October 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1539-1: moderate: update for mozilla-nss
by opensuse-security＠opensuse.org 10 Oct '13

10 Oct '13

openSUSE Security Update: update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1539-1 Rating: moderate References: #842979 Cross-References: CVE-2013-1739 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Mozilla NSS was updated to 3.15.2 (bnc#842979) * Support for AES-GCM ciphersuites that use the SHA-256 PRF * MD2, MD4, and MD5 signatures are no longer accepted for OCSP or CRLs * Add PK11_CipherFinal macro * sizeof() used incorrectly * nssutil_ReadSecmodDB() leaks memory * Allow SSL_HandshakeNegotiatedExtension to be called before the handshake is finished. * Deprecate the SSL cipher policy code * Avoid uninitialized data read in the event of a decryption failure. (CVE-2013-1739) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-749 - openSUSE 12.2: zypper in -t patch openSUSE-2013-749 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libfreebl3-3.15.2-1.16.1 libfreebl3-debuginfo-3.15.2-1.16.1 libsoftokn3-3.15.2-1.16.1 libsoftokn3-debuginfo-3.15.2-1.16.1 mozilla-nss-3.15.2-1.16.1 mozilla-nss-certs-3.15.2-1.16.1 mozilla-nss-certs-debuginfo-3.15.2-1.16.1 mozilla-nss-debuginfo-3.15.2-1.16.1 mozilla-nss-debugsource-3.15.2-1.16.1 mozilla-nss-devel-3.15.2-1.16.1 mozilla-nss-sysinit-3.15.2-1.16.1 mozilla-nss-sysinit-debuginfo-3.15.2-1.16.1 mozilla-nss-tools-3.15.2-1.16.1 mozilla-nss-tools-debuginfo-3.15.2-1.16.1 - openSUSE 12.3 (x86_64): libfreebl3-32bit-3.15.2-1.16.1 libfreebl3-debuginfo-32bit-3.15.2-1.16.1 libsoftokn3-32bit-3.15.2-1.16.1 libsoftokn3-debuginfo-32bit-3.15.2-1.16.1 mozilla-nss-32bit-3.15.2-1.16.1 mozilla-nss-certs-32bit-3.15.2-1.16.1 mozilla-nss-certs-debuginfo-32bit-3.15.2-1.16.1 mozilla-nss-debuginfo-32bit-3.15.2-1.16.1 mozilla-nss-sysinit-32bit-3.15.2-1.16.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.2-1.16.1 - openSUSE 12.2 (i586 x86_64): libfreebl3-3.15.2-2.27.1 libfreebl3-debuginfo-3.15.2-2.27.1 libsoftokn3-3.15.2-2.27.1 libsoftokn3-debuginfo-3.15.2-2.27.1 mozilla-nss-3.15.2-2.27.1 mozilla-nss-certs-3.15.2-2.27.1 mozilla-nss-certs-debuginfo-3.15.2-2.27.1 mozilla-nss-debuginfo-3.15.2-2.27.1 mozilla-nss-debugsource-3.15.2-2.27.1 mozilla-nss-devel-3.15.2-2.27.1 mozilla-nss-sysinit-3.15.2-2.27.1 mozilla-nss-sysinit-debuginfo-3.15.2-2.27.1 mozilla-nss-tools-3.15.2-2.27.1 mozilla-nss-tools-debuginfo-3.15.2-2.27.1 - openSUSE 12.2 (x86_64): libfreebl3-32bit-3.15.2-2.27.1 libfreebl3-debuginfo-32bit-3.15.2-2.27.1 libsoftokn3-32bit-3.15.2-2.27.1 libsoftokn3-debuginfo-32bit-3.15.2-2.27.1 mozilla-nss-32bit-3.15.2-2.27.1 mozilla-nss-certs-32bit-3.15.2-2.27.1 mozilla-nss-certs-debuginfo-32bit-3.15.2-2.27.1 mozilla-nss-debuginfo-32bit-3.15.2-2.27.1 mozilla-nss-sysinit-32bit-3.15.2-2.27.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.2-2.27.1 References: http://support.novell.com/security/cve/CVE-2013-1739.html https://bugzilla.novell.com/842979

1 0

openSUSE-RU-2013:1538-1: gummi: Fix crash on opening file
by maintenance＠opensuse.org 09 Oct '13

09 Oct '13

openSUSE Recommended Update: gummi: Fix crash on opening file ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1538-1 Rating: low References: #840589 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with gummi: - bnc#840589: Fix crash on opening file Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-748 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): gummi-0.6.5-1.5.2 gummi-debuginfo-0.6.5-1.5.2 gummi-debugsource-0.6.5-1.5.2 References: https://bugzilla.novell.com/840589

1 0

openSUSE-RU-2013:1537-1: openssl: fixed VPN openconnect problem
by maintenance＠opensuse.org 09 Oct '13

09 Oct '13

openSUSE Recommended Update: openssl: fixed VPN openconnect problem ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1537-1 Rating: low References: #822642 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with openssl: - bnc#822642: fixed VPN openconnect problem. (DTLS handshake failed) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-747 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libopenssl-devel-1.0.1e-1.9.1 libopenssl1_0_0-1.0.1e-1.9.1 libopenssl1_0_0-debuginfo-1.0.1e-1.9.1 openssl-1.0.1e-1.9.1 openssl-debuginfo-1.0.1e-1.9.1 openssl-debugsource-1.0.1e-1.9.1 - openSUSE 12.3 (x86_64): libopenssl-devel-32bit-1.0.1e-1.9.1 libopenssl1_0_0-32bit-1.0.1e-1.9.1 libopenssl1_0_0-debuginfo-32bit-1.0.1e-1.9.1 - openSUSE 12.3 (noarch): openssl-doc-1.0.1e-1.9.1 References: https://bugzilla.novell.com/822642

1 0

openSUSE-RU-2013:1536-1: cryptsetup-mkinitrd: fix handling of wrong passphrase in initrd
by maintenance＠opensuse.org 09 Oct '13

09 Oct '13

openSUSE Recommended Update: cryptsetup-mkinitrd: fix handling of wrong passphrase in initrd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1536-1 Rating: low References: #795913 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with cryptsetup-mkinitrd: - bnc#795913: fix handling of wrong passphrase in initrd Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-746 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): cryptsetup-mkinitrd-0_201206151440-3.8.1 References: https://bugzilla.novell.com/795913

1 0

openSUSE-RU-2013:1535-1: moderate: claws-mail: Update to 3.9.2
by maintenance＠opensuse.org 08 Oct '13

08 Oct '13

openSUSE Recommended Update: claws-mail: Update to 3.9.2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1535-1 Rating: moderate References: #816881 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with claws-mail: - Update to version 3.9.2 (bnc#816881). + New big icon for compose windows. + Never decode multipart/ or message/ parts, as RFC states. + Add missing check for libperl. + Fix check for libsoup - it is not obligatory. + Do not try to destroy a NULL session after an unsuccesful NNTP connect attempt. + The extraheaderrc format doesn't allow data after the header colon. Other OSes may insert extra characters other than \n, so, remove them all. + Fix undoing file insertion. + Fix check for python. + Fix detection of account in --compose and --compose-from-file where the From value contains a name + email. + Bugs fixed: claws#2923, claws#2927. - Update to version 3.9.1: + All plugins previously packaged as 'Extra Plugins' are now contained within the Claws Mail package. In addition to that, the following plugins have been dropped: TrayIcon, Dillo Viewer, and Gtkhtml2 Viewer. + 3 command-line switches have been added: * --cancel-receiving which cancels the currently running message retrieval operation. * --cancel-sending which cancels the currently running message sending operation. * --debug which toggles debug output. + '/Message/Cancel sending' has been added to the main menu. + In the filtering and processing condition configuration for Age, it is now possible to match based on number of hours. + The GnuPG signature timestamp is now displayed in the full signature information. + Support for GnuTLS priority string has been added. + Keep-alive pings are now performed on IMAP and NNTP connections. + In the Compose window, the focus is now moved to the message body when focus is in the Subject entry and the Enter key is pressed. + The Delete key can now be used to remove Colour Label hotkeys. + PDF Viewer: The printed PDF quality has been improved. + Fancy HTML viewer: The options dialogue has been completely reworked, and disabling remote content is now totally strict. + Python plugin: Added Cc field to messageinfo objects. + Python plugin: Added examples. + Python plugin: Added a function to get an arbitrary header from a MessageInfo object. + Perl plugin: The documentation for insert_perl.pl has been improved. + Basic handling of vcard 3.0 has been added to vcard2xml.py. + The man page has been updated. + Bugs fixed: claws#1137, claws#1684, claws#1963, claws#2340, claws#2617, claws#2624, claws#2702, claws#2774, claws#2785, claws#2801, claws#2826, claws#2828, claws#2832, claws#2835, claws#2859, claws#2862, claws#2863, claws#2878, claws#2879, claws#2882, claws#2885, claws#2890, claws#2893, claws#2903, claws#2909. + Updated translations. - Fix brp check failure due to some missing include headers. - Explicitly pass all --enable-*-plugins to configure, to ensure we will not lose any at any time. - Drop --enable-openssl configure parameter: no longer supported. - Fix crash with unknown encodings (bnc#816881) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-739 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): claws-mail-3.9.2-2.4.1 claws-mail-debuginfo-3.9.2-2.4.1 claws-mail-debugsource-3.9.2-2.4.1 claws-mail-devel-3.9.2-2.4.1 - openSUSE 12.3 (noarch): claws-mail-lang-3.9.2-2.4.1 References: https://bugzilla.novell.com/816881

