November 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2013:1652-1: smb4k: Update to version 1.0.9:
by maintenance＠opensuse.org 11 Nov '13

11 Nov '13

openSUSE Recommended Update: smb4k: Update to version 1.0.9: ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1652-1 Rating: low References: #847839 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with smb4k: - Update to version 1.0.9: * bnc#847839: With non-English languages the change introduced in version 1.0.8 might not work correctly, because e.g. umlauts are not recognized and the shell output is truncated. Setting the language to "en_US.UTF-8" fixes this problem. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-828 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): smb4k-1.0.9-2.8.1 smb4k-debuginfo-1.0.9-2.8.1 smb4k-debugsource-1.0.9-2.8.1 smb4k-doc-1.0.9-2.8.1 - openSUSE 12.3 (noarch): smb4k-lang-1.0.9-2.8.1 References: https://bugzilla.novell.com/847839

1 0

openSUSE-SU-2013:1651-1: update for strongswan
by opensuse-security＠opensuse.org 09 Nov '13

09 Nov '13

openSUSE Security Update: update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1651-1 Rating: low References: #840826 #847506 Cross-References: CVE-2013-6075 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: - Applied upstream fix for a denial-of-service and authorization bypass vulnerability via crafted ID payload in strongswan 4.3.3 up to 5.1.0 (CVE-2013-6075, bnc#847506). [0007-strongswan-4.3.3_5.1.0-bnc-847506-CVE-2013-6075.patch] - Added a recursion limit to get_route in netlink plugin to avoid a charon crash while trying to find a source address when local left is set to %any on newer kernels sorting the default route as first one (bnc#840826). [0006-strongswan-4.6.4-bnc-840826-recursion-limit.patch] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-158 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): strongswan-4.5.0-6.60.1 strongswan-debugsource-4.5.0-6.60.1 strongswan-doc-4.5.0-6.60.1 strongswan-ikev1-4.5.0-6.60.1 strongswan-ikev1-debuginfo-4.5.0-6.60.1 strongswan-ikev2-4.5.0-6.60.1 strongswan-ikev2-debuginfo-4.5.0-6.60.1 strongswan-ipsec-4.5.0-6.60.1 strongswan-ipsec-debuginfo-4.5.0-6.60.1 strongswan-libs0-4.5.0-6.60.1 strongswan-libs0-debuginfo-4.5.0-6.60.1 strongswan-mysql-4.5.0-6.60.1 strongswan-mysql-debuginfo-4.5.0-6.60.1 strongswan-nm-4.5.0-6.60.1 strongswan-nm-debuginfo-4.5.0-6.60.1 strongswan-sqlite-4.5.0-6.60.1 strongswan-sqlite-debuginfo-4.5.0-6.60.1 References: http://support.novell.com/security/cve/CVE-2013-6075.html https://bugzilla.novell.com/840826 https://bugzilla.novell.com/847506

1 0

openSUSE-RU-2013:1650-1: moderate: update for postgresql
by maintenance＠opensuse.org 09 Nov '13

