December 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1836-1: moderate: subversion: update to 1.8.5
by opensuse-security＠opensuse.org 07 Dec '13

07 Dec '13

openSUSE Security Update: subversion: update to 1.8.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1836-1 Rating: moderate References: #850667 #850747 Cross-References: CVE-2013-4505 CVE-2013-4558 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes the following issues with subversion (CVE-2013-4505,CVE-2013-4558): - bnc#850747: update to 1.8.5 * CVE-2013-4505: mod_dontdothat does not restrict requests from serf clients. * CVE-2013-4558: mod_dav_svn assertion triggered by autoversioning commits. + Client-side bugfixes: * fix externals that point at redirected locations * diff: fix assertion with move inside a copy + Server-side bugfixes: * mod_dav_svn: Prevent crashes with some 3rd party modules * mod_dav_svn: canonicalize paths properly * mod_authz_svn: fix crash of mod_authz_svn with invalid config * hotcopy: fix hotcopy losing revprop files in packed repos + Other tool improvements and bugfixes: * mod_dontdothat: Fix the uri parser + Developer-visible changes: * fix compilation with '--enable-optimize' with clang * add test to fail when built against broken ZLib + Bindings: * ctypes-python: build with compiler selected via configure - require python-sqlite when running regression tests for all targets, no longer pulled in implicitly - print error logs on regression test failures - fix regression tests for ppc/ppc64 architectures, found in openSUSE package build and fixed with upstream developers - if running regression tests, also run them against bdb backend - update keyring, use Subversion Project Management Committee keyring rather than all committers Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-942 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.8.5-2.11.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.5-2.11.1 libsvn_auth_kwallet-1-0-1.8.5-2.11.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.5-2.11.1 subversion-1.8.5-2.11.1 subversion-debuginfo-1.8.5-2.11.1 subversion-debugsource-1.8.5-2.11.1 subversion-devel-1.8.5-2.11.1 subversion-perl-1.8.5-2.11.1 subversion-perl-debuginfo-1.8.5-2.11.1 subversion-python-1.8.5-2.11.1 subversion-python-debuginfo-1.8.5-2.11.1 subversion-ruby-1.8.5-2.11.1 subversion-ruby-debuginfo-1.8.5-2.11.1 subversion-server-1.8.5-2.11.1 subversion-server-debuginfo-1.8.5-2.11.1 subversion-tools-1.8.5-2.11.1 subversion-tools-debuginfo-1.8.5-2.11.1 - openSUSE 13.1 (noarch): subversion-bash-completion-1.8.5-2.11.1 References: http://support.novell.com/security/cve/CVE-2013-4505.html http://support.novell.com/security/cve/CVE-2013-4558.html https://bugzilla.novell.com/850667 https://bugzilla.novell.com/850747

1 0

openSUSE-SU-2013:1835-1: moderate: update for ruby19
by opensuse-security＠opensuse.org 07 Dec '13

07 Dec '13

openSUSE Security Update: update for ruby19 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1835-1 Rating: moderate References: #851803 Cross-References: CVE-2013-4164 Affected Products: openSUSE 13.1 openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The following security issue was fixed in ruby19: Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-940 - openSUSE 12.3: zypper in -t patch openSUSE-2013-940 - openSUSE 12.2: zypper in -t patch openSUSE-2013-940 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): ruby19-1.9.3.p448-2.4.1 ruby19-debuginfo-1.9.3.p448-2.4.1 ruby19-debugsource-1.9.3.p448-2.4.1 ruby19-devel-1.9.3.p448-2.4.1 ruby19-devel-extra-1.9.3.p448-2.4.1 ruby19-tk-1.9.3.p448-2.4.1 ruby19-tk-debuginfo-1.9.3.p448-2.4.1 - openSUSE 13.1 (noarch): ruby19-doc-ri-1.9.3.p448-2.4.1 - openSUSE 12.3 (i586 x86_64): ruby19-1.9.3.p392-1.17.1 ruby19-debuginfo-1.9.3.p392-1.17.1 ruby19-debugsource-1.9.3.p392-1.17.1 ruby19-devel-1.9.3.p392-1.17.1 ruby19-devel-extra-1.9.3.p392-1.17.1 ruby19-tk-1.9.3.p392-1.17.1 ruby19-tk-debuginfo-1.9.3.p392-1.17.1 - openSUSE 12.3 (noarch): ruby19-doc-ri-1.9.3.p392-1.17.1 - openSUSE 12.2 (i586 x86_64): ruby19-1.9.3.p392-3.34.1 ruby19-debuginfo-1.9.3.p392-3.34.1 ruby19-debugsource-1.9.3.p392-3.34.1 ruby19-devel-1.9.3.p392-3.34.1 ruby19-devel-extra-1.9.3.p392-3.34.1 ruby19-tk-1.9.3.p392-3.34.1 ruby19-tk-debuginfo-1.9.3.p392-3.34.1 - openSUSE 12.2 (noarch): ruby19-doc-ri-1.9.3.p392-3.34.1 References: http://support.novell.com/security/cve/CVE-2013-4164.html https://bugzilla.novell.com/851803

1 0

openSUSE-SU-2013:1834-1: moderate: update for ruby20
by opensuse-security＠opensuse.org 07 Dec '13

07 Dec '13

openSUSE Security Update: update for ruby20 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1834-1 Rating: moderate References: #851803 Cross-References: CVE-2013-4164 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: the following security issue was fixed in ruby20: - fix CVE-2013-4164: heap overflow in float point parsing (bnc#851803) The file CVE-2013-4164.patch contains the patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-943 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): ruby20-2.0.0.p247-3.7.1 ruby20-debuginfo-2.0.0.p247-3.7.1 ruby20-debugsource-2.0.0.p247-3.7.1 ruby20-devel-2.0.0.p247-3.7.1 ruby20-devel-extra-2.0.0.p247-3.7.1 ruby20-tk-2.0.0.p247-3.7.1 ruby20-tk-debuginfo-2.0.0.p247-3.7.1 - openSUSE 13.1 (noarch): ruby20-doc-ri-2.0.0.p247-3.7.1 References: http://support.novell.com/security/cve/CVE-2013-4164.html https://bugzilla.novell.com/851803

1 0

openSUSE-SU-2013:1833-1: moderate: update for krb5
by opensuse-security＠opensuse.org 07 Dec '13

07 Dec '13

openSUSE Security Update: update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1833-1 Rating: moderate References: #849240 #850660 Cross-References: CVE-2013-1417 CVE-2013-1418 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: the following security issues were fixed in krb5: - Fix a KDC null pointer dereference [CVE-2013-1417] that could affect realms with an uncommon configuration. (bnc#850660) bug-850660-CVE-2013-1417-KDC-null-deref-due-to-referrals.dif - Fix a KDC null pointer dereference [CVE-2013-1418] that could affect KDCs that serve multiple realms. (bnc#849240) bug-849240-CVE-2013-1418-fix-multi-realm-kdc-null-deref.dif Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-941 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): krb5-1.11.3-3.4.1 krb5-client-1.11.3-3.4.1 krb5-client-debuginfo-1.11.3-3.4.1 krb5-debuginfo-1.11.3-3.4.1 krb5-debugsource-1.11.3-3.4.1 krb5-devel-1.11.3-3.4.1 krb5-doc-1.11.3-3.4.1 krb5-mini-1.11.3-3.4.1 krb5-mini-debuginfo-1.11.3-3.4.1 krb5-mini-debugsource-1.11.3-3.4.1 krb5-mini-devel-1.11.3-3.4.1 krb5-plugin-kdb-ldap-1.11.3-3.4.1 krb5-plugin-kdb-ldap-debuginfo-1.11.3-3.4.1 krb5-plugin-preauth-pkinit-1.11.3-3.4.1 krb5-plugin-preauth-pkinit-debuginfo-1.11.3-3.4.1 krb5-server-1.11.3-3.4.1 krb5-server-debuginfo-1.11.3-3.4.1 - openSUSE 13.1 (x86_64): krb5-32bit-1.11.3-3.4.1 krb5-debuginfo-32bit-1.11.3-3.4.1 krb5-devel-32bit-1.11.3-3.4.1 References: http://support.novell.com/security/cve/CVE-2013-1417.html http://support.novell.com/security/cve/CVE-2013-1418.html https://bugzilla.novell.com/849240 https://bugzilla.novell.com/850660