1 0

openSUSE-RU-2013:1534-1: ladspa: Fix double free in destructor of caps plugin
by maintenance＠opensuse.org 08 Oct '13

08 Oct '13

openSUSE Recommended Update: ladspa: Fix double free in destructor of caps plugin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1534-1 Rating: low References: #842420 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with ladspa: - bnc#842420: Fix double free in destructor of caps plugin Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-740 - openSUSE 12.2: zypper in -t patch openSUSE-2013-740 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): ladspa-1.13-19.4.1 ladspa-debuginfo-1.13-19.4.1 ladspa-debugsource-1.13-19.4.1 - openSUSE 12.3 (x86_64): ladspa-32bit-1.13-19.4.1 ladspa-debuginfo-32bit-1.13-19.4.1 - openSUSE 12.3 (noarch): ladspa-devel-1.13-19.4.1 - openSUSE 12.2 (i586 x86_64): ladspa-1.13-17.4.1 ladspa-debuginfo-1.13-17.4.1 ladspa-debugsource-1.13-17.4.1 - openSUSE 12.2 (x86_64): ladspa-32bit-1.13-17.4.1 ladspa-debuginfo-32bit-1.13-17.4.1 - openSUSE 12.2 (noarch): ladspa-devel-1.13-17.4.1 References: https://bugzilla.novell.com/842420

1 0

openSUSE-RU-2013:1533-1: graphviz: several bugfixes
by maintenance＠opensuse.org 08 Oct '13

08 Oct '13

openSUSE Recommended Update: graphviz: several bugfixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1533-1 Rating: low References: #820631 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: graphviz received various bugfixes: - Add libXaw-devel to BuildRequires so that lefty is built (bnc#820631) - Use explicit list of binaries instead of wildcards so that missing binaries fail the build. - Add graphviz-add_shebang.patch that adds a shebang to gvmap.sh Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-678 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): graphviz-2.28.0-14.8.1 graphviz-debuginfo-2.28.0-14.8.1 graphviz-debugsource-2.28.0-14.8.1 graphviz-devel-2.28.0-14.8.1 graphviz-doc-2.28.0-14.8.2 graphviz-gd-2.28.0-14.8.2 graphviz-gd-debuginfo-2.28.0-14.8.2 graphviz-gnome-2.28.0-14.8.2 graphviz-gnome-debuginfo-2.28.0-14.8.2 graphviz-guile-2.28.0-14.8.2 graphviz-guile-debuginfo-2.28.0-14.8.2 graphviz-java-2.28.0-14.8.2 graphviz-lua-2.28.0-14.8.2 graphviz-lua-debuginfo-2.28.0-14.8.2 graphviz-ocaml-2.28.0-14.8.2 graphviz-ocaml-debuginfo-2.28.0-14.8.2 graphviz-perl-2.28.0-14.8.2 graphviz-perl-debuginfo-2.28.0-14.8.2 graphviz-php-2.28.0-14.8.2 graphviz-php-debuginfo-2.28.0-14.8.2 graphviz-plugins-debugsource-2.28.0-14.8.2 graphviz-python-2.28.0-14.8.2 graphviz-python-debuginfo-2.28.0-14.8.2 graphviz-ruby-2.28.0-14.8.2 graphviz-ruby-debuginfo-2.28.0-14.8.2 graphviz-sharp-2.28.0-14.8.2 graphviz-sharp-debuginfo-2.28.0-14.8.2 graphviz-tcl-2.28.0-14.8.2 graphviz-tcl-debuginfo-2.28.0-14.8.2 References: https://bugzilla.novell.com/820631

1 0

openSUSE-SU-2013:1532-1: moderate: update for gpg2
by opensuse-security＠opensuse.org 07 Oct '13