09 Nov '13

openSUSE Recommended Update: update for postgresql ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1650-1 Rating: moderate References: Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: Postgresql was update to version 9.0.14 fixes following bugs: * Prevent downcasing of non-ASCII non-double-quoted identifiers in multi-byte encodings (Andrew Dunstan) * Fix checkpoint memory leak in background writer when wal_level = hot_standby (Naoya Anzai) * Fix memory leak caused by lo_open() failure (Heikki Linnakangas) * Fix memory overcommit bug when work_mem is using more than 24GB of memory (Stephen Frost) * Fix libpq SSL deadlock bug (Stephen Frost) * Fix possible SSL network stack corruption in threaded libpq applications (Nick Phillips, Stephen Frost) * Properly compute row estimates for boolean columns containing many NULL values (Andrew Gierth) * Previously tests like col IS NOT TRUE and col IS NOT FALSE did not properly factor in NULL values when estimating plan costs. * Prevent pushing down WHERE clauses into unsafe UNION/INTERSECT subqueries (Tom Lane) * Fix rare GROUP BY query error caused by improperly processed date type modifiers (Tom Lane) * Allow view dump code to better handle dropped columns on base tables (Tom Lane) * Properly record index comments created using UNIQUE and PRIMARY KEY syntax (Andres Freund) * Fix REINDEX TABLE and REINDEX DATABASE to properly revalidate constraints and mark invalidated indexes as valid (Noah Misch) * REINDEX INDEX has always worked properly. * Fix possible deadlock during concurrent CREATE INDEX CONCURRENTLY operations (Tom Lane) * Fix regexp_matches() handling of zero-length matches (Jeevan Chalke) * Fix crash for overly-complex regular expressions (Heikki Linnakangas) * Fix regular expression match failures for back references combined with non-greedy quantifiers (Jeevan Chalke) * Prevent CREATE FUNCTION from checking SET variables unless function body checking is enabled (Tom Lane) * Allow ALTER DEFAULT PRIVILEGES to operate on schemas without requiring CREATE permission (Tom Lane) * Loosen restriction on keywords used in queries (Tom Lane) * Fix pgp_pub_decrypt() so it works for secret keys with passwords (Marko Kreen) * Remove rare inaccurate warning during vacuum of index-less tables (Heikki Linnakangas) * Improve analyze statistics generation after a cancelled file truncate request (Kevin Grittner) * Avoid possible failure when performing transaction control commands (e.g ROLLBACK) in prepared queries (Tom Lane) * Allow various spellings of infinity on all platforms (Tom Lane) * Expand ability to compare rows to records and arrays (Rafal Rzepecki, Tom Lane) * Update time zone data files to tzdata release 2013d for DST law changes in DST law changes in Israel, Morocco, Palestine, Paraguay. Also, historical zone data corrections for Macquarie Island (Tom Lane) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-159 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libecpg6-9.0.14-35.1 libecpg6-debuginfo-9.0.14-35.1 libpq5-9.0.14-35.1 libpq5-debuginfo-9.0.14-35.1 postgresql-9.0.14-35.1 postgresql-contrib-9.0.14-35.1 postgresql-contrib-debuginfo-9.0.14-35.1 postgresql-debuginfo-9.0.14-35.1 postgresql-debugsource-9.0.14-35.1 postgresql-devel-9.0.14-35.1 postgresql-devel-debuginfo-9.0.14-35.1 postgresql-libs-debugsource-9.0.14-35.1 postgresql-plperl-9.0.14-35.1 postgresql-plperl-debuginfo-9.0.14-35.1 postgresql-plpython-9.0.14-35.1 postgresql-plpython-debuginfo-9.0.14-35.1 postgresql-pltcl-9.0.14-35.1 postgresql-pltcl-debuginfo-9.0.14-35.1 postgresql-server-9.0.14-35.1 postgresql-server-debuginfo-9.0.14-35.1 - openSUSE 11.4 (x86_64): libpq5-32bit-9.0.14-35.1 libpq5-debuginfo-32bit-9.0.14-35.1 - openSUSE 11.4 (noarch): postgresql-docs-9.0.14-35.1 - openSUSE 11.4 (ia64): libpq5-debuginfo-x86-9.0.14-35.1 libpq5-x86-9.0.14-35.1 References:

1 0

openSUSE-SU-2013:1649-1: moderate: update for openvpn
by opensuse-security＠opensuse.org 09 Nov '13

09 Nov '13

openSUSE Security Update: update for openvpn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1649-1 Rating: moderate References: #843509 Cross-References: CVE-2013-2061 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The following security issues were fixed: - Applied upstream patch changing to use a constant time memcmp when comparing HMACs in openvpn_decrypt to address ciphertext injection in UDP mode (CVE-2013-2061, bnc#843509). [0006-openvpn-2.0.9-HMAC-memcmp-CVE-2013-2061_bnc843509.patc h] Changes in openvpn: - Applied upstream patch changing to use a constant time memcmp when comparing HMACs in openvpn_decrypt to address ciphertext injection in UDP mode (CVE-2013-2061, bnc#843509). [0006-openvpn-2.0.9-HMAC-memcmp-CVE-2013-2061_bnc843509.patc h] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-157 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): openvpn-2.1.4-11.34.1 openvpn-auth-pam-plugin-2.1.4-11.34.1 openvpn-auth-pam-plugin-debuginfo-2.1.4-11.34.1 openvpn-debuginfo-2.1.4-11.34.1 openvpn-debugsource-2.1.4-11.34.1 openvpn-down-root-plugin-2.1.4-11.34.1 openvpn-down-root-plugin-debuginfo-2.1.4-11.34.1 References: http://support.novell.com/security/cve/CVE-2013-2061.html https://bugzilla.novell.com/843509

1 0

openSUSE-SU-2013:1648-1: moderate: update for python-pyOpenSSL
by opensuse-security＠opensuse.org 09 Nov '13

09 Nov '13

openSUSE Security Update: update for python-pyOpenSSL ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1648-1 Rating: moderate References: #839107 Cross-References: CVE-2013-4314 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: update to 0.13.1 fixes the following security issue: NUL byte handling in subjectAltName (bnc#839107, CVE-2013-4314) CVE-2013-4314 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-822 - openSUSE 12.2: zypper in -t patch openSUSE-2013-822 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): python-pyOpenSSL-0.13.1-3.4.1 python-pyOpenSSL-debuginfo-0.13.1-3.4.1 python-pyOpenSSL-debugsource-0.13.1-3.4.1 python-pyOpenSSL-doc-0.13.1-3.4.1 - openSUSE 12.2 (i586 x86_64): python-pyOpenSSL-0.12-7.4.1 python-pyOpenSSL-debuginfo-0.12-7.4.1 python-pyOpenSSL-debugsource-0.12-7.4.1 python-pyOpenSSL-doc-0.12-7.4.1 References: http://support.novell.com/security/cve/CVE-2013-4314.html https://bugzilla.novell.com/839107

1 0

openSUSE-RU-2013:1647-1: - Applied upstream fix for a denial-of-service and authorization
by maintenance＠opensuse.org 09 Nov '13

09 Nov '13

openSUSE Recommended Update: - Applied upstream fix for a denial-of-service and authorization ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1647-1 Rating: low References: Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: - Applied upstream fix for a denial-of-service and authorization bypass vulnerability via crafted ID payload in strongswan 4.3.3 up to 5.1.0 (CVE-2013-6075, bnc#847506). [0007-strongswan-4.3.3_5.1.0-bnc-847506-CVE-2013-6075.patch] - Added a recursion limit to get_route in netlink plugin to avoid a charon crash while trying to find a source address when local left is set to %any on newer kernels sorting the default route as first one (bnc#840826). [0006-strongswan-4.6.4-bnc-840826-recursion-limit.patch] - Fixed patch file/number in spec and bug/file references in the changes and inside of the patch files. [0004 -> 0005-strongswan-4.3.0-5.0.4_is_asn1-CVE-2013-5018.bnc833278. patch] [0003 -> 0004-Check-return-value-of-ECDSA_Verify-correctly.patch] [0001 -> 0003-openssl-Ensure-the-thread-ID-is-never-zero.patch] Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-825 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): strongswan-4.6.4-2.16.1 strongswan-debugsource-4.6.4-2.16.1 strongswan-ikev1-4.6.4-2.16.1 strongswan-ikev1-debuginfo-4.6.4-2.16.1 strongswan-ikev2-4.6.4-2.16.1 strongswan-ikev2-debuginfo-4.6.4-2.16.1 strongswan-ipsec-4.6.4-2.16.1 strongswan-ipsec-debuginfo-4.6.4-2.16.1 strongswan-libs0-4.6.4-2.16.1 strongswan-libs0-debuginfo-4.6.4-2.16.1 strongswan-mysql-4.6.4-2.16.1 strongswan-mysql-debuginfo-4.6.4-2.16.1 strongswan-nm-4.6.4-2.16.1 strongswan-nm-debuginfo-4.6.4-2.16.1 strongswan-sqlite-4.6.4-2.16.1 strongswan-sqlite-debuginfo-4.6.4-2.16.1 - openSUSE 12.2 (noarch): strongswan-doc-4.6.4-2.16.1 References:

1 0

openSUSE-SU-2013:1646-1: - Applied upstream fix for a denial-of-service and authorization
by opensuse-security＠opensuse.org 09 Nov '13

09 Nov '13

openSUSE Security Update: - Applied upstream fix for a denial-of-service and authorization ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1646-1 Rating: low References: #847506 Cross-References: CVE-2013-6075 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Applied upstream fix for a denial-of-service and authorization bypass vulnerability via crafted ID payload in strongswan 4.3.3 up to 5.1.0 (CVE-2013-6075, bnc#847506). [0005-strongswan-4.3.3_5.1.0-bnc-847506-CVE-2013-6075.patch] - Added missed references to patch file 0003. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-826 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): strongswan-5.0.1-4.12.1 strongswan-debugsource-5.0.1-4.12.1 strongswan-ipsec-5.0.1-4.12.1 strongswan-ipsec-debuginfo-5.0.1-4.12.1 strongswan-libs0-5.0.1-4.12.1 strongswan-libs0-debuginfo-5.0.1-4.12.1 strongswan-mysql-5.0.1-4.12.1 strongswan-mysql-debuginfo-5.0.1-4.12.1 strongswan-nm-5.0.1-4.12.1 strongswan-nm-debuginfo-5.0.1-4.12.1 strongswan-sqlite-5.0.1-4.12.1 strongswan-sqlite-debuginfo-5.0.1-4.12.1 - openSUSE 12.3 (noarch): strongswan-doc-5.0.1-4.12.1 References: http://support.novell.com/security/cve/CVE-2013-6075.html https://bugzilla.novell.com/847506

1 0

openSUSE-SU-2013:1645-1: moderate: update for openvpn
by opensuse-security＠opensuse.org 09 Nov '13

09 Nov '13

openSUSE Security Update: update for openvpn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1645-1 Rating: moderate References: #843509 Cross-References: CVE-2013-2061 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The following security issues were fixed: - Applied upstream patch changing to use a constant time memcmp when comparing HMACs in openvpn_decrypt to address ciphertext injection in UDP mode (CVE-2013-2061, bnc#843509). [0006-openvpn-2.0.9-HMAC-memcmp-CVE-2013-2061_bnc843509.patc h] Changes in openvpn: - Applied upstream patch changing to use a constant time memcmp when comparing HMACs in openvpn_decrypt to address ciphertext injection in UDP mode (CVE-2013-2061, bnc#843509). [0006-openvpn-2.0.9-HMAC-memcmp-CVE-2013-2061_bnc843509.patc h] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-823 - openSUSE 12.2: zypper in -t patch openSUSE-2013-823 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): openvpn-2.2.2-9.5.1 openvpn-auth-pam-plugin-2.2.2-9.5.1 openvpn-auth-pam-plugin-debuginfo-2.2.2-9.5.1 openvpn-debuginfo-2.2.2-9.5.1 openvpn-debugsource-2.2.2-9.5.1 openvpn-down-root-plugin-2.2.2-9.5.1 openvpn-down-root-plugin-debuginfo-2.2.2-9.5.1 - openSUSE 12.2 (i586 x86_64): openvpn-2.2.2-3.8.1 openvpn-auth-pam-plugin-2.2.2-3.8.1 openvpn-auth-pam-plugin-debuginfo-2.2.2-3.8.1 openvpn-debuginfo-2.2.2-3.8.1 openvpn-debugsource-2.2.2-3.8.1 openvpn-down-root-plugin-2.2.2-3.8.1 openvpn-down-root-plugin-debuginfo-2.2.2-3.8.1 References: http://support.novell.com/security/cve/CVE-2013-2061.html https://bugzilla.novell.com/843509

