November 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1636-1: moderate: xen: security and bugfix update to 4.1.6
by opensuse-security＠opensuse.org 07 Nov '13

07 Nov '13

openSUSE Security Update: xen: security and bugfix update to 4.1.6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1636-1 Rating: moderate References: #828623 #833251 #833796 #834751 #839596 #839600 #840196 #840592 #841766 #842511 #845520 Cross-References: CVE-2013-1442 CVE-2013-4355 CVE-2013-4361 CVE-2013-4368 CVE-2013-4416 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 6 fixes is now available. Description: Xen was updated to 4.1.6 c/s 23588 to fix various bugs and security issues. Following changes are listed: - Comment out the -include directive in Config.mk as the build service build seems to error out not finding '.config' xen-config.diff - bnc#845520 - CVE-2013-4416: xen: ocaml xenstored mishandles oversized message replies - Improvements to block-dmmd script bnc#828623 - bnc#840196 - MTU size on Dom0 gets reset when booting DomU with e1000 device - bnc#840592 - CVE-2013-4355: XSA-63: xen: Information leaks through I/O instruction emulation - bnc#841766 - CVE-2013-4361: XSA-66: xen: Information leak through fbld instruction emulation - bnc#842511 - CVE-2013-4368: XSA-67: xen: Information leak through outs instruction emulation - xen/27397-ACPI-fix-acpi_os_map_memory.patch: address regression - bnc#839596 - CVE-2013-1442: XSA-62: xen: Information leak on AVX and/or LWP capable CPUs - bnc#833251 - In HP’s UEFI x86_64 platform and with xen environment, in booting stage ,xen hypervisor will panic. - bnc#833796 - Xen: migration broken from xsave-capable to xsave-incapable host - bnc#834751 - In xen, “shutdown –y 0 –h” cannot power off system - bnc#833251 - In HP’s UEFI x86_64 platform and with xen environment, in booting stage ,xen hypervisor will panic. - bnc#839600 - In HP’s UEFI x86_64 platform and sles11sp3 with xen environment, xen hypervisor will panic on multiple blades nPar. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-821 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): xen-debugsource-4.1.6_01-5.33.1 xen-devel-4.1.6_01-5.33.1 xen-kmp-default-4.1.6_01_k3.4.47_2.38-5.33.1 xen-kmp-default-debuginfo-4.1.6_01_k3.4.47_2.38-5.33.1 xen-kmp-desktop-4.1.6_01_k3.4.47_2.38-5.33.1 xen-kmp-desktop-debuginfo-4.1.6_01_k3.4.47_2.38-5.33.1 xen-libs-4.1.6_01-5.33.1 xen-libs-debuginfo-4.1.6_01-5.33.1 xen-tools-domU-4.1.6_01-5.33.1 xen-tools-domU-debuginfo-4.1.6_01-5.33.1 - openSUSE 12.2 (x86_64): xen-4.1.6_01-5.33.1 xen-doc-html-4.1.6_01-5.33.1 xen-doc-pdf-4.1.6_01-5.33.1 xen-libs-32bit-4.1.6_01-5.33.1 xen-libs-debuginfo-32bit-4.1.6_01-5.33.1 xen-tools-4.1.6_01-5.33.1 xen-tools-debuginfo-4.1.6_01-5.33.1 - openSUSE 12.2 (i586): xen-kmp-pae-4.1.6_01_k3.4.47_2.38-5.33.1 xen-kmp-pae-debuginfo-4.1.6_01_k3.4.47_2.38-5.33.1 References: http://support.novell.com/security/cve/CVE-2013-1442.html http://support.novell.com/security/cve/CVE-2013-4355.html http://support.novell.com/security/cve/CVE-2013-4361.html http://support.novell.com/security/cve/CVE-2013-4368.html http://support.novell.com/security/cve/CVE-2013-4416.html https://bugzilla.novell.com/828623 https://bugzilla.novell.com/833251 https://bugzilla.novell.com/833796 https://bugzilla.novell.com/834751 https://bugzilla.novell.com/839596 https://bugzilla.novell.com/839600 https://bugzilla.novell.com/840196 https://bugzilla.novell.com/840592 https://bugzilla.novell.com/841766 https://bugzilla.novell.com/842511 https://bugzilla.novell.com/845520

1 0

openSUSE-SU-2013:1635-1:
by opensuse-security＠opensuse.org 07 Nov '13

07 Nov '13

openSUSE Security Update: ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1635-1 Rating: low References: #834483 Cross-References: CVE-2013-4233 CVE-2013-4234 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: No description available. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-820 - openSUSE 12.2: zypper in -t patch openSUSE-2013-820 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libmodplug-debugsource-0.8.8.4-9.4.1 libmodplug-devel-0.8.8.4-9.4.1 libmodplug1-0.8.8.4-9.4.1 libmodplug1-debuginfo-0.8.8.4-9.4.1 - openSUSE 12.3 (x86_64): libmodplug1-32bit-0.8.8.4-9.4.1 libmodplug1-debuginfo-32bit-0.8.8.4-9.4.1 - openSUSE 12.2 (i586 x86_64): libmodplug-debugsource-0.8.8.4-7.4.1 libmodplug-devel-0.8.8.4-7.4.1 libmodplug1-0.8.8.4-7.4.1 libmodplug1-debuginfo-0.8.8.4-7.4.1 - openSUSE 12.2 (x86_64): libmodplug1-32bit-0.8.8.4-7.4.1 libmodplug1-debuginfo-32bit-0.8.8.4-7.4.1 References: http://support.novell.com/security/cve/CVE-2013-4233.html http://support.novell.com/security/cve/CVE-2013-4234.html https://bugzilla.novell.com/834483

1 0

openSUSE-SU-2013:1634-1: important: Mozilla updates 10/2013
by opensuse-security＠opensuse.org 07 Nov '13