07 Oct '13

openSUSE Security Update: update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1532-1 Rating: moderate References: #840510 Cross-References: CVE-2013-4351 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This gpg2 update fixes a security issue with "key flags". It contains a version update to 2.0.18 for other bugfixes including a buildfix with updated version of libgcrypt in the update channel. CVE-2013-4351: gpg2: GnuPG treats no-usage-permitted keys as all-usages-permitted Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-143 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gpg2-2.0.19-14.1 gpg2-debuginfo-2.0.19-14.1 gpg2-debugsource-2.0.19-14.1 - openSUSE 11.4 (noarch): gpg2-lang-2.0.19-14.1 References: http://support.novell.com/security/cve/CVE-2013-4351.html https://bugzilla.novell.com/840510

1 0

openSUSE-SU-2013:1528-1: moderate: systemd: bugfix and
by opensuse-security＠opensuse.org 07 Oct '13

07 Oct '13

openSUSE Security Update: systemd: bugfix and ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1528-1 Rating: moderate References: #821800 #836932 #840055 #840864 Cross-References: CVE-2013-4288 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This systemd update fixes several security and non-security issues. - polkit-Avoid-race-condition-in-scraping-proc.patch: VUL-0: polkit: process subject race condition (bnc#836932) CVE-2013-4288. - Don't use a trigger to create symlink for sysctl.conf, always run the test on %post (bnc#840864). - Move symlink migration trigger to post (bnc#821800). - Add systemd-fix-crash-listing-session-files.patch (bnc#840055). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-737 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libgudev-1_0-0-195-13.45.1 libgudev-1_0-0-debuginfo-195-13.45.1 libgudev-1_0-devel-195-13.45.1 libudev-devel-195-13.45.1 libudev-mini-devel-195-13.45.1 libudev-mini1-195-13.45.1 libudev-mini1-debuginfo-195-13.45.1 libudev1-195-13.45.1 libudev1-debuginfo-195-13.45.1 systemd-195-13.45.1 systemd-analyze-195-13.45.1 systemd-debuginfo-195-13.45.1 systemd-debugsource-195-13.45.1 systemd-devel-195-13.45.1 systemd-logger-195-13.45.1 systemd-mini-195-13.45.1 systemd-mini-analyze-195-13.45.1 systemd-mini-debuginfo-195-13.45.1 systemd-mini-debugsource-195-13.45.1 systemd-mini-devel-195-13.45.1 systemd-mini-sysvinit-195-13.45.1 systemd-sysvinit-195-13.45.1 typelib-1_0-GUdev-1_0-195-13.45.1 udev-195-13.45.1 udev-debuginfo-195-13.45.1 udev-mini-195-13.45.1 udev-mini-debuginfo-195-13.45.1 - openSUSE 12.3 (x86_64): libgudev-1_0-0-32bit-195-13.45.1 libgudev-1_0-0-debuginfo-32bit-195-13.45.1 libudev1-32bit-195-13.45.1 libudev1-debuginfo-32bit-195-13.45.1 systemd-32bit-195-13.45.1 systemd-debuginfo-32bit-195-13.45.1 References: http://support.novell.com/security/cve/CVE-2013-4288.html https://bugzilla.novell.com/821800 https://bugzilla.novell.com/836932 https://bugzilla.novell.com/840055 https://bugzilla.novell.com/840864

1 0

openSUSE-SU-2013:1527-1: moderate: update for systemd
by opensuse-security＠opensuse.org 07 Oct '13

07 Oct '13

openSUSE Security Update: update for systemd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1527-1 Rating: moderate References: #836932 Cross-References: CVE-2013-4288 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This systemd update fixes several security issue. - polkit-Avoid-race-condition-in-scraping-proc.patch VUL-0: polkit: process subject race condition (bnc#836932) CVE-2013-4288. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-738 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): systemd-44-10.21.1 systemd-analyze-44-10.21.1 systemd-debuginfo-44-10.21.1 systemd-debugsource-44-10.21.1 systemd-devel-44-10.21.1 systemd-gtk-44-10.21.1 systemd-gtk-debuginfo-44-10.21.1 systemd-gtk-debugsource-44-10.21.1 systemd-sysvinit-44-10.21.1 - openSUSE 12.2 (x86_64): systemd-32bit-44-10.21.1 systemd-debuginfo-32bit-44-10.21.1 References: http://support.novell.com/security/cve/CVE-2013-4288.html https://bugzilla.novell.com/836932

1 0