February 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:0276-1: moderate: wireshark: update to 1.8.5
by opensuse-security＠opensuse.org 12 Feb '13

12 Feb '13

openSUSE Security Update: wireshark: update to 1.8.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0276-1 Rating: moderate References: #801131 Cross-References: CVE-2013-1572 CVE-2013-1573 CVE-2013-1574 CVE-2013-1575 CVE-2013-1576 CVE-2013-1577 CVE-2013-1578 CVE-2013-1579 CVE-2013-1580 CVE-2013-1581 CVE-2013-1582 CVE-2013-1583 CVE-2013-1584 CVE-2013-1585 CVE-2013-1586 CVE-2013-1587 CVE-2013-1588 CVE-2013-1589 CVE-2013-1590 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: wireshark was updated to 1.8.5 to fix bugs and security issues. Vulnerabilities fixed: * Infinite and large loops in the Bluetooth HCI, CSN.1, DCP-ETSI DOCSIS CM-STAUS, IEEE 802.3 Slow Protocols, MPLS, R3, RTPS, SDP, and SIP dissectors wnpa-sec-2013-01 CVE-2013-1572 CVE-2013-1573 CVE-2013-1574 CVE-2013-1575 CVE-2013-1576 CVE-2013-1577 CVE-2013-1578 CVE-2013-1579 CVE-2013-1580 CVE-2013-1581 * The CLNP dissector could crash wnpa-sec-2013-02 CVE-2013-1582 * The DTN dissector could crash wnpa-sec-2013-03 CVE-2013-1583 CVE-2013-1584 * The MS-MMC dissector (and possibly others) could crash wnpa-sec-2013-04 CVE-2013-1585 * The DTLS dissector could crash wnpa-sec-2013-05 CVE-2013-1586 * The ROHC dissector could crash wnpa-sec-2013-06 CVE-2013-1587 * The DCP-ETSI dissector could corrupt memory wnpa-sec-2013-07 CVE-2013-1588 * The Wireshark dissection engine could crash wnpa-sec-2013-08 CVE-2013-1589 * The NTLMSSP dissector could overflow a buffer wnpa-sec-2013-09 CVE-2013-1590 + Further bug fixes and updated protocol support as listed in: http://www.wireshark.org/docs/relnotes/wireshark-1.8.5.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-104 - openSUSE 12.1: zypper in -t patch openSUSE-2013-104 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): wireshark-1.8.5-1.19.1 wireshark-debuginfo-1.8.5-1.19.1 wireshark-debugsource-1.8.5-1.19.1 wireshark-devel-1.8.5-1.19.1 - openSUSE 12.1 (i586 x86_64): wireshark-1.8.5-3.37.1 wireshark-debuginfo-1.8.5-3.37.1 wireshark-debugsource-1.8.5-3.37.1 wireshark-devel-1.8.5-3.37.1 References: http://support.novell.com/security/cve/CVE-2013-1572.html http://support.novell.com/security/cve/CVE-2013-1573.html http://support.novell.com/security/cve/CVE-2013-1574.html http://support.novell.com/security/cve/CVE-2013-1575.html http://support.novell.com/security/cve/CVE-2013-1576.html http://support.novell.com/security/cve/CVE-2013-1577.html http://support.novell.com/security/cve/CVE-2013-1578.html http://support.novell.com/security/cve/CVE-2013-1579.html http://support.novell.com/security/cve/CVE-2013-1580.html http://support.novell.com/security/cve/CVE-2013-1581.html http://support.novell.com/security/cve/CVE-2013-1582.html http://support.novell.com/security/cve/CVE-2013-1583.html http://support.novell.com/security/cve/CVE-2013-1584.html http://support.novell.com/security/cve/CVE-2013-1585.html http://support.novell.com/security/cve/CVE-2013-1586.html http://support.novell.com/security/cve/CVE-2013-1587.html http://support.novell.com/security/cve/CVE-2013-1588.html http://support.novell.com/security/cve/CVE-2013-1589.html http://support.novell.com/security/cve/CVE-2013-1590.html https://bugzilla.novell.com/801131

1 0

openSUSE-SU-2013:0275-1: important: update for libvirt
by opensuse-security＠opensuse.org 12 Feb '13

12 Feb '13

openSUSE Security Update: update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0275-1 Rating: important References: #793900 #800976 Cross-References: CVE-2013-0170 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: - Update to libvirt 0.9.11.9 stable release - Fixes CVE-2013-0170 by including cherry picked master commit 46532e3e, bnc#800976 - Fix starting lxc VM e.g from OpenStack bnc#793900 and rh#858104 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-108 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libvirt-0.9.11.9-1.9.1 libvirt-client-0.9.11.9-1.9.1 libvirt-client-debuginfo-0.9.11.9-1.9.1 libvirt-debuginfo-0.9.11.9-1.9.1 libvirt-debugsource-0.9.11.9-1.9.1 libvirt-devel-0.9.11.9-1.9.1 libvirt-doc-0.9.11.9-1.9.1 libvirt-lock-sanlock-0.9.11.9-1.9.1 libvirt-lock-sanlock-debuginfo-0.9.11.9-1.9.1 libvirt-python-0.9.11.9-1.9.1 libvirt-python-debuginfo-0.9.11.9-1.9.1 - openSUSE 12.2 (x86_64): libvirt-client-32bit-0.9.11.9-1.9.1 libvirt-client-debuginfo-32bit-0.9.11.9-1.9.1 libvirt-devel-32bit-0.9.11.9-1.9.1 References: http://support.novell.com/security/cve/CVE-2013-0170.html https://bugzilla.novell.com/793900 https://bugzilla.novell.com/800976

1 0

openSUSE-SU-2013:0274-1: important: libvirt to fix use-after-free in virNetMessageFree()
by opensuse-security＠opensuse.org 12 Feb '13

12 Feb '13

openSUSE Security Update: libvirt to fix use-after-free in virNetMessageFree() ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0274-1 Rating: important References: #772586 #773621 #773626 #780432 #800976 Cross-References: CVE-2012-4423 CVE-2013-0170 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: libvirt was updated to fix some bugs and security issues: Security issues fixed: - Fix crash on error paths of message dispatching, CVE-2013-0170 bnc#800976 - security: Fix libvirtd crash possibility CVE-2012-4423 bnc#780432 Also bugs were fixed: - qemu: Fix probing for guest capabilities bnc#772586 - xen-xm: Generate UUID if not specified bnc#773626 - xenParseXM: don't dereference NULL pointer when script is empty bnc#773621 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-105 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libvirt-0.9.6-3.13.1 libvirt-client-0.9.6-3.13.1 libvirt-client-debuginfo-0.9.6-3.13.1 libvirt-debuginfo-0.9.6-3.13.1 libvirt-debugsource-0.9.6-3.13.1 libvirt-devel-0.9.6-3.13.1 libvirt-doc-0.9.6-3.13.1 libvirt-python-0.9.6-3.13.1 libvirt-python-debuginfo-0.9.6-3.13.1 - openSUSE 12.1 (x86_64): libvirt-client-32bit-0.9.6-3.13.1 libvirt-client-debuginfo-32bit-0.9.6-3.13.1 libvirt-devel-32bit-0.9.6-3.13.1 - openSUSE 12.1 (ia64): libvirt-client-debuginfo-x86-0.9.6-3.13.1 libvirt-client-x86-0.9.6-3.13.1 References: http://support.novell.com/security/cve/CVE-2012-4423.html http://support.novell.com/security/cve/CVE-2013-0170.html https://bugzilla.novell.com/772586 https://bugzilla.novell.com/773621 https://bugzilla.novell.com/773626 https://bugzilla.novell.com/780432 https://bugzilla.novell.com/800976

1 0

openSUSE-SU-2013:0273-1: moderate: Opera to version 12.3
by opensuse-security＠opensuse.org 12 Feb '13

12 Feb '13

openSUSE Security Update: Opera to version 12.3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0273-1 Rating: moderate References: #801233 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Opera 12.13 is a recommended upgrade offering security and stability enhancements. -fixed an issue where Opera gets internal communication errors on Facebook -fixed an issue where no webpages load on startup, if Opera is disconnected from the Internet -fixed an issue where images will not load after back navigation, when a site uses the HTML5 history API (deviantart.com) -improved protection against hijacking of the default search, including a one-time reset -fixed an issue where DOM events manipulation might be used to execute arbitrary code; -fixed an issue where use of SVG clipPaths could allow execution of arbitrary code; -fixed a low severity security issue; details will be disclosed at a later date -fixed an issue where CORS requests could omit the preflight request; Also check out http://www.opera.com/docs/changelogs/unix/1213 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-109 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): opera-12.13-38.1 opera-gtk-12.13-38.1 opera-kde4-12.13-38.1 References: https://bugzilla.novell.com/801233

1 0

openSUSE-RU-2013:0270-1: moderate: ntfs-3g: fix for possible filesystem corruption
by maintenance＠opensuse.org 11 Feb '13

11 Feb '13

openSUSE Recommended Update: ntfs-3g: fix for possible filesystem corruption ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0270-1 Rating: moderate References: #798337 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: NTFS and FAT filesystem corruption with Windows 8 systems - ntfs-3g vfat state saved across shutdowns Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-18 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): ntfs-3g-2010.10.2-5.1 ntfs-3g-debuginfo-2010.10.2-5.1 ntfs-3g-debugsource-2010.10.2-5.1 ntfs-3g-devel-2010.10.2-5.1 References: https://bugzilla.novell.com/798337

1 0

openSUSE-RU-2013:0269-1: moderate: osc: feature release 0.138.0
by maintenance＠opensuse.org 11 Feb '13

11 Feb '13

openSUSE Recommended Update: osc: feature release 0.138.0 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0269-1 Rating: moderate References: #801334 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The commandline tool osc was updated to 0.138.0, implementing new features and fixing bugs: Update to 0.138.0: - add support to remove repositories recursively (mostly only usefull for admins) - submitrequest: old not anymore used maintenance code got removed. It is possible now to create one request to submit all changed packages of an project in one request. Just run "osc sr" in the checked out project directory. - disable keyring usage by default. print warning about misconfigured keyrings. - prdiff: new command to diff entire projects Update to 0.137.0: - support single binary download via getbinaries command - support to set the bugowner # # Features which requires OBS 2.4 # - offer to send set_bugowner request if target is not writeable - support delete requests for repositories. - support default maintainer/bugowner search based on binary package names - support to lookup --all definitions of maintainers of bugowners. Either for showing or setting them. - buildinfo --debug option for verbose output of dependency calculation Update to 0.136.0: - prefer TLS v1.1 or v1.2 if available - declined is considered to be an open state (that is "osc rq list" also shows declined requests) - added support to move files across packages via "osc mv" (fixes issue #10) - various bugfixes - recommend the python-keyring package (needed for storing credentials in kwallet/gnome-keyring) Update to 0.135.1 - do not forward submit requests to targets which link to request target - fix creator name in forwarded message Update to 0.135.0 - request accept is offering now to forward submit request if it is a devel area like webui does - support archlinux builds (requires OBS 2.4) - support maintenancerequest from local checkout - bugfixes for review handling, result watching, gnome-keyring Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-102 - openSUSE 12.1: zypper in -t patch openSUSE-2013-102 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (noarch): osc-0.138.0-1.5.1 - openSUSE 12.1 (noarch): osc-0.138.0-2.8.1 References: https://bugzilla.novell.com/801334

1 0

openSUSE-RU-2013:0268-1: cronie: fixed session handling
by maintenance＠opensuse.org 11 Feb '13

11 Feb '13

openSUSE Recommended Update: cronie: fixed session handling ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0268-1 Rating: low References: #801553 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The last update contained a broken patch which lead to problems with PAM session handling. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-101 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): cron-4.2-37.9.1 cronie-1.4.8-37.9.1 cronie-anacron-1.4.8-37.9.1 cronie-anacron-debuginfo-1.4.8-37.9.1 cronie-debuginfo-1.4.8-37.9.1 cronie-debugsource-1.4.8-37.9.1 References: https://bugzilla.novell.com/801553

1 0

openSUSE-RU-2013:0267-1: taglib: fixed messing up MP4 tags on de_DE and others
by maintenance＠opensuse.org 11 Feb '13

11 Feb '13

openSUSE Recommended Update: taglib: fixed messing up MP4 tags on de_DE and others ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0267-1 Rating: low References: #780256 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: taglib was fixed to avoid corruption of MP4 tags in non-russian locales. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-100 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libtag-devel-1.7.2-2.4.1 libtag1-1.7.2-2.4.1 libtag1-debuginfo-1.7.2-2.4.1 libtag_c0-1.7.2-2.4.1 libtag_c0-debuginfo-1.7.2-2.4.1 taglib-1.7.2-2.4.1 taglib-debugsource-1.7.2-2.4.1 - openSUSE 12.2 (x86_64): libtag1-32bit-1.7.2-2.4.1 libtag1-debuginfo-32bit-1.7.2-2.4.1 libtag_c0-32bit-1.7.2-2.4.1 libtag_c0-debuginfo-32bit-1.7.2-2.4.1 References: https://bugzilla.novell.com/780256

1 0

openSUSE-RU-2013:0266-1: ntfs-3g_ntfsprogs: avoid corrupting Win8 filesystems
by maintenance＠opensuse.org 11 Feb '13

11 Feb '13

openSUSE Recommended Update: ntfs-3g_ntfsprogs: avoid corrupting Win8 filesystems ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0266-1 Rating: low References: #798337 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: A bug in ntfs-3g_ntfsprogs caused Win8 partