February 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:0303-1: moderate: rubygem-rdoc: fixed a security bug
by opensuse-security＠opensuse.org 15 Feb '13

15 Feb '13

openSUSE Security Update: rubygem-rdoc: fixed a security bug ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0303-1 Rating: moderate References: #802406 Cross-References: CVE-2013-0256 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rubgem rdoc was updated to fix a security issue: CVE-2013-0256: rubygem-rdoc: XSS exploit of RDoc documentation generated by rdoc * Ensured that rd parser files are generated before checking the manifest. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-122 - openSUSE 12.1: zypper in -t patch openSUSE-2013-122 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): rubygem-rdoc-3.12.1-2.4.1 rubygem-rdoc-doc-3.12.1-2.4.1 rubygem-rdoc-testsuite-3.12.1-2.4.1 - openSUSE 12.1 (i586 x86_64): rubygem-rdoc-2.5.11-3.4.1 References: http://support.novell.com/security/cve/CVE-2013-0256.html https://bugzilla.novell.com/802406

1 0

openSUSE-SU-2013:0302-1: moderate: blender: fixed tmp races in undo save quit Blender kernel routine
by opensuse-security＠opensuse.org 15 Feb '13

15 Feb '13

openSUSE Security Update: blender: fixed tmp races in undo save quit Blender kernel routine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0302-1 Rating: moderate References: #779210 Cross-References: CVE-2010-5105 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes tmp races in the undo save quit Blender routine. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-121 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): blender-2.63a-2.4.1 blender-debuginfo-2.63a-2.4.1 - openSUSE 12.2 (noarch): blender-lang-2.63a-2.4.1 References: http://support.novell.com/security/cve/CVE-2010-5105.html https://bugzilla.novell.com/779210

1 0

openSUSE-SU-2013:0301-1: moderate: gnome-online-accounts: enable ssl certificate checking
by opensuse-security＠opensuse.org 15 Feb '13

15 Feb '13

openSUSE Security Update: gnome-online-accounts: enable ssl certificate checking ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0301-1 Rating: moderate References: #802409 Cross-References: CVE-2013-0240 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gnome-online-accounts was updated to do SSL certicicate checking when creating accounts, avoiding man-in-the-middle attack possibilities. (CVE-2013--240) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-120 - openSUSE 12.1: zypper in -t patch openSUSE-2013-120 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): gnome-online-accounts-3.4.2-2.4.1 gnome-online-accounts-debuginfo-3.4.2-2.4.1 gnome-online-accounts-debugsource-3.4.2-2.4.1 gnome-online-accounts-devel-3.4.2-2.4.1 libgoa-1_0-0-3.4.2-2.4.1 libgoa-1_0-0-debuginfo-3.4.2-2.4.1 libgoa-backend-1_0-0-3.4.2-2.4.1 libgoa-backend-1_0-0-debuginfo-3.4.2-2.4.1 typelib-1_0-Goa-1_0-3.4.2-2.4.1 - openSUSE 12.2 (x86_64): libgoa-1_0-0-32bit-3.4.2-2.4.1 libgoa-1_0-0-debuginfo-32bit-3.4.2-2.4.1 libgoa-backend-1_0-0-32bit-3.4.2-2.4.1 libgoa-backend-1_0-0-debuginfo-32bit-3.4.2-2.4.1 - openSUSE 12.2 (noarch): gnome-online-accounts-lang-3.4.2-2.4.1 - openSUSE 12.1 (i586 x86_64): gnome-online-accounts-3.2.1-2.4.1 gnome-online-accounts-debuginfo-3.2.1-2.4.1 gnome-online-accounts-debugsource-3.2.1-2.4.1 gnome-online-accounts-devel-3.2.1-2.4.1 libgoa-1_0-0-3.2.1-2.4.1 libgoa-1_0-0-debuginfo-3.2.1-2.4.1 libgoa-backend-1_0-0-3.2.1-2.4.1 libgoa-backend-1_0-0-debuginfo-3.2.1-2.4.1 - openSUSE 12.1 (noarch): gnome-online-accounts-lang-3.2.1-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-0240.html https://bugzilla.novell.com/802409

1 0

openSUSE-RU-2013:0299-1: nagios: fixed last security patch
by maintenance＠opensuse.org 14 Feb '13

14 Feb '13

openSUSE Recommended Update: nagios: fixed last security patch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0299-1 Rating: low References: #797237 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The last Nagios security fixes contained incorrect snprintf usage which would likely lead to crashes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-24 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): nagios-3.2.3-3.22.1 nagios-debuginfo-3.2.3-3.22.1 nagios-debugsource-3.2.3-3.22.1 nagios-devel-3.2.3-3.22.1 nagios-www-3.2.3-3.22.1 References: https://bugzilla.novell.com/797237

1 0

openSUSE-SU-2013:0298-1: critical: flash-player: update to 11.2.202.270
by opensuse-security＠opensuse.org 14 Feb '13

14 Feb '13

openSUSE Security Update: flash-player: update to 11.2.202.270 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0298-1 Rating: critical References: #803485 Cross-References: CVE-2013-0637 CVE-2013-0638 CVE-2013-0639 CVE-2013-0642 CVE-2013-0644 CVE-2013-0645 CVE-2013-0647 CVE-2013-0649 CVE-2013-1365 CVE-2013-1366 CVE-2013-1367 CVE-2013-1368 CVE-2013-1369 CVE-2013-1370 CVE-2013-1372 CVE-2013-1373 CVE-2013-1374 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.270: (bnc#803485) * APSB13-05, CVE-2013-1372, CVE-2013-0645, CVE-2013-1373, CVE-2013-1369, CVE-2013-1370, CVE-2013-1366, CVE-2013-0649, CVE-2013-1365, CVE-2013-1374, CVE-2013-1368, CVE-2013-0642, CVE-2013-0644, CVE-2013-0647, CVE-2013-1367, CVE-2013-0639, CVE-2013-0638, CVE-2013-0637 More information can be found on: http://www.adobe.com/support/security/bulletins/apsb13-05.ht ml Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-25 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.270-47.1 flash-player-gnome-11.2.202.270-47.1 flash-player-kde4-11.2.202.270-47.1 References: http://support.novell.com/security/cve/CVE-2013-0637.html http://support.novell.com/security/cve/CVE-2013-0638.html http://support.novell.com/security/cve/CVE-2013-0639.html http://support.novell.com/security/cve/CVE-2013-0642.html http://support.novell.com/security/cve/CVE-2013-0644.html http://support.novell.com/security/cve/CVE-2013-0645.html http://support.novell.com/security/cve/CVE-2013-0647.html http://support.novell.com/security/cve/CVE-2013-0649.html http://support.novell.com/security/cve/CVE-2013-1365.html http://support.novell.com/security/cve/CVE-2013-1366.html http://support.novell.com/security/cve/CVE-2013-1367.html http://support.novell.com/security/cve/CVE-2013-1368.html http://support.novell.com/security/cve/CVE-2013-1369.html http://support.novell.com/security/cve/CVE-2013-1370.html http://support.novell.com/security/cve/CVE-2013-1372.html http://support.novell.com/security/cve/CVE-2013-1373.html http://support.novell.com/security/cve/CVE-2013-1374.html https://bugzilla.novell.com/803485

1 0

openSUSE-SU-2013:0297-1: moderate: inkscape: two security fixes
by opensuse-security＠opensuse.org 14 Feb '13

14 Feb '13

openSUSE Security Update: inkscape: two security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0297-1 Rating: moderate References: #794958 #796306 Cross-References: CVE-2012-5656 CVE-2012-6076 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Inkscape was updated to fix two security issues: - inkscape occasionaly tries to open EPS files from /tmp (bnc#796306, CVE-2012-6076). - inkscape could load XML from external hosts (bnc#794958, CWE-827, CVE-2012-5656). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-26 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): inkscape-0.48.1-8.1 inkscape-debuginfo-0.48.1-8.1 inkscape-debugsource-0.48.1-8.1 inkscape-extensions-dia-0.48.1-8.1 inkscape-extensions-extra-0.48.1-8.1 inkscape-extensions-fig-0.48.1-8.1 inkscape-extensions-gimp-0.48.1-8.1 inkscape-extensions-skencil-0.48.1-8.1 - openSUSE 11.4 (noarch): inkscape-lang-0.48.1-8.1 References: http://support.novell.com/security/cve/CVE-2012-5656.html http://support.novell.com/security/cve/CVE-2012-6076.html https://bugzilla.novell.com/794958 https://bugzilla.novell.com/796306

1 0

openSUSE-SU-2013:0295-1: critical: flash-player: update to 11.2.202.270
by opensuse-security＠opensuse.org 14 Feb '13

