc#831058). - Drivers: hv: util: Fix a bug in util version negotiation code (bnc#838346). - vmxnet3: prevent div-by-zero panic when ring resizing uninitialized dev (bnc#833321). - bnx2x: protect different statistics flows (bnc#814336). - bnx2x: Avoid sending multiple statistics queries (bnc#814336). - Drivers: hv: util: Fix a bug in version negotiation code for util services (bnc#828714). - Update Xen patches to 3.4.53. - netfront: fix kABI after "reduce gso_max_size to account for max TCP header". - netback: don't disconnect frontend when seeing oversize packet (bnc#823342). - netfront: reduce gso_max_size to account for max TCP header. - backends: Check for insane amounts of requests on the ring. - reiserfs: Fixed double unlock in reiserfs_setattr failure path. - reiserfs: locking, release lock around quota operations (bnc#815320). - reiserfs: locking, handle nested locks properly (bnc#815320). - reiserfs: locking, push write lock out of xattr code (bnc#815320). - ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size (bnc#831055, CVE-2013-4163). - af_key: fix info leaks in notify messages (bnc#827749 CVE-2013-2234). - af_key: initialize satype in key_notify_policy_flush() (bnc#828119 CVE-2013-2237). - ipv6: call udp_push_pending_frames when uncorking a socket with (bnc#831058, CVE-2013-4162). - ipv6: ip6_sk_dst_check() must not assume ipv6 dst. - xfs: fix _xfs_buf_find oops on blocks beyond the filesystem end (CVE-2013-1819 bnc#807471). - brcmsmac: don't start device when RfKill is engaged (bnc#787649). - CIFS: Protect i_nlink from being negative (bnc#785542 bnc#789598). - cifs: don't compare uniqueids in cifs_prime_dcache unless server inode numbers are in use (bnc#794988). - xfs: xfs: fallback to vmalloc for large buffers in xfs_compat_attrlist_by_handle (bnc#818053 bnc#807153). - xfs: fallback to vmalloc for large buffers in xfs_attrlist_by_handle (bnc#818053 bnc#807153). - Linux 3.4.53 (CVE-2013-2164 CVE-2013-2851 bnc#822575 bnc#824295). - drivers/cdrom/cdrom.c: use kzalloc() for failing hardware (bnc#824295, CVE-2013-2164). - fanotify: info leak in copy_event_to_user() (CVE-2013-2148 bnc#823517). - block: do not pass disk names as format strings (bnc#822575 CVE-2013-2851). - ext4: avoid hang when mounting non-journal filesystems with orphan list (bnc#817377). - Linux 3.4.49 (CVE-2013-0231 XSA-43 bnc#801178). - Linux 3.4.48 (CVE-2013-1774 CVE-2013-2850 bnc#806976 bnc#821560). - Always include the git commit in KOTD builds This allows us not to set it explicitly in builds submitted to the official distribution (bnc#821612, bnc#824171). - Bluetooth: Really fix registering hci with duplicate name (bnc#783858). - Bluetooth: Fix registering hci with duplicate name (bnc#783858). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-813 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): kernel-default-3.4.63-2.44.1 kernel-default-base-3.4.63-2.44.1 kernel-default-base-debuginfo-3.4.63-2.44.1 kernel-default-debuginfo-3.4.63-2.44.1 kernel-default-debugsource-3.4.63-2.44.1 kernel-default-devel-3.4.63-2.44.1 kernel-default-devel-debuginfo-3.4.63-2.44.1 kernel-syms-3.4.63-2.44.1 - openSUSE 12.2 (i686 x86_64): kernel-debug-3.4.63-2.44.1 kernel-debug-base-3.4.63-2.44.1 kernel-debug-base-debuginfo-3.4.63-2.44.1 kernel-debug-debuginfo-3.4.63-2.44.1 kernel-debug-debugsource-3.4.63-2.44.1 kernel-debug-devel-3.4.63-2.44.1 kernel-debug-devel-debuginfo-3.4.63-2.44.1 kernel-desktop-3.4.63-2.44.1 kernel-desktop-base-3.4.63-2.44.1 kernel-desktop-base-debuginfo-3.4.63-2.44.1 kernel-desktop-debuginfo-3.4.63-2.44.1 kernel-desktop-debugsource-3.4.63-2.44.1 kernel-desktop-devel-3.4.63-2.44.1 kernel-desktop-devel-debuginfo-3.4.63-2.44.1 kernel-ec2-3.4.63-2.44.1 kernel-ec2-base-3.4.63-2.44.1 kernel-ec2-base-debuginfo-3.4.63-2.44.1 kernel-ec2-debuginfo-3.4.63-2.44.1 kernel-ec2-debugsource-3.4.63-2.44.1 kernel-ec2-devel-3.4.63-2.44.1 kernel-ec2-devel-debuginfo-3.4.63-2.44.1 kernel-ec2-extra-3.4.63-2.44.1 kernel-ec2-extra-debuginfo-3.4.63-2.44.1 kernel-trace-3.4.63-2.44.1 kernel-trace-base-3.4.63-2.44.1 kernel-trace-base-debuginfo-3.4.63-2.44.1 kernel-trace-debuginfo-3.4.63-2.44.1 kernel-trace-debugsource-3.4.63-2.44.1 kernel-trace-devel-3.4.63-2.44.1 kernel-trace-devel-debuginfo-3.4.63-2.44.1 kernel-vanilla-3.4.63-2.44.1 kernel-vanilla-debuginfo-3.4.63-2.44.1 kernel-vanilla-debugsource-3.4.63-2.44.1 kernel-vanilla-devel-3.4.63-2.44.1 kernel-vanilla-devel-debuginfo-3.4.63-2.44.1 kernel-xen-3.4.63-2.44.1 kernel-xen-base-3.4.63-2.44.1 kernel-xen-base-debuginfo-3.4.63-2.44.1 kernel-xen-debuginfo-3.4.63-2.44.1 kernel-xen-debugsource-3.4.63-2.44.1 kernel-xen-devel-3.4.63-2.44.1 kernel-xen-devel-debuginfo-3.4.63-2.44.1 - openSUSE 12.2 (noarch): kernel-devel-3.4.63-2.44.1 kernel-docs-3.4.63-2.44.2 kernel-source-3.4.63-2.44.1 kernel-source-vanilla-3.4.63-2.44.1 - openSUSE 12.2 (i686): kernel-pae-3.4.63-2.44.1 kernel-pae-base-3.4.63-2.44.1 kernel-pae-base-debuginfo-3.4.63-2.44.1 kernel-pae-debuginfo-3.4.63-2.44.1 kernel-pae-debugsource-3.4.63-2.44.1 kernel-pae-devel-3.4.63-2.44.1 kernel-pae-devel-debuginfo-3.4.63-2.44.1 References: http://support.novell.com/security/cve/CVE-2013-0231.html http://support.novell.com/security/cve/CVE-2013-1774.html http://support.novell.com/security/cve/CVE-2013-1819.html http://support.novell.com/security/cve/CVE-2013-2148.html http://support.novell.com/security/cve/CVE-2013-2164.html http://support.novell.com/security/cve/CVE-2013-2232.html http://support.novell.com/security/cve/CVE-2013-2234.html http://support.novell.com/security/cve/CVE-2013-2237.html http://support.novell.com/security/cve/CVE-2013-2850.html http://support.novell.com/security/cve/CVE-2013-2851.html http://support.novell.com/security/cve/CVE-2013-4162.html http://support.novell.com/security/cve/CVE-2013-4163.html https://bugzilla.novell.com/783858 https://bugzilla.novell.com/785542 https://bugzilla.novell.com/787649 https://bugzilla.novell.com/789598 https://bugzilla.novell.com/794988 https://bugzilla.novell.com/801178 https://bugzilla.novell.com/806976 https://bugzilla.novell.com/807153 https://bugzilla.novell.com/807471 https://bugzilla.novell.com/814336 https://bugzilla.novell.com/815320 https://bugzilla.novell.com/817377 https://bugzilla.novell.com/818053 https://bugzilla.novell.com/821560 https://bugzilla.novell.com/821612 https://bugzilla.novell.com/822575 https://bugzilla.novell.com/823342 https://bugzilla.novell.com/823517 https://bugzilla.novell.com/824171 https://bugzilla.novell.com/824295 https://bugzilla.novell.com/827749 https://bugzilla.novell.com/827750 https://bugzilla.novell.com/828119 https://bugzilla.novell.com/828714 https://bugzilla.novell.com/831055 https://bugzilla.novell.com/831058 https://bugzilla.novell.com/833321 https://bugzilla.novell.com/835414 https://bugzilla.novell.com/838346

1 0

openSUSE-SU-2013:1617-1: moderate: update for hplip
by opensuse-security＠opensuse.org 31 Oct '13

31 Oct '13

openSUSE Security Update: update for hplip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1617-1 Rating: moderate References: #835827 #836937 Cross-References: CVE-2013-4288 CVE-2013-4325 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: the following security issue was fixed for HPLIP 3.13.10: usage of an insecure polkit DBUS API (fix for bnc#836937 and CVE-2013-4325 that are related to CVE-2013-4288 and bnc#835827). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-812 - openSUSE 12.2: zypper in -t patch openSUSE-2013-812 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): hplip-3.12.11-2.5.1 hplip-debuginfo-3.12.11-2.5.1 hplip-debugsource-3.12.11-2.5.1 hplip-hpijs-3.12.11-2.5.1 hplip-hpijs-debuginfo-3.12.11-2.5.1 hplip-sane-3.12.11-2.5.1 hplip-sane-debuginfo-3.12.11-2.5.1 - openSUSE 12.2 (i586 x86_64): hplip-3.12.4-3.6.1 hplip-debuginfo-3.12.4-3.6.1 hplip-debugsource-3.12.4-3.6.1 hplip-hpijs-3.12.4-3.6.1 hplip-hpijs-debuginfo-3.12.4-3.6.1 hplip-sane-3.12.4-3.6.1 hplip-sane-debuginfo-3.12.4-3.6.1 References: http://support.novell.com/security/cve/CVE-2013-4288.html http://support.novell.com/security/cve/CVE-2013-4325.html https://bugzilla.novell.com/835827 https://bugzilla.novell.com/836937

1 0

openSUSE-SU-2013:1616-1: moderate: update for dropbear
by opensuse-security＠opensuse.org 31 Oct '13

31 Oct '13

openSUSE Security Update: update for dropbear ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1616-1 Rating: moderate References: #845306 Cross-References: CVE-2013-4421 CVE-2013-4434 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: dropbear was updated to version 2013.60 to fix following bugs: * Fix "make install" so that it doesn't always install to /bin and /sbin * Fix "make install MULTI=1", installing manpages failed * Fix "make install" when scp is included since it has no manpage * Make --disable-bundled-libtom work - used as bug fix release for bnc#845306 - VUL-0: CVE-2013-4421 and CVE-2013-4434 - provided links for download sources - employed gpg-offline - verify sources - imported upstream version 2013.59 * Fix crash from -J command Thanks to Lluís Batlle i Rossell and Arnaud Mouiche for patches * Avoid reading too much from /proc/net/rt_cache since that causes system slowness. * Improve EOF handling for half-closed connections Thanks to Catalin Patulea * Send a banner message to report PAM error messages intended for the user Patch from Martin Donnelly * Limit the size of decompressed payloads, avoids memory exhaustion denial of service Thanks to Logan Lamb for reporting and investigating it * Avoid disclosing existence of valid users through inconsistent delays Thanks to Logan Lamb for reporting * Update config.guess and config.sub for newer architectures * Avoid segfault in server for locked accounts * "make install" now installs manpages dropbearkey.8 has been renamed to dropbearkey.1 manpage added for dropbearconvert * Get rid of one second delay when running non-interactive commands Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-811 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): dropbear-2013.60-7.4.1 dropbear-debuginfo-2013.60-7.4.1 dropbear-debugsource-2013.60-7.4.1 References: http://support.novell.com/security/cve/CVE-2013-4421.html http://support.novell.com/security/cve/CVE-2013-4434.html https://bugzilla.novell.com/845306

1 0

openSUSE-SU-2013:1614-1: moderate: update for xorg-x11-server
by opensuse-security＠opensuse.org 30 Oct '13

30 Oct '13

openSUSE Security Update: update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1614-1 Rating: moderate References: #816813 #843652 Cross-References: CVE-2013-4396 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: Fixes the following security issue: - an authenticated X client can cause an X server to use memory after it was freed, potentially leading to crash and/or memory corruption. (CVE-2013-4396, bnc#843652) and the following bug was fixed too: - rfbAuthReenable is accessing rfbClient structure that was in most cases already freed. It actually needs only ScreenPtr, so pass it directly. (bnc#816813) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-153 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): xorg-x11-Xvnc-7.6_1.9.3-15.44.1 xorg-x11-Xvnc-debuginfo-7.6_1.9.3-15.44.1 xorg-x11-server-7.6_1.9.3-15.44.1 xorg-x11-server-debuginfo-7.6_1.9.3-15.44.1 xorg-x11-server-debugsource-7.6_1.9.3-15.44.1 xorg-x11-server-extra-7.6_1.9.3-15.44.1 xorg-x11-server-extra-debuginfo-7.6_1.9.3-15.44.1 xorg-x11-server-sdk-7.6_1.9.3-15.44.1 References: http://support.novell.com/security/cve/CVE-2013-4396.html https://bugzilla.novell.com/816813 https://bugzilla.novell.com/843652

1 0

openSUSE-SU-2013:1613-1: moderate: This update fixes a heap overflow in apache2-mod_fcgid, identified as CVE-2013-4365. [bnc#844935]
by opensuse-security＠opensuse.org 30 Oct '13

30 Oct '13

openSUSE Security Update: This update fixes a heap overflow in apache2-mod_fcgid, identified as CVE-2013-4365. [bnc#844935] ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1613-1 Rating: moderate References: #844935 Cross-References: CVE-2013-4365 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: the following security issue was fixed in apache2-mod_fcgid: - fixes a heap overflow identified by CVE-2013-4365 [bnc#844935]. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-152 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-mod_fcgid-2.3.6-6.1 apache2-mod_fcgid-debuginfo-2.3.6-6.1 apache2-mod_fcgid-debugsource-2.3.6-6.1 References: http://support.novell.com/security/cve/CVE-2013-4365.html https://bugzilla.novell.com/844935

1 0

openSUSE-RU-2013:1612-1: timezone: Update to 2013h
by maintenance＠opensuse.org 30 Oct '13

30 Oct '13

openSUSE Recommended Update: timezone: Update to 2013h ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1612-1 Rating: low References: #845530 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with timezone: - update to to 2013h: * Lybia has switched back to UTC+2 * Western Sahara uses Morocco's DST rules * Acre sitches from UTC-4 to UTC-5 on Nov. 10th - bnc#845530: fix patch expansion for local time link - sync changes-file with the devel-project again Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-809 - openSUSE 12.2: zypper in -t patch openSUSE-2013-809 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): timezone-2013h-2.33.1 timezone-debuginfo-2013h-2.33.1 timezone-debugsource-2013h-2.33.1 - openSUSE 12.3 (noarch): timezone-java-2013h-2.33.1 - openSUSE 12.2 (i586 x86_64): timezone-2013h-1.40.1 timezone-debuginfo-2013h-1.40.1 timezone-debugsource-2013h-1.40.1 - openSUSE 12.2 (noarch): timezone-java-2013h-1.40.1 References: https://bugzilla.novell.com/845530

1 0

openSUSE-SU-2013:1611-1: moderate: update for ruby19
by opensuse-security＠opensuse.org 30 Oct '13

