November 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2013:1754-1: libzypp-bindings: Two fixes
by maintenance＠opensuse.org 25 Nov '13

25 Nov '13

openSUSE Recommended Update: libzypp-bindings: Two fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1754-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues with libzypp-bindings: - wrap changelog class - fix no attribute access via PoolItem::resolvable Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-885 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libzypp-bindings-debugsource-0.5.17-4.1 perl-zypp-0.5.17-4.1 perl-zypp-debuginfo-0.5.17-4.1 python-zypp-0.5.17-4.1 python-zypp-debuginfo-0.5.17-4.1 ruby-zypp-0.5.17-4.1 ruby-zypp-debuginfo-0.5.17-4.1 References:

1 0

openSUSE-RU-2013:1753-1: perl-XML-Twig: fixed 3 tests
by maintenance＠opensuse.org 25 Nov '13

25 Nov '13

openSUSE Recommended Update: perl-XML-Twig: fixed 3 tests ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1753-1 Rating: low References: #789917 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with perl-XML-Twig: - fix for bnc#789917, rt#72765: * fixed 3 tests used $[ instead of $] in 3 tests Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-886 - openSUSE 12.2: zypper in -t patch openSUSE-2013-886 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): perl-XML-Twig-3.39-5.5.1 - openSUSE 12.2 (i586 x86_64): perl-XML-Twig-3.39-3.5.1 References: https://bugzilla.novell.com/789917

1 0

openSUSE-RU-2013:1752-1: ladspa: Fix double free in destructor of caps plugin leading to the crash
by maintenance＠opensuse.org 25 Nov '13

25 Nov '13

openSUSE Recommended Update: ladspa: Fix double free in destructor of caps plugin leading to the crash ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1752-1 Rating: low References: #842420 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with ladspa: - bnc#842420: Fix double free in destructor of caps plugin leading to the crash and stack trace Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-887 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): ladspa-1.13-21.4.1 ladspa-debuginfo-1.13-21.4.1 ladspa-debugsource-1.13-21.4.1 - openSUSE 13.1 (x86_64): ladspa-32bit-1.13-21.4.1 ladspa-debuginfo-32bit-1.13-21.4.1 - openSUSE 13.1 (noarch): ladspa-devel-1.13-21.4.1 References: https://bugzilla.novell.com/842420

1 0

openSUSE-SU-2013:1751-1: moderate: krb5: fix Multi-realm KDC null deref
by opensuse-security＠opensuse.org 24 Nov '13

24 Nov '13

openSUSE Security Update: krb5: fix Multi-realm KDC null deref ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1751-1 Rating: moderate References: #849240 Cross-References: CVE-2013-1418 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue with krb5: - bnc#849240, CVE-2013-1418: fix Multi-realm KDC null deref Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-164 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): krb5-1.8.3-67.1 krb5-client-1.8.3-67.1 krb5-client-debuginfo-1.8.3-67.1 krb5-debuginfo-1.8.3-67.1 krb5-debugsource-1.8.3-67.1 krb5-devel-1.8.3-67.1 krb5-plugin-kdb-ldap-1.8.3-67.1 krb5-plugin-kdb-ldap-debuginfo-1.8.3-67.1 krb5-plugin-preauth-pkinit-1.8.3-67.1 krb5-plugin-preauth-pkinit-debuginfo-1.8.3-67.1 krb5-server-1.8.3-67.1 krb5-server-debuginfo-1.8.3-67.1 - openSUSE 11.4 (x86_64): krb5-32bit-1.8.3-67.1 krb5-debuginfo-32bit-1.8.3-67.1 krb5-devel-32bit-1.8.3-67.1 - openSUSE 11.4 (ia64): krb5-debuginfo-x86-1.8.3-67.1 krb5-x86-1.8.3-67.1 References: http://support.novell.com/security/cve/CVE-2013-1418.html https://bugzilla.novell.com/849240

1 0

openSUSE-RU-2013:1746-1: phonon-backend-vlc: Relax vlc-noX requirement
by maintenance＠opensuse.org 22 Nov '13

