December 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1876-1: moderate: xen: security and bugfix update
by opensuse-security＠opensuse.org 16 Dec '13

16 Dec '13

openSUSE Security Update: xen: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1876-1 Rating: moderate References: #845520 #848657 #849665 #849667 #849668 #851386 #851749 Cross-References: CVE-2013-4416 CVE-2013-4494 CVE-2013-4551 CVE-2013-4553 CVE-2013-4554 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has two fixes is now available. Description: Xen was updated to 4.3.1 and also to fix various security issues and bugs: - bnc#851749 - Xen service file does not call xend properly xend.service - Add missing requires to pciutils package for xend-tools - bnc#851386 - xen: XSA-78: Insufficient TLB flushing in VT-d (iommu) code - Make -devel package depend on libuuid-devel, since libxl.h includes uuid.h - bnc#849667 - CVE-2013-4553: xen: XSA-74: Lock order reversal between page_alloc_lock and mm_rwlock - bnc#849665 - CVE-2013-4551: xen: XSA-75: Host crash due to guest VMX instruction execution - bnc#849668 - CVE-2013-4554: xen: XSA-76: Hypercalls exposed to privilege rings 1 and 2 of HVM guests - bnc#848657 - xen: CVE-2013-4494: XSA-73: Lock order reversal between page allocation and grant table locks - Update to Xen 4.3.1 - bnc#845520 - CVE-2013-4416: xen: ocaml xenstored mishandles oversized message replies Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-968 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): xen-debugsource-4.3.1_02-4.4 xen-devel-4.3.1_02-4.4 xen-kmp-default-4.3.1_02_k3.11.6_4-4.4 xen-kmp-default-debuginfo-4.3.1_02_k3.11.6_4-4.4 xen-kmp-desktop-4.3.1_02_k3.11.6_4-4.4 xen-kmp-desktop-debuginfo-4.3.1_02_k3.11.6_4-4.4 xen-libs-4.3.1_02-4.4 xen-libs-debuginfo-4.3.1_02-4.4 xen-tools-domU-4.3.1_02-4.4 xen-tools-domU-debuginfo-4.3.1_02-4.4 - openSUSE 13.1 (x86_64): xen-4.3.1_02-4.4 xen-doc-html-4.3.1_02-4.4 xen-libs-32bit-4.3.1_02-4.4 xen-libs-debuginfo-32bit-4.3.1_02-4.4 xen-tools-4.3.1_02-4.4 xen-tools-debuginfo-4.3.1_02-4.4 xen-xend-tools-4.3.1_02-4.4 xen-xend-tools-debuginfo-4.3.1_02-4.4 - openSUSE 13.1 (i586): xen-kmp-pae-4.3.1_02_k3.11.6_4-4.4 xen-kmp-pae-debuginfo-4.3.1_02_k3.11.6_4-4.4 References: http://support.novell.com/security/cve/CVE-2013-4416.html http://support.novell.com/security/cve/CVE-2013-4494.html http://support.novell.com/security/cve/CVE-2013-4551.html http://support.novell.com/security/cve/CVE-2013-4553.html http://support.novell.com/security/cve/CVE-2013-4554.html https://bugzilla.novell.com/845520 https://bugzilla.novell.com/848657 https://bugzilla.novell.com/849665 https://bugzilla.novell.com/849667 https://bugzilla.novell.com/849668 https://bugzilla.novell.com/851386 https://bugzilla.novell.com/851749

1 0

openSUSE-RU-2013:1873-1: critical: posreplication bugfix for postgresql
by maintenance＠opensuse.org 13 Dec '13