1 0

openSUSE-SU-2013:1826-1: moderate: update for horde5
by opensuse-security＠opensuse.org 04 Dec '13

04 Dec '13

openSUSE Security Update: update for horde5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1826-1 Rating: moderate References: #811369 Cross-References: CVE-2013-1090 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - it fixes config directory permission and owner for bnc#811369 CVE-2013-1090 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-938 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): horde5-5.0.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1090.html https://bugzilla.novell.com/811369

1 0

openSUSE-SU-2013:1825-1: ibus-pinyin: fixed typed password visibility
by opensuse-security＠opensuse.org 04 Dec '13

04 Dec '13

openSUSE Security Update: ibus-pinyin: fixed typed password visibility ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1825-1 Rating: low References: #847718 Cross-References: CVE-2013-4509 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following issue with ibus-pinyin: - Fix visible password entry in GNOME lock screen (CVE-2013-4509, bnc#847718) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-939 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): ibus-pinyin-1.5.0-3.6.1 ibus-pinyin-debuginfo-1.5.0-3.6.1 ibus-pinyin-debugsource-1.5.0-3.6.1 References: http://support.novell.com/security/cve/CVE-2013-4509.html https://bugzilla.novell.com/847718

1 0

openSUSE-RU-2013:1823-1: python-veusz: Fix incorrect histogram error bars
by maintenance＠opensuse.org 04 Dec '13

04 Dec '13

openSUSE Recommended Update: python-veusz: Fix incorrect histogram error bars ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1823-1 Rating: low References: #852537 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with python-veusz: - bnc#852537: Fix incorrect histogram error bars Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-932 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): python-veusz-1.18-2.4.1 python-veusz-debuginfo-1.18-2.4.1 python-veusz-debugsource-1.18-2.4.1 References: https://bugzilla.novell.com/852537

1 0

openSUSE-RU-2013:1822-1: NetworkManager-kde4: Update to latest bugfix release 0.9.0.10
by maintenance＠opensuse.org 04 Dec '13

04 Dec '13

openSUSE Recommended Update: NetworkManager-kde4: Update to latest bugfix release 0.9.0.10 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1822-1 Rating: low References: #845783 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with NetworkManager-kde4: - Update to 0.9.0.10 + Bugfix release + bnc#845783, kde#299863: Fixed crash when adding WPA2 Enterprise connections + Re-add support to NetworkManager 0.9.6.x. + Add IPv6 information into connection details. + kde#324880: Fix signal quality and access technology updating for 3G connections. + Small optimization: disable updating traffic plotter if popup is closed. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-928 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): NetworkManager-kde4-debugsource-0.9.0.10-2.4.1 NetworkManager-kde4-devel-0.9.0.10-2.4.1 NetworkManager-kde4-libs-0.9.0.10-2.4.1 NetworkManager-kde4-libs-debuginfo-0.9.0.10-2.4.1 NetworkManager-novellvpn-kde4-0.9.0.10-2.4.1 NetworkManager-novellvpn-kde4-debuginfo-0.9.0.10-2.4.1 NetworkManager-openconnect-kde4-0.9.0.10-2.4.1 NetworkManager-openconnect-kde4-debuginfo-0.9.0.10-2.4.1 NetworkManager-openvpn-kde4-0.9.0.10-2.4.1 NetworkManager-openvpn-kde4-debuginfo-0.9.0.10-2.4.1 NetworkManager-pptp-kde4-0.9.0.10-2.4.1 NetworkManager-pptp-kde4-debuginfo-0.9.0.10-2.4.1 NetworkManager-strongswan-kde4-0.9.0.10-2.4.1 NetworkManager-strongswan-kde4-debuginfo-0.9.0.10-2.4.1 NetworkManager-vpnc-kde4-0.9.0.10-2.4.1 NetworkManager-vpnc-kde4-debuginfo-0.9.0.10-2.4.1 plasmoid-networkmanagement-0.9.0.10-2.4.1 plasmoid-networkmanagement-debuginfo-0.9.0.10-2.4.1 - openSUSE 13.1 (noarch): NetworkManager-kde4-libs-lang-0.9.0.10-2.4.1 References: https://bugzilla.novell.com/845783

1 0

openSUSE-RU-2013:1821-1: plasma-nm, libNetworkManagerQt, libModemManagerQt: add full support for ModemManager 1.0
by maintenance＠opensuse.org 04 Dec '13

04 Dec '13

openSUSE Recommended Update: plasma-nm, libNetworkManagerQt, libModemManagerQt: add full support for ModemManager 1.0 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1821-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides full support for ModemManager 1.0 for plasma-nm, libNetworkManagerQt and libModemManagerQt. - plasma-nm: + Update to 0.9.3.2 * Bugfix release * Improved support for HDPI displays * For more details see: http://grulja.wordpress.com/2013/11/22/kde-pim-solid-sprint- report/ + fix the VPN icon displayed when connected to a VPN connection + Split out Strongswan plugin to its own sub-package. - libNetworkManagerQt: + Update to 0.9.8.0 * Added integration with ModemManager >= 0.8 - libModemManagerQt: + Update to 1.0.0 * Added full ModemManager 0.8+ support Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-934 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libModemManagerQt-debugsource-1.0.0-2.4.1 libModemManagerQt-devel-1.0.0-2.4.1 libModemManagerQt0-1.0.0-2.4.1 libModemManagerQt0-debuginfo-1.0.0-2.4.1 libNetworkManagerQt-debugsource-0.9.8.0-4.1 libNetworkManagerQt-devel-0.9.8.0-4.1 libNetworkManagerQt0-0.9.8.0-4.1 libNetworkManagerQt0-debuginfo-0.9.8.0-4.1 plasma-nm-0.9.3.2-4.1 plasma-nm-debuginfo-0.9.3.2-4.1 plasma-nm-debugsource-0.9.3.2-4.1 plasma-nm-l2tp-0.9.3.2-4.1 plasma-nm-l2tp-debuginfo-0.9.3.2-4.1 plasma-nm-openconnect-0.9.3.2-4.1 plasma-nm-openconnect-debuginfo-0.9.3.2-4.1 plasma-nm-openswan-0.9.3.2-4.1 plasma-nm-openswan-debuginfo-0.9.3.2-4.1 plasma-nm-openvpn-0.9.3.2-4.1 plasma-nm-openvpn-debuginfo-0.9.3.2-4.1 plasma-nm-pptp-0.9.3.2-4.1 plasma-nm-pptp-debuginfo-0.9.3.2-4.1 plasma-nm-strongswan-0.9.3.2-4.1 plasma-nm-strongswan-debuginfo-0.9.3.2-4.1 plasma-nm-vpnc-0.9.3.2-4.1 plasma-nm-vpnc-debuginfo-0.9.3.2-4.1 - openSUSE 13.1 (noarch): plasma-nm-lang-0.9.3.2-4.1 References:

1 0

openSUSE-RU-2013:1820-1: kscreen, libkscreen: Update to latest bugfix release
by maintenance＠opensuse.org 04 Dec '13

04 Dec '13

openSUSE Recommended Update: kscreen, libkscreen: Update to latest bugfix release ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1820-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides the current bugfix release of kscreen (1.0.2.1 kde#327877) and libkscreen (1.0.2) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-935 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): kscreen-1.0.2.1-3.4.1 kscreen-debuginfo-1.0.2.1-3.4.1 kscreen-debugsource-1.0.2.1-3.4.1 libkscreen-1.0.2-3.4.1 libkscreen-debuginfo-1.0.2-3.4.1 libkscreen-debugsource-1.0.2-3.4.1 libkscreen-devel-1.0.2-3.4.1 libkscreen-devel-debuginfo-1.0.2-3.4.1 libkscreen1-1.0.2-3.4.1 libkscreen1-debuginfo-1.0.2-3.4.1 - openSUSE 13.1 (noarch): kscreen-lang-1.0.2.1-3.4.1 References:

1 0