1 0

openSUSE-SU-2013:1644-1: - update to SeaMonkey 2.22 (bnc#847708)
by opensuse-security＠opensuse.org 09 Nov '13

09 Nov '13

openSUSE Security Update: - update to SeaMonkey 2.22 (bnc#847708) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1644-1 Rating: low References: #847708 Cross-References: CVE-2013-5590 CVE-2013-5591 CVE-2013-5592 CVE-2013-5593 CVE-2013-5595 CVE-2013-5596 CVE-2013-5597 CVE-2013-5598 CVE-2013-5599 CVE-2013-5600 CVE-2013-5601 CVE-2013-5602 CVE-2013-5603 CVE-2013-5604 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: - update to SeaMonkey 2.22 (bnc#847708) * rebased patches * requires NSS 3.15.2 or higher * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-99/CVE-2013-5598 (bmo#920515) Security bypass of PDF.js checks using iframes * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-824 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): seamonkey-2.22-2.54.1 seamonkey-debuginfo-2.22-2.54.1 seamonkey-debugsource-2.22-2.54.1 seamonkey-dom-inspector-2.22-2.54.1 seamonkey-irc-2.22-2.54.1 seamonkey-translations-common-2.22-2.54.1 seamonkey-translations-other-2.22-2.54.1 seamonkey-venkman-2.22-2.54.1 References: http://support.novell.com/security/cve/CVE-2013-5590.html http://support.novell.com/security/cve/CVE-2013-5591.html http://support.novell.com/security/cve/CVE-2013-5592.html http://support.novell.com/security/cve/CVE-2013-5593.html http://support.novell.com/security/cve/CVE-2013-5595.html http://support.novell.com/security/cve/CVE-2013-5596.html http://support.novell.com/security/cve/CVE-2013-5597.html http://support.novell.com/security/cve/CVE-2013-5598.html http://support.novell.com/security/cve/CVE-2013-5599.html http://support.novell.com/security/cve/CVE-2013-5600.html http://support.novell.com/security/cve/CVE-2013-5601.html http://support.novell.com/security/cve/CVE-2013-5602.html http://support.novell.com/security/cve/CVE-2013-5603.html http://support.novell.com/security/cve/CVE-2013-5604.html https://bugzilla.novell.com/847708

1 0

openSUSE-SU-2013:1637-1: update for libmodplug
by opensuse-security＠opensuse.org 07 Nov '13

07 Nov '13

openSUSE Security Update: update for libmodplug ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1637-1 Rating: low References: #834483 Cross-References: CVE-2013-4233 CVE-2013-4234 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes various buffers overflows: -CVE-2013-4233 -CVE-2013-4234 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-156 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libmodplug-debugsource-0.8.8.4-2.14.1 libmodplug-devel-0.8.8.4-2.14.1 libmodplug0-0.8.8.4-2.14.1 libmodplug0-debuginfo-0.8.8.4-2.14.1 - openSUSE 11.4 (x86_64): libmodplug0-32bit-0.8.8.4-2.14.1 libmodplug0-debuginfo-32bit-0.8.8.4-2.14.1 - openSUSE 11.4 (ia64): libmodplug0-debuginfo-x86-0.8.8.4-2.14.1 libmodplug0-x86-0.8.8.4-2.14.1 References: http://support.novell.com/security/cve/CVE-2013-4233.html http://support.novell.com/security/cve/CVE-2013-4234.html https://bugzilla.novell.com/834483

1 0