13 Dec '13

openSUSE Recommended Update: posreplication bugfix for postgresql ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1873-1 Rating: critical References: Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: Following bugs were fixed for postgresql server, including critical ones , which repairs possible data corruption durning replication: *Fix VACUUM's tests to see whether it can update relfrozenxid: In some cases VACUUM (either manual or autovacuum) could incorrectly advance a table's relfrozenxid value, allowing tuples to escape freezing, causing those rows to become invisible once 2^31 transactions have elapsed. The probability of data loss is fairly low since multiple incorrect advancements would need to happen before actual loss occurs, but it's not zero. Users upgrading from releases 9.0.4 or 8.4.8 or earlier are not affected, but all later versions contain the bug. The issue can be ameliorated by, after upgrading, vacuuming all tables in all databases while having vacuum_freeze_table_age set to zero. This will fix any latent corruption but will not be able to fix all pre-existing data errors. However, an installation can be presumed safe after performing this vacuuming if it has executed fewer than 2^31 update transactions in its lifetime (check this with SELECT txid_current() < 2^31). *Fix initialization of pg_clog and pg_subtrans during hot standby startup This bug can cause data loss on standby servers at the moment they start to accept hot-standby queries, by marking committed transactions as uncommitted. The likelihood of such corruption is small unless, at the time of standby startup, the primary server has executed many updating transactions since its last checkpoint. Symptoms include missing rows, rows that should have been deleted being still visible, and obsolete versions of updated rows being still visible alongside their newer versions. This bug was introduced in versions 9.3.0, 9.2.5, 9.1.10, and 9.0.14. Standby servers that have only been running earlier releases are not at risk. It's recommended that standby servers that have ever run any of the buggy releases be re-cloned from the primary (e.g., with a new base backup) after upgrading. *Truncate pg_multixact contents during WAL replay This avoids ever-increasing disk space consumption in standby servers. *Fix race condition in GIN index posting tree page deletion This could lead to transient wrong answers or query failures. *Avoid flattening a subquery whose SELECT list contains a volatile function wrapped inside a sub-SELECT This avoids unexpected results due to extra evaluations of the volatile function. *Fix planner's processing of non-simple-variable subquery outputs nested within outer joins This error could lead to incorrect plans for queries involving multiple levels of subqueries within JOIN syntax. *Fix premature deletion of temporary files *Fix possible read past end of memory in rule printing *Fix array slicing of int2vector and oidvector values Expressions of this kind are now implicitly promoted to regular int2 or oid arrays. *Fix incorrect behaviors when using a SQL-standard, simple GMT offset timezone In some cases, the system would use the simple GMT offset value when it should have used the regular timezone setting that had prevailed before the simple offset was selected. This change also causes the timeofday function to honor the simple GMT offset zone. *Fix pg_dumpall to work when a source database sets default_transaction_read_only via ALTER DATABASE SET Previously, the generated script would fail during restore. *Fix ecpg's processing of lists of variables declared varchar *Make contrib/lo defend against incorrect trigger definitions *Update time zone data files to tzdata release 2013h for DST law changes in Argentina, Brazil, Jordan, Libya, Liechtenstein, Morocco, and Palestine. Also, new timezone abbreviations WIB, WIT, WITA for Indonesia. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-172 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libecpg6-9.0.15-39.1 libecpg6-debuginfo-9.0.15-39.1 libpq5-9.0.15-39.1 libpq5-debuginfo-9.0.15-39.1 postgresql-9.0.15-39.1 postgresql-contrib-9.0.15-39.1 postgresql-contrib-debuginfo-9.0.15-39.1 postgresql-debuginfo-9.0.15-39.1 postgresql-debugsource-9.0.15-39.1 postgresql-devel-9.0.15-39.1 postgresql-devel-debuginfo-9.0.15-39.1 postgresql-libs-debugsource-9.0.15-39.1 postgresql-plperl-9.0.15-39.1 postgresql-plperl-debuginfo-9.0.15-39.1 postgresql-plpython-9.0.15-39.1 postgresql-plpython-debuginfo-9.0.15-39.1 postgresql-pltcl-9.0.15-39.1 postgresql-pltcl-debuginfo-9.0.15-39.1 postgresql-server-9.0.15-39.1 postgresql-server-debuginfo-9.0.15-39.1 - openSUSE 11.4 (x86_64): libpq5-32bit-9.0.15-39.1 libpq5-debuginfo-32bit-9.0.15-39.1 - openSUSE 11.4 (noarch): postgresql-docs-9.0.15-39.1 - openSUSE 11.4 (ia64): libpq5-debuginfo-x86-9.0.15-39.1 libpq5-x86-9.0.15-39.1 References:

1 0

openSUSE-SU-2013:1871-1: important: Mozilla updates 2013/12
by opensuse-security＠opensuse.org 13 Dec '13

13 Dec '13

openSUSE Security Update: Mozilla updates 2013/12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1871-1 Rating: important References: #854367 #854370 Cross-References: CVE-2013-5609 CVE-2013-5610 CVE-2013-5613 CVE-2013-5615 CVE-2013-5616 CVE-2013-5618 CVE-2013-6629 CVE-2013-6630 CVE-2013-6671 CVE-2013-6673 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This patch contains * mozilla-nss 3.15.3.1 which includes a certstore update (1.95) to explicitely revoke AC DG Tresor SSL intermediate CA which was misused. * Firefox 24.2esr * Thunderbird 24.2 * Seamonkey 2.23 These updates fix several security issues: * CVE-2013-5611 Mozilla: Application Installation doorhanger persists on navigation (MFSA 2013-105) * CVE-2013-5609 Mozilla: Miscellaneous memory safety hazards (rv:24.2) (MFSA 2013-104) * CVE-2013-5610 Mozilla: Miscellaneous memory safety hazards (rv:26.0) (MFSA 2013-104) * CVE-2013-5612 Mozilla: Character encoding cross-origin XSS attack (MFSA 2013-106) * CVE-2013-5614 Mozilla: Sandbox restrictions not applied to nested object elements (MFSA 2013-107) * CVE-2013-5616 Mozilla: Use-after-free in event listeners (MFSA 2013-108) * CVE-2013-5619 Mozilla: Potential overflow in JavaScript binary search algorithms (MFSA 2013-110) * CVE-2013-6671 Mozilla: Segmentation violation when replacing ordered list elements (MFSA 2013-111) * CVE-2013-6673 Mozilla: Trust settings for built-in roots ignored during EV certificate validation (MFSA 2013-113) * CVE-2013-5613 Mozilla: Use-after-free in synthetic mouse movement (MFSA 2013-114) * CVE-2013-5615 Mozilla: GetElementIC typed array stubs can be generated outside observed typesets (MFSA 2013-115) * CVE-2013-6672 Mozilla: Linux clipboard information disclosure though selection paste (MFSA 2013-112) * CVE-2013-5618 Mozilla: Use-after-free during Table Editing (MFSA 2013-109) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-170 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-24.2.0-95.2 MozillaFirefox-branding-upstream-24.2.0-95.2 MozillaFirefox-buildsymbols-24.2.0-95.2 MozillaFirefox-debuginfo-24.2.0-95.2 MozillaFirefox-debugsource-24.2.0-95.2 MozillaFirefox-devel-24.2.0-95.2 MozillaFirefox-translations-common-24.2.0-95.2 MozillaFirefox-translations-other-24.2.0-95.2 MozillaThunderbird-24.2.0-81.2 MozillaThunderbird-buildsymbols-24.2.0-81.2 MozillaThunderbird-debuginfo-24.2.0-81.2 MozillaThunderbird-debugsource-24.2.0-81.2 MozillaThunderbird-devel-24.2.0-81.2 MozillaThunderbird-translations-common-24.2.0-81.2 MozillaThunderbird-translations-other-24.2.0-81.2 enigmail-1.6.0+24.2.0-81.2 libfreebl3-3.15.3.1-74.1 libfreebl3-debuginfo-3.15.3.1-74.1 libsoftokn3-3.15.3.1-74.1 libsoftokn3-debuginfo-3.15.3.1-74.1 mozilla-nss-3.15.3.1-74.1 mozilla-nss-certs-3.15.3.1-74.1 mozilla-nss-certs-debuginfo-3.15.3.1-74.1 mozilla-nss-debuginfo-3.15.3.1-74.1 mozilla-nss-debugsource-3.15.3.1-74.1 mozilla-nss-devel-3.15.3.1-74.1 mozilla-nss-sysinit-3.15.3.1-74.1 mozilla-nss-sysinit-debuginfo-3.15.3.1-74.1 mozilla-nss-tools-3.15.3.1-74.1 mozilla-nss-tools-debuginfo-3.15.3.1-74.1 seamonkey-2.23-85.1 seamonkey-debuginfo-2.23-85.1 seamonkey-debugsource-2.23-85.1 seamonkey-dom-inspector-2.23-85.1 seamonkey-irc-2.23-85.1 seamonkey-translations-common-2.23-85.1 seamonkey-translations-other-2.23-85.1 seamonkey-venkman-2.23-85.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.15.3.1-74.1 libfreebl3-debuginfo-32bit-3.15.3.1-74.1 libsoftokn3-32bit-3.15.3.1-74.1 libsoftokn3-debuginfo-32bit-3.15.3.1-74.1 mozilla-nss-32bit-3.15.3.1-74.1 mozilla-nss-certs-32bit-3.15.3.1-74.1 mozilla-nss-certs-debuginfo-32bit-3.15.3.1-74.1 mozilla-nss-debuginfo-32bit-3.15.3.1-74.1 mozilla-nss-sysinit-32bit-3.15.3.1-74.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.3.1-74.1 - openSUSE 11.4 (ia64): libfreebl3-debuginfo-x86-3.15.3.1-74.1 libfreebl3-x86-3.15.3.1-74.1 libsoftokn3-debuginfo-x86-3.15.3.1-74.1 libsoftokn3-x86-3.15.3.1-74.1 mozilla-nss-certs-debuginfo-x86-3.15.3.1-74.1 mozilla-nss-certs-x86-3.15.3.1-74.1 mozilla-nss-debuginfo-x86-3.15.3.1-74.1 mozilla-nss-sysinit-debuginfo-x86-3.15.3.1-74.1 mozilla-nss-sysinit-x86-3.15.3.1-74.1 mozilla-nss-x86-3.15.3.1-74.1 References: http://support.novell.com/security/cve/CVE-2013-5609.html http://support.novell.com/security/cve/CVE-2013-5610.html http://support.novell.com/security/cve/CVE-2013-5613.html http://support.novell.com/security/cve/CVE-2013-5615.html http://support.novell.com/security/cve/CVE-2013-5616.html http://support.novell.com/security/cve/CVE-2013-5618.html http://support.novell.com/security/cve/CVE-2013-6629.html http://support.novell.com/security/cve/CVE-2013-6630.html http://support.novell.com/security/cve/CVE-2013-6671.html http://support.novell.com/security/cve/CVE-2013-6673.html https://bugzilla.novell.com/854367 https://bugzilla.novell.com/854370