22 Nov '13

openSUSE Recommended Update: phonon-backend-vlc: Relax vlc-noX requirement ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1746-1 Rating: low References: #851063 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with phonon-backend-vlc: - bnc#851063: Relax vlc-noX requirement, for making it easier to install VLC from alternative repositories. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-883 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): phonon-backend-vlc-0.7.0-9.1 phonon-backend-vlc-debuginfo-0.7.0-9.1 phonon-backend-vlc-debugsource-0.7.0-9.1 References: https://bugzilla.novell.com/851063

1 0

openSUSE-SU-2013:1745-1: moderate: nginx: fixed restriction bypass problem
by opensuse-security＠opensuse.org 22 Nov '13

22 Nov '13

openSUSE Security Update: nginx: fixed restriction bypass problem ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1745-1 Rating: moderate References: #851295 Cross-References: CVE-2013-4547 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The nginx webserver was fixed to avoid a restriction bypass when a space in not correctly escaped. (CVE-2013-4547) On openSUSE 12.2, nginx was updated to version 1.4.4 stable * CVE-2013-4547 a character following an unescaped space in a request line was handled incorrectly [bnc#851295] * bugfix: segmentation fault might occur in the spdy module * bugfix: segmentation fault might occur on start if if the "try_files" directive was used with an empty parameter. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-882 - openSUSE 12.3: zypper in -t patch openSUSE-2013-882 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): nginx-1.4.4-3.5.1 nginx-debuginfo-1.4.4-3.5.1 nginx-debugsource-1.4.4-3.5.1 - openSUSE 12.3 (i586 x86_64): nginx-1.2.9-3.8.1 nginx-debuginfo-1.2.9-3.8.1 nginx-debugsource-1.2.9-3.8.1 References: http://support.novell.com/security/cve/CVE-2013-4547.html https://bugzilla.novell.com/851295

1 0

openSUSE-SU-2013:1742-1: moderate: samba: security and bugfix update
by opensuse-security＠opensuse.org 22 Nov '13

22 Nov '13

openSUSE Security Update: samba: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1742-1 Rating: moderate References: #848101 #848103 #850656 Cross-References: CVE-2013-4475 CVE-2013-4476 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: Samba received bug and security fixes: - Unconditionally create the CUPS smb backend sym link pointing to smbspool; (bnc#850656). - Private key in key.pem world readable; CVE-2013-4476; (bnc#848103). - ACLs are not checked on opening an alternate data stream on a file or directory; CVE-2013-4475; (bso#10229); (bnc#848101). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-881 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libdcerpc-atsvc-devel-4.1.0-3.8.1 libdcerpc-atsvc0-4.1.0-3.8.1 libdcerpc-atsvc0-debuginfo-4.1.0-3.8.1 libdcerpc-binding0-4.1.0-3.8.1 libdcerpc-binding0-debuginfo-4.1.0-3.8.1 libdcerpc-devel-4.1.0-3.8.1 libdcerpc-samr-devel-4.1.0-3.8.1 libdcerpc-samr0-4.1.0-3.8.1 libdcerpc-samr0-debuginfo-4.1.0-3.8.1 libdcerpc0-4.1.0-3.8.1 libdcerpc0-debuginfo-4.1.0-3.8.1 libgensec-devel-4.1.0-3.8.1 libgensec0-4.1.0-3.8.1 libgensec0-debuginfo-4.1.0-3.8.1 libndr-devel-4.1.0-3.8.1 libndr-krb5pac-devel-4.1.0-3.8.1 libndr-krb5pac0-4.1.0-3.8.1 libndr-krb5pac0-debuginfo-4.1.0-3.8.1 libndr-nbt-devel-4.1.0-3.8.1 libndr-nbt0-4.1.0-3.8.1 libndr-nbt0-debuginfo-4.1.0-3.8.1 libndr-standard-devel-4.1.0-3.8.1 libndr-standard0-4.1.0-3.8.1 libndr-standard0-debuginfo-4.1.0-3.8.1 libndr0-4.1.0-3.8.1 libndr0-debuginfo-4.1.0-3.8.1 libnetapi-devel-4.1.0-3.8.1 libnetapi0-4.1.0-3.8.1 libnetapi0-debuginfo-4.1.0-3.8.1 libpdb-devel-4.1.0-3.8.1 libpdb0-4.1.0-3.8.1 libpdb0-debuginfo-4.1.0-3.8.1 libregistry-devel-4.1.0-3.8.1 libregistry0-4.1.0-3.8.1 libregistry0-debuginfo-4.1.0-3.8.1 libsamba-credentials-devel-4.1.0-3.8.1 libsamba-credentials0-4.1.0-3.8.1 libsamba-credentials0-debuginfo-4.1.0-3.8.1 libsamba-hostconfig-devel-4.1.0-3.8.1 libsamba-hostconfig0-4.1.0-3.8.1 libsamba-hostconfig0-debuginfo-4.1.0-3.8.1 libsamba-policy-devel-4.1.0-3.8.1 libsamba-policy0-4.1.0-3.8.1 libsamba-policy0-debuginfo-4.1.0-3.8.1 libsamba-util-devel-4.1.0-3.8.1 libsamba-util0-4.1.0-3.8.1 libsamba-util0-debuginfo-4.1.0-3.8.1 libsamdb-devel-4.1.0-3.8.1 libsamdb0-4.1.0-3.8.1 libsamdb0-debuginfo-4.1.0-3.8.1 libsmbclient-devel-4.1.0-3.8.1 libsmbclient-raw-devel-4.1.0-3.8.1 libsmbclient-raw0-4.1.0-3.8.1 libsmbclient-raw0-debuginfo-4.1.0-3.8.1 libsmbclient0-4.1.0-3.8.1 libsmbclient0-debuginfo-4.1.0-3.8.1 libsmbconf-devel-4.1.0-3.8.1 libsmbconf0-4.1.0-3.8.1 libsmbconf0-debuginfo-4.1.0-3.8.1 libsmbldap-devel-4.1.0-3.8.1 libsmbldap0-4.1.0-3.8.1 libsmbldap0-debuginfo-4.1.0-3.8.1 libsmbsharemodes-devel-4.1.0-3.8.1 libsmbsharemodes0-4.1.0-3.8.1 libsmbsharemodes0-debuginfo-4.1.0-3.8.1 libtevent-util-devel-4.1.0-3.8.1 libtevent-util0-4.1.0-3.8.1 libtevent-util0-debuginfo-4.1.0-3.8.1 