December 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1904-1: moderate: update for rubygem-actionpack-3_2
by opensuse-security＠opensuse.org 18 Dec '13

18 Dec '13

openSUSE Security Update: update for rubygem-actionpack-3_2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1904-1 Rating: moderate References: #853625 #853627 #853632 #853633 Cross-References: CVE-2013-0155 CVE-2013-4491 CVE-2013-6414 CVE-2013-6415 CVE-2013-6417 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: - fix CVE-2013-4491: rubygem-actionpack: i18n missing translation XSS (bnc#853625). File CVE-2013-4491.patch contains the patch - fix CVE-2013-6414: rubygem-actionpack: Action View DoS (bnc#853633). File CVE-2013-6414.patch contains the patch. - fix CVE-2013-6415: rubygem-actionpack: number_to_currency XSS (bnc#853632). File CVE-2013-6415.patch contains the patch. - fix CVE-2013-6417: rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013-0155) (bnc#853627). File CVE-2013-6417.patch contains the patch. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-989 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): rubygem-actionpack-3_2-3.2.12-1.8.1 rubygem-actionpack-3_2-doc-3.2.12-1.8.1 References: http://support.novell.com/security/cve/CVE-2013-0155.html http://support.novell.com/security/cve/CVE-2013-4491.html http://support.novell.com/security/cve/CVE-2013-6414.html http://support.novell.com/security/cve/CVE-2013-6415.html http://support.novell.com/security/cve/CVE-2013-6417.html https://bugzilla.novell.com/853625 https://bugzilla.novell.com/853627 https://bugzilla.novell.com/853632 https://bugzilla.novell.com/853633

1 0

openSUSE-RU-2013:1902-1: yast2: fixed reading bridge configuration
by maintenance＠opensuse.org 17 Dec '13

17 Dec '13

openSUSE Recommended Update: yast2: fixed reading bridge configuration ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1902-1 Rating: low References: #851769 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with yast2: - bnc#851769: fixed reading bridge configuration Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-985 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): yast2-3.0.11-7.1 yast2-devel-doc-3.0.11-7.1 References: https://bugzilla.novell.com/851769

1 0

openSUSE-RU-2013:1901-1: gmime: Update to 2.6.19
by maintenance＠opensuse.org 17 Dec '13

17 Dec '13

openSUSE Recommended Update: gmime: Update to 2.6.19 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1901-1 Rating: low References: #855023 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with gmime: - Update to version 2.6.19: + bnc#855023, bgo#709031: Custom writer for References headers so that individual msgid tokens do not get folded. + bgo#708818: Initialize the mutexes earlier. + Fixed warnings for glib >= 2.35.1. + Minor code/comment cleanup. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-984 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): gmime-debugsource-2.6.19-4.1 gmime-devel-2.6.19-4.1 gmime-sharp-2.6.19-4.1 libgmime-2_6-0-2.6.19-4.1 libgmime-2_6-0-debuginfo-2.6.19-4.1 typelib-1_0-GMime-2_6-2.6.19-4.1 References: https://bugzilla.novell.com/855023

1 0

openSUSE-RU-2013:1900-1: rsyslog: update to 7.4.7
by maintenance＠opensuse.org 17 Dec '13