30 Oct '13

openSUSE Security Update: update for ruby19 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1611-1 Rating: moderate References: #837457 #843686 Cross-References: CVE-2013-2065 CVE-2013-4287 CVE-2013-4363 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: ruby19 was updated to fix the following security issues: - fix CVE-2013-2065: Object taint bypassing in DL and Fiddle (bnc#843686) The file CVE-2013-2065.patch contains the patch - fix CVE-2013-4287 CVE-2013-4363: ruby19: Algorithmic complexity vulnerability (bnc#837457) The file CVE-2013-4287-4363.patch contains the patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-806 - openSUSE 12.2: zypper in -t patch openSUSE-2013-806 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): ruby19-1.9.3.p392-1.13.1 ruby19-debuginfo-1.9.3.p392-1.13.1 ruby19-debugsource-1.9.3.p392-1.13.1 ruby19-devel-1.9.3.p392-1.13.1 ruby19-devel-extra-1.9.3.p392-1.13.1 ruby19-tk-1.9.3.p392-1.13.1 ruby19-tk-debuginfo-1.9.3.p392-1.13.1 - openSUSE 12.3 (noarch): ruby19-doc-ri-1.9.3.p392-1.13.1 - openSUSE 12.2 (i586 x86_64): ruby19-1.9.3.p392-3.30.1 ruby19-debuginfo-1.9.3.p392-3.30.1 ruby19-debugsource-1.9.3.p392-3.30.1 ruby19-devel-1.9.3.p392-3.30.1 ruby19-devel-extra-1.9.3.p392-3.30.1 ruby19-tk-1.9.3.p392-3.30.1 ruby19-tk-debuginfo-1.9.3.p392-3.30.1 - openSUSE 12.2 (noarch): ruby19-doc-ri-1.9.3.p392-3.30.1 References: http://support.novell.com/security/cve/CVE-2013-2065.html http://support.novell.com/security/cve/CVE-2013-4287.html http://support.novell.com/security/cve/CVE-2013-4363.html https://bugzilla.novell.com/837457 https://bugzilla.novell.com/843686

1 0

openSUSE-SU-2013:1610-1: moderate: update for xorg-x11-server
by opensuse-security＠opensuse.org 30 Oct '13

30 Oct '13

openSUSE Security Update: update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1610-1 Rating: moderate References: #816813 #843652 Cross-References: CVE-2013-4396 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: Fixes the following security issue: - an authenticated X client can cause an X server to use memory after it was freed, potentially leading to crash and/or memory corruption. (CVE-2013-4396, bnc#843652) and the following bug was fixed too: - rfbAuthReenable is accessing rfbClient structure that was in most cases already freed. It actually needs only ScreenPtr, so pass it directly. (bnc#816813) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-807 - openSUSE 12.2: zypper in -t patch openSUSE-2013-807 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): xorg-x11-server-7.6_1.13.2-1.17.1 xorg-x11-server-debuginfo-7.6_1.13.2-1.17.1 xorg-x11-server-debugsource-7.6_1.13.2-1.17.1 xorg-x11-server-extra-7.6_1.13.2-1.17.1 xorg-x11-server-extra-debuginfo-7.6_1.13.2-1.17.1 xorg-x11-server-sdk-7.6_1.13.2-1.17.1 - openSUSE 12.2 (i586 x86_64): xorg-x11-Xvnc-7.6_1.12.3-1.37.1 xorg-x11-Xvnc-debuginfo-7.6_1.12.3-1.37.1 xorg-x11-server-7.6_1.12.3-1.37.1 xorg-x11-server-debuginfo-7.6_1.12.3-1.37.1 xorg-x11-server-debugsource-7.6_1.12.3-1.37.1 xorg-x11-server-extra-7.6_1.12.3-1.37.1 xorg-x11-server-extra-debuginfo-7.6_1.12.3-1.37.1 xorg-x11-server-sdk-7.6_1.12.3-1.37.1 References: http://support.novell.com/security/cve/CVE-2013-4396.html https://bugzilla.novell.com/816813 https://bugzilla.novell.com/843652

1 0

openSUSE-SU-2013:1609-1: moderate: update for apache2-mod_fcgid
by opensuse-security＠opensuse.org 30 Oct '13

30 Oct '13

openSUSE Security Update: update for apache2-mod_fcgid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1609-1 Rating: moderate References: #844935 Cross-References: CVE-2013-4365 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: the following security issue was fixed in apache2-mod_fcgid: - fixes a heap overflow identified by CVE-2013-4365 [bnc#844935]. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-808 - openSUSE 12.2: zypper in -t patch openSUSE-2013-808 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): apache2-mod_fcgid-2.3.6-11.4.1 apache2-mod_fcgid-debuginfo-2.3.6-11.4.1 apache2-mod_fcgid-debugsource-2.3.6-11.4.1 - openSUSE 12.2 (i586 x86_64): apache2-mod_fcgid-2.3.6-9.4.1 apache2-mod_fcgid-debuginfo-2.3.6-9.4.1 apache2-mod_fcgid-debugsource-2.3.6-9.4.1 References: http://support.novell.com/security/cve/CVE-2013-4365.html https://bugzilla.novell.com/844935

1 0

openSUSE-RU-2013:1602-1: moderate: yast2-autofs: fixed Yast2 autoFS module running with UI
by maintenance＠opensuse.org 29 Oct '13

29 Oct '13

openSUSE Recommended Update: yast2-autofs: fixed Yast2 autoFS module running with UI ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1602-1 Rating: moderate References: #740167 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with yast2-autofs: - bnc#740167: fixed Yast2 autoFS module running with UI Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-805 - openSUSE 12.2: zypper in -t patch openSUSE-2013-805 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): yast2-autofs-2.22.0-4.5.1 - openSUSE 12.2 (noarch): yast2-autofs-2.22.0-2.5.1 References: https://bugzilla.novell.com/740167

1 0

openSUSE-SU-2013:1600-1: moderate: update for zrtpcpp
by opensuse-security＠opensuse.org 29 Oct '13

29 Oct '13

openSUSE Security Update: update for zrtpcpp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1600-1 Rating: moderate References: #828028 Cross-References: CVE-2013-2221 CVE-2013-2222 CVE-2013-2223 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Add cve-fixes-bnc828028.diff: backport patch for fixing CVE-2013-2221, CVE-2013-2222, CVE-2013-2223 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-151 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libzrtpcpp-1.6.0-6.1 libzrtpcpp-debuginfo-1.6.0-6.1 libzrtpcpp-debugsource-1.6.0-6.1 libzrtpcpp-devel-1.6.0-6.1 References: http://support.novell.com/security/cve/CVE-2013-2221.html http://support.novell.com/security/cve/CVE-2013-2222.html http://support.novell.com/security/cve/CVE-2013-2223.html https://bugzilla.novell.com/828028

1 0

openSUSE-SU-2013:1599-1: moderate: libzrtpcpp: fixed multiple security issues
by opensuse-security＠opensuse.org 29 Oct '13

29 Oct '13

openSUSE Security Update: libzrtpcpp: fixed multiple security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1599-1 Rating: moderate References: #828028 Cross-References: CVE-2013-2221 CVE-2013-2222 CVE-2013-2223 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: libzrtpcpp was updated to fix multiple security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-804 - openSUSE 12.2: zypper in -t patch openSUSE-2013-804 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libzrtpcpp-debugsource-2.0.0-8.4.1 libzrtpcpp-devel-2.0.0-8.4.1 libzrtpcpp2-2.0.0-8.4.1 libzrtpcpp2-debuginfo-2.0.0-8.4.1 - openSUSE 12.2 (i586 x86_64): libzrtpcpp-debugsource-2.0.0-6.4.1 libzrtpcpp-devel-2.0.0-6.4.1 libzrtpcpp2-2.0.0-6.4.1 libzrtpcpp2-debuginfo-2.0.0-6.4.1 References: http://support.novell.com/security/cve/CVE-2013-2221.html http://support.novell.com/security/cve/CVE-2013-2222.html http://support.novell.com/security/cve/CVE-2013-2223.html https://bugzilla.novell.com/828028

1 0

openSUSE-SU-2013:1597-1: moderate: rtkit: fixed a race condition in pid checking
by opensuse-security＠opensuse.org 29 Oct '13

29 Oct '13

openSUSE Security Update: rtkit: fixed a race condition in pid checking ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1597-1 Rating: moderate References: #836939 Cross-References: CVE-2013-4326 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rtkit was fixed to avoid a TOCTOU race condition that might have allowed local attackers to gain realtime rights they should not have. (CVE-2013-4326) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-150 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): rtkit-0.5-12.1 rtkit-debuginfo-0.5-12.1 rtkit-debugsource-0.5-12.1 References: http://support.novell.com/security/cve/CVE-2013-4326.html https://bugzilla.novell.com/836939

1 0

openSUSE-SU-2013:1596-1: moderate: update for jakarta-commons-fileupload
by opensuse-security＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Security Update: update for jakarta-commons-fileupload ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1596-1 Rating: moderate References: #846174 Cross-References: CVE-2013-2186 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A remote attacker could supply a serialized instance of the DiskFileItem class, which would be deserialized on a server and write arbitrary content to any location on the server that is permitted by the user running the application server process. bnc#846174/CVE-2013-2186 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-149 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): jakarta-commons-fileupload-1.1.1-109.2 jakarta-commons-fileupload-javadoc-1.1.1-109.2 References: http://support.novell.com/security/cve/CVE-2013-2186.html https://bugzilla.novell.com/846174

1 0

openSUSE-RU-2013:1593-1: cyrus-sasl: fixed typo in patch, preventing sql auxprop plugin to work
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: cyrus-sasl: fixed typo in patch, preventing sql auxprop plugin to work ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1593-1 Rating: low References: #827230 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with cyrus-sasl: - bnc#827230: fixed typo in patch, preventing sql auxprop plugin to work Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-803 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): cyrus-sasl-2.1.25-24.4.1 cyrus-sasl-crammd5-2.1.25-24.4.1 cyrus-sasl-crammd5-debuginfo-2.1.25-24.4.1 cyrus-sasl-debuginfo-2.1.25-24.4.1 cyrus-sasl-debugsource-2.1.25-24.4.1 cyrus-sasl-devel-2.1.25-24.4.1 cyrus-sasl-digestmd5-2.1.25-24.4.1 cyrus-sasl-digestmd5-debuginfo-2.1.25-24.4.1 cyrus-sasl-gs2-2.1.25-24.4.1 cyrus-sasl-gs2-debuginfo-2.1.25-24.4.1 cyrus-sasl-gssapi-2.1.25-24.4.1 cyrus-sasl-gssapi-debuginfo-2.1.25-24.4.1 cyrus-sasl-ldap-auxprop-2.1.25-24.4.1 cyrus-sasl-ldap-auxprop-debuginfo-2.1.25-24.4.1 cyrus-sasl-ntlm-2.1.25-24.4.1 cyrus-sasl-ntlm-debuginfo-2.1.25-24.4.1 cyrus-sasl-otp-2.1.25-24.4.1 cyrus-sasl-otp-debuginfo-2.1.25-24.4.1 cyrus-sasl-plain-2.1.25-24.4.1 cyrus-sasl-plain-debuginfo-2.1.25-24.4.1 cyrus-sasl-saslauthd-2.1.25-24.4.1 cyrus-sasl-saslauthd-debuginfo-2.1.25-24.4.1 cyrus-sasl-saslauthd-debugsource-2.1.25-24.4.1 cyrus-sasl-scram-2.1.25-24.4.1 cyrus-sasl-scram-debuginfo-2.1.25-24.4.1 cyrus-sasl-sqlauxprop-2.1.25-24.4.1 cyrus-sasl-sqlauxprop-debuginfo-2.1.25-24.4.1 - openSUSE 12.3 (x86_64): cyrus-sasl-32bit-2.1.25-24.4.1 cyrus-sasl-crammd5-32bit-2.1.25-24.4.1 cyrus-sasl-crammd5-debuginfo-32bit-2.1.25-24.4.1 cyrus-sasl-debuginfo-32bit-2.1.25-24.4.1 cyrus-sasl-devel-32bit-2.1.25-24.4.1 cyrus-sasl-digestmd5-32bit-2.1.25-24.4.1 cyrus-sasl-digestmd5-debuginfo-32bit-2.1.25-24.4.1 cyrus-sasl-gssapi-32bit-2.1.25-24.4.1 cyrus-sasl-gssapi-debuginfo-32bit-2.1.25-24.4.1 cyrus-sasl-ldap-auxprop-32bit-2.1.25-24.4.1 cyrus-sasl-ldap-auxprop-debuginfo-32bit-2.1.25-24.4.1 cyrus-sasl-otp-32bit-2.1.25-24.4.1 cyrus-sasl-otp-debuginfo-32bit-2.1.25-24.4.1 cyrus-sasl-plain-32bit-2.1.25-24.4.1 cyrus-sasl-plain-debuginfo-32bit-2.1.25-24.4.1 cyrus-sasl-sqlauxprop-32bit-2.1.25-24.4.1 cyrus-sasl-sqlauxprop-debuginfo-32bit-2.1.25-24.4.1 References: https://bugzilla.novell.com/827230