libwbclient-devel-4.1.0-3.8.1 libwbclient0-4.1.0-3.8.1 libwbclient0-debuginfo-4.1.0-3.8.1 samba-4.1.0-3.8.1 samba-client-4.1.0-3.8.1 samba-client-debuginfo-4.1.0-3.8.1 samba-core-devel-4.1.0-3.8.1 samba-debuginfo-4.1.0-3.8.1 samba-debugsource-4.1.0-3.8.1 samba-libs-4.1.0-3.8.1 samba-libs-debuginfo-4.1.0-3.8.1 samba-pidl-4.1.0-3.8.1 samba-python-4.1.0-3.8.1 samba-python-debuginfo-4.1.0-3.8.1 samba-test-4.1.0-3.8.1 samba-test-debuginfo-4.1.0-3.8.1 samba-test-devel-4.1.0-3.8.1 samba-winbind-4.1.0-3.8.1 samba-winbind-debuginfo-4.1.0-3.8.1 - openSUSE 13.1 (x86_64): libdcerpc-atsvc0-32bit-4.1.0-3.8.1 libdcerpc-atsvc0-debuginfo-32bit-4.1.0-3.8.1 libdcerpc-binding0-32bit-4.1.0-3.8.1 libdcerpc-binding0-debuginfo-32bit-4.1.0-3.8.1 libdcerpc-samr0-32bit-4.1.0-3.8.1 libdcerpc-samr0-debuginfo-32bit-4.1.0-3.8.1 libdcerpc0-32bit-4.1.0-3.8.1 libdcerpc0-debuginfo-32bit-4.1.0-3.8.1 libgensec0-32bit-4.1.0-3.8.1 libgensec0-debuginfo-32bit-4.1.0-3.8.1 libndr-krb5pac0-32bit-4.1.0-3.8.1 libndr-krb5pac0-debuginfo-32bit-4.1.0-3.8.1 libndr-nbt0-32bit-4.1.0-3.8.1 libndr-nbt0-debuginfo-32bit-4.1.0-3.8.1 libndr-standard0-32bit-4.1.0-3.8.1 libndr-standard0-debuginfo-32bit-4.1.0-3.8.1 libndr0-32bit-4.1.0-3.8.1 libndr0-debuginfo-32bit-4.1.0-3.8.1 libnetapi0-32bit-4.1.0-3.8.1 libnetapi0-debuginfo-32bit-4.1.0-3.8.1 libpdb0-32bit-4.1.0-3.8.1 libpdb0-debuginfo-32bit-4.1.0-3.8.1 libregistry0-32bit-4.1.0-3.8.1 libregistry0-debuginfo-32bit-4.1.0-3.8.1 libsamba-credentials0-32bit-4.1.0-3.8.1 libsamba-credentials0-debuginfo-32bit-4.1.0-3.8.1 libsamba-hostconfig0-32bit-4.1.0-3.8.1 libsamba-hostconfig0-debuginfo-32bit-4.1.0-3.8.1 libsamba-policy0-32bit-4.1.0-3.8.1 libsamba-policy0-debuginfo-32bit-4.1.0-3.8.1 libsamba-util0-32bit-4.1.0-3.8.1 libsamba-util0-debuginfo-32bit-4.1.0-3.8.1 libsamdb0-32bit-4.1.0-3.8.1 libsamdb0-debuginfo-32bit-4.1.0-3.8.1 libsmbclient-raw0-32bit-4.1.0-3.8.1 libsmbclient-raw0-debuginfo-32bit-4.1.0-3.8.1 libsmbclient0-32bit-4.1.0-3.8.1 libsmbclient0-debuginfo-32bit-4.1.0-3.8.1 libsmbconf0-32bit-4.1.0-3.8.1 libsmbconf0-debuginfo-32bit-4.1.0-3.8.1 libsmbldap0-32bit-4.1.0-3.8.1 libsmbldap0-debuginfo-32bit-4.1.0-3.8.1 libtevent-util0-32bit-4.1.0-3.8.1 libtevent-util0-debuginfo-32bit-4.1.0-3.8.1 libwbclient0-32bit-4.1.0-3.8.1 libwbclient0-debuginfo-32bit-4.1.0-3.8.1 samba-32bit-4.1.0-3.8.1 samba-client-32bit-4.1.0-3.8.1 samba-client-debuginfo-32bit-4.1.0-3.8.1 samba-debuginfo-32bit-4.1.0-3.8.1 samba-libs-32bit-4.1.0-3.8.1 samba-libs-debuginfo-32bit-4.1.0-3.8.1 samba-winbind-32bit-4.1.0-3.8.1 samba-winbind-debuginfo-32bit-4.1.0-3.8.1 - openSUSE 13.1 (noarch): samba-doc-4.1.0-3.8.1 References: http://support.novell.com/security/cve/CVE-2013-4475.html http://support.novell.com/security/cve/CVE-2013-4476.html https://bugzilla.novell.com/848101 https://bugzilla.novell.com/848103 https://bugzilla.novell.com/850656

1 0

openSUSE-SU-2013:1738-1: krb5: fix Multi-realm KDC null deref
by opensuse-security＠opensuse.org 21 Nov '13

21 Nov '13

openSUSE Security Update: krb5: fix Multi-realm KDC null deref ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1738-1 Rating: low References: #849240 Cross-References: CVE-2013-1418 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue with krb5: - bnc#849240, CVE-2013-1418: fix Multi-realm KDC null deref Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-880 - openSUSE 12.2: zypper in -t patch openSUSE-2013-880 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): krb5-1.10.2-10.22.1 krb5-client-1.10.2-10.22.1 krb5-client-debuginfo-1.10.2-10.22.1 krb5-debuginfo-1.10.2-10.22.1 krb5-debugsource-1.10.2-10.22.1 krb5-devel-1.10.2-10.22.1 krb5-mini-1.10.2-10.22.1 krb5-mini-debuginfo-1.10.2-10.22.1 krb5-mini-debugsource-1.10.2-10.22.1 krb5-mini-devel-1.10.2-10.22.1 krb5-plugin-kdb-ldap-1.10.2-10.22.1 krb5-plugin-kdb-ldap-debuginfo-1.10.2-10.22.1 krb5-plugin-preauth-pkinit-1.10.2-10.22.1 krb5-plugin-preauth-pkinit-debuginfo-1.10.2-10.22.1 krb5-server-1.10.2-10.22.1 krb5-server-debuginfo-1.10.2-10.22.1 - openSUSE 12.3 (x86_64): krb5-32bit-1.10.2-10.22.1 krb5-debuginfo-32bit-1.10.2-10.22.1 krb5-devel-32bit-1.10.2-10.22.1 - openSUSE 12.3 (noarch): krb5-doc-1.10.2-10.22.2 - openSUSE 12.2 (i586 x86_64): krb5-1.10.2-3.25.1 krb5-client-1.10.2-3.25.1 krb5-client-debuginfo-1.10.2-3.25.1 krb5-debuginfo-1.10.2-3.25.1 krb5-debugsource-1.10.2-3.25.1 krb5-devel-1.10.2-3.25.1 krb5-mini-1.10.2-3.25.1 krb5-mini-debuginfo-1.10.2-3.25.1 krb5-mini-debugsource-1.10.2-3.25.1 krb5-mini-devel-1.10.2-3.25.1 krb5-plugin-kdb-ldap-1.10.2-3.25.1 krb5-plugin-kdb-ldap-debuginfo-1.10.2-3.25.1 krb5-plugin-preauth-pkinit-1.10.2-3.25.1 krb5-plugin-preauth-pkinit-debuginfo-1.10.2-3.25.1 krb5-server-1.10.2-3.25.1 krb5-server-debuginfo-1.10.2-3.25.1 - openSUSE 12.2 (x86_64): krb5-32bit-1.10.2-3.25.1 krb5-debuginfo-32bit-1.10.2-3.25.1 krb5-devel-32bit-1.10.2-3.25.1 - openSUSE 12.2 (noarch): krb5-doc-1.10.2-3.25.2 References: http://support.novell.com/security/cve/CVE-2013-1418.html https://bugzilla.novell.com/849240

1 0

openSUSE-SU-2013:1737-1: important: flash-player to 11.2.202.327
by opensuse-security＠opensuse.org 21 Nov '13

21 Nov '13

openSUSE Security Update: flash-player to 11.2.202.327 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1737-1 Rating: important References: #850220 Cross-References: CVE-2013-5329 CVE-2013-5330 Affected Products: openSUSE 13.1:NonFree openSUSE 12.3:NonFree openSUSE 12.2:NonFree ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.327: (bnc#850220) * APSB13-26, CVE-2013-5329, CVE-2013-5330 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2013-879 - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2013-879 - openSUSE 12.2:NonFree: zypper in -t patch openSUSE-2013-879 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.327-14.1 flash-player-gnome-11.2.202.327-14.1 flash-player-kde4-11.2.202.327-14.1 - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.327-2.40.1 flash-player-gnome-11.2.202.327-2.40.1 flash-player-kde4-11.2.202.327-2.40.1 - openSUSE 12.2:NonFree (i586 x86_64): flash-player-11.2.202.327-1.64.1 flash-player-gnome-11.2.202.327-1.64.1 flash-player-kde4-11.2.202.327-1.64.1 References: http://support.novell.com/security/cve/CVE-2013-5329.html http://support.novell.com/security/cve/CVE-2013-5330.html https://bugzilla.novell.com/850220