1 0

openSUSE-SU-2013:1870-1: important: ca-certificates-mozilla: add, remove or blacklist some certificates
by opensuse-security＠opensuse.org 13 Dec '13

13 Dec '13

openSUSE Security Update: ca-certificates-mozilla: add, remove or blacklist some certificates ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1870-1 Rating: important References: #854163 #854367 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The Mozilla CA certificates package was updated to match the current Mozilla revision 1.95 of certdata.txt. It blacklists some misused certificate authorities, adds some new and adjusts some others. On openSUSE 13.1 a problem with names was also fixed. * distrust: AC DG Tresor SSL (bnc#854367) * new: CA_Disig_Root_R1:2.9.0.195.3.154.238.80.144.110.40.crt server auth, code signing, email signing * new: CA_Disig_Root_R2:2.9.0.146.184.136.219.176.138.193.99.crt server auth, code signing, email signing * new: China_Internet_Network_Information_Center_EV_Certificates_Ro ot:2.4.72.159.0.1.crt server auth * changed: Digital_Signature_Trust_Co._Global_CA_1:2.4.54.112.21.150.cr t removed code signing and server auth abilities * changed: Digital_Signature_Trust_Co._Global_CA_3:2.4.54.110.211.206.c rt removed code signing and server auth abilities * new: D-TRUST_Root_Class_3_CA_2_2009:2.3.9.131.243.crt server auth * new: D-TRUST_Root_Class_3_CA_2_EV_2009:2.3.9.131.244.crt server auth * removed: Equifax_Secure_eBusiness_CA_2:2.4.55.112.207.181.crt * new: PSCProcert:2.1.11.crt server auth, code signing, email signing * new: Swisscom_Root_CA_2:2.16.30.158.40.232.72.242.229.239.195.124 .74.30.90.24.103.182.crt server auth, code signing, email signing * new: Swisscom_Root_EV_CA_2:2.17.0.242.250.100.226.116.99.211.141. 253.16.29.4.31.118.202.88.crt server auth, code signing * changed: TC_TrustCenter_Universal_CA_III:2.14.99.37.0.1.0.2.20.141.51 .21.2.228.108.244.crt removed all abilities * new: TURKTRUST_Certificate_Services_Provider_Root_2007:2.1.1.crt server auth, code signing * changed: TWCA_Root_Certification_Authority:2.1.1.crt added code signing ability Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-171 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): ca-certificates-mozilla-1.95-17.1 References: https://bugzilla.novell.com/854163 https://bugzilla.novell.com/854367

1 0

openSUSE-SU-2013:1869-1: moderate: subversion: update to 1.7.14
by opensuse-security＠opensuse.org 13 Dec '13

13 Dec '13

openSUSE Security Update: subversion: update to 1.7.14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1869-1 Rating: moderate References: #528714 #649861 #662030 #713919 #788015 #794676 #830031 #836245 #850747 Cross-References: CVE-2010-3315 CVE-2010-4539 CVE-2010-4644 CVE-2013-1884 CVE-2013-4131 CVE-2013-4505 CVE-2013-4558 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update fixes the following issues with subversion: - bnc#850747: update to 1.7.14 * CVE-2013-4505: mod_dontdothat does not restrict requests from serf clients. * CVE-2013-4558: mod_dav_svn assertion triggered by autoversioning commits. + Client- and server-side bugfixes: * fix assertion on urls of the form 'file://./' + Client-side bugfixes: * upgrade: fix an assertion when used with pre-1.3 wcs * fix externals that point at redirected locations * diff: fix incorrect calculation of changes in some cases * diff: fix errors with added/deleted targets + Server-side bugfixes: * mod_dav_svn: Prevent crashes with some 3rd party modules * fix OOM on concurrent requests at threaded server start * fsfs: limit commit time of files with deep change histories * mod_dav_svn: canonicalize paths properly + Other tool improvements and bugfixes: * mod_dontdothat: Fix the uri parser + Developer-visible changes: * javahl: canonicalize path for streamFileContent method + require python-sqlite when running regression tests Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-169 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.7.14-59.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.7.14-59.1 libsvn_auth_kwallet-1-0-1.7.14-59.1 libsvn_auth_kwallet-1-0-debuginfo-1.7.14-59.1 subversion-1.7.14-59.1 subversion-debuginfo-1.7.14-59.1 subversion-debugsource-1.7.14-59.1 subversion-devel-1.7.14-59.1 subversion-perl-1.7.14-59.1 subversion-perl-debuginfo-1.7.14-59.1 subversion-python-1.7.14-59.1 subversion-python-debuginfo-1.7.14-59.1 subversion-ruby-1.7.14-59.1 subversion-ruby-debuginfo-1.7.14-59.1 subversion-server-1.7.14-59.1 subversion-server-debuginfo-1.7.14-59.1 subversion-tools-1.7.14-59.1 subversion-tools-debuginfo-1.7.14-59.1 - openSUSE 11.4 (noarch): subversion-bash-completion-1.7.14-59.1 References: http://support.novell.com/security/cve/CVE-2010-3315.html http://support.novell.com/security/cve/CVE-2010-4539.html http://support.novell.com/security/cve/CVE-2010-4644.html http://support.novell.com/security/cve/CVE-2013-1884.html http://support.novell.com/security/cve/CVE-2013-4131.html http://support.novell.com/security/cve/CVE-2013-4505.html http://support.novell.com/security/cve/CVE-2013-4558.html https://bugzilla.novell.com/528714 https://bugzilla.novell.com/649861 https://bugzilla.novell.com/662030 https://bugzilla.novell.com/713919 https://bugzilla.novell.com/788015 https://bugzilla.novell.com/794676 https://bugzilla.novell.com/830031 https://bugzilla.novell.com/836245 https://bugzilla.novell.com/850747