1 0

openSUSE-RU-2013:1592-1: Mesa: Fix issue with Intel 865G
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: Mesa: Fix issue with Intel 865G ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1592-1 Rating: low References: #846614 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with Mesa: - bnc#846614, fdo#56042: Fix issue blocking GL on some Intel chipset (865G and earlier). Context had never been created due to this bug. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-800 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): Mesa-9.0.2-34.24.1 Mesa-debuginfo-9.0.2-34.24.1 Mesa-debugsource-9.0.2-34.24.1 Mesa-devel-9.0.2-34.24.1 Mesa-libEGL-devel-9.0.2-34.24.1 Mesa-libEGL1-9.0.2-34.24.1 Mesa-libEGL1-debuginfo-9.0.2-34.24.1 Mesa-libGL-devel-9.0.2-34.24.1 Mesa-libGL1-9.0.2-34.24.1 Mesa-libGL1-debuginfo-9.0.2-34.24.1 Mesa-libGLESv1_CM-devel-9.0.2-34.24.1 Mesa-libGLESv1_CM1-9.0.2-34.24.1 Mesa-libGLESv1_CM1-debuginfo-9.0.2-34.24.1 Mesa-libGLESv2-2-9.0.2-34.24.1 Mesa-libGLESv2-2-debuginfo-9.0.2-34.24.1 Mesa-libGLESv2-devel-9.0.2-34.24.1 Mesa-libIndirectGL-devel-9.0.2-34.24.1 Mesa-libIndirectGL1-9.0.2-34.24.1 Mesa-libIndirectGL1-debuginfo-9.0.2-34.24.1 Mesa-libglapi-devel-9.0.2-34.24.1 Mesa-libglapi0-9.0.2-34.24.1 Mesa-libglapi0-debuginfo-9.0.2-34.24.1 libOSMesa-devel-9.0.2-34.24.1 libOSMesa9-9.0.2-34.24.1 libOSMesa9-debuginfo-9.0.2-34.24.1 libXvMC_nouveau-9.0.2-34.24.1 libXvMC_nouveau-debuginfo-9.0.2-34.24.1 libXvMC_r300-9.0.2-34.24.1 libXvMC_r300-debuginfo-9.0.2-34.24.1 libXvMC_r600-9.0.2-34.24.1 libXvMC_r600-debuginfo-9.0.2-34.24.1 libXvMC_softpipe-9.0.2-34.24.1 libXvMC_softpipe-debuginfo-9.0.2-34.24.1 libgbm-devel-0.0.0-34.24.1 libgbm1-0.0.0-34.24.1 libgbm1-debuginfo-0.0.0-34.24.1 libvdpau_nouveau-9.0.2-34.24.1 libvdpau_nouveau-debuginfo-9.0.2-34.24.1 libvdpau_r300-9.0.2-34.24.1 libvdpau_r300-debuginfo-9.0.2-34.24.1 libvdpau_r600-9.0.2-34.24.1 libvdpau_r600-debuginfo-9.0.2-34.24.1 libvdpau_softpipe-9.0.2-34.24.1 libvdpau_softpipe-debuginfo-9.0.2-34.24.1 libxatracker-devel-1.0.0-34.24.1 libxatracker1-1.0.0-34.24.1 libxatracker1-debuginfo-1.0.0-34.24.1 - openSUSE 12.3 (x86_64): Mesa-32bit-9.0.2-34.24.1 Mesa-debuginfo-32bit-9.0.2-34.24.1 Mesa-devel-32bit-9.0.2-34.24.1 Mesa-libEGL-devel-32bit-9.0.2-34.24.1 Mesa-libEGL1-32bit-9.0.2-34.24.1 Mesa-libEGL1-debuginfo-32bit-9.0.2-34.24.1 Mesa-libGL-devel-32bit-9.0.2-34.24.1 Mesa-libGL1-32bit-9.0.2-34.24.1 Mesa-libGL1-debuginfo-32bit-9.0.2-34.24.1 Mesa-libGLESv1_CM-devel-32bit-9.0.2-34.24.1 Mesa-libGLESv1_CM1-32bit-9.0.2-34.24.1 Mesa-libGLESv1_CM1-debuginfo-32bit-9.0.2-34.24.1 Mesa-libGLESv2-2-32bit-9.0.2-34.24.1 Mesa-libGLESv2-2-debuginfo-32bit-9.0.2-34.24.1 Mesa-libGLESv2-devel-32bit-9.0.2-34.24.1 Mesa-libIndirectGL-devel-32bit-9.0.2-34.24.1 Mesa-libIndirectGL1-32bit-9.0.2-34.24.1 Mesa-libIndirectGL1-debuginfo-32bit-9.0.2-34.24.1 Mesa-libglapi-devel-32bit-9.0.2-34.24.1 Mesa-libglapi0-32bit-9.0.2-34.24.1 Mesa-libglapi0-debuginfo-32bit-9.0.2-34.24.1 libOSMesa-devel-32bit-9.0.2-34.24.1 libOSMesa9-32bit-9.0.2-34.24.1 libOSMesa9-debuginfo-32bit-9.0.2-34.24.1 libXvMC_nouveau-32bit-9.0.2-34.24.1 libXvMC_nouveau-debuginfo-32bit-9.0.2-34.24.1 libXvMC_r300-32bit-9.0.2-34.24.1 libXvMC_r300-debuginfo-32bit-9.0.2-34.24.1 libXvMC_r600-32bit-9.0.2-34.24.1 libXvMC_r600-debuginfo-32bit-9.0.2-34.24.1 libXvMC_softpipe-32bit-9.0.2-34.24.1 libXvMC_softpipe-debuginfo-32bit-9.0.2-34.24.1 libgbm-devel-32bit-0.0.0-34.24.1 libgbm1-32bit-0.0.0-34.24.1 libgbm1-debuginfo-32bit-0.0.0-34.24.1 libvdpau_nouveau-32bit-9.0.2-34.24.1 libvdpau_nouveau-debuginfo-32bit-9.0.2-34.24.1 libvdpau_r300-32bit-9.0.2-34.24.1 libvdpau_r300-debuginfo-32bit-9.0.2-34.24.1 libvdpau_r600-32bit-9.0.2-34.24.1 libvdpau_r600-debuginfo-32bit-9.0.2-34.24.1 libvdpau_softpipe-32bit-9.0.2-34.24.1 libvdpau_softpipe-debuginfo-32bit-9.0.2-34.24.1 References: https://bugzilla.novell.com/846614

1 0

openSUSE-RU-2013:1591-1: moderate: varnish: bugfix release to avoid crashes with pcre
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: varnish: bugfix release to avoid crashes with pcre ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1591-1 Rating: moderate References: #839358 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: varnish was updated to deactivate the libpcre JIT to avoid crashes (bnc#839358) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-802 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libvarnishapi1-3.0.3-2.5.1 libvarnishapi1-debuginfo-3.0.3-2.5.1 varnish-3.0.3-2.5.1 varnish-debuginfo-3.0.3-2.5.1 varnish-debugsource-3.0.3-2.5.1 varnish-devel-3.0.3-2.5.1 References: https://bugzilla.novell.com/839358

1 0

openSUSE-RU-2013:1590-1: kernel-firmware: Use qlogic firmware from linux-firmware
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: kernel-firmware: Use qlogic firmware from linux-firmware ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1590-1 Rating: low References: #846629 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with kernel-firmware: - bnc#846629: Use qlogic firmware from linux-firmware instead of the separate archive. This has the effect of updating the qlogic firmware to 05.08.00. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-801 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): kernel-firmware-20130714git-1.9.1 References: https://bugzilla.novell.com/846629

1 0

openSUSE-RU-2013:1589-1: froxlor: Update from 0.9.27 to 0.9.29 and added configuration files for openSUSE 12.x
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: froxlor: Update from 0.9.27 to 0.9.29 and added configuration files for openSUSE 12.x ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1589-1 Rating: low References: #846355 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This udpate fixes the following issues with froxlor: - added configuration files openSUSE 12.x (at Server Configuration) - upstream upgrade to version 0.9.29 (bnc#846355) + Froxlor package for armhf doesn't show up in aptitude + unable to register 'memcache' SSL session cache: Memcache support not enabled + Cron Domain-SSL certificate + fixed error in Apache mod_write + Provide php.ini configuration for php-fpm - upstream upgrade to version 0.9.28.1 Due to a syntax-error in the updater we had to re-release as version 0.9.28.1 - upstream upgrade to version 0.9.28 + Use complete domain name as default path for DocumentRoot + added possibility to add random prefixes to a customers database-name + fixed FreeBSD 8.2: Bind 9 is missing from list of Daemons + fixed bug in "Amount of APS installations" counter + fixed webserver-specific default vHost settings don't work in ligHTTPd + fixed Redirect with SSL Enabled Domain + fixed bug in "Amount of autoresponders" counter + fixed incorrect configuration command for awstats under Gentoo + fixed falsely used e-mail sender name + updated default parameter list of sendmail-program in php.ini-template + fixed falsely added specialsettings to a ssl-redirect + fixed usage of empty value for CertificateChainFile (it's allowed) + cleaned up language files + fixed redirect to "ip:port" + fixed clean-up if fcgid/php-fpm configurations - upstream upragde to version 0.9.28-rc1 + customers are now able to search their email-addresses in the overview (like domains, etc.) + new directory-structure for e-mail accounts. New added accounts will be stored in a new maildir-structure (e.g. /var/customers/mail/customeracc/domain/mailacc/Maildir/). An explanation why this makes sense can be found in the ticket-description. Note: no configuration changes are necessary and existing accounts do not need to be updated, as the homedir/maildir is read from the database. + the default language for users without a language-setting is now determined via HTTP_ACCEPT_LANGUAGE + added support for apache-2.4 (note: mod_log_sql is not compatible to apache-2.4) + path to nginx's fastcgi_params-file is now customizable (as other distributions/systems do not have it in /etc/nginx/) + fixed alias generation when the docroot of a (sub)domain was below the customerdocroot + Apply settings for all subdomains in now deactivateable (but will be checked when you re-open the domain-edit view, this is intended!) + the default php-cgi listener for nginx is now editable as intended + php-fpm files are generated correctly - due to a double "cleaning" of the php-cgi-configdir, they were created and later removed in the cronjobs + fixed php-fpm usage on apache-webserver + fixed incorrect display of used traffic in admin-overview + fixed falsey used private class property in database-class + fixed endless-loop in readdir() when bind is not installed but php-fpm is activated + fixed problems when disabling a customer / the customer removes one of his database with mysql version >4.1 + froxlor is now completely using UTF-8 encoding. + The classic theme has been removed. Maintaining two very different themes and the goal to gain usability and simplicity lead to that decision. - Important information: + support for mod_log_sql will drop in the final 0.9.28 release. If you still use it, please switch to webalizer or awstats + support for dovecot-1 on Gentoo will be dropped in 0.9.29 as Gentoo's tree does not include it anymore. + support for Debian Lenny has been removed as it is EOL since 6.2.2012. + support for Ubuntu Hardy will be deprecated in 0.9.28 and removed in 0.9.29 as it will be unsupported in april 2013. + php's safe_mode setting will be removed in the final 0.9.28 release as it is deprecated. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-798 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (noarch): froxlor-0.9.29-2.4.1 References: https://bugzilla.novell.com/846355

1 0

openSUSE-RU-2013:1588-1: apparmor: Update to 2.8.2
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: apparmor: Update to 2.8.2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1588-1 Rating: low References: #777471 #798183 #807104 #822277 #824577 #845867 #846054 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This udpate fixes the following issues with apparmor: - update AppArmmor to 2.8.2 + several fixes for python3 compability + several profile improvements: * various additions to abstractions/fonts * move poppler's cMaps from gnome to fonts; gnome includes fonts * deny @{HOME}/.gnome2/keyrings/** to abstractions/private-files-strict * add read access to @{PROC}/sys/vm/overcommit_memory to abstractions/base (bnc#824577) * update pulseaudio directory and cookie file paths * add missing permissions to the nscd profile (bnc#807104) * deny capability block_suspend to nscd (bnc#807104) * MariaDB compatability in abstractions/mysql (bnc#798183) + see http://wiki.apparmor.net/index.php/ReleaseNotes_2_8_2 for all details - additional patches: + update apparmor/__init__.py to support the new tools developed in GSoC + fix aa-unconfined to work in all languages - additional profile updates: + fix ntp profile by allowing read access to openssl.cnf + update samba profiles for samba 4.x (bnc#845867, bnc#846054) + abstractions/p11-kit needs access to /usr/share/p11-kit/modules + allow reading /etc/machine-id in the dbus-session abstraction - enable python and ruby subpackages - some other small changes, see changelog for all details Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-793 - openSUSE 12.2: zypper in -t patch openSUSE-2013-793 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): apache2-mod_apparmor-2.8.2-3.4.1 apache2-mod_apparmor-debuginfo-2.8.2-3.4.1 apparmor-debugsource-2.8.2-3.4.1 apparmor-parser-2.8.2-3.4.1 apparmor-parser-debuginfo-2.8.2-3.4.1 libapparmor-devel-2.8.2-3.4.1 libapparmor1-2.8.2-3.4.1 libapparmor1-debuginfo-2.8.2-3.4.1 pam_apparmor-2.8.2-3.4.1 pam_apparmor-debuginfo-2.8.2-3.4.1 perl-apparmor-2.8.2-3.4.1 perl-apparmor-debuginfo-2.8.2-3.4.1 python3-apparmor-2.8.2-3.4.1 python3-apparmor-debuginfo-2.8.2-3.4.1 ruby-apparmor-2.8.2-3.4.1 ruby-apparmor-debuginfo-2.8.2-3.4.1 - openSUSE 12.3 (x86_64): libapparmor1-32bit-2.8.2-3.4.1 libapparmor1-debuginfo-32bit-2.8.2-3.4.1 pam_apparmor-32bit-2.8.2-3.4.1 pam_apparmor-debuginfo-32bit-2.8.2-3.4.1 - openSUSE 12.3 (noarch): apparmor-docs-2.8.2-3.4.1 apparmor-parser-lang-2.8.2-3.4.1 apparmor-profiles-2.8.2-3.4.1 apparmor-utils-2.8.2-3.4.1 apparmor-utils-lang-2.8.2-3.4.1 - openSUSE 12.2 (i586 x86_64): apache2-mod_apparmor-2.8.2-2.11.1 apache2-mod_apparmor-debuginfo-2.8.2-2.11.1 apparmor-debugsource-2.8.2-2.11.1 apparmor-parser-2.8.2-2.11.1 apparmor-parser-debuginfo-2.8.2-2.11.1 libapparmor-devel-2.8.2-2.11.1 libapparmor1-2.8.2-2.11.1 libapparmor1-debuginfo-2.8.2-2.11.1 pam_apparmor-2.8.2-2.11.1 perl-apparmor-2.8.2-2.11.1 perl-apparmor-debuginfo-2.8.2-2.11.1 python-apparmor-2.8.2-2.11.1 python-apparmor-debuginfo-2.8.2-2.11.1 ruby-apparmor-2.8.2-2.11.1 ruby-apparmor-debuginfo-2.8.2-2.11.1 - openSUSE 12.2 (x86_64): libapparmor1-32bit-2.8.2-2.11.1 libapparmor1-debuginfo-32bit-2.8.2-2.11.1 pam_apparmor-32bit-2.8.2-2.11.1 - openSUSE 12.2 (noarch): apparmor-docs-2.8.2-2.11.1 apparmor-parser-lang-2.8.2-2.11.1 apparmor-profiles-2.8.2-2.11.1 apparmor-utils-2.8.2-2.11.1 apparmor-utils-lang-2.8.2-2.11.1 References: https://bugzilla.novell.com/777471 https://bugzilla.novell.com/798183 https://bugzilla.novell.com/807104 https://bugzilla.novell.com/822277 https://bugzilla.novell.com/824577 https://bugzilla.novell.com/845867 https://bugzilla.novell.com/846054

1 0

openSUSE-RU-2013:1587-1: moderate: blender: make it work on older i586 systems
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: blender: make it work on older i586 systems ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1587-1 Rating: moderate References: #846545 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Blender was updated to fix running it on older x86 systems by disabling sse2 instructions on non x86_64 arches, bnc#846545 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-796 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): blender-2.64a-4.4.1 blender-debuginfo-2.64a-4.4.1 - openSUSE 12.3 (noarch): blender-lang-2.64a-4.4.1 References: https://bugzilla.novell.com/846545

1 0

openSUSE-RU-2013:1586-1: xerces-c: Disable sse2 instructions on non x86_64 arches
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: xerces-c: Disable sse2 instructions on non x86_64 arches ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1586-1 Rating: low References: #846539 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with xerces-c: - bnc#846539: Disable sse2 instructions on non x86_64 arches Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-792 - openSUSE 12.2: zypper in -t patch openSUSE-2013-792 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libxerces-c-3_1-3.1.1-7.4.1 libxerces-c-3_1-debuginfo-3.1.1-7.4.1 libxerces-c-devel-3.1.1-7.4.1 xerces-c-3.1.1-7.4.1 xerces-c-debuginfo-3.1.1-7.4.1 xerces-c-debugsource-3.1.1-7.4.1 - openSUSE 12.2 (i586 x86_64): libxerces-c-3_1-3.1.1-5.4.1 libxerces-c-3_1-debuginfo-3.1.1-5.4.1 libxerces-c-devel-3.1.1-5.4.1 xerces-c-3.1.1-5.4.1 xerces-c-debuginfo-3.1.1-5.4.1 xerces-c-debugsource-3.1.1-5.4.1 References: https://bugzilla.novell.com/846539

1 0

openSUSE-RU-2013:1585-1: openh323: Fix invalid openh323-devel openh323u.mak
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: openh323: Fix invalid openh323-devel openh323u.mak ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1585-1 Rating: low References: #839475 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with openh323: - bnc#839475: Fix openh323-devel openh323u.mak to refer to the correct directories. It fixes self compilation of some third party projects (e. g. asterisk). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-794 - openSUSE 12.2: zypper in -t patch openSUSE-2013-794 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): openh323-1.19.0.1-252.4.1 openh323-debuginfo-1.19.0.1-252.4.1 openh323-debugsource-1.19.0.1-252.4.1 openh323-devel-1.19.0.1-252.4.1 - openSUSE 12.2 (i586 x86_64): openh323-1.19.0.1-249.4.1 openh323-debuginfo-1.19.0.1-249.4.1 openh323-debugsource-1.19.0.1-249.4.1 openh323-devel-1.19.0.1-249.4.1 References: https://bugzilla.novell.com/839475

1 0

openSUSE-RU-2013:1584-1: moderate: libestr: update to 0.1.8
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: libestr: update to 0.1.8 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1584-1 Rating: moderate References: #846487 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: libestr was updated to 0.1.8 - [bnc#846487] - bugfix: invalid comparison results for different-length strings es_strcmp, es_strcasecmp, es_strbufcmp, and es_strcasebufcmp - includes changes from 0.1.6: - bugfix ascii hex code escapes did not work Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-791 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libestr-debugsource-0.1.8-2.8.1 libestr-devel-0.1.8-2.8.1 libestr0-0.1.8-2.8.1 libestr0-debuginfo-0.1.8-2.8.1 References: https://bugzilla.novell.com/846487

1 0

openSUSE-RU-2013:1583-1: nagios-plugins-zypper: Update to 1.50 and one additional fix
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: nagios-plugins-zypper: Update to 1.50 and one additional fix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1583-1 Rating: low References: #830658 #839839 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with nagios-plugins-zypper: - Update to 1.50 + bnc#839839: also handle "out-of-date" for outdated repositories + SLE-11-SP1 is not supported any more + bnc#830658: also use the keyword "Softwarestack" as indication for an update of the software stack as such Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-795 - openSUSE 12.2: zypper in -t patch openSUSE-2013-795 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): nagios-plugins-zypper-1.50-1.8.1 - openSUSE 12.2 (noarch): nagios-plugins-zypper-1.50-1.9.1 References: https://bugzilla.novell.com/830658 https://bugzilla.novell.com/839839

1 0

openSUSE-RU-2013:1582-1: froxlor: Update from 0.9.27 to 0.9.29 and added configuration files for openSUSE 12.x
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: froxlor: Update from 0.9.27 to 0.9.29 and added configuration files for openSUSE 12.x ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1582-1 Rating: low References: #846355 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This udpate fixes the following issues with froxlor: - added configuration files openSUSE 12.x (at Server Configuration) - upstream upgrade to version 0.9.29 (bnc#846355) + Froxlor package for armhf doesn't show up in aptitude + unable to register 'memcache' SSL session cache: Memcache support not enabled + Cron Domain-SSL certificate + fixed error in Apache mod_write + Provide php.ini configuration for php-fpm - upstream upgrade to version 0.9.28.1 Due to a syntax-error in the updater we had to re-release as version 0.9.28.1 - upstream upgrade to version 0.9.28 + Use complete domain name as default path for DocumentRoot + added possibility to add random prefixes to a customers database-name + fixed FreeBSD 8.2: Bind 9 is missing from list of Daemons + fixed bug in "Amount of APS installations" counter + fixed webserver-specific default vHost settings don't work in ligHTTPd + fixed Redirect with SSL Enabled Domain + fixed bug in "Amount of autoresponders" counter + fixed incorrect configuration command for awstats under Gentoo + fixed falsely used e-mail sender name + updated default parameter list of sendmail-program in php.ini-template + fixed falsely added specialsettings to a ssl-redirect + fixed usage of empty value for CertificateChainFile (it's allowed) + cleaned up language files + fixed redirect to "ip:port" + fixed clean-up if fcgid/php-fpm configurations - upstream upragde to version 0.9.28-rc1 + customers are now able to search their email-addresses in the overview (like domains, etc.) + new directory-structure for e-mail accounts. New added accounts will be stored in a new maildir-structure (e.g. /var/customers/mail/customeracc/domain/mailacc/Maildir/). An explanation why this makes sense can be found in the ticket-description. Note: no configuration changes are necessary and existing accounts do not need to be updated, as the homedir/maildir is read from the database. + the default language for users without a language-setting is now determined via HTTP_ACCEPT_LANGUAGE + added support for apache-2.4 (note: mod_log_sql is not compatible to apache-2.4) + path to nginx's fastcgi_params-file is now customizable (as other distributions/systems do not have it in /etc/nginx/) + fixed alias generation when the docroot of a (sub)domain was below the customerdocroot + Apply settings for all subdomains in now deactivateable (but will be checked when you re-open the domain-edit view, this is intended!) + the default php-cgi listener for nginx is now editable as intended + php-fpm files are generated correctly - due to a double "cleaning" of the php-cgi-configdir, they were created and later removed in the cronjobs + fixed php-fpm usage on apache-webserver + fixed incorrect display of used traffic in admin-overview + fixed falsey used private class property in database-class + fixed endless-loop in readdir() when bind is not installed but php-fpm is activated + fixed problems when disabling a customer / the customer removes one of his database with mysql version >4.1 + froxlor is now completely using UTF-8 encoding. + The classic theme has been removed. Maintaining two very different themes and the goal to gain usability and simplicity lead to that decision. - Important information: + support for mod_log_sql will drop in the final 0.9.28 release. If you still use it, please switch to webalizer or awstats + support for dovecot-1 on Gentoo will be dropped in 0.9.29 as Gentoo's tree does not include it anymore. + support for Debian Lenny has been removed as it is EOL since 6.2.2012. + support for Ubuntu Hardy will be deprecated in 0.9.28 and removed in 0.9.29 as it will be unsupported in april 2013. + php's safe_mode setting will be removed in the final 0.9.28 release as it is deprecated. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-799 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): froxlor-0.9.29-4.4.1 References: https://bugzilla.novell.com/846355

1 0

openSUSE-RU-2013:1581-1: srtp: Fix invalid srtp-devel
by maintenance＠opensuse.org 28 Oct '13

28 Oct '13

openSUSE Recommended Update: srtp: Fix invalid srtp-devel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1581-1 Rating: low References: #839475 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with srtp: - bnc#839475: Fix srtp header files to not point to private not installed files. It fixes self compilation of some third party projects (e. g. asterisk). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-797 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libsrtp1-1.4.4-2.8.1 libsrtp1-debuginfo-1.4.4-2.8.1 srtp-debugsource-1.4.4-2.8.1 srtp-devel-1.4.4-2.8.1 References: https://bugzilla.novell.com/839475

1 0

openSUSE-RU-2013:1580-1: moderate: timezone: regular update to V2013f
by maintenance＠opensuse.org 27 Oct '13

27 Oct '13

openSUSE Recommended Update: timezone: regular update to V2013f ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1580-1 Rating: moderate References: Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues with timezone: - Update to V2013f + many updates for Tocantins, Jordan, Palestine, Paraguay, Fiji, Indonesia, etc. see NEWS for details Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-148 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): timezone-2013f-26.1 timezone-debuginfo-2013f-26.1 timezone-debugsource-2013f-26.1 - openSUSE 11.4 (noarch): timezone-java-2013f-26.1 References:

1 0

openSUSE-SU-2013:1579-1: moderate: nmap: security fix for http-domino-enum-passwords script
by opensuse-security＠opensuse.org 25 Oct '13

25 Oct '13

openSUSE Security Update: nmap: security fix for http-domino-enum-passwords script ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1579-1 Rating: moderate References: #844953 Cross-References: CVE-2013-4885 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: nmap was updated to fix bnc#844953/CVE-2013-4885: There was a vulnerability in one of our 437 NSE scripts. If you ran the (fortunately non-default) http-domino-enum-passwords script with the (fortunately also non-default) domino-enum-passwords.idpath parameter against a malicious server, it could cause an arbitrarily named file to to be written to the client system. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-790 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): ncat-6.01-1.5.1 ndiff-6.01-1.5.1 nmap-6.01-1.5.1 nmap-debuginfo-6.01-1.5.1 nmap-debugsource-6.01-1.5.1 nping-6.01-1.5.1 zenmap-6.01-1.5.1 References: http://support.novell.com/security/cve/CVE-2013-4885.html https://bugzilla.novell.com/844953

1 0

openSUSE-RU-2013:1573-1: moderate: kdebase4-workspace: various bugfixes
by maintenance＠opensuse.org 24 Oct '13

24 Oct '13

openSUSE Recommended Update: kdebase4-workspace: various bugfixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1573-1 Rating: moderate References: #726550 #809835 #845809 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: kdebase4-workspace was updated to fix several bugs: - Adjust kdm-sysconfig-values.diff to set default boot loader to "Grub2" in kdm's kcm as well (bnc#845809) - Added fix-click-on-trash-plasmoid.diff: Fix click on trashcan plasmoid when on desktop and widgets are unlocked (kde#325330) - Added kscreensaver-disable-sessionmanagement.diff: disable session management for screensavers prevents screensaver windows popping up at login (kde#314859, bnc#809835) - Added add-calculator-hotkey.patch, which adds a default hotkey to launch KCalc on pressing the Calculator button (bnc#726550) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-789 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): kde4-kgreeter-plugins-4.10.5-1.115.1 kde4-kgreeter-plugins-debuginfo-4.10.5-1.115.1 kdebase4-workspace-4.10.5-1.115.1 kdebase4-workspace-branding-upstream-4.10.5-1.115.1 kdebase4-workspace-debuginfo-4.10.5-1.115.1 kdebase4-workspace-debugsource-4.10.5-1.115.1 kdebase4-workspace-devel-4.10.5-1.115.1 kdebase4-workspace-devel-debuginfo-4.10.5-1.115.1 kdebase4-workspace-ksysguardd-4.10.5-1.115.1 kdebase4-workspace-ksysguardd-debuginfo-4.10.5-1.115.1 kdebase4-workspace-liboxygenstyle-4.10.5-1.115.1 kdebase4-workspace-liboxygenstyle-debuginfo-4.10.5-1.115.1 kdebase4-workspace-plasma-calendar-4.10.5-1.115.1 kdebase4-workspace-plasma-calendar-debuginfo-4.10.5-1.115.1 kdm-4.10.5-1.115.1 kdm-branding-upstream-4.10.5-1.115.1 kdm-debuginfo-4.10.5-1.115.1 kwin-4.10.5-1.115.1 kwin-debuginfo-4.10.5-1.115.1 python-kdebase4-4.10.5-1.115.1 - openSUSE 12.3 (x86_64): kdebase4-workspace-liboxygenstyle-32bit-4.10.5-1.115.1 kdebase4-workspace-liboxygenstyle-debuginfo-32bit-4.10.5-1.115.1 References: https://bugzilla.novell.com/726550 https://bugzilla.novell.com/809835 https://bugzilla.novell.com/845809

1 0

openSUSE-SU-2013:1571-1: moderate: update for jakarta-commons-fileupload
by opensuse-security＠opensuse.org 23 Oct '13

23 Oct '13

openSUSE Security Update: update for jakarta-commons-fileupload ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1571-1 Rating: moderate References: #846174 Cross-References: CVE-2013-2186 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A remote attacker could supply a serialized instance of the DiskFileItem class, which would be deserialized on a server and write arbitrary content to any location on the server that is permitted by the user running the application server process. bnc#846174/CVE-2013-2186 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-786 - openSUSE 12.2: zypper in -t patch openSUSE-2013-786 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): jakarta-commons-fileupload-1.1.1-114.4.1 jakarta-commons-fileupload-javadoc-1.1.1-114.4.1 - openSUSE 12.2 (noarch): jakarta-commons-fileupload-1.1.1-112.4.1 jakarta-commons-fileupload-javadoc-1.1.1-112.4.1 References: http://support.novell.com/security/cve/CVE-2013-2186.html https://bugzilla.novell.com/846174

1 0

openSUSE-SU-2013:1563-1: moderate: proftpd: security and bugfix update to 1.3.4d
by opensuse-security＠opensuse.org 22 Oct '13

22 Oct '13

openSUSE Security Update: proftpd: security and bugfix update to 1.3.4d ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1563-1 Rating: moderate References: #787884 #811793 #843444 Cross-References: CVE-2013-4359 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: proftpd was updated to 1.3.4d. * Fixed broken build when using --disable-ipv6 configure option * Fixed mod_sql "SQLAuthType Backend" MySQL issues - fix for bnc#843444 (CVE-2013-4359) * http://bugs.proftpd.org/show_bug.cgi?id=3973 * add proftpd-sftp-kbdint-max-responses-bug3973.patch - Improve systemd service file - use upstream tmpfiles.d file. related to [bnc#811793] - Use /run instead of /var/run - update to 1.3.4c * Added Spanish translation. * Fixed several mod_sftp issues, including SFTPPassPhraseProvider, handling of symlinks for REALPATH requests, and response code logging. * Fixed symlink race for creating directories when UserOwner is in effect. * Increased performance of FTP directory listings. - rebase and rename patches (remove version string) * proftpd-1.3.4a-dist.patch -> proftpd-dist.patch * proftpd-1.3.4a-ftpasswd.patch -> proftpd-ftpasswd.patch * proftpd-1.3.4a-strip.patch -> proftpd-strip.patch - fix proftpd.conf (rebase basic.conf patch) * IdentLookups is now a seperate module <IfModule mod_ident.c> IdentLookups on/off </IfModule> is needed and module is not built cause crrodriguez disabled it. - fix for bnc#787884 (https://bugzilla.novell.com/show_bug.cgi?id=787884) * added extra Source proftpd.conf.tmpfile - Disable ident lookups, this protocol is totally obsolete and dangerous. (add --disable-ident) - Fix debug info generation ( add --disable-strip) - Add systemd unit - update to 1.3.4b + Fixed mod_ldap segfault on login when LDAPUsers with no filters used. + Fixed sporadic SFTP upload issues for large files. + Fixed SSH2 handling for some clients (e.g. OpenVMS). + New FactsOptions directive; see doc/modules/mod_facts.html#FactsOptions + Fixed build errors on Tru64, AIX, Cygwin. - add Source Signatuire (.asc) file - add noBuildDate patch - add lang pkg * --enable-nls - add configure option * --enable-openssl, --with-lastlog Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-778 - openSUSE 12.2: zypper in -t patch openSUSE-2013-778 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): proftpd-1.3.4d-4.4.5 proftpd-debuginfo-1.3.4d-4.4.5 proftpd-debugsource-1.3.4d-4.4.5 proftpd-devel-1.3.4d-4.4.5 proftpd-doc-1.3.4d-4.4.5 proftpd-ldap-1.3.4d-4.4.5 proftpd-ldap-debuginfo-1.3.4d-4.4.5 proftpd-mysql-1.3.4d-4.4.5 proftpd-mysql-debuginfo-1.3.4d-4.4.5 proftpd-pgsql-1.3.4d-4.4.5 proftpd-pgsql-debuginfo-1.3.4d-4.4.5 proftpd-radius-1.3.4d-4.4.5 proftpd-radius-debuginfo-1.3.4d-4.4.5 proftpd-sqlite-1.3.4d-4.4.5 proftpd-sqlite-debuginfo-1.3.4d-4.4.5 - openSUSE 12.3 (noarch): proftpd-lang-1.3.4d-4.4.5 - openSUSE 12.2 (i586 x86_64): proftpd-1.3.4d-2.5.1 proftpd-debuginfo-1.3.4d-2.5.1 proftpd-debugsource-1.3.4d-2.5.1 proftpd-devel-1.3.4d-2.5.1 proftpd-doc-1.3.4d-2.5.1 proftpd-ldap-1.3.4d-2.5.1 proftpd-ldap-debuginfo-1.3.4d-2.5.1 proftpd-mysql-1.3.4d-2.5.1 proftpd-mysql-debuginfo-1.3.4d-2.5.1 proftpd-pgsql-1.3.4d-2.5.1 proftpd-pgsql-debuginfo-1.3.4d-2.5.1 proftpd-radius-1.3.4d-2.5.1 proftpd-radius-debuginfo-1.3.4d-2.5.1 proftpd-sqlite-1.3.4d-2.5.1 proftpd-sqlite-debuginfo-1.3.4d-2.5.1 - openSUSE 12.2 (noarch): proftpd-lang-1.3.4d-2.5.1 References: http://support.novell.com/security/cve/CVE-2013-4359.html https://bugzilla.novell.com/787884 https://bugzilla.novell.com/811793 https://bugzilla.novell.com/843444

