October 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1549-1: moderate: libvirt: fixed security bugs
by opensuse-security＠opensuse.org 15 Oct '13

15 Oct '13

openSUSE Security Update: libvirt: fixed security bugs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1549-1 Rating: moderate References: #836931 #838638 Cross-References: CVE-2013-4296 CVE-2013-4311 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: libvirt was updated to fix 2 security issues: CVE-2013-4311: Add support for using 3-arg pkcheck syntax for process, which previously could be used for race conditions to gain privileges. CVE-2013-4296: Fix crash in remoteDispatchDomainMemoryStats Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-764 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libvirt-0.9.11.9-1.13.1 libvirt-client-0.9.11.9-1.13.1 libvirt-client-debuginfo-0.9.11.9-1.13.1 libvirt-debuginfo-0.9.11.9-1.13.1 libvirt-debugsource-0.9.11.9-1.13.1 libvirt-devel-0.9.11.9-1.13.1 libvirt-doc-0.9.11.9-1.13.1 libvirt-lock-sanlock-0.9.11.9-1.13.1 libvirt-lock-sanlock-debuginfo-0.9.11.9-1.13.1 libvirt-python-0.9.11.9-1.13.1 libvirt-python-debuginfo-0.9.11.9-1.13.1 - openSUSE 12.2 (x86_64): libvirt-client-32bit-0.9.11.9-1.13.1 libvirt-client-debuginfo-32bit-0.9.11.9-1.13.1 libvirt-devel-32bit-0.9.11.9-1.13.1 References: http://support.novell.com/security/cve/CVE-2013-4296.html http://support.novell.com/security/cve/CVE-2013-4311.html https://bugzilla.novell.com/836931 https://bugzilla.novell.com/838638

1 0

openSUSE-SU-2013:1548-1: moderate: rtkit: fixed a race condition in pid checking
by opensuse-security＠opensuse.org 14 Oct '13

14 Oct '13

openSUSE Security Update: rtkit: fixed a race condition in pid checking ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1548-1 Rating: moderate References: #836939 Cross-References: CVE-2013-4326 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rtkit was fixed to avoid a TOCTOU race condition that might have allowed local attackers to gain realtime rights they should not have. (CVE-2013-4326) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-755 - openSUSE 12.2: zypper in -t patch openSUSE-2013-755 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): rtkit-0.11_git201205151338-3.4.1 rtkit-debuginfo-0.11_git201205151338-3.4.1 rtkit-debugsource-0.11_git201205151338-3.4.1 - openSUSE 12.2 (i586 x86_64): rtkit-0.10_git201107141740-9.4.1 rtkit-debuginfo-0.10_git201107141740-9.4.1 rtkit-debugsource-0.10_git201107141740-9.4.1 References: http://support.novell.com/security/cve/CVE-2013-4326.html https://bugzilla.novell.com/836939

1 0

openSUSE-SU-2013:1547-1: lcms: fixed stack overflow issues in lcms utilities
by opensuse-security＠opensuse.org 14 Oct '13

14 Oct '13

openSUSE Security Update: lcms: fixed stack overflow issues in lcms utilities ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1547-1 Rating: low References: #843716 Cross-References: CVE-2013-4276 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Some minor stackoverflows in lcms utilities were fixed. (CVE-2013-4276). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-757 - openSUSE 12.2: zypper in -t patch openSUSE-2013-757 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): lcms-1.19-11.4.1 lcms-debuginfo-1.19-11.4.1 lcms-debugsource-1.19-11.4.1 liblcms-devel-1.19-11.4.1 liblcms1-1.19-11.4.1 liblcms1-debuginfo-1.19-11.4.1 python-lcms-1.19-11.4.1 python-lcms-debuginfo-1.19-11.4.1 - openSUSE 12.3 (x86_64): liblcms-devel-32bit-1.19-11.4.1 liblcms1-32bit-1.19-11.4.1 liblcms1-debuginfo-32bit-1.19-11.4.1 - openSUSE 12.2 (i586 x86_64): lcms-1.19-9.4.1 lcms-debuginfo-1.19-9.4.1 lcms-debugsource-1.19-9.4.1 liblcms-devel-1.19-9.4.1 liblcms1-1.19-9.4.1 liblcms1-debuginfo-1.19-9.4.1 python-lcms-1.19-9.4.1 python-lcms-debuginfo-1.19-9.4.1 - openSUSE 12.2 (x86_64): liblcms-devel-32bit-1.19-9.4.1 liblcms1-32bit-1.19-9.4.1 liblcms1-debuginfo-32bit-1.19-9.4.1 References: http://support.novell.com/security/cve/CVE-2013-4276.html https://bugzilla.novell.com/843716

1 0

openSUSE-SU-2013:1546-1: moderate: gpg2: fixed a denial of service attack
by opensuse-security＠opensuse.org 14 Oct '13