17 Dec '13

openSUSE Recommended Update: rsyslog: update to 7.4.7 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1900-1 Rating: low References: #855058 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with rsyslog: - bnc#855058: update to 7.4.7 [v7.4-stable] + limiting queue disk space did not work properly + linux kernel-like ratelimiter did not work properly with all inputs (for example, it did not work with imdup). + disk queues created files in wrong working directory + legacy directive $ActionQueueWorkerThreads was not honored + segfault on startup when certain script constructs are used e.g. "if not $msg ..." + imuxsock: UseSysTimeStamp config parameter did not work correctly + $SystemLogUseSysTimeStamp/$SystemLogUsePIDFromSystem did not work + improved checking of queue config parameters on startup + call to ruleset with async queue did not use the queue + if imtcp is loaded and no listeners are configured (which is uncommon), rsyslog crashes during shutdown. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-986 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): rsyslog-7.4.7-2.8.1 rsyslog-debuginfo-7.4.7-2.8.1 rsyslog-debugsource-7.4.7-2.8.1 rsyslog-diag-tools-7.4.7-2.8.1 rsyslog-diag-tools-debuginfo-7.4.7-2.8.1 rsyslog-doc-7.4.7-2.8.1 rsyslog-module-dbi-7.4.7-2.8.1 rsyslog-module-dbi-debuginfo-7.4.7-2.8.1 rsyslog-module-elasticsearch-7.4.7-2.8.1 rsyslog-module-elasticsearch-debuginfo-7.4.7-2.8.1 rsyslog-module-gcrypt-7.4.7-2.8.1 rsyslog-module-gcrypt-debuginfo-7.4.7-2.8.1 rsyslog-module-gssapi-7.4.7-2.8.1 rsyslog-module-gssapi-debuginfo-7.4.7-2.8.1 rsyslog-module-gtls-7.4.7-2.8.1 rsyslog-module-gtls-debuginfo-7.4.7-2.8.1 rsyslog-module-guardtime-7.4.7-2.8.1 rsyslog-module-guardtime-debuginfo-7.4.7-2.8.1 rsyslog-module-mmnormalize-7.4.7-2.8.1 rsyslog-module-mmnormalize-debuginfo-7.4.7-2.8.1 rsyslog-module-mysql-7.4.7-2.8.1 rsyslog-module-mysql-debuginfo-7.4.7-2.8.1 rsyslog-module-pgsql-7.4.7-2.8.1 rsyslog-module-pgsql-debuginfo-7.4.7-2.8.1 rsyslog-module-relp-7.4.7-2.8.1 rsyslog-module-relp-debuginfo-7.4.7-2.8.1 rsyslog-module-snmp-7.4.7-2.8.1 rsyslog-module-snmp-debuginfo-7.4.7-2.8.1 rsyslog-module-udpspoof-7.4.7-2.8.1 rsyslog-module-udpspoof-debuginfo-7.4.7-2.8.1 References: https://bugzilla.novell.com/855058

1 0

openSUSE-SU-2013:1898-1: moderate: update for flash-player
by opensuse-security＠opensuse.org 17 Dec '13

17 Dec '13

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1898-1 Rating: moderate References: #854881 Cross-References: CVE-2013-5331 CVE-2013-5332 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes the following security issues with flash-player: - Security update to 11.2.202.332: (bnc#854881) * APSB13-28, CVE-2013-5331, CVE-2013-5332 * Prevents possible remote code execution! Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-173 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.332-83.1 flash-player-gnome-11.2.202.332-83.1 flash-player-kde4-11.2.202.332-83.1 References: http://support.novell.com/security/cve/CVE-2013-5331.html http://support.novell.com/security/cve/CVE-2013-5332.html https://bugzilla.novell.com/854881

1 0

openSUSE-SU-2013:1891-1: important: ca-certificates-mozilla: add, remove or blacklist some certificates
by opensuse-security＠opensuse.org 16 Dec '13

16 Dec '13

openSUSE Security Update: ca-certificates-mozilla: add, remove or blacklist some certificates ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1891-1 Rating: important References: #854163 #854367 Affected Products: openSUSE 13.1 openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The Mozilla CA certificates package was updated to match the current Mozilla revision 1.95 of certdata.txt. It blacklists some misused certificate authorities, adds some new and adjusts some others. On openSUSE 13.1 a problem with names was also fixed. * distrust: AC DG Tresor SSL (bnc#854367) * new: CA_Disig_Root_R1:2.9.0.195.3.154.238.80.144.110.40.crt server auth, code signing, email signing * new: CA_Disig_Root_R2:2.9.0.146.184.136.219.176.138.193.99.crt server auth, code signing, email signing * new: China_Internet_Network_Information_Center_EV_Certificates_Ro ot:2.4.72.159.0.1.crt server auth * changed: Digital_Signature_Trust_Co._Global_CA_1:2.4.54.112.21.150.cr t removed code signing and server auth abilities * changed: Digital_Signature_Trust_Co._Global_CA_3:2.4.54.110.211.206.c rt removed code signing and server auth abilities * new: D-TRUST_Root_Class_3_CA_2_2009:2.3.9.131.243.crt server auth * new: D-TRUST_Root_Class_3_CA_2_EV_2009:2.3.9.131.244.crt server auth * removed: Equifax_Secure_eBusiness_CA_2:2.4.55.112.207.181.crt * new: PSCProcert:2.1.11.crt server auth, code signing, email signing * new: Swisscom_Root_CA_2:2.16.30.158.40.232.72.242.229.239.195.124 .74.30.90.24.103.182.crt server auth, code signing, email signing * new: Swisscom_Root_EV_CA_2:2.17.0.242.250.100.226.116.99.211.141. 253.16.29.4.31.118.202.88.crt server auth, code signing * changed: TC_TrustCenter_Universal_CA_III:2.14.99.37.0.1.0.2.20.141.51 .21.2.228.108.244.crt removed all abilities * new: TURKTRUST_Certificate_Services_Provider_Root_2007:2.1.1.crt server auth, code signing * changed: TWCA_Root_Certification_Authority:2.1.1.crt added code signing ability Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-983 - openSUSE 12.3: zypper in -t patch openSUSE-2013-983 - openSUSE 12.2: zypper in -t patch openSUSE-2013-983 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): ca-certificates-mozilla-1.95-3.4.1 - openSUSE 12.3 (noarch): ca-certificates-mozilla-1.95-3.4.1 - openSUSE 12.2 (noarch): ca-certificates-mozilla-1.95-8.12.1 References: https://bugzilla.novell.com/854163 https://bugzilla.novell.com/854367

1 0

openSUSE-RU-2013:1890-1: python3-pyparsing: update to 2.0.1
by maintenance＠opensuse.org 16 Dec '13

16 Dec '13

openSUSE Recommended Update: python3-pyparsing: update to 2.0.1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1890-1 Rating: low References: #853270 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with python3-pyparsing: - bnc#853270: update to 2.0.1 * Removed use of "nonlocal" that prevented using this version of pyparsing with Python 2.6 and 2.7. This will make it easier to install for packages that depend on pyparsing, under Python versions 2.6 and later. Those using older versions of Python will have to manually install pyparsing 1.5.7. * Fixed implementation of <<= operator to return self; Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-974 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): python3-pyparsing-2.0.1-2.4.1 python3-pyparsing-doc-2.0.1-2.4.1 References: https://bugzilla.novell.com/853270

1 0

openSUSE-RU-2013:1889-1: NetworkManager-kde4: Make openconnect plugin explicitly require NetworkManager-openconnect
by maintenance＠opensuse.org 16 Dec '13

16 Dec '13

openSUSE Recommended Update: NetworkManager-kde4: Make openconnect plugin explicitly require NetworkManager-openconnect ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1889-1 Rating: low References: #845909 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with NetworkManager-kde4: - bnc#845909: Make openconnect plugin explicitly require NetworkManager-openconnect Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-979 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): NetworkManager-kde4-debugsource-0.9.0.10-2.8.1 NetworkManager-kde4-devel-0.9.0.10-2.8.1 NetworkManager-kde4-libs-0.9.0.10-2.8.1 NetworkManager-kde4-libs-debuginfo-0.9.0.10-2.8.1 NetworkManager-novellvpn-kde4-0.9.0.10-2.8.1 NetworkManager-novellvpn-kde4-debuginfo-0.9.0.10-2.8.1 NetworkManager-openconnect-kde4-0.9.0.10-2.8.1 NetworkManager-openconnect-kde4-debuginfo-0.9.0.10-2.8.1 NetworkManager-openvpn-kde4-0.9.0.10-2.8.1 NetworkManager-openvpn-kde4-debuginfo-0.9.0.10-2.8.1 NetworkManager-pptp-kde4-0.9.0.10-2.8.1 NetworkManager-pptp-kde4-debuginfo-0.9.0.10-2.8.1 NetworkManager-strongswan-kde4-0.9.0.10-2.8.1 NetworkManager-strongswan-kde4-debuginfo-0.9.0.10-2.8.1 NetworkManager-vpnc-kde4-0.9.0.10-2.8.1 NetworkManager-vpnc-kde4-debuginfo-0.9.0.10-2.8.1 plasmoid-networkmanagement-0.9.0.10-2.8.1 plasmoid-networkmanagement-debuginfo-0.9.0.10-2.8.1 - openSUSE 13.1 (noarch): NetworkManager-kde4-libs-lang-0.9.0.10-2.8.1 References: https://bugzilla.novell.com/845909

1 0

openSUSE-RU-2013:1888-1: important: libvirt: several fixes
by maintenance＠opensuse.org 16 Dec '13

16 Dec '13

openSUSE Recommended Update: libvirt: several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1888-1 Rating: important References: #848918 #849524 #850882 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update fixes the following issues with libvirt: - Allow execution of libvirt hook scripts in /etc/libvirt/hooks/ in libvirtd AppArmor profile - bnc#849524: Allow execution of Xen binaries in /usr/lib{,64}/xen/bin in libvirtd AppArmor profile - bnc#850882: Require libvirt-daemon-{hypervisor} in the main libvirt package for each supported hypervisor - bnc#848918: + Fix initialization of libxl NIC devices + Fix package dependency issues Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-969 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libvirt-1.1.2-2.10.2 libvirt-client-1.1.2-2.10.2 libvirt-client-debuginfo-1.1.2-2.10.2 libvirt-daemon-1.1.2-2.10.2 libvirt-daemon-config-nwfilter-1.1.2-2.10.2 libvirt-daemon-debuginfo-1.1.2-2.10.2 libvirt-daemon-driver-interface-1.1.2-2.10.2 libvirt-daemon-driver-interface-debuginfo-1.1.2-2.10.2 libvirt-daemon-driver-lxc-1.1.2-2.10.2 libvirt-daemon-driver-lxc-debuginfo-1.1.2-2.10.2 libvirt-daemon-driver-network-1.1.2-2.10.2 libvirt-daemon-driver-network-debuginfo-1.1.2-2.10.2 libvirt-daemon-driver-nodedev-1.1.2-2.10.2 libvirt-daemon-driver-nodedev-debuginfo-1.1.2-2.10.2 libvirt-daemon-driver-nwfilter-1.1.2-2.10.2 libvirt-daemon-driver-nwfilter-debuginfo-1.1.2-2.10.2 libvirt-daemon-driver-qemu-1.1.2-2.10.2 libvirt-daemon-driver-qemu-debuginfo-1.1.2-2.10.2 libvirt-daemon-driver-secret-1.1.2-2.10.2 libvirt-daemon-driver-secret-debuginfo-1.1.2-2.10.2 libvirt-daemon-driver-storage-1.1.2-2.10.2 libvirt-daemon-driver-storage-debuginfo-1.1.2-2.10.2 libvirt-daemon-driver-uml-1.1.2-2.10.2 libvirt-daemon-driver-uml-debuginfo-1.1.2-2.10.2 libvirt-daemon-driver-vbox-1.1.2-2.10.2 libvirt-daemon-driver-vbox-debuginfo-1.1.2-2.10.2 libvirt-daemon-lxc-1.1.2-2.10.2 libvirt-daemon-qemu-1.1.2-2.10.2 libvirt-daemon-uml-1.1.2-2.10.2 libvirt-daemon-vbox-1.1.2-2.10.2 libvirt-debugsource-1.1.2-2.10.2 libvirt-devel-1.1.2-2.10.2 libvirt-doc-1.1.2-2.10.2 libvirt-lock-sanlock-1.1.2-2.10.2 libvirt-lock-sanlock-debuginfo-1.1.2-2.10.2 libvirt-login-shell-1.1.2-2.10.2 libvirt-login-shell-debuginfo-1.1.2-2.10.2 libvirt-python-1.1.2-2.10.2 libvirt-python-debuginfo-1.1.2-2.10.2 - openSUSE 13.1 (x86_64): libvirt-client-32bit-1.1.2-2.10.2 libvirt-client-debuginfo-32bit-1.1.2-2.10.2 libvirt-daemon-driver-libxl-1.1.2-2.10.2 libvirt-daemon-driver-libxl-debuginfo-1.1.2-2.10.2 libvirt-daemon-driver-xen-1.1.2-2.10.2 libvirt-daemon-driver-xen-debuginfo-1.1.2-2.10.2 libvirt-daemon-xen-1.1.2-2.10.2 libvirt-devel-32bit-1.1.2-2.10.2 References: https://bugzilla.novell.com/848918 https://bugzilla.novell.com/849524 https://bugzilla.novell.com/850882

1 0

openSUSE-RU-2013:1887-1: release-notes-openSUSE: Update to 13.1.9 and disabled PDF build on armv7l and aarch64
by maintenance＠opensuse.org 16 Dec '13

16 Dec '13

openSUSE Recommended Update: release-notes-openSUSE: Update to 13.1.9 and disabled PDF build on armv7l and aarch64 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1887-1 Rating: low References: #849449 #850058 #851083 #851588 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following issues with release-notes-openSUSE: - Do not try to build PDF on armv7l and aarch64, xmlgraphics-fop does not exit - bnc#851083: 13.1.9 + Update translations. + bnc#849449: Avoid "odd characters" in .txt files + Updated entries: * bnc#850058: AppArmor and Permission Settings + New entries: * bnc#851588: AutoYaST Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2013-980 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): release-notes-openSUSE-13.1.9-29.1 References: https://bugzilla.novell.com/849449 https://bugzilla.novell.com/850058 https://bugzilla.novell.com/851083 https://bugzilla.novell.com/851588

1 0