07 Nov '13

openSUSE Security Update: Mozilla updates 10/2013 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1634-1 Rating: important References: #847708 Cross-References: CVE-2013-5590 CVE-2013-5591 CVE-2013-5592 CVE-2013-5593 CVE-2013-5595 CVE-2013-5596 CVE-2013-5597 CVE-2013-5599 CVE-2013-5600 CVE-2013-5601 CVE-2013-5602 CVE-2013-5603 CVE-2013-5604 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: Update NSPR to 4.10.1 Update Thunderbird to 24.1.0 (incl. enigmail 1.6) Update Firefox to 24.1.0esr Changes in MozillaFirefox: * requires NSS 3.15.2 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-99/CVE-2013-5598 (bmo#920515) Security bypass of PDF.js checks using iframes * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates Changes in MozillaThunderbird: * requires NSS 3.15.2 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates - update to Thunderbird 24.0.1 * fqdn for smtp server name was not accepted (bmo#913785) * fixed crash in PL_strncasecmp (bmo#917955) - update Enigmail to 1.6 * The passphrase timeout configuration in Enigmail is now read and written from/to gpg-agent. * New dialog to change the expiry date of keys * New function to search for the OpenPGP keys of all Address Book entries on a keyserver * removed obsolete enigmail-build.patch Changes in mozilla-nspr: - update to version 4.10.1 * bmo#888273: RWIN Scaling (RFC1323) limited to 2 on Windows 7 and 8 (Windows only) * bmo#907512: Unix platforms shouldn't mask errors specific to Unix domain sockets Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-155 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-24.1.0-91.1 MozillaFirefox-branding-upstream-24.1.0-91.1 MozillaFirefox-buildsymbols-24.1.0-91.1 MozillaFirefox-debuginfo-24.1.0-91.1 MozillaFirefox-debugsource-24.1.0-91.1 MozillaFirefox-devel-24.1.0-91.1 MozillaFirefox-translations-common-24.1.0-91.1 MozillaFirefox-translations-other-24.1.0-91.1 MozillaThunderbird-24.1.0-77.2 MozillaThunderbird-buildsymbols-24.1.0-77.2 MozillaThunderbird-debuginfo-24.1.0-77.2 MozillaThunderbird-debugsource-24.1.0-77.2 MozillaThunderbird-devel-24.1.0-77.2 MozillaThunderbird-translations-common-24.1.0-77.2 MozillaThunderbird-translations-other-24.1.0-77.2 enigmail-1.6.0+24.1.0-77.2 mozilla-nspr-4.10.1-32.1 mozilla-nspr-debuginfo-4.10.1-32.1 mozilla-nspr-debugsource-4.10.1-32.1 mozilla-nspr-devel-4.10.1-32.1 seamonkey-2.22-81.1 seamonkey-debuginfo-2.22-81.1 seamonkey-debugsource-2.22-81.1 seamonkey-dom-inspector-2.22-81.1 seamonkey-irc-2.22-81.1 seamonkey-translations-common-2.22-81.1 seamonkey-translations-other-2.22-81.1 seamonkey-venkman-2.22-81.1 - openSUSE 11.4 (x86_64): mozilla-nspr-32bit-4.10.1-32.1 mozilla-nspr-debuginfo-32bit-4.10.1-32.1 - openSUSE 11.4 (ia64): mozilla-nspr-debuginfo-x86-4.10.1-32.1 mozilla-nspr-x86-4.10.1-32.1 References: http://support.novell.com/security/cve/CVE-2013-5590.html http://support.novell.com/security/cve/CVE-2013-5591.html http://support.novell.com/security/cve/CVE-2013-5592.html http://support.novell.com/security/cve/CVE-2013-5593.html http://support.novell.com/security/cve/CVE-2013-5595.html http://support.novell.com/security/cve/CVE-2013-5596.html http://support.novell.com/security/cve/CVE-2013-5597.html http://support.novell.com/security/cve/CVE-2013-5599.html http://support.novell.com/security/cve/CVE-2013-5600.html http://support.novell.com/security/cve/CVE-2013-5601.html http://support.novell.com/security/cve/CVE-2013-5602.html http://support.novell.com/security/cve/CVE-2013-5603.html http://support.novell.com/security/cve/CVE-2013-5604.html https://bugzilla.novell.com/847708

1 0

openSUSE-SU-2013:1633-1: important: Mozilla Suite: Update to October 2013 release
by opensuse-security＠opensuse.org 07 Nov '13