1 0

openSUSE-SU-2013:1732-1: moderate: update for mozilla-nss
by opensuse-security＠opensuse.org 19 Nov '13

19 Nov '13

openSUSE Security Update: update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1732-1 Rating: moderate References: #850148 Cross-References: CVE-2013-1741 CVE-2013-5605 CVE-2013-5606 CVE-2013-5607 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: update NSPR to version 4.10.2 * bmo#770534: possible pointer overflow in PL_ArenaAllocate() * bmo#888546: ptio.c:PR_ImportUDPSocket doesn't work * bmo#927687: (CVE-2013-5607) Avoid unsigned integer wrapping in PL_ArenaAllocate. update NSS to version 3.15.3 * Bug 925100 - (CVE-2013-1741) Ensure a size is <= half of the maximum PRUint32 value * Bug 934016 - (CVE-2013-5605) Handle invalid handshake packets * Bug 910438 - (CVE-2013-5606) Return the correct result in CERT_VerifyCert on failure, if a verifyLog isn't used Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-163 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libfreebl3-3.15.3-70.1 libfreebl3-debuginfo-3.15.3-70.1 libsoftokn3-3.15.3-70.1 libsoftokn3-debuginfo-3.15.3-70.1 mozilla-nspr-4.10.2-36.1 mozilla-nspr-debuginfo-4.10.2-36.1 mozilla-nspr-debugsource-4.10.2-36.1 mozilla-nspr-devel-4.10.2-36.1 mozilla-nss-3.15.3-70.1 mozilla-nss-certs-3.15.3-70.1 mozilla-nss-certs-debuginfo-3.15.3-70.1 mozilla-nss-debuginfo-3.15.3-70.1 mozilla-nss-debugsource-3.15.3-70.1 mozilla-nss-devel-3.15.3-70.1 mozilla-nss-sysinit-3.15.3-70.1 mozilla-nss-sysinit-debuginfo-3.15.3-70.1 mozilla-nss-tools-3.15.3-70.1 mozilla-nss-tools-debuginfo-3.15.3-70.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.15.3-70.1 libfreebl3-debuginfo-32bit-3.15.3-70.1 libsoftokn3-32bit-3.15.3-70.1 libsoftokn3-debuginfo-32bit-3.15.3-70.1 mozilla-nspr-32bit-4.10.2-36.1 mozilla-nspr-debuginfo-32bit-4.10.2-36.1 mozilla-nss-32bit-3.15.3-70.1 mozilla-nss-certs-32bit-3.15.3-70.1 mozilla-nss-certs-debuginfo-32bit-3.15.3-70.1 mozilla-nss-debuginfo-32bit-3.15.3-70.1 mozilla-nss-sysinit-32bit-3.15.3-70.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.3-70.1 - openSUSE 11.4 (ia64): libfreebl3-debuginfo-x86-3.15.3-70.1 libfreebl3-x86-3.15.3-70.1 libsoftokn3-debuginfo-x86-3.15.3-70.1 libsoftokn3-x86-3.15.3-70.1 mozilla-nspr-debuginfo-x86-4.10.2-36.1 mozilla-nspr-x86-4.10.2-36.1 mozilla-nss-certs-debuginfo-x86-3.15.3-70.1 mozilla-nss-certs-x86-3.15.3-70.1 mozilla-nss-debuginfo-x86-3.15.3-70.1 mozilla-nss-sysinit-debuginfo-x86-3.15.3-70.1 mozilla-nss-sysinit-x86-3.15.3-70.1 mozilla-nss-x86-3.15.3-70.1 References: http://support.novell.com/security/cve/CVE-2013-1741.html http://support.novell.com/security/cve/CVE-2013-5605.html http://support.novell.com/security/cve/CVE-2013-5606.html http://support.novell.com/security/cve/CVE-2013-5607.html https://bugzilla.novell.com/850148

1 0