14 Oct '13

openSUSE Security Update: gpg2: fixed a denial of service attack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1546-1 Rating: moderate References: #844175 Cross-References: CVE-2013-4402 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gpg2 was updated to fix a denial of service attack through infinite recursion in the compressed packet parser [bnc#844175] [CVE-2013-4402]. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-758 - openSUSE 12.2: zypper in -t patch openSUSE-2013-758 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): gpg2-2.0.19-5.12.1 gpg2-debuginfo-2.0.19-5.12.1 gpg2-debugsource-2.0.19-5.12.1 - openSUSE 12.3 (noarch): gpg2-lang-2.0.19-5.12.1 - openSUSE 12.2 (i586 x86_64): gpg2-2.0.19-2.17.1 gpg2-debuginfo-2.0.19-2.17.1 gpg2-debugsource-2.0.19-2.17.1 - openSUSE 12.2 (noarch): gpg2-lang-2.0.19-2.17.1 References: http://support.novell.com/security/cve/CVE-2013-4402.html https://bugzilla.novell.com/844175

1 0

openSUSE-RU-2013:1545-1: make: fixed dependency tracking of library targets
by maintenance＠opensuse.org 14 Oct '13

14 Oct '13

openSUSE Recommended Update: make: fixed dependency tracking of library targets ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1545-1 Rating: low References: #841457 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Make was fixed in regards to dependency tracking of library targets in (foo.o bar.o) style. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-756 - openSUSE 12.2: zypper in -t patch openSUSE-2013-756 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): make-3.82-154.4.1 make-debuginfo-3.82-154.4.1 make-debugsource-3.82-154.4.1 - openSUSE 12.2 (i586 x86_64): make-3.82-151.9.1 make-debuginfo-3.82-151.9.1 make-debugsource-3.82-151.9.1 References: https://bugzilla.novell.com/841457

1 0

openSUSE-RU-2013:1544-1: moderate: dbus-1: update to help migration to 13.1
by maintenance＠opensuse.org 11 Oct '13

11 Oct '13

openSUSE Recommended Update: dbus-1: update to help migration to 13.1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1544-1 Rating: moderate References: #802525 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: A migration help for 12.3 - 13.1 migration in dbus was added that helps migrating from /var/run to /run. (bnc#802525) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-754 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): dbus-1-1.6.8-2.10.1 dbus-1-debuginfo-1.6.8-2.10.1 dbus-1-debugsource-1.6.8-2.10.1 dbus-1-devel-1.6.8-2.10.1 dbus-1-x11-1.6.8-2.10.1 dbus-1-x11-debuginfo-1.6.8-2.10.1 dbus-1-x11-debugsource-1.6.8-2.10.1 libdbus-1-3-1.6.8-2.10.1 libdbus-1-3-debuginfo-1.6.8-2.10.1 - openSUSE 12.3 (x86_64): dbus-1-32bit-1.6.8-2.10.1 dbus-1-debuginfo-32bit-1.6.8-2.10.1 dbus-1-devel-32bit-1.6.8-2.10.1 libdbus-1-3-32bit-1.6.8-2.10.1 libdbus-1-3-debuginfo-32bit-1.6.8-2.10.1 - openSUSE 12.3 (noarch): dbus-1-devel-doc-1.6.8-2.10.1 References: https://bugzilla.novell.com/802525

1 0

openSUSE-RU-2013:1543-1: build: avoid modifying devpts mount during build
by maintenance＠opensuse.org 11 Oct '13

11 Oct '13

openSUSE Recommended Update: build: avoid modifying devpts mount during build ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1543-1 Rating: low References: #843775 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The build script used the incorrect devpts permissions which changed the global devpts mount incorrectly and in turn made konsole and other terminals not work. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-753 - openSUSE 12.2: zypper in -t patch openSUSE-2013-753 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): build-initvm-20121123-2.4.1 build-initvm-debuginfo-20121123-2.4.1 - openSUSE 12.3 (x86_64): build-initvm-debuginfo-32bit-20121123-2.4.1 build-initvm-debuginfo-i586-20121123-2.4.1 build-initvm-i586-20121123-2.4.1 - openSUSE 12.3 (noarch): build-20121123-2.4.1 build-mkbaselibs-20121123-2.4.1 build-mkdrpms-20121123-2.4.1 - openSUSE 12.2 (i586 x86_64): build-initvm-2012.07.19-1.4.1 build-initvm-debuginfo-2012.07.19-1.4.1 - openSUSE 12.2 (x86_64): build-initvm-debuginfo-32bit-2012.07.19-1.4.1 build-initvm-debuginfo-i586-2012.07.19-1.4.1 build-initvm-i586-2012.07.19-1.4.1 - openSUSE 12.2 (noarch): build-2012.07.19-1.4.1 build-mkbaselibs-2012.07.19-1.4.1 build-mkbaselibs-sle-2012.07.19-1.4.1 build-mkdrpms-2012.07.19-1.4.1 References: https://bugzilla.novell.com/843775

1 0

openSUSE-SU-2013:1542-1: moderate: update for mozilla-nss
by opensuse-security＠opensuse.org 10 Oct '13