1 0

openSUSE-SU-2013:1562-1: moderate: spice-gtk: fixed race condition in pid checking
by opensuse-security＠opensuse.org 22 Oct '13

22 Oct '13

openSUSE Security Update: spice-gtk: fixed race condition in pid checking ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1562-1 Rating: moderate References: #844967 Cross-References: CVE-2013-4324 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: spice-gtk received fixes for the acl helper policy kit checks that had a race condition in PID checking. (CVE-2013-4324, bnc#844967). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-777 - openSUSE 12.2: zypper in -t patch openSUSE-2013-777 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libspice-client-glib-2_0-8-0.14-3.4.1 libspice-client-glib-2_0-8-debuginfo-0.14-3.4.1 libspice-client-gtk-2_0-4-0.14-3.4.1 libspice-client-gtk-2_0-4-debuginfo-0.14-3.4.1 libspice-client-gtk-3_0-4-0.14-3.4.1 libspice-client-gtk-3_0-4-debuginfo-0.14-3.4.1 libspice-controller0-0.14-3.4.1 libspice-controller0-debuginfo-0.14-3.4.1 python-SpiceClientGtk-0.14-3.4.1 python-SpiceClientGtk-debuginfo-0.14-3.4.1 spice-gtk-0.14-3.4.1 spice-gtk-debuginfo-0.14-3.4.1 spice-gtk-debugsource-0.14-3.4.1 spice-gtk-devel-0.14-3.4.1 typelib-1_0-SpiceClientGlib-2_0-0.14-3.4.1 typelib-1_0-SpiceClientGtk-2_0-0.14-3.4.1 typelib-1_0-SpiceClientGtk-3_0-0.14-3.4.1 - openSUSE 12.3 (noarch): spice-gtk-lang-0.14-3.4.1 - openSUSE 12.2 (i586 x86_64): libspice-client-glib-2_0-1-0.12-2.4.1 libspice-client-glib-2_0-1-debuginfo-0.12-2.4.1 libspice-client-gtk-2_0-1-0.12-2.4.1 libspice-client-gtk-2_0-1-debuginfo-0.12-2.4.1 libspice-client-gtk-3_0-1-0.12-2.4.1 libspice-client-gtk-3_0-1-debuginfo-0.12-2.4.1 libspice-controller0-0.12-2.4.1 libspice-controller0-debuginfo-0.12-2.4.1 python-SpiceClientGtk-0.12-2.4.1 python-SpiceClientGtk-debuginfo-0.12-2.4.1 spice-gtk-0.12-2.4.1 spice-gtk-debuginfo-0.12-2.4.1 spice-gtk-debugsource-0.12-2.4.1 spice-gtk-devel-0.12-2.4.1 typelib-1_0-SpiceClientGlib-2_0-0.12-2.4.1 typelib-1_0-SpiceClientGtk-2_0-0.12-2.4.1 typelib-1_0-SpiceClientGtk-3_0-0.12-2.4.1 - openSUSE 12.2 (noarch): spice-gtk-lang-0.12-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-4324.html https://bugzilla.novell.com/844967

1 0

openSUSE-SU-2013:1561-1: moderate: nmap: fixed http-domino-enum-passwords script
by opensuse-security＠opensuse.org 21 Oct '13

21 Oct '13

openSUSE Security Update: nmap: fixed http-domino-enum-passwords script ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1561-1 Rating: moderate References: #844953 Cross-References: CVE-2013-4885 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: nmap was updated to fix the http-domino-enum-passwords scripts. If you ran the (fortunately non-default) http-domino-enum-passwords script with the (fortunately also non-default) domino-enum-passwords.idpath parameter against a malicious server, it could cause an arbitrarily named file to to be written to the client system. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-776 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): ncat-6.25-3.4.2 ndiff-6.25-3.4.2 nmap-6.25-3.4.2 nmap-debuginfo-6.25-3.4.2 nmap-debugsource-6.25-3.4.2 nping-6.25-3.4.2 zenmap-6.25-3.4.2 References: http://support.novell.com/security/cve/CVE-2013-4885.html https://bugzilla.novell.com/844953

1 0

openSUSE-SU-2013:1560-1: lcms: fixed stack overflow issues in lcms utilities
by opensuse-security＠opensuse.org 19 Oct '13

19 Oct '13

openSUSE Security Update: lcms: fixed stack overflow issues in lcms utilities ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1560-1 Rating: low References: #843716 Cross-References: CVE-2013-4276 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Some minor stackoverflows in lcms utilities were fixed. (CVE-2013-4276) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-147 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): lcms-1.19-5.1 lcms-debuginfo-1.19-5.1 lcms-debugsource-1.19-5.1 liblcms-devel-1.19-5.1 liblcms1-1.19-5.1 liblcms1-debuginfo-1.19-5.1 python-lcms-1.19-5.1 python-lcms-debuginfo-1.19-5.1 - openSUSE 11.4 (x86_64): liblcms-devel-32bit-1.19-5.1 liblcms1-32bit-1.19-5.1 liblcms1-debuginfo-32bit-1.19-5.1 - openSUSE 11.4 (ia64): liblcms1-debuginfo-x86-1.19-5.1 liblcms1-x86-1.19-5.1 References: http://support.novell.com/security/cve/CVE-2013-4276.html https://bugzilla.novell.com/843716

1 0

openSUSE-RU-2013:1558-1: important: various fixes for gcin (#bnc843918)
by maintenance＠opensuse.org 17 Oct '13

17 Oct '13

openSUSE Recommended Update: various fixes for gcin (#bnc843918) ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1558-1 Rating: important References: #843918 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: fix: gcin now can input in firefox/chrome. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-770 - openSUSE 12.2: zypper in -t patch openSUSE-2013-770 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): gcin-2.7.9-4.4.2 gcin-anthy-module-2.7.9-4.4.2 gcin-anthy-module-debuginfo-2.7.9-4.4.2 gcin-branding-upstream-2.7.9-4.4.2 gcin-debuginfo-2.7.9-4.4.2 gcin-debugsource-2.7.9-4.4.2 gcin-gtk2-immodule-2.7.9-4.4.2 gcin-gtk2-immodule-debuginfo-2.7.9-4.4.2 gcin-gtk3-immodule-2.7.9-4.4.2 gcin-gtk3-immodule-debuginfo-2.7.9-4.4.2 gcin-qt4-immodule-2.7.9-4.4.2 gcin-qt4-immodule-debuginfo-2.7.9-4.4.2 - openSUSE 12.3 (x86_64): gcin-32bit-2.7.9-4.4.2 gcin-debuginfo-32bit-2.7.9-4.4.2 gcin-gtk2-immodule-32bit-2.7.9-4.4.2 gcin-gtk2-immodule-debuginfo-32bit-2.7.9-4.4.2 gcin-gtk3-immodule-32bit-2.7.9-4.4.2 gcin-gtk3-immodule-debuginfo-32bit-2.7.9-4.4.2 gcin-qt4-immodule-32bit-2.7.9-4.4.2 gcin-qt4-immodule-debuginfo-32bit-2.7.9-4.4.2 - openSUSE 12.2 (i586 x86_64): gcin-2.7.5-4.4.1 gcin-anthy-module-2.7.5-4.4.1 gcin-branding-upstream-2.7.5-4.4.1 gcin-chewing-module-2.7.5-4.4.1 gcin-gtk2-immodule-2.7.5-4.4.1 gcin-gtk3-immodule-2.7.5-4.4.1 gcin-qt4-immodule-2.7.5-4.4.1 - openSUSE 12.2 (x86_64): gcin-32bit-2.7.5-4.4.1 gcin-gtk2-immodule-32bit-2.7.5-4.4.1 gcin-gtk3-immodule-32bit-2.7.5-4.4.1 gcin-qt4-immodule-32bit-2.7.5-4.4.1 References: https://bugzilla.novell.com/843918

1 0

openSUSE-SU-2013:1556-1: important: chromium: 30.0.1599.66 security and bugfix update
by opensuse-security＠opensuse.org 16 Oct '13

16 Oct '13

openSUSE Security Update: chromium: 30.0.1599.66 security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1556-1 Rating: important References: #779448 #825157 #831584 #836059 Cross-References: CVE-2013-2906 CVE-2013-2907 CVE-2013-2908 CVE-2013-2909 CVE-2013-2910 CVE-2013-2911 CVE-2013-2912 CVE-2013-2913 CVE-2013-2914 CVE-2013-2915 CVE-2013-2916 CVE-2013-2917 CVE-2013-2918 CVE-2013-2919 CVE-2013-2920 CVE-2013-2921 CVE-2013-2922 CVE-2013-2923 CVE-2013-2924 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: Update to Chromium 30.0.1599.66: - Easier searching by image - A number of new apps/extension APIs - Lots of under the hood changes for stability and performance - Security fixes: + CVE-2013-2906: Races in Web Audio + CVE-2013-2907: Out of bounds read in Window.prototype object + CVE-2013-2908: Address bar spoofing related to the “204 No Content” status code + CVE-2013-2909: Use after free in inline-block rendering + CVE-2013-2910: Use-after-free in Web Audio + CVE-2013-2911: Use-after-free in XSLT + CVE-2013-2912: Use-after-free in PPAPI + CVE-2013-2913: Use-after-free in XML document parsing + CVE-2013-2914: Use after free in the Windows color chooser dialog + CVE-2013-2915: Address bar spoofing via a malformed scheme + CVE-2013-2916: Address bar spoofing related to the “204 No Content” status code + CVE-2013-2917: Out of bounds read in Web Audio + CVE-2013-2918: Use-after-free in DOM + CVE-2013-2919: Memory corruption in V8 + CVE-2013-2920: Out of bounds read in URL parsing + CVE-2013-2921: Use-after-free in resource loader + CVE-2013-2922: Use-after-free in template element + CVE-2013-2923: Various fixes from internal audits, fuzzing and other initiatives + CVE-2013-2924: Use-after-free in ICU. Upstream bug - Add patch chromium-fix-altgrkeys.diff - Make sure that AltGr is treated correctly (issue#296835) - Do not build with system libxml (bnc#825157) - Update to Chromium 31.0.1640.0 * Bug and Stability Fixes - Fix destkop file for chromium by removing extension from icon - Change the methodology for the Chromium packages. Build is now based on an official tarball. As soon as the Beta channel catches up with the current version, Chromium will be based on the Beta channel instead of svn snapshots - Update to 31.0.1632 * Bug and Stability fixes - Added the flag --enable-threaded-compositing to the startup script. This flag seems to be required when hardware acceleration is in use. This prevents websites from locking up on users in certain cases. - Update to 31.0.1627 * Bug and Stability fixes - Update to 31.0.1619 * bug and Stability fixes - require mozilla-nss-devel >= 3.14 and mozilla-nspr-devel >= 4.9.5 - Add patch exclude_ymp.diff to ensure that 1-click-install files are downloaded and NOT opened (bnc#836059) - Update to 31.0.1611 * Bug and stability fixes - Update to 31.0.1605 * Bug and stability fixes - Change the startup script so that Chromium will not start when the chrome_sandbox doesn't have the SETUID. (bnc#779448) - Update to 31.0.1601 * Bug and stability fixes - Update to 30.0.1594 * Bug and stability fixes - Correct specfile to properly own /usr/bin/chromium (bnc#831584) - Chromium now expects the SUID-helper installed in the same directory as chromium. So let's create a symlink to the helper in /usr/lib - Update to 30.0.1587 * Bug and stability fixes - Remove patch chromium-nss-compliant.diff (Upstream) - Update to 30.0.1575 * Bug and stability fixes * Enable the gpu-sandbox again due to upstream fix (chromium#255063) - Update to 30.0.1567 * bug and Stability fixes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-769 - openSUSE 12.2: zypper in -t patch openSUSE-2013-769 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): chromedriver-30.0.1599.66-1.11.2 chromedriver-debuginfo-30.0.1599.66-1.11.2 chromium-30.0.1599.66-1.11.2 chromium-debuginfo-30.0.1599.66-1.11.2 chromium-debugsource-30.0.1599.66-1.11.2 chromium-desktop-gnome-30.0.1599.66-1.11.2 chromium-desktop-kde-30.0.1599.66-1.11.2 chromium-ffmpegsumo-30.0.1599.66-1.11.2 chromium-ffmpegsumo-debuginfo-30.0.1599.66-1.11.2 chromium-suid-helper-30.0.1599.66-1.11.2 chromium-suid-helper-debuginfo-30.0.1599.66-1.11.2 - openSUSE 12.2 (i586 x86_64): chromedriver-30.0.1599.66-1.46.1 chromedriver-debuginfo-30.0.1599.66-1.46.1 chromium-30.0.1599.66-1.46.1 chromium-debuginfo-30.0.1599.66-1.46.1 chromium-debugsource-30.0.1599.66-1.46.1 chromium-desktop-gnome-30.0.1599.66-1.46.1 chromium-desktop-kde-30.0.1599.66-1.46.1 chromium-ffmpegsumo-30.0.1599.66-1.46.1 chromium-ffmpegsumo-debuginfo-30.0.1599.66-1.46.1 chromium-suid-helper-30.0.1599.66-1.46.1 chromium-suid-helper-debuginfo-30.0.1599.66-1.46.1 References: http://support.novell.com/security/cve/CVE-2013-2906.html http://support.novell.com/security/cve/CVE-2013-2907.html http://support.novell.com/security/cve/CVE-2013-2908.html http://support.novell.com/security/cve/CVE-2013-2909.html http://support.novell.com/security/cve/CVE-2013-2910.html http://support.novell.com/security/cve/CVE-2013-2911.html http://support.novell.com/security/cve/CVE-2013-2912.html http://support.novell.com/security/cve/CVE-2013-2913.html http://support.novell.com/security/cve/CVE-2013-2914.html http://support.novell.com/security/cve/CVE-2013-2915.html http://support.novell.com/security/cve/CVE-2013-2916.html http://support.novell.com/security/cve/CVE-2013-2917.html http://support.novell.com/security/cve/CVE-2013-2918.html http://support.novell.com/security/cve/CVE-2013-2919.html http://support.novell.com/security/cve/CVE-2013-2920.html http://support.novell.com/security/cve/CVE-2013-2921.html http://support.novell.com/security/cve/CVE-2013-2922.html http://support.novell.com/security/cve/CVE-2013-2923.html http://support.novell.com/security/cve/CVE-2013-2924.html https://bugzilla.novell.com/779448 https://bugzilla.novell.com/825157 https://bugzilla.novell.com/831584 https://bugzilla.novell.com/836059

1 0

openSUSE-RU-2013:1555-1: moderate: aaa_base: fixes JRE_HOME overwriting
by maintenance＠opensuse.org 16 Oct '13

16 Oct '13

openSUSE Recommended Update: aaa_base: fixes JRE_HOME overwriting ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1555-1 Rating: moderate References: #841284 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The alljava.sh script was changed to set JRE_HOME only in a case it was not defined before (bnc#841284) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-768 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): aaa_base-12.3-14.12.1 aaa_base-debuginfo-12.3-14.12.1 aaa_base-debugsource-12.3-14.12.1 aaa_base-extras-12.3-14.12.1 aaa_base-malloccheck-12.3-14.12.1 References: https://bugzilla.novell.com/841284

1 0

openSUSE-SU-2013:1552-1: moderate: gpg2: fixed a denial of service attack
by opensuse-security＠opensuse.org 16 Oct '13