07 Nov '13

openSUSE Security Update: Mozilla Suite: Update to October 2013 release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1633-1 Rating: important References: #840485 #847708 Cross-References: CVE-2013-1705 CVE-2013-1718 CVE-2013-1722 CVE-2013-1725 CVE-2013-1730 CVE-2013-1732 CVE-2013-1735 CVE-2013-1736 CVE-2013-1737 CVE-2013-5590 CVE-2013-5591 CVE-2013-5592 CVE-2013-5593 CVE-2013-5595 CVE-2013-5596 CVE-2013-5597 CVE-2013-5598 CVE-2013-5599 CVE-2013-5600 CVE-2013-5601 CVE-2013-5602 CVE-2013-5603 CVE-2013-5604 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: MozillaFirefox was updated to Firefox 25.0. MozillaThunderbird was updated to Thunderbird 24.1.0. Mozilla XULRunner was updated to 17.0.10esr. Mozilla NSPR was updated to 4.10.1. Changes in MozillaFirefox: * requires NSS 3.15.2 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-99/CVE-2013-5598 (bmo#920515) Security bypass of PDF.js checks using iframes * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates Changes in MozillaThunderbird: * requires NSS 3.15.2 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates - update to Thunderbird 24.0.1 * fqdn for smtp server name was not accepted (bmo#913785) * fixed crash in PL_strncasecmp (bmo#917955) - update Enigmail to 1.6 * The passphrase timeout configuration in Enigmail is now read and written from/to gpg-agent. * New dialog to change the expiry date of keys * New function to search for the OpenPGP keys of all Address Book entries on a keyserver * removed obsolete enigmail-build.patch Changes in xulrunner: - update to 17.0.10esr (bnc#847708) * require NSS 3.14.4 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers - update to 17.0.9esr (bnc#840485) * MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests * MFSA 2013-76/CVE-2013-1718 Miscellaneous memory safety hazards * MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning * MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new Javascript objects can lead to memory corruption * MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes * MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats * MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling * MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong "this" object Changes in mozilla-nspr: - update to version 4.10.1 * bmo#888273: RWIN Scaling (RFC1323) limited to 2 on Windows 7 and 8 (Windows only) * bmo#907512: Unix platforms shouldn't mask errors specific to Unix domain sockets Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-819 - openSUSE 12.2: zypper in -t patch openSUSE-2013-819 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): MozillaFirefox-25.0-1.39.1 MozillaFirefox-branding-upstream-25.0-1.39.1 MozillaFirefox-buildsymbols-25.0-1.39.1 MozillaFirefox-debuginfo-25.0-1.39.1 MozillaFirefox-debugsource-25.0-1.39.1 MozillaFirefox-devel-25.0-1.39.1 MozillaFirefox-translations-common-25.0-1.39.1 MozillaFirefox-translations-other-25.0-1.39.1 MozillaThunderbird-24.1.0-61.31.1 MozillaThunderbird-buildsymbols-24.1.0-61.31.1 MozillaThunderbird-debuginfo-24.1.0-61.31.1 MozillaThunderbird-debugsource-24.1.0-61.31.1 MozillaThunderbird-devel-24.1.0-61.31.1 MozillaThunderbird-translations-common-24.1.0-61.31.1 MozillaThunderbird-translations-other-24.1.0-61.31.1 enigmail-1.6.0+24.1.0-61.31.1 enigmail-debuginfo-1.6.0+24.1.0-61.31.1 mozilla-js-17.0.10-1.30.2 mozilla-js-debuginfo-17.0.10-1.30.2 mozilla-nspr-4.10.1-1.18.1 mozilla-nspr-debuginfo-4.10.1-1.18.1 mozilla-nspr-debugsource-4.10.1-1.18.1 mozilla-nspr-devel-4.10.1-1.18.1 xulrunner-17.0.10-1.30.2 xulrunner-buildsymbols-17.0.10-1.30.2 xulrunner-debuginfo-17.0.10-1.30.2 xulrunner-debugsource-17.0.10-1.30.2 xulrunner-devel-17.0.10-1.30.2 xulrunner-devel-debuginfo-17.0.10-1.30.2 - openSUSE 12.3 (x86_64): mozilla-js-32bit-17.0.10-1.30.2 mozilla-js-debuginfo-32bit-17.0.10-1.30.2 mozilla-nspr-32bit-4.10.1-1.18.1 mozilla-nspr-debuginfo-32bit-4.10.1-1.18.1 xulrunner-32bit-17.0.10-1.30.2 xulrunner-debuginfo-32bit-17.0.10-1.30.2 - openSUSE 12.2 (i586 x86_64): MozillaFirefox-25.0-2.63.1 MozillaFirefox-branding-upstream-25.0-2.63.1 MozillaFirefox-buildsymbols-25.0-2.63.1 MozillaFirefox-debuginfo-25.0-2.63.1 MozillaFirefox-debugsource-25.0-2.63.1 MozillaFirefox-devel-25.0-2.63.1 MozillaFirefox-translations-common-25.0-2.63.1 MozillaFirefox-translations-other-25.0-2.63.1 MozillaThunderbird-24.1.0-49.59.2 MozillaThunderbird-buildsymbols-24.1.0-49.59.2 MozillaThunderbird-debuginfo-24.1.0-49.59.2 MozillaThunderbird-debugsource-24.1.0-49.59.2 MozillaThunderbird-devel-24.1.0-49.59.2 MozillaThunderbird-translations-common-24.1.0-49.59.2 MozillaThunderbird-translations-other-24.1.0-49.59.2 enigmail-1.6.0+24.1.0-49.59.2 mozilla-js-17.0.10-2.56.2 mozilla-js-debuginfo-17.0.10-2.56.2 mozilla-nspr-4.10.1-1.20.1 mozilla-nspr-debuginfo-4.10.1-1.20.1 mozilla-nspr-debugsource-4.10.1-1.20.1 mozilla-nspr-devel-4.10.1-1.20.1 xulrunner-17.0.10-2.56.2 xulrunner-buildsymbols-17.0.10-2.56.2 xulrunner-debuginfo-17.0.10-2.56.2 xulrunner-debugsource-17.0.10-2.56.2 xulrunner-devel-17.0.10-2.56.2 xulrunner-devel-debuginfo-17.0.10-2.56.2 - openSUSE 12.2 (x86_64): mozilla-js-32bit-17.0.10-2.56.2 mozilla-js-debuginfo-32bit-17.0.10-2.56.2 mozilla-nspr-32bit-4.10.1-1.20.1 mozilla-nspr-debuginfo-32bit-4.10.1-1.20.1 xulrunner-32bit-17.0.10-2.56.2 xulrunner-debuginfo-32bit-17.0.10-2.56.2 References: http://support.novell.com/security/cve/CVE-2013-1705.html http://support.novell.com/security/cve/CVE-2013-1718.html http://support.novell.com/security/cve/CVE-2013-1722.html http://support.novell.com/security/cve/CVE-2013-1725.html http://support.novell.com/security/cve/CVE-2013-1730.html http://support.novell.com/security/cve/CVE-2013-1732.html http://support.novell.com/security/cve/CVE-2013-1735.html http://support.novell.com/security/cve/CVE-2013-1736.html http://support.novell.com/security/cve/CVE-2013-1737.html http://support.novell.com/security/cve/CVE-2013-5590.html http://support.novell.com/security/cve/CVE-2013-5591.html http://support.novell.com/security/cve/CVE-2013-5592.html http://support.novell.com/security/cve/CVE-2013-5593.html http://support.novell.com/security/cve/CVE-2013-5595.html http://support.novell.com/security/cve/CVE-2013-5596.html http://support.novell.com/security/cve/CVE-2013-5597.html http://support.novell.com/security/cve/CVE-2013-5598.html http://support.novell.com/security/cve/CVE-2013-5599.html http://support.novell.com/security/cve/CVE-2013-5600.html http://support.novell.com/security/cve/CVE-2013-5601.html http://support.novell.com/security/cve/CVE-2013-5602.html http://support.novell.com/security/cve/CVE-2013-5603.html http://support.novell.com/security/cve/CVE-2013-5604.html https://bugzilla.novell.com/840485 https://bugzilla.novell.com/847708