14 Feb '13

openSUSE Security Update: flash-player: update to 11.2.202.270 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0295-1 Rating: critical References: #803485 Cross-References: CVE-2013-0637 CVE-2013-0638 CVE-2013-0639 CVE-2013-0642 CVE-2013-0644 CVE-2013-0645 CVE-2013-0647 CVE-2013-0649 CVE-2013-1365 CVE-2013-1366 CVE-2013-1367 CVE-2013-1368 CVE-2013-1369 CVE-2013-1370 CVE-2013-1372 CVE-2013-1373 CVE-2013-1374 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.270: (bnc#803485) * APSB13-05, CVE-2013-1372, CVE-2013-0645, CVE-2013-1373, CVE-2013-1369, CVE-2013-1370, CVE-2013-1366, CVE-2013-0649, CVE-2013-1365, CVE-2013-1374, CVE-2013-1368, CVE-2013-0642, CVE-2013-0644, CVE-2013-0647, CVE-2013-1367, CVE-2013-0639, CVE-2013-0638, CVE-2013-0637 More information can be found on: http://www.adobe.com/support/security/bulletins/apsb13-05.ht ml Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-119 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.270-50.1 flash-player-gnome-11.2.202.270-50.1 flash-player-kde4-11.2.202.270-50.1 References: http://support.novell.com/security/cve/CVE-2013-0637.html http://support.novell.com/security/cve/CVE-2013-0638.html http://support.novell.com/security/cve/CVE-2013-0639.html http://support.novell.com/security/cve/CVE-2013-0642.html http://support.novell.com/security/cve/CVE-2013-0644.html http://support.novell.com/security/cve/CVE-2013-0645.html http://support.novell.com/security/cve/CVE-2013-0647.html http://support.novell.com/security/cve/CVE-2013-0649.html http://support.novell.com/security/cve/CVE-2013-1365.html http://support.novell.com/security/cve/CVE-2013-1366.html http://support.novell.com/security/cve/CVE-2013-1367.html http://support.novell.com/security/cve/CVE-2013-1368.html http://support.novell.com/security/cve/CVE-2013-1369.html http://support.novell.com/security/cve/CVE-2013-1370.html http://support.novell.com/security/cve/CVE-2013-1372.html http://support.novell.com/security/cve/CVE-2013-1373.html http://support.novell.com/security/cve/CVE-2013-1374.html https://bugzilla.novell.com/803485

1 0

openSUSE-SU-2013:0294-1: moderate: inkscape: two security fixes
by opensuse-security＠opensuse.org 14 Feb '13

14 Feb '13

openSUSE Security Update: inkscape: two security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0294-1 Rating: moderate References: #794958 #796306 Cross-References: CVE-2012-5656 CVE-2012-6076 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Inkscape was updated to fix two security issues: - inkscape occasionaly tries to open EPS files from /tmp (bnc#796306, CVE-2012-6076). - inkscape could load XML from external hosts (bnc#794958, CWE-827, CVE-2012-5656). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-118 - openSUSE 12.1: zypper in -t patch openSUSE-2013-118 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): inkscape-0.48.3.1-5.9.1 inkscape-debuginfo-0.48.3.1-5.9.1 inkscape-debugsource-0.48.3.1-5.9.1 inkscape-extensions-dia-0.48.3.1-5.9.1 inkscape-extensions-extra-0.48.3.1-5.9.1 inkscape-extensions-fig-0.48.3.1-5.9.1 inkscape-extensions-gimp-0.48.3.1-5.9.1 inkscape-extensions-skencil-0.48.3.1-5.9.1 - openSUSE 12.2 (noarch): inkscape-lang-0.48.3.1-5.9.1 - openSUSE 12.1 (i586 x86_64): inkscape-0.48.2-2.4.1 inkscape-debuginfo-0.48.2-2.4.1 inkscape-debugsource-0.48.2-2.4.1 inkscape-extensions-dia-0.48.2-2.4.1 inkscape-extensions-extra-0.48.2-2.4.1 inkscape-extensions-fig-0.48.2-2.4.1 inkscape-extensions-gimp-0.48.2-2.4.1 inkscape-extensions-skencil-0.48.2-2.4.1 - openSUSE 12.1 (noarch): inkscape-lang-0.48.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-5656.html http://support.novell.com/security/cve/CVE-2012-6076.html https://bugzilla.novell.com/794958 https://bugzilla.novell.com/796306

1 0

openSUSE-RU-2013:0293-1: nagios: fixed last security patch
by maintenance＠opensuse.org 14 Feb '13

14 Feb '13

openSUSE Recommended Update: nagios: fixed last security patch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0293-1 Rating: low References: #797237 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The last Nagios security fixes contained incorrect snprintf usage which would likely lead to crashes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-117 - openSUSE 12.1: zypper in -t patch openSUSE-2013-117 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): nagios-3.4.1-2.9.1 nagios-debuginfo-3.4.1-2.9.1 nagios-debugsource-3.4.1-2.9.1 nagios-devel-3.4.1-2.9.1 nagios-www-3.4.1-2.9.1 nagios-www-debuginfo-3.4.1-2.9.1 - openSUSE 12.1 (i586 x86_64): nagios-3.3.1-9.10.1 nagios-debuginfo-3.3.1-9.10.1 nagios-debugsource-3.3.1-9.10.1 nagios-devel-3.3.1-9.10.1 nagios-www-3.3.1-9.10.1 nagios-www-debuginfo-3.3.1-9.10.1 References: https://bugzilla.novell.com/797237

1 0

openSUSE-RU-2013:0290-1: - removed controller for /hosts path (was accessible for
by maintenance＠opensuse.org 13 Feb '13

13 Feb '13

openSUSE Recommended Update: - removed controller for /hosts path (was accessible for ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0290-1 Rating: low References: Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: - removed controller for /hosts path (was accessible for unauthorized users) (CVE-2012-0435) (bnc#792712) - 0.2.67 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-114 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (noarch): webyast-base-ui-0.2.67-1.4.1 webyast-base-ui-branding-default-0.2.67-1.4.1 webyast-base-ui-testsuite-0.2.67-1.4.1 References:

1 0