16 Oct '13

openSUSE Security Update: gpg2: fixed a denial of service attack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1552-1 Rating: moderate References: #844175 Cross-References: CVE-2013-4402 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gpg2 was updated to fix a denial of service attack through infinite recursion in the compressed packet parser [bnc#844175] [CVE-2013-4402]. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-146 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gpg2-2.0.19-18.1 gpg2-debuginfo-2.0.19-18.1 gpg2-debugsource-2.0.19-18.1 - openSUSE 11.4 (noarch): gpg2-lang-2.0.19-18.1 References: http://support.novell.com/security/cve/CVE-2013-4402.html https://bugzilla.novell.com/844175

1 0

openSUSE-SU-2013:1550-1: moderate: libvirt: security and bugfix update
by opensuse-security＠opensuse.org 15 Oct '13

15 Oct '13

openSUSE Security Update: libvirt: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1550-1 Rating: moderate References: #810611 #820888 #836931 #837999 #838638 Cross-References: CVE-2013-4296 CVE-2013-4311 CVE-2013-5651 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: libvirt was updated to fix security issues and bugs: Security issues fixed: CVE-2013-4311: Add support for using 3-arg pkcheck syntax for process to avoid race conditions. CVE-2013-4296: Fix a crash (denial of service) in remoteDispatchDomainMemoryStats CVE-2013-5651: Fix virBitmapParse to avoid access beyond bounds of array (denial of service crash). Also bugs were fixed: - nwfilter: check for inverted ctdir. bnc#810611 - Add xencommons as 'Wanted' in the systemd libvirtd service file. bnc#820888 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-763 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libvirt-1.0.2-1.10.1 libvirt-client-1.0.2-1.10.1 libvirt-client-debuginfo-1.0.2-1.10.1 libvirt-debuginfo-1.0.2-1.10.1 libvirt-debugsource-1.0.2-1.10.1 libvirt-devel-1.0.2-1.10.1 libvirt-doc-1.0.2-1.10.1 libvirt-lock-sanlock-1.0.2-1.10.1 libvirt-lock-sanlock-debuginfo-1.0.2-1.10.1 libvirt-python-1.0.2-1.10.1 libvirt-python-debuginfo-1.0.2-1.10.1 - openSUSE 12.3 (x86_64): libvirt-client-32bit-1.0.2-1.10.1 libvirt-client-debuginfo-32bit-1.0.2-1.10.1 libvirt-devel-32bit-1.0.2-1.10.1 References: http://support.novell.com/security/cve/CVE-2013-4296.html http://support.novell.com/security/cve/CVE-2013-4311.html http://support.novell.com/security/cve/CVE-2013-5651.html https://bugzilla.novell.com/810611 https://bugzilla.novell.com/820888 https://bugzilla.novell.com/836931 https://bugzilla.novell.com/837999 https://bugzilla.novell.com/838638

1 0

openSUSE-SU-2013:1549-1: moderate: libvirt: fixed security bugs
by opensuse-security＠opensuse.org 15 Oct '13

15 Oct '13

openSUSE Security Update: libvirt: fixed security bugs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1549-1 Rating: moderate References: #836931 #838638 Cross-References: CVE-2013-4296 CVE-2013-4311 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: libvirt was updated to fix 2 security issues: CVE-2013-4311: Add support for using 3-arg pkcheck syntax for process, which previously could be used for race conditions to gain privileges. CVE-2013-4296: Fix crash in remoteDispatchDomainMemoryStats Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-764 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libvirt-0.9.11.9-1.13.1 libvirt-client-0.9.11.9-1.13.1 libvirt-client-debuginfo-0.9.11.9-1.13.1 libvirt-debuginfo-0.9.11.9-1.13.1 libvirt-debugsource-0.9.11.9-1.13.1 libvirt-devel-0.9.11.9-1.13.1 libvirt-doc-0.9.11.9-1.13.1 libvirt-lock-sanlock-0.9.11.9-1.13.1 libvirt-lock-sanlock-debuginfo-0.9.11.9-1.13.1 libvirt-python-0.9.11.9-1.13.1 libvirt-python-debuginfo-0.9.11.9-1.13.1 - openSUSE 12.2 (x86_64): libvirt-client-32bit-0.9.11.9-1.13.1 libvirt-client-debuginfo-32bit-0.9.11.9-1.13.1 libvirt-devel-32bit-0.9.11.9-1.13.1 References: http://support.novell.com/security/cve/CVE-2013-4296.html http://support.novell.com/security/cve/CVE-2013-4311.html https://bugzilla.novell.com/836931 https://bugzilla.novell.com/838638

1 0

openSUSE-SU-2013:1548-1: moderate: rtkit: fixed a race condition in pid checking
by opensuse-security＠opensuse.org 14 Oct '13

14 Oct '13

openSUSE Security Update: rtkit: fixed a race condition in pid checking ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1548-1 Rating: moderate References: #836939 Cross-References: CVE-2013-4326 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rtkit was fixed to avoid a TOCTOU race condition that might have allowed local attackers to gain realtime rights they should not have. (CVE-2013-4326) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-755 - openSUSE 12.2: zypper in -t patch openSUSE-2013-755 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): rtkit-0.11_git201205151338-3.4.1 rtkit-debuginfo-0.11_git201205151338-3.4.1 rtkit-debugsource-0.11_git201205151338-3.4.1 - openSUSE 12.2 (i586 x86_64): rtkit-0.10_git201107141740-9.4.1 rtkit-debuginfo-0.10_git201107141740-9.4.1 rtkit-debugsource-0.10_git201107141740-9.4.1 References: http://support.novell.com/security/cve/CVE-2013-4326.html https://bugzilla.novell.com/836939

1 0

openSUSE-SU-2013:1547-1: lcms: fixed stack overflow issues in lcms utilities
by opensuse-security＠opensuse.org 14 Oct '13

14 Oct '13

openSUSE Security Update: lcms: fixed stack overflow issues in lcms utilities ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1547-1 Rating: low References: #843716 Cross-References: CVE-2013-4276 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Some minor stackoverflows in lcms utilities were fixed. (CVE-2013-4276). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-757 - openSUSE 12.2: zypper in -t patch openSUSE-2013-757 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): lcms-1.19-11.4.1 lcms-debuginfo-1.19-11.4.1 lcms-debugsource-1.19-11.4.1 liblcms-devel-1.19-11.4.1 liblcms1-1.19-11.4.1 liblcms1-debuginfo-1.19-11.4.1 python-lcms-1.19-11.4.1 python-lcms-debuginfo-1.19-11.4.1 - openSUSE 12.3 (x86_64): liblcms-devel-32bit-1.19-11.4.1 liblcms1-32bit-1.19-11.4.1 liblcms1-debuginfo-32bit-1.19-11.4.1 - openSUSE 12.2 (i586 x86_64): lcms-1.19-9.4.1 lcms-debuginfo-1.19-9.4.1 lcms-debugsource-1.19-9.4.1 liblcms-devel-1.19-9.4.1 liblcms1-1.19-9.4.1 liblcms1-debuginfo-1.19-9.4.1 python-lcms-1.19-9.4.1 python-lcms-debuginfo-1.19-9.4.1 - openSUSE 12.2 (x86_64): liblcms-devel-32bit-1.19-9.4.1 liblcms1-32bit-1.19-9.4.1 liblcms1-debuginfo-32bit-1.19-9.4.1 References: http://support.novell.com/security/cve/CVE-2013-4276.html https://bugzilla.novell.com/843716

1 0

openSUSE-SU-2013:1546-1: moderate: gpg2: fixed a denial of service attack
by opensuse-security＠opensuse.org 14 Oct '13

14 Oct '13

openSUSE Security Update: gpg2: fixed a denial of service attack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1546-1 Rating: moderate References: #844175 Cross-References: CVE-2013-4402 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gpg2 was updated to fix a denial of service attack through infinite recursion in the compressed packet parser [bnc#844175] [CVE-2013-4402]. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-758 - openSUSE 12.2: zypper in -t patch openSUSE-2013-758 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): gpg2-2.0.19-5.12.1 gpg2-debuginfo-2.0.19-5.12.1 gpg2-debugsource-2.0.19-5.12.1 - openSUSE 12.3 (noarch): gpg2-lang-2.0.19-5.12.1 - openSUSE 12.2 (i586 x86_64): gpg2-2.0.19-2.17.1 gpg2-debuginfo-2.0.19-2.17.1 gpg2-debugsource-2.0.19-2.17.1 - openSUSE 12.2 (noarch): gpg2-lang-2.0.19-2.17.1 References: http://support.novell.com/security/cve/CVE-2013-4402.html https://bugzilla.novell.com/844175

1 0

openSUSE-RU-2013:1545-1: make: fixed dependency tracking of library targets
by maintenance＠opensuse.org 14 Oct '13

14 Oct '13

openSUSE Recommended Update: make: fixed dependency tracking of library targets ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1545-1 Rating: low References: #841457 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Make was fixed in regards to dependency tracking of library targets in (foo.o bar.o) style. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-756 - openSUSE 12.2: zypper in -t patch openSUSE-2013-756 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): make-3.82-154.4.1 make-debuginfo-3.82-154.4.1 make-debugsource-3.82-154.4.1 - openSUSE 12.2 (i586 x86_64): make-3.82-151.9.1 make-debuginfo-3.82-151.9.1 make-debugsource-3.82-151.9.1 References: https://bugzilla.novell.com/841457

1 0

openSUSE-RU-2013:1544-1: moderate: dbus-1: update to help migration to 13.1
by maintenance＠opensuse.org 11 Oct '13

11 Oct '13

openSUSE Recommended Update: dbus-1: update to help migration to 13.1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1544-1 Rating: moderate References: #802525 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: A migration help for 12.3 - 13.1 migration in dbus was added that helps migrating from /var/run to /run. (bnc#802525) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-754 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): dbus-1-1.6.8-2.10.1 dbus-1-debuginfo-1.6.8-2.10.1 dbus-1-debugsource-1.6.8-2.10.1 dbus-1-devel-1.6.8-2.10.1 dbus-1-x11-1.6.8-2.10.1 dbus-1-x11-debuginfo-1.6.8-2.10.1 dbus-1-x11-debugsource-1.6.8-2.10.1 libdbus-1-3-1.6.8-2.10.1 libdbus-1-3-debuginfo-1.6.8-2.10.1 - openSUSE 12.3 (x86_64): dbus-1-32bit-1.6.8-2.10.1 dbus-1-debuginfo-32bit-1.6.8-2.10.1 dbus-1-devel-32bit-1.6.8-2.10.1 libdbus-1-3-32bit-1.6.8-2.10.1 libdbus-1-3-debuginfo-32bit-1.6.8-2.10.1 - openSUSE 12.3 (noarch): dbus-1-devel-doc-1.6.8-2.10.1 References: https://bugzilla.novell.com/802525

1 0

openSUSE-RU-2013:1543-1: build: avoid modifying devpts mount during build
by maintenance＠opensuse.org 11 Oct '13

11 Oct '13

openSUSE Recommended Update: build: avoid modifying devpts mount during build ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1543-1 Rating: low References: #843775 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The build script used the incorrect devpts permissions which changed the global devpts mount incorrectly and in turn made konsole and other terminals not work. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-753 - openSUSE 12.2: zypper in -t patch openSUSE-2013-753 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): build-initvm-20121123-2.4.1 build-initvm-debuginfo-20121123-2.4.1 - openSUSE 12.3 (x86_64): build-initvm-debuginfo-32bit-20121123-2.4.1 build-initvm-debuginfo-i586-20121123-2.4.1 build-initvm-i586-20121123-2.4.1 - openSUSE 12.3 (noarch): build-20121123-2.4.1 build-mkbaselibs-20121123-2.4.1 build-mkdrpms-20121123-2.4.1 - openSUSE 12.2 (i586 x86_64): build-initvm-2012.07.19-1.4.1 build-initvm-debuginfo-2012.07.19-1.4.1 - openSUSE 12.2 (x86_64): build-initvm-debuginfo-32bit-2012.07.19-1.4.1 build-initvm-debuginfo-i586-2012.07.19-1.4.1 build-initvm-i586-2012.07.19-1.4.1 - openSUSE 12.2 (noarch): build-2012.07.19-1.4.1 build-mkbaselibs-2012.07.19-1.4.1 build-mkbaselibs-sle-2012.07.19-1.4.1 build-mkdrpms-2012.07.19-1.4.1 References: https://bugzilla.novell.com/843775

1 0

openSUSE-SU-2013:1542-1: moderate: update for mozilla-nss
by opensuse-security＠opensuse.org 10 Oct '13

10 Oct '13

openSUSE Security Update: update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1542-1 Rating: moderate References: #842979 Cross-References: CVE-2013-1739 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Update mozilla-nss to 3.15.2 which contains a fix to avoid uninitialized data read in the event of a decryption failure. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-144 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libfreebl3-3.15.2-66.1 libfreebl3-debuginfo-3.15.2-66.1 libsoftokn3-3.15.2-66.1 libsoftokn3-debuginfo-3.15.2-66.1 mozilla-nss-3.15.2-66.1 mozilla-nss-certs-3.15.2-66.1 mozilla-nss-certs-debuginfo-3.15.2-66.1 mozilla-nss-debuginfo-3.15.2-66.1 mozilla-nss-debugsource-3.15.2-66.1 mozilla-nss-devel-3.15.2-66.1 mozilla-nss-sysinit-3.15.2-66.1 mozilla-nss-sysinit-debuginfo-3.15.2-66.1 mozilla-nss-tools-3.15.2-66.1 mozilla-nss-tools-debuginfo-3.15.2-66.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.15.2-66.1 libfreebl3-debuginfo-32bit-3.15.2-66.1 libsoftokn3-32bit-3.15.2-66.1 libsoftokn3-debuginfo-32bit-3.15.2-66.1 mozilla-nss-32bit-3.15.2-66.1 mozilla-nss-certs-32bit-3.15.2-66.1 mozilla-nss-certs-debuginfo-32bit-3.15.2-66.1 mozilla-nss-debuginfo-32bit-3.15.2-66.1 mozilla-nss-sysinit-32bit-3.15.2-66.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.2-66.1 - openSUSE 11.4 (ia64): libfreebl3-debuginfo-x86-3.15.2-66.1 libfreebl3-x86-3.15.2-66.1 libsoftokn3-debuginfo-x86-3.15.2-66.1 libsoftokn3-x86-3.15.2-66.1 mozilla-nss-certs-debuginfo-x86-3.15.2-66.1 mozilla-nss-certs-x86-3.15.2-66.1 mozilla-nss-debuginfo-x86-3.15.2-66.1 mozilla-nss-sysinit-debuginfo-x86-3.15.2-66.1 mozilla-nss-sysinit-x86-3.15.2-66.1 mozilla-nss-x86-3.15.2-66.1 References: http://support.novell.com/security/cve/CVE-2013-1739.html https://bugzilla.novell.com/842979

1 0

openSUSE-SU-2013:1541-1: moderate: update for python-django
by opensuse-security＠opensuse.org 10 Oct '13

10 Oct '13

openSUSE Security Update: update for python-django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1541-1 Rating: moderate References: #840832 Cross-References: CVE-2013-1443 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python-django update fixes several security issues. - Update to version 1.4.8 (bnc#840832, CVE-2013-1443): + Fixed denial-of-service via large passwords - Changes from version 1.4.7: + Fixed directory traversal with ssi template tag - Changes from version 1.4.6: + Fixed Cross-site scripting (XSS) in admin interface + Fixed Possible XSS via is_safe_url Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-145 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): python-django-1.4.8-13.1 References: http://support.novell.com/security/cve/CVE-2013-1443.html https://bugzilla.novell.com/840832

1 0

openSUSE-SU-2013:1540-1: moderate: clutter: fixed a crash after system resume
by opensuse-security＠opensuse.org 10 Oct '13

10 Oct '13

openSUSE Security Update: clutter: fixed a crash after system resume ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1540-1 Rating: moderate References: #843441 Cross-References: CVE-2013-2190 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: clutter was updatd to fix improper translation of hierarchy events (gnome-shell crash after system resume) (CVE-2013-2190, bnc#843441). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-750 - openSUSE 12.2: zypper in -t patch openSUSE-2013-750 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): clutter-debugsource-1.12.2-2.4.1 clutter-devel-1.12.2-2.4.1 libclutter-1_0-0-1.12.2-2.4.1 libclutter-1_0-0-debuginfo-1.12.2-2.4.1 typelib-1_0-Clutter-1_0-1.12.2-2.4.1 - openSUSE 12.3 (x86_64): libclutter-1_0-0-32bit-1.12.2-2.4.1 libclutter-1_0-0-debuginfo-32bit-1.12.2-2.4.1 - openSUSE 12.3 (noarch): clutter-lang-1.12.2-2.4.1 - openSUSE 12.2 (i586 x86_64): clutter-debugsource-1.10.6-2.4.1 clutter-devel-1.10.6-2.4.1 libclutter-1_0-0-1.10.6-2.4.1 libclutter-1_0-0-debuginfo-1.10.6-2.4.1 typelib-1_0-Clutter-1_0-1.10.6-2.4.1 - openSUSE 12.2 (x86_64): libclutter-1_0-0-32bit-1.10.6-2.4.1 libclutter-1_0-0-debuginfo-32bit-1.10.6-2.4.1 - openSUSE 12.2 (noarch): clutter-lang-1.10.6-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-2190.html https://bugzilla.novell.com/843441

1 0

openSUSE-SU-2013:1539-1: moderate: update for mozilla-nss
by opensuse-security＠opensuse.org 10 Oct '13

10 Oct '13

openSUSE Security Update: update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1539-1 Rating: moderate References: #842979 Cross-References: CVE-2013-1739 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Mozilla NSS was updated to 3.15.2 (bnc#842979) * Support for AES-GCM ciphersuites that use the SHA-256 PRF * MD2, MD4, and MD5 signatures are no longer accepted for OCSP or CRLs * Add PK11_CipherFinal macro * sizeof() used incorrectly * nssutil_ReadSecmodDB() leaks memory * Allow SSL_HandshakeNegotiatedExtension to be called before the handshake is finished. * Deprecate the SSL cipher policy code * Avoid uninitialized data read in the event of a decryption failure. (CVE-2013-1739) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-749 - openSUSE 12.2: zypper in -t patch openSUSE-2013-749 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libfreebl3-3.15.2-1.16.1 libfreebl3-debuginfo-3.15.2-1.16.1 libsoftokn3-3.15.2-1.16.1 libsoftokn3-debuginfo-3.15.2-1.16.1 mozilla-nss-3.15.2-1.16.1 mozilla-nss-certs-3.15.2-1.16.1 mozilla-nss-certs-debuginfo-3.15.2-1.16.1 mozilla-nss-debuginfo-3.15.2-1.16.1 mozilla-nss-debugsource-3.15.2-1.16.1 mozilla-nss-devel-3.15.2-1.16.1 mozilla-nss-sysinit-3.15.2-1.16.1 mozilla-nss-sysinit-debuginfo-3.15.2-1.16.1 mozilla-nss-tools-3.15.2-1.16.1 mozilla-nss-tools-debuginfo-3.15.2-1.16.1 - openSUSE 12.3 (x86_64): libfreebl3-32bit-3.15.2-1.16.1 libfreebl3-debuginfo-32bit-3.15.2-1.16.1 libsoftokn3-32bit-3.15.2-1.16.1 libsoftokn3-debuginfo-32bit-3.15.2-1.16.1 mozilla-nss-32bit-3.15.2-1.16.1 mozilla-nss-certs-32bit-3.15.2-1.16.1 mozilla-nss-certs-debuginfo-32bit-3.15.2-1.16.1 mozilla-nss-debuginfo-32bit-3.15.2-1.16.1 mozilla-nss-sysinit-32bit-3.15.2-1.16.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.2-1.16.1 - openSUSE 12.2 (i586 x86_64): libfreebl3-3.15.2-2.27.1 libfreebl3-debuginfo-3.15.2-2.27.1 libsoftokn3-3.15.2-2.27.1 libsoftokn3-debuginfo-3.15.2-2.27.1 mozilla-nss-3.15.2-2.27.1 mozilla-nss-certs-3.15.2-2.27.1 mozilla-nss-certs-debuginfo-3.15.2-2.27.1 mozilla-nss-debuginfo-3.15.2-2.27.1 mozilla-nss-debugsource-3.15.2-2.27.1 mozilla-nss-devel-3.15.2-2.27.1 mozilla-nss-sysinit-3.15.2-2.27.1 mozilla-nss-sysinit-debuginfo-3.15.2-2.27.1 mozilla-nss-tools-3.15.2-2.27.1 mozilla-nss-tools-debuginfo-3.15.2-2.27.1 - openSUSE 12.2 (x86_64): libfreebl3-32bit-3.15.2-2.27.1 libfreebl3-debuginfo-32bit-3.15.2-2.27.1 libsoftokn3-32bit-3.15.2-2.27.1 libsoftokn3-debuginfo-32bit-3.15.2-2.27.1 mozilla-nss-32bit-3.15.2-2.27.1 mozilla-nss-certs-32bit-3.15.2-2.27.1 mozilla-nss-certs-debuginfo-32bit-3.15.2-2.27.1 mozilla-nss-debuginfo-32bit-3.15.2-2.27.1 mozilla-nss-sysinit-32bit-3.15.2-2.27.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.2-2.27.1 References: http://support.novell.com/security/cve/CVE-2013-1739.html https://bugzilla.novell.com/842979

1 0

openSUSE-RU-2013:1538-1: gummi: Fix crash on opening file
by maintenance＠opensuse.org 09 Oct '13

09 Oct '13

openSUSE Recommended Update: gummi: Fix crash on opening file ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1538-1 Rating: low References: #840589 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with gummi: - bnc#840589: Fix crash on opening file Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-748 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): gummi-0.6.5-1.5.2 gummi-debuginfo-0.6.5-1.5.2 gummi-debugsource-0.6.5-1.5.2 References: https://bugzilla.novell.com/840589

1 0

openSUSE-RU-2013:1537-1: openssl: fixed VPN openconnect problem
by maintenance＠opensuse.org 09 Oct '13

09 Oct '13

openSUSE Recommended Update: openssl: fixed VPN openconnect problem ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1537-1 Rating: low References: #822642 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with openssl: - bnc#822642: fixed VPN openconnect problem. (DTLS handshake failed) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-747 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libopenssl-devel-1.0.1e-1.9.1 libopenssl1_0_0-1.0.1e-1.9.1 libopenssl1_0_0-debuginfo-1.0.1e-1.9.1 openssl-1.0.1e-1.9.1 openssl-debuginfo-1.0.1e-1.9.1 openssl-debugsource-1.0.1e-1.9.1 - openSUSE 12.3 (x86_64): libopenssl-devel-32bit-1.0.1e-1.9.1 libopenssl1_0_0-32bit-1.0.1e-1.9.1 libopenssl1_0_0-debuginfo-32bit-1.0.1e-1.9.1 - openSUSE 12.3 (noarch): openssl-doc-1.0.1e-1.9.1 References: https://bugzilla.novell.com/822642

1 0

openSUSE-RU-2013:1536-1: cryptsetup-mkinitrd: fix handling of wrong passphrase in initrd
by maintenance＠opensuse.org 09 Oct '13

09 Oct '13

openSUSE Recommended Update: cryptsetup-mkinitrd: fix handling of wrong passphrase in initrd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1536-1 Rating: low References: #795913 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with cryptsetup-mkinitrd: - bnc#795913: fix handling of wrong passphrase in initrd Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-746 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): cryptsetup-mkinitrd-0_201206151440-3.8.1 References: https://bugzilla.novell.com/795913

1 0

openSUSE-RU-2013:1535-1: moderate: claws-mail: Update to 3.9.2
by maintenance＠opensuse.org 08 Oct '13

08 Oct '13

openSUSE Recommended Update: claws-mail: Update to 3.9.2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1535-1 Rating: moderate References: #816881 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with claws-mail: - Update to version 3.9.2 (bnc#816881). + New big icon for compose windows. + Never decode multipart/ or message/ parts, as RFC states. + Add missing check for libperl. + Fix check for libsoup - it is not obligatory. + Do not try to destroy a NULL session after an unsuccesful NNTP connect attempt. + The extraheaderrc format doesn't allow data after the header colon. Other OSes may insert extra characters other than \n, so, remove them all. + Fix undoing file insertion. + Fix check for python. + Fix detection of account in --compose and --compose-from-file where the From value contains a name + email. + Bugs fixed: claws#2923, claws#2927. - Update to version 3.9.1: + All plugins previously packaged as 'Extra Plugins' are now contained within the Claws Mail package. In addition to that, the following plugins have been dropped: TrayIcon, Dillo Viewer, and Gtkhtml2 Viewer. + 3 command-line switches have been added: * --cancel-receiving which cancels the currently running message retrieval operation. * --cancel-sending which cancels the currently running message sending operation. * --debug which toggles debug output. + '/Message/Cancel sending' has been added to the main menu. + In the filtering and processing condition configuration for Age, it is now possible to match based on number of hours. + The GnuPG signature timestamp is now displayed in the full signature information. + Support for GnuTLS priority string has been added. + Keep-alive pings are now performed on IMAP and NNTP connections. + In the Compose window, the focus is now moved to the message body when focus is in the Subject entry and the Enter key is pressed. + The Delete key can now be used to remove Colour Label hotkeys. + PDF Viewer: The printed PDF quality has been improved. + Fancy HTML viewer: The options dialogue has been completely reworked, and disabling remote content is now totally strict. + Python plugin: Added Cc field to messageinfo objects. + Python plugin: Added examples. + Python plugin: Added a function to get an arbitrary header from a MessageInfo object. + Perl plugin: The documentation for insert_perl.pl has been improved. + Basic handling of vcard 3.0 has been added to vcard2xml.py. + The man page has been updated. + Bugs fixed: claws#1137, claws#1684, claws#1963, claws#2340, claws#2617, claws#2624, claws#2702, claws#2774, claws#2785, claws#2801, claws#2826, claws#2828, claws#2832, claws#2835, claws#2859, claws#2862, claws#2863, claws#2878, claws#2879, claws#2882, claws#2885, claws#2890, claws#2893, claws#2903, claws#2909. + Updated translations. - Fix brp check failure due to some missing include headers. - Explicitly pass all --enable-*-plugins to configure, to ensure we will not lose any at any time. - Drop --enable-openssl configure parameter: no longer supported. - Fix crash with unknown encodings (bnc#816881) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-739 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): claws-mail-3.9.2-2.4.1 claws-mail-debuginfo-3.9.2-2.4.1 claws-mail-debugsource-3.9.2-2.4.1 claws-mail-devel-3.9.2-2.4.1 - openSUSE 12.3 (noarch): claws-mail-lang-3.9.2-2.4.1 References: https://bugzilla.novell.com/816881

1 0

openSUSE-RU-2013:1534-1: ladspa: Fix double free in destructor of caps plugin
by maintenance＠opensuse.org 08 Oct '13

08 Oct '13

openSUSE Recommended Update: ladspa: Fix double free in destructor of caps plugin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1534-1 Rating: low References: #842420 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with ladspa: - bnc#842420: Fix double free in destructor of caps plugin Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-740 - openSUSE 12.2: zypper in -t patch openSUSE-2013-740 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): ladspa-1.13-19.4.1 ladspa-debuginfo-1.13-19.4.1 ladspa-debugsource-1.13-19.4.1 - openSUSE 12.3 (x86_64): ladspa-32bit-1.13-19.4.1 ladspa-debuginfo-32bit-1.13-19.4.1 - openSUSE 12.3 (noarch): ladspa-devel-1.13-19.4.1 - openSUSE 12.2 (i586 x86_64): ladspa-1.13-17.4.1 ladspa-debuginfo-1.13-17.4.1 ladspa-debugsource-1.13-17.4.1 - openSUSE 12.2 (x86_64): ladspa-32bit-1.13-17.4.1 ladspa-debuginfo-32bit-1.13-17.4.1 - openSUSE 12.2 (noarch): ladspa-devel-1.13-17.4.1 References: https://bugzilla.novell.com/842420

1 0

openSUSE-RU-2013:1533-1: graphviz: several bugfixes
by maintenance＠opensuse.org 08 Oct '13

08 Oct '13

openSUSE Recommended Update: graphviz: several bugfixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1533-1 Rating: low References: #820631 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: graphviz received various bugfixes: - Add libXaw-devel to BuildRequires so that lefty is built (bnc#820631) - Use explicit list of binaries instead of wildcards so that missing binaries fail the build. - Add graphviz-add_shebang.patch that adds a shebang to gvmap.sh Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-678 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): graphviz-2.28.0-14.8.1 graphviz-debuginfo-2.28.0-14.8.1 graphviz-debugsource-2.28.0-14.8.1 graphviz-devel-2.28.0-14.8.1 graphviz-doc-2.28.0-14.8.2 graphviz-gd-2.28.0-14.8.2 graphviz-gd-debuginfo-2.28.0-14.8.2 graphviz-gnome-2.28.0-14.8.2 graphviz-gnome-debuginfo-2.28.0-14.8.2 graphviz-guile-2.28.0-14.8.2 graphviz-guile-debuginfo-2.28.0-14.8.2 graphviz-java-2.28.0-14.8.2 graphviz-lua-2.28.0-14.8.2 graphviz-lua-debuginfo-2.28.0-14.8.2 graphviz-ocaml-2.28.0-14.8.2 graphviz-ocaml-debuginfo-2.28.0-14.8.2 graphviz-perl-2.28.0-14.8.2 graphviz-perl-debuginfo-2.28.0-14.8.2 graphviz-php-2.28.0-14.8.2 graphviz-php-debuginfo-2.28.0-14.8.2 graphviz-plugins-debugsource-2.28.0-14.8.2 graphviz-python-2.28.0-14.8.2 graphviz-python-debuginfo-2.28.0-14.8.2 graphviz-ruby-2.28.0-14.8.2 graphviz-ruby-debuginfo-2.28.0-14.8.2 graphviz-sharp-2.28.0-14.8.2 graphviz-sharp-debuginfo-2.28.0-14.8.2 graphviz-tcl-2.28.0-14.8.2 graphviz-tcl-debuginfo-2.28.0-14.8.2 References: https://bugzilla.novell.com/820631

1 0

openSUSE-SU-2013:1532-1: moderate: update for gpg2
by opensuse-security＠opensuse.org 07 Oct '13

07 Oct '13

openSUSE Security Update: update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1532-1 Rating: moderate References: #840510 Cross-References: CVE-2013-4351 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This gpg2 update fixes a security issue with "key flags". It contains a version update to 2.0.18 for other bugfixes including a buildfix with updated version of libgcrypt in the update channel. CVE-2013-4351: gpg2: GnuPG treats no-usage-permitted keys as all-usages-permitted Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-143 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gpg2-2.0.19-14.1 gpg2-debuginfo-2.0.19-14.1 gpg2-debugsource-2.0.19-14.1 - openSUSE 11.4 (noarch): gpg2-lang-2.0.19-14.1 References: http://support.novell.com/security/cve/CVE-2013-4351.html https://bugzilla.novell.com/840510

1 0

openSUSE-SU-2013:1528-1: moderate: systemd: bugfix and
by opensuse-security＠opensuse.org 07 Oct '13