1 0

openSUSE-SU-2013:1868-1: moderate: update for mozilla-nss
by opensuse-security＠opensuse.org 13 Dec '13

13 Dec '13

openSUSE Security Update: update for mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1868-1 Rating: moderate References: #854367 Affected Products: openSUSE 13.1 openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update fixes the following security issue with mozilla-nss: - update to 3.15.3.1 (bnc#854367) * includes certstore update (1.95) (bmo#946351) (explicitely distrust AC DG Tresor SSL) - adapt specfile to ppc64le Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-967 - openSUSE 12.3: zypper in -t patch openSUSE-2013-967 - openSUSE 12.2: zypper in -t patch openSUSE-2013-967 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libfreebl3-3.15.3.1-8.1 libfreebl3-debuginfo-3.15.3.1-8.1 libsoftokn3-3.15.3.1-8.1 libsoftokn3-debuginfo-3.15.3.1-8.1 mozilla-nss-3.15.3.1-8.1 mozilla-nss-certs-3.15.3.1-8.1 mozilla-nss-certs-debuginfo-3.15.3.1-8.1 mozilla-nss-debuginfo-3.15.3.1-8.1 mozilla-nss-debugsource-3.15.3.1-8.1 mozilla-nss-devel-3.15.3.1-8.1 mozilla-nss-sysinit-3.15.3.1-8.1 mozilla-nss-sysinit-debuginfo-3.15.3.1-8.1 mozilla-nss-tools-3.15.3.1-8.1 mozilla-nss-tools-debuginfo-3.15.3.1-8.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.15.3.1-8.1 libfreebl3-debuginfo-32bit-3.15.3.1-8.1 libsoftokn3-32bit-3.15.3.1-8.1 libsoftokn3-debuginfo-32bit-3.15.3.1-8.1 mozilla-nss-32bit-3.15.3.1-8.1 mozilla-nss-certs-32bit-3.15.3.1-8.1 mozilla-nss-certs-debuginfo-32bit-3.15.3.1-8.1 mozilla-nss-debuginfo-32bit-3.15.3.1-8.1 mozilla-nss-sysinit-32bit-3.15.3.1-8.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.3.1-8.1 - openSUSE 12.3 (i586 x86_64): libfreebl3-3.15.3.1-1.24.1 libfreebl3-debuginfo-3.15.3.1-1.24.1 libsoftokn3-3.15.3.1-1.24.1 libsoftokn3-debuginfo-3.15.3.1-1.24.1 mozilla-nss-3.15.3.1-1.24.1 mozilla-nss-certs-3.15.3.1-1.24.1 mozilla-nss-certs-debuginfo-3.15.3.1-1.24.1 mozilla-nss-debuginfo-3.15.3.1-1.24.1 mozilla-nss-debugsource-3.15.3.1-1.24.1 mozilla-nss-devel-3.15.3.1-1.24.1 mozilla-nss-sysinit-3.15.3.1-1.24.1 mozilla-nss-sysinit-debuginfo-3.15.3.1-1.24.1 mozilla-nss-tools-3.15.3.1-1.24.1 mozilla-nss-tools-debuginfo-3.15.3.1-1.24.1 - openSUSE 12.3 (x86_64): libfreebl3-32bit-3.15.3.1-1.24.1 libfreebl3-debuginfo-32bit-3.15.3.1-1.24.1 libsoftokn3-32bit-3.15.3.1-1.24.1 libsoftokn3-debuginfo-32bit-3.15.3.1-1.24.1 mozilla-nss-32bit-3.15.3.1-1.24.1 mozilla-nss-certs-32bit-3.15.3.1-1.24.1 mozilla-nss-certs-debuginfo-32bit-3.15.3.1-1.24.1 mozilla-nss-debuginfo-32bit-3.15.3.1-1.24.1 mozilla-nss-sysinit-32bit-3.15.3.1-1.24.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.3.1-1.24.1 - openSUSE 12.2 (i586 x86_64): libfreebl3-3.15.3.1-2.35.1 libfreebl3-debuginfo-3.15.3.1-2.35.1 libsoftokn3-3.15.3.1-2.35.1 libsoftokn3-debuginfo-3.15.3.1-2.35.1 mozilla-nss-3.15.3.1-2.35.1 mozilla-nss-certs-3.15.3.1-2.35.1 mozilla-nss-certs-debuginfo-3.15.3.1-2.35.1 mozilla-nss-debuginfo-3.15.3.1-2.35.1 mozilla-nss-debugsource-3.15.3.1-2.35.1 mozilla-nss-devel-3.15.3.1-2.35.1 mozilla-nss-sysinit-3.15.3.1-2.35.1 mozilla-nss-sysinit-debuginfo-3.15.3.1-2.35.1 mozilla-nss-tools-3.15.3.1-2.35.1 mozilla-nss-tools-debuginfo-3.15.3.1-2.35.1 - openSUSE 12.2 (x86_64): libfreebl3-32bit-3.15.3.1-2.35.1 libfreebl3-debuginfo-32bit-3.15.3.1-2.35.1 libsoftokn3-32bit-3.15.3.1-2.35.1 libsoftokn3-debuginfo-32bit-3.15.3.1-2.35.1 mozilla-nss-32bit-3.15.3.1-2.35.1 mozilla-nss-certs-32bit-3.15.3.1-2.35.1 mozilla-nss-certs-debuginfo-32bit-3.15.3.1-2.35.1 mozilla-nss-debuginfo-32bit-3.15.3.1-2.35.1 mozilla-nss-sysinit-32bit-3.15.3.1-2.35.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.3.1-2.35.1 References: https://bugzilla.novell.com/854367

1 0

openSUSE-SU-2013:1865-1: moderate: update for curl
by opensuse-security＠opensuse.org 12 Dec '13

12 Dec '13

openSUSE Security Update: update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1865-1 Rating: moderate References: #849596 Cross-References: CVE-2013-4545 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issues with curl: - fix CVE-2013-4545 (bnc#849596) = acknowledge VERIFYHOST without VERIFYPEER Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-168 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): curl-7.21.2-37.1 curl-debuginfo-7.21.2-37.1 libcurl-devel-7.21.2-37.1 libcurl4-7.21.2-37.1 - openSUSE 11.4 (x86_64): libcurl4-32bit-7.21.2-37.1 libcurl4-debuginfo-32bit-7.21.2-37.1 - openSUSE 11.4 (ia64): libcurl4-debuginfo-x86-7.21.2-37.1 libcurl4-x86-7.21.2-37.1 - openSUSE 11.4 (i586): libcurl4-debuginfo-7.21.2-37.1 References: http://support.novell.com/security/cve/CVE-2013-4545.html https://bugzilla.novell.com/849596

1 0

openSUSE-SU-2013:1864-1: moderate: xtrabackup: update to 2.1.6
by opensuse-security＠opensuse.org 12 Dec '13

12 Dec '13

openSUSE Security Update: xtrabackup: update to 2.1.6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1864-1 Rating: moderate References: #852224 Cross-References: CVE-2013-6394 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Percona XtraBackup was updated to 2.1.6 [bnc#852224] - New Features: * New innobackupex --force-non-empty-directories option * now supports logs created with the new log block checksums - New Features specific to MySQL 5.6: option innodb_log_checksum_algorithm in Percona Server 5.6 - Bugs Fixed: * innobackupex --copy-back fails on empty innodb_data_home_dir * A fixed initialization vector (constant string) was used while encrypting the data. This opened the encrypted stream/data to plaintext attacks among others. CVE-2013-6394 * innobackupex --version-check is now on by default. * Since Version Check is enabled by default, new optin --no-version-check option has been introduced to disable it. * xtrabackup_slave_info didn't contain any GTID information, which could cause master_auto_position not to work properly * now supports absolute paths in innodb_data_file_path variable. * wouldn't back up the empty directory created with mkdir (i.e. test) outside of the server which could lead to inconsistencies during the Percona XtraDB Cluster State Snapshot Transfer. * wasn't able to perform backups to the NFS mount in some NFS configurations, because it was trying to preserve file ownership. * unable to perform backup if innodb_log_arch_dir variable was used in server configuration * Race condition in start_query_killer child code could cause parent MySQL connection to close. - Bugs Fixed specific to MySQL 5.6: * xtrabackup_56 was using CRC32 as the default checksum algorithm This could cause error if the innodb_checksum_algorithm value was changed to strict_innodb value after a restore. * xtrabackup_56 binary didn't store the server’s innodb_checksum_algorithm value to backup-my.cnf. This value is needed because it affects the on-disk data format. - update and tag percona-xtrabackup-2.1.x-nodoc.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-963 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): xtrabackup-2.1.6-5.1 xtrabackup-debuginfo-2.1.6-5.1 xtrabackup-debugsource-2.1.6-5.1 References: http://support.novell.com/security/cve/CVE-2013-6394.html https://bugzilla.novell.com/852224

1 0

openSUSE-SU-2013:1863-1: moderate: update for nodejs
by opensuse-security＠opensuse.org 12 Dec '13

12 Dec '13

openSUSE Security Update: update for nodejs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1863-1 Rating: moderate References: #846808 Cross-References: CVE-2013-4450 Affected Products: openSUSE 13.1 openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue with nodejs: - fix CVE-2013-4450: nodejs: HTTP Pipelining DoS (bnc#846808) CVE-2013-4450-v0.10.x.patch: contains the fix Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-965 - openSUSE 12.3: zypper in -t patch openSUSE-2013-965 - openSUSE 12.2: zypper in -t patch openSUSE-2013-965 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): nodejs-0.10.5-3.4.1 nodejs-debuginfo-0.10.5-3.4.1 nodejs-debugsource-0.10.5-3.4.1 nodejs-devel-0.10.5-3.4.1 - openSUSE 12.3 (i586 x86_64): nodejs-0.8.12-3.4.1 nodejs-debuginfo-0.8.12-3.4.1 nodejs-debugsource-0.8.12-3.4.1 nodejs-devel-0.8.12-3.4.1 - openSUSE 12.2 (i586 x86_64): nodejs-0.6.19-1.8.1 nodejs-debuginfo-0.6.19-1.8.1 nodejs-debugsource-0.6.19-1.8.1 nodejs-devel-0.6.19-1.8.1 References: http://support.novell.com/security/cve/CVE-2013-4450.html https://bugzilla.novell.com/846808

1 0

openSUSE-SU-2013:1862-1: moderate: update for thttpd
by opensuse-security＠opensuse.org 12 Dec '13

12 Dec '13

openSUSE Security Update: update for thttpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1862-1 Rating: moderate References: #853381 Cross-References: CVE-2013-0348 Affected Products: openSUSE 13.1 openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue with thttpd: - fix CVE-2013-0348 (bnc#853381) * don't create a world readable logfile Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-966 - openSUSE 12.3: zypper in -t patch openSUSE-2013-966 - openSUSE 12.2: zypper in -t patch openSUSE-2013-966 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): thttpd-2.25b-199.4.1 thttpd-debuginfo-2.25b-199.4.1 thttpd-debugsource-2.25b-199.4.1 - openSUSE 12.3 (i586 x86_64): thttpd-2.25b-195.4.1 thttpd-debuginfo-2.25b-195.4.1 thttpd-debugsource-2.25b-195.4.1 - openSUSE 12.2 (i586 x86_64): thttpd-2.25b-192.4.1 thttpd-debuginfo-2.25b-192.4.1 thttpd-debugsource-2.25b-192.4.1 References: http://support.novell.com/security/cve/CVE-2013-0348.html https://bugzilla.novell.com/853381

1 0