1 0

openSUSE-SU-2013:1630-1: moderate: openssl: disable compression
by opensuse-security＠opensuse.org 06 Nov '13

06 Nov '13

openSUSE Security Update: openssl: disable compression ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1630-1 Rating: moderate References: #793420 Cross-References: CVE-2012-4929 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update disables compression in openssl by default, as the varying sizes resulting from compression can be used to retrieve plaintext in various cases. (CRIME attack CVE-2012-4929). This update introduces a environment variable OPENSSL_NO_DEFAULT_ZLIB which can be set to "no" to reenable compression in selected services. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-818 - openSUSE 12.2: zypper in -t patch openSUSE-2013-818 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libopenssl-devel-1.0.1e-1.13.1 libopenssl1_0_0-1.0.1e-1.13.1 libopenssl1_0_0-debuginfo-1.0.1e-1.13.1 openssl-1.0.1e-1.13.1 openssl-debuginfo-1.0.1e-1.13.1 openssl-debugsource-1.0.1e-1.13.1 - openSUSE 12.3 (x86_64): libopenssl-devel-32bit-1.0.1e-1.13.1 libopenssl1_0_0-32bit-1.0.1e-1.13.1 libopenssl1_0_0-debuginfo-32bit-1.0.1e-1.13.1 - openSUSE 12.3 (noarch): openssl-doc-1.0.1e-1.13.1 - openSUSE 12.2 (i586 x86_64): libopenssl-devel-1.0.1e-2.12.1 libopenssl1_0_0-1.0.1e-2.12.1 libopenssl1_0_0-debuginfo-1.0.1e-2.12.1 openssl-1.0.1e-2.12.1 openssl-debuginfo-1.0.1e-2.12.1 openssl-debugsource-1.0.1e-2.12.1 - openSUSE 12.2 (x86_64): libopenssl-devel-32bit-1.0.1e-2.12.1 libopenssl1_0_0-32bit-1.0.1e-2.12.1 libopenssl1_0_0-debuginfo-32bit-1.0.1e-2.12.1 - openSUSE 12.2 (noarch): openssl-doc-1.0.1e-2.12.1 References: http://support.novell.com/security/cve/CVE-2012-4929.html https://bugzilla.novell.com/793420

1 0

openSUSE-RU-2013:1624-1: moderate: kdelibs4: resolved kded memory leak
by maintenance＠opensuse.org 04 Nov '13

04 Nov '13

openSUSE Recommended Update: kdelibs4: resolved kded memory leak ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1624-1 Rating: moderate References: Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issue with kdelibs4: - kde#324954: Resolved memory leak when wifi connections fail Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-817 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): kdelibs4-4.10.5-1.105.1 kdelibs4-branding-upstream-4.10.5-1.105.1 kdelibs4-core-4.10.5-1.105.1 kdelibs4-core-debuginfo-4.10.5-1.105.1 kdelibs4-debuginfo-4.10.5-1.105.1 kdelibs4-debugsource-4.10.5-1.105.1 kdelibs4-doc-4.10.5-1.105.1 kdelibs4-doc-debuginfo-4.10.5-1.105.1 libkde4-4.10.5-1.105.1 libkde4-debuginfo-4.10.5-1.105.1 libkde4-devel-4.10.5-1.105.1 libkdecore4-4.10.5-1.105.1 libkdecore4-debuginfo-4.10.5-1.105.1 libkdecore4-devel-4.10.5-1.105.1 libkdecore4-devel-debuginfo-4.10.5-1.105.1 libksuseinstall-devel-4.10.5-1.105.1 libksuseinstall1-4.10.5-1.105.1 libksuseinstall1-debuginfo-4.10.5-1.105.1 - openSUSE 12.3 (x86_64): libkde4-32bit-4.10.5-1.105.1 libkde4-debuginfo-32bit-4.10.5-1.105.1 libkdecore4-32bit-4.10.5-1.105.1 libkdecore4-debuginfo-32bit-4.10.5-1.105.1 libksuseinstall1-32bit-4.10.5-1.105.1 libksuseinstall1-debuginfo-32bit-4.10.5-1.105.1 - openSUSE 12.3 (noarch): kdelibs4-apidocs-4.10.5-1.105.1 References:

1 0

openSUSE-RU-2013:1623-1: libestr: update to 0.1.9
by maintenance＠opensuse.org 04 Nov '13

04 Nov '13

openSUSE Recommended Update: libestr: update to 0.1.9 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1623-1 Rating: low References: #847968 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with libestr: - bnc#847968: + update to 0.1.9 * fixed invalid number string when creating string from integer Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-816 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libestr-debugsource-0.1.9-2.12.1 libestr-devel-0.1.9-2.12.1 libestr0-0.1.9-2.12.1 libestr0-debuginfo-0.1.9-2.12.1 References: https://bugzilla.novell.com/847968

1 0

openSUSE-RU-2013:1622-1: smb4k: Update to version 1.0.8:
by maintenance＠opensuse.org 04 Nov '13

04 Nov '13

openSUSE Recommended Update: smb4k: Update to version 1.0.8: ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1622-1 Rating: low References: #847839 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with smb4k: - Update to version 1.0.8: * bnc#847839: Explicity set language to "C" in Smb4KProcess, because Samba might be localized (closes SF ticket #34). - Update to version 1.0.7: * Fixed remounting of shares. * Fixed Smb4KCustomOptionsManager::hasCustomOptions(). The default options defined via the configuration dialog are honored now. * Fixed "Ignoring unknown parameter" error messages * Fixed command line argument when a master browser is queried for the browse list. - Update to version 1.0.6: * Fixed crash in Smb4KMounter::slotAuthError() due to signals being emitted from Smb4KMountJob::slotActionFinished() too often * Fixed unmounting of selected shares * Removed faulty and useless clean-up code from read function of Smb4KCustomOptionsManager. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-815 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): smb4k-1.0.8-2.4.2 smb4k-debuginfo-1.0.8-2.4.2 smb4k-debugsource-1.0.8-2.4.2 smb4k-doc-1.0.8-2.4.2 - openSUSE 12.3 (noarch): smb4k-lang-1.0.8-2.4.2 References: https://bugzilla.novell.com/847839

1 0

openSUSE-RU-2013:1621-1: kdebase4-workspace: fix plasma crash when notifications would get shown
by maintenance＠opensuse.org 04 Nov '13

04 Nov '13

openSUSE Recommended Update: kdebase4-workspace: fix plasma crash when notifications would get shown ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1621-1 Rating: low References: #808656 #812536 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issue with kdebase4-workspace: - bnc#808656, bnc#812536, kde#311871: fixes annoying plasma crash when notifications would get shown Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-814 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): kde4-kgreeter-plugins-4.10.5-1.119.1 kde4-kgreeter-plugins-debuginfo-4.10.5-1.119.1 kdebase4-workspace-4.10.5-1.119.1 kdebase4-workspace-branding-upstream-4.10.5-1.119.1 kdebase4-workspace-debuginfo-4.10.5-1.119.1 kdebase4-workspace-debugsource-4.10.5-1.119.1 kdebase4-workspace-devel-4.10.5-1.119.1 kdebase4-workspace-devel-debuginfo-4.10.5-1.119.1 kdebase4-workspace-ksysguardd-4.10.5-1.119.1 kdebase4-workspace-ksysguardd-debuginfo-4.10.5-1.119.1 kdebase4-workspace-liboxygenstyle-4.10.5-1.119.1 kdebase4-workspace-liboxygenstyle-debuginfo-4.10.5-1.119.1 kdebase4-workspace-plasma-calendar-4.10.5-1.119.1 kdebase4-workspace-plasma-calendar-debuginfo-4.10.5-1.119.1 kdm-4.10.5-1.119.1 kdm-branding-upstream-4.10.5-1.119.1 kdm-debuginfo-4.10.5-1.119.1 kwin-4.10.5-1.119.1 kwin-debuginfo-4.10.5-1.119.1 python-kdebase4-4.10.5-1.119.1 - openSUSE 12.3 (x86_64): kdebase4-workspace-liboxygenstyle-32bit-4.10.5-1.119.1 kdebase4-workspace-liboxygenstyle-debuginfo-32bit-4.10.5-1.119.1 References: https://bugzilla.novell.com/808656 https://bugzilla.novell.com/812536

1 0

openSUSE-SU-2013:1620-1: moderate: update for hplip
by opensuse-security＠opensuse.org 01 Nov '13

01 Nov '13

openSUSE Security Update: update for hplip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1620-1 Rating: moderate References: #835827 #836937 Cross-References: CVE-2013-4288 CVE-2013-4325 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: the following security issue was fixed for HPLIP 3.13.10: usage of an insecure polkit DBUS API (fix for bnc#836937 and CVE-2013-4325 that are related to CVE-2013-4288 and bnc#835827). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-154 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): hplip-3.11.5-1.15.1 hplip-debuginfo-3.11.5-1.15.1 hplip-debugsource-3.11.5-1.15.1 hplip-hpijs-3.11.5-1.15.1 hplip-hpijs-debuginfo-3.11.5-1.15.1 References: http://support.novell.com/security/cve/CVE-2013-4288.html http://support.novell.com/security/cve/CVE-2013-4325.html https://bugzilla.novell.com/835827 https://bugzilla.novell.com/836937

1 0