07 Oct '13

openSUSE Security Update: systemd: bugfix and ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1528-1 Rating: moderate References: #821800 #836932 #840055 #840864 Cross-References: CVE-2013-4288 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This systemd update fixes several security and non-security issues. - polkit-Avoid-race-condition-in-scraping-proc.patch: VUL-0: polkit: process subject race condition (bnc#836932) CVE-2013-4288. - Don't use a trigger to create symlink for sysctl.conf, always run the test on %post (bnc#840864). - Move symlink migration trigger to post (bnc#821800). - Add systemd-fix-crash-listing-session-files.patch (bnc#840055). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-737 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libgudev-1_0-0-195-13.45.1 libgudev-1_0-0-debuginfo-195-13.45.1 libgudev-1_0-devel-195-13.45.1 libudev-devel-195-13.45.1 libudev-mini-devel-195-13.45.1 libudev-mini1-195-13.45.1 libudev-mini1-debuginfo-195-13.45.1 libudev1-195-13.45.1 libudev1-debuginfo-195-13.45.1 systemd-195-13.45.1 systemd-analyze-195-13.45.1 systemd-debuginfo-195-13.45.1 systemd-debugsource-195-13.45.1 systemd-devel-195-13.45.1 systemd-logger-195-13.45.1 systemd-mini-195-13.45.1 systemd-mini-analyze-195-13.45.1 systemd-mini-debuginfo-195-13.45.1 systemd-mini-debugsource-195-13.45.1 systemd-mini-devel-195-13.45.1 systemd-mini-sysvinit-195-13.45.1 systemd-sysvinit-195-13.45.1 typelib-1_0-GUdev-1_0-195-13.45.1 udev-195-13.45.1 udev-debuginfo-195-13.45.1 udev-mini-195-13.45.1 udev-mini-debuginfo-195-13.45.1 - openSUSE 12.3 (x86_64): libgudev-1_0-0-32bit-195-13.45.1 libgudev-1_0-0-debuginfo-32bit-195-13.45.1 libudev1-32bit-195-13.45.1 libudev1-debuginfo-32bit-195-13.45.1 systemd-32bit-195-13.45.1 systemd-debuginfo-32bit-195-13.45.1 References: http://support.novell.com/security/cve/CVE-2013-4288.html https://bugzilla.novell.com/821800 https://bugzilla.novell.com/836932 https://bugzilla.novell.com/840055 https://bugzilla.novell.com/840864

1 0

openSUSE-SU-2013:1527-1: moderate: update for systemd
by opensuse-security＠opensuse.org 07 Oct '13

07 Oct '13

openSUSE Security Update: update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1527-1 Rating: moderate References: #836932 Cross-References: CVE-2013-4288 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This systemd update fixes several security issue. - polkit-Avoid-race-condition-in-scraping-proc.patch VUL-0: polkit: process subject race condition (bnc#836932) CVE-2013-4288. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-738 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): systemd-44-10.21.1 systemd-analyze-44-10.21.1 systemd-debuginfo-44-10.21.1 systemd-debugsource-44-10.21.1 systemd-devel-44-10.21.1 systemd-gtk-44-10.21.1 systemd-gtk-debuginfo-44-10.21.1 systemd-gtk-debugsource-44-10.21.1 systemd-sysvinit-44-10.21.1 - openSUSE 12.2 (x86_64): systemd-32bit-44-10.21.1 systemd-debuginfo-32bit-44-10.21.1 References: http://support.novell.com/security/cve/CVE-2013-4288.html https://bugzilla.novell.com/836932

1 0

openSUSE-SU-2013:1526-1: moderate: update for gpg2
by opensuse-security＠opensuse.org 06 Oct '13

06 Oct '13

openSUSE Security Update: update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1526-1 Rating: moderate References: Cross-References: CVE-2013-4351 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: * GnuPG treated no-usage-permitted keys as all-usages-permitted * added gpg2-CVE-2013-4351.patch * GnuPG treated no-usage-permitted keys as all-usages-permitted * added gpg2-CVE-2013-4351.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-736 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): gpg2-2.0.19-2.11.1 gpg2-debuginfo-2.0.19-2.11.1 gpg2-debugsource-2.0.19-2.11.1 - openSUSE 12.2 (noarch): gpg2-lang-2.0.19-2.11.1 References: http://support.novell.com/security/cve/CVE-2013-4351.html

1 0

openSUSE-SU-2013:1523-1: update for boost
by opensuse-security＠opensuse.org 04 Oct '13

04 Oct '13

openSUSE Security Update: update for boost ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1523-1 Rating: low References: #801991 Cross-References: CVE-2013-0252 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This boost update fixes a UTF validation problem. - Apply boost-locale_utf.patch to fix a vulnerability in the utf handling of boost:locale (bnc#801991, CVE-2013-0252) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-722 - openSUSE 12.2: zypper in -t patch openSUSE-2013-722 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): boost-debugsource-1.49.0-12.4.1 boost-devel-1.49.0-12.4.1 libboost_chrono1_49_0-1.49.0-12.4.1 libboost_chrono1_49_0-debuginfo-1.49.0-12.4.1 libboost_date_time1_49_0-1.49.0-12.4.1 libboost_date_time1_49_0-debuginfo-1.49.0-12.4.1 libboost_filesystem1_49_0-1.49.0-12.4.1 libboost_filesystem1_49_0-debuginfo-1.49.0-12.4.1 libboost_graph1_49_0-1.49.0-12.4.1 libboost_graph1_49_0-debuginfo-1.49.0-12.4.1 libboost_iostreams1_49_0-1.49.0-12.4.1 libboost_iostreams1_49_0-debuginfo-1.49.0-12.4.1 libboost_locale1_49_0-1.49.0-12.4.1 libboost_locale1_49_0-debuginfo-1.49.0-12.4.1 libboost_math1_49_0-1.49.0-12.4.1 libboost_math1_49_0-debuginfo-1.49.0-12.4.1 libboost_mpi1_49_0-1.49.0-12.4.1 libboost_mpi1_49_0-debuginfo-1.49.0-12.4.1 libboost_program_options1_49_0-1.49.0-12.4.1 libboost_program_options1_49_0-debuginfo-1.49.0-12.4.1 libboost_python1_49_0-1.49.0-12.4.1 libboost_python1_49_0-debuginfo-1.49.0-12.4.1 libboost_random1_49_0-1.49.0-12.4.1 libboost_random1_49_0-debuginfo-1.49.0-12.4.1 libboost_regex1_49_0-1.49.0-12.4.1 libboost_regex1_49_0-debuginfo-1.49.0-12.4.1 libboost_serialization1_49_0-1.49.0-12.4.1 libboost_serialization1_49_0-debuginfo-1.49.0-12.4.1 libboost_signals1_49_0-1.49.0-12.4.1 libboost_signals1_49_0-debuginfo-1.49.0-12.4.1 libboost_system1_49_0-1.49.0-12.4.1 libboost_system1_49_0-debuginfo-1.49.0-12.4.1 libboost_test1_49_0-1.49.0-12.4.1 libboost_test1_49_0-debuginfo-1.49.0-12.4.1 libboost_thread1_49_0-1.49.0-12.4.1 libboost_thread1_49_0-debuginfo-1.49.0-12.4.1 libboost_timer1_49_0-1.49.0-12.4.1 libboost_timer1_49_0-debuginfo-1.49.0-12.4.1 libboost_wave1_49_0-1.49.0-12.4.1 libboost_wave1_49_0-debuginfo-1.49.0-12.4.1 - openSUSE 12.3 (x86_64): boost-devel-32bit-1.49.0-12.4.1 libboost_date_time1_49_0-32bit-1.49.0-12.4.1 libboost_date_time1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_filesystem1_49_0-32bit-1.49.0-12.4.1 libboost_filesystem1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_graph1_49_0-32bit-1.49.0-12.4.1 libboost_graph1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_iostreams1_49_0-32bit-1.49.0-12.4.1 libboost_iostreams1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_math1_49_0-32bit-1.49.0-12.4.1 libboost_math1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_mpi1_49_0-32bit-1.49.0-12.4.1 libboost_mpi1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_program_options1_49_0-32bit-1.49.0-12.4.1 libboost_program_options1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_python1_49_0-32bit-1.49.0-12.4.1 libboost_python1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_random1_49_0-32bit-1.49.0-12.4.1 libboost_random1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_regex1_49_0-32bit-1.49.0-12.4.1 libboost_regex1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_serialization1_49_0-32bit-1.49.0-12.4.1 libboost_serialization1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_signals1_49_0-32bit-1.49.0-12.4.1 libboost_signals1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_system1_49_0-32bit-1.49.0-12.4.1 libboost_system1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_test1_49_0-32bit-1.49.0-12.4.1 libboost_test1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_thread1_49_0-32bit-1.49.0-12.4.1 libboost_thread1_49_0-debuginfo-32bit-1.49.0-12.4.1 libboost_wave1_49_0-32bit-1.49.0-12.4.1 libboost_wave1_49_0-debuginfo-32bit-1.49.0-12.4.1 - openSUSE 12.3 (noarch): boost-doc-html-1.49.0-12.4.1 boost-doc-man-1.49.0-12.4.1 boost-doc-pdf-1.49.0-12.4.1 boost-license1_49_0-1.49.0-12.4.1 - openSUSE 12.2 (i586 x86_64): boost-debugsource-1.49.0-6.4.1 boost-devel-1.49.0-6.4.1 libboost_chrono1_49_0-1.49.0-6.4.1 libboost_chrono1_49_0-debuginfo-1.49.0-6.4.1 libboost_date_time1_49_0-1.49.0-6.4.1 libboost_date_time1_49_0-debuginfo-1.49.0-6.4.1 libboost_filesystem1_49_0-1.49.0-6.4.1 libboost_filesystem1_49_0-debuginfo-1.49.0-6.4.1 libboost_graph1_49_0-1.49.0-6.4.1 libboost_graph1_49_0-debuginfo-1.49.0-6.4.1 libboost_iostreams1_49_0-1.49.0-6.4.1 libboost_iostreams1_49_0-debuginfo-1.49.0-6.4.1 libboost_locale1_49_0-1.49.0-6.4.1 libboost_locale1_49_0-debuginfo-1.49.0-6.4.1 libboost_math1_49_0-1.49.0-6.4.1 libboost_math1_49_0-debuginfo-1.49.0-6.4.1 libboost_mpi1_49_0-1.49.0-6.4.1 libboost_mpi1_49_0-debuginfo-1.49.0-6.4.1 libboost_program_options1_49_0-1.49.0-6.4.1 libboost_program_options1_49_0-debuginfo-1.49.0-6.4.1 libboost_python1_49_0-1.49.0-6.4.1 libboost_python1_49_0-debuginfo-1.49.0-6.4.1 libboost_random1_49_0-1.49.0-6.4.1 libboost_random1_49_0-debuginfo-1.49.0-6.4.1 libboost_regex1_49_0-1.49.0-6.4.1 libboost_regex1_49_0-debuginfo-1.49.0-6.4.1 libboost_serialization1_49_0-1.49.0-6.4.1 libboost_serialization1_49_0-debuginfo-1.49.0-6.4.1 libboost_signals1_49_0-1.49.0-6.4.1 libboost_signals1_49_0-debuginfo-1.49.0-6.4.1 libboost_system1_49_0-1.49.0-6.4.1 libboost_system1_49_0-debuginfo-1.49.0-6.4.1 libboost_test1_49_0-1.49.0-6.4.1 libboost_test1_49_0-debuginfo-1.49.0-6.4.1 libboost_thread1_49_0-1.49.0-6.4.1 libboost_thread1_49_0-debuginfo-1.49.0-6.4.1 libboost_timer1_49_0-1.49.0-6.4.1 libboost_timer1_49_0-debuginfo-1.49.0-6.4.1 libboost_wave1_49_0-1.49.0-6.4.1 libboost_wave1_49_0-debuginfo-1.49.0-6.4.1 - openSUSE 12.2 (x86_64): boost-devel-32bit-1.49.0-6.4.1 libboost_date_time1_49_0-32bit-1.49.0-6.4.1 libboost_date_time1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_filesystem1_49_0-32bit-1.49.0-6.4.1 libboost_filesystem1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_graph1_49_0-32bit-1.49.0-6.4.1 libboost_graph1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_iostreams1_49_0-32bit-1.49.0-6.4.1 libboost_iostreams1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_math1_49_0-32bit-1.49.0-6.4.1 libboost_math1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_mpi1_49_0-32bit-1.49.0-6.4.1 libboost_mpi1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_program_options1_49_0-32bit-1.49.0-6.4.1 libboost_program_options1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_python1_49_0-32bit-1.49.0-6.4.1 libboost_python1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_random1_49_0-32bit-1.49.0-6.4.1 libboost_random1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_regex1_49_0-32bit-1.49.0-6.4.1 libboost_regex1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_serialization1_49_0-32bit-1.49.0-6.4.1 libboost_serialization1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_signals1_49_0-32bit-1.49.0-6.4.1 libboost_signals1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_system1_49_0-32bit-1.49.0-6.4.1 libboost_system1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_test1_49_0-32bit-1.49.0-6.4.1 libboost_test1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_thread1_49_0-32bit-1.49.0-6.4.1 libboost_thread1_49_0-debuginfo-32bit-1.49.0-6.4.1 libboost_wave1_49_0-32bit-1.49.0-6.4.1 libboost_wave1_49_0-debuginfo-32bit-1.49.0-6.4.1 - openSUSE 12.2 (noarch): boost-doc-html-1.49.0-6.4.1 boost-doc-man-1.49.0-6.4.1 boost-doc-pdf-1.49.0-6.4.1 boost-license1_49_0-1.49.0-6.4.1 References: http://support.novell.com/security/cve/CVE-2013-0252.html https://bugzilla.novell.com/801991

1 0

openSUSE-RU-2013:1517-1: moderate: timezone: regular update to V2013f
by maintenance＠opensuse.org 02 Oct '13

02 Oct '13

openSUSE Recommended Update: timezone: regular update to V2013f ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1517-1 Rating: moderate References: Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues with timezone: - Update to V2013f + many updates for Tocantins, Jordan, Palestine, Paraguay, Fiji, Indonesia, etc. see NEWS for details Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-735 - openSUSE 12.2: zypper in -t patch openSUSE-2013-735 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): timezone-2013f-2.29.1 timezone-debuginfo-2013f-2.29.1 timezone-debugsource-2013f-2.29.1 - openSUSE 12.3 (noarch): timezone-java-2013f-2.29.1 - openSUSE 12.2 (i586 x86_64): timezone-2013f-1.36.1 timezone-debuginfo-2013f-1.36.1 timezone-debugsource-2013f-1.36.1 - openSUSE 12.2 (noarch): timezone-java-2013f-1.36.1 References:

1 0

openSUSE-RU-2013:1516-1: gamin: Fixed two issues
by maintenance＠opensuse.org 02 Oct '13

02 Oct '13

openSUSE Recommended Update: gamin: Fixed two issues ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1516-1 Rating: low References: Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues with gamin: - bgo#693006: poll files on nfs4 - bgo#669292: fixed gam_server deadlocks - add conflict with libfam0-32bit Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-734 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): gamin-debugsource-0.1.10-4.4.1 gamin-devel-0.1.10-4.4.1 gamin-doc-0.1.10-4.4.1 gamin-server-0.1.10-4.4.1 gamin-server-debuginfo-0.1.10-4.4.1 libfam0-gamin-0.1.10-4.4.1 libfam0-gamin-debuginfo-0.1.10-4.4.1 libgamin-1-0-0.1.10-4.4.1 libgamin-1-0-debuginfo-0.1.10-4.4.1 python-gamin-0.1.10-4.4.1 python-gamin-debuginfo-0.1.10-4.4.1 - openSUSE 12.3 (x86_64): libfam0-gamin-32bit-0.1.10-4.4.1 libfam0-gamin-debuginfo-32bit-0.1.10-4.4.1 libgamin-1-0-32bit-0.1.10-4.4.1 libgamin-1-0-debuginfo-32bit-0.1.10-4.4.1 References:

1 0