10 Oct '13

openSUSE Security Update: update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1542-1 Rating: moderate References: #842979 Cross-References: CVE-2013-1739 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Update mozilla-nss to 3.15.2 which contains a fix to avoid uninitialized data read in the event of a decryption failure. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-144 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libfreebl3-3.15.2-66.1 libfreebl3-debuginfo-3.15.2-66.1 libsoftokn3-3.15.2-66.1 libsoftokn3-debuginfo-3.15.2-66.1 mozilla-nss-3.15.2-66.1 mozilla-nss-certs-3.15.2-66.1 mozilla-nss-certs-debuginfo-3.15.2-66.1 mozilla-nss-debuginfo-3.15.2-66.1 mozilla-nss-debugsource-3.15.2-66.1 mozilla-nss-devel-3.15.2-66.1 mozilla-nss-sysinit-3.15.2-66.1 mozilla-nss-sysinit-debuginfo-3.15.2-66.1 mozilla-nss-tools-3.15.2-66.1 mozilla-nss-tools-debuginfo-3.15.2-66.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.15.2-66.1 libfreebl3-debuginfo-32bit-3.15.2-66.1 libsoftokn3-32bit-3.15.2-66.1 libsoftokn3-debuginfo-32bit-3.15.2-66.1 mozilla-nss-32bit-3.15.2-66.1 mozilla-nss-certs-32bit-3.15.2-66.1 mozilla-nss-certs-debuginfo-32bit-3.15.2-66.1 mozilla-nss-debuginfo-32bit-3.15.2-66.1 mozilla-nss-sysinit-32bit-3.15.2-66.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.2-66.1 - openSUSE 11.4 (ia64): libfreebl3-debuginfo-x86-3.15.2-66.1 libfreebl3-x86-3.15.2-66.1 libsoftokn3-debuginfo-x86-3.15.2-66.1 libsoftokn3-x86-3.15.2-66.1 mozilla-nss-certs-debuginfo-x86-3.15.2-66.1 mozilla-nss-certs-x86-3.15.2-66.1 mozilla-nss-debuginfo-x86-3.15.2-66.1 mozilla-nss-sysinit-debuginfo-x86-3.15.2-66.1 mozilla-nss-sysinit-x86-3.15.2-66.1 mozilla-nss-x86-3.15.2-66.1 References: http://support.novell.com/security/cve/CVE-2013-1739.html https://bugzilla.novell.com/842979

1 0

openSUSE-SU-2013:1541-1: moderate: update for python-django
by opensuse-security＠opensuse.org 10 Oct '13

10 Oct '13

openSUSE Security Update: update for python-django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1541-1 Rating: moderate References: #840832 Cross-References: CVE-2013-1443 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python-django update fixes several security issues. - Update to version 1.4.8 (bnc#840832, CVE-2013-1443): + Fixed denial-of-service via large passwords - Changes from version 1.4.7: + Fixed directory traversal with ssi template tag - Changes from version 1.4.6: + Fixed Cross-site scripting (XSS) in admin interface + Fixed Possible XSS via is_safe_url Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-145 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): python-django-1.4.8-13.1 References: http://support.novell.com/security/cve/CVE-2013-1443.html https://bugzilla.novell.com/840832

1 0

openSUSE-SU-2013:1540-1: moderate: clutter: fixed a crash after system resume
by opensuse-security＠opensuse.org 10 Oct '13

10 Oct '13

openSUSE Security Update: clutter: fixed a crash after system resume ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1540-1 Rating: moderate References: #843441 Cross-References: CVE-2013-2190 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: clutter was updatd to fix improper translation of hierarchy events (gnome-shell crash after system resume) (CVE-2013-2190, bnc#843441). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-750 - openSUSE 12.2: zypper in -t patch openSUSE-2013-750 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): clutter-debugsource-1.12.2-2.4.1 clutter-devel-1.12.2-2.4.1 libclutter-1_0-0-1.12.2-2.4.1 libclutter-1_0-0-debuginfo-1.12.2-2.4.1 typelib-1_0-Clutter-1_0-1.12.2-2.4.1 - openSUSE 12.3 (x86_64): libclutter-1_0-0-32bit-1.12.2-2.4.1 libclutter-1_0-0-debuginfo-32bit-1.12.2-2.4.1 - openSUSE 12.3 (noarch): clutter-lang-1.12.2-2.4.1 - openSUSE 12.2 (i586 x86_64): clutter-debugsource-1.10.6-2.4.1 clutter-devel-1.10.6-2.4.1 libclutter-1_0-0-1.10.6-2.4.1 libclutter-1_0-0-debuginfo-1.10.6-2.4.1 typelib-1_0-Clutter-1_0-1.10.6-2.4.1 - openSUSE 12.2 (x86_64): libclutter-1_0-0-32bit-1.10.6-2.4.1 libclutter-1_0-0-debuginfo-32bit-1.10.6-2.4.1 - openSUSE 12.2 (noarch): clutter-lang-1.10.6-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-2190.html https://bugzilla.novell.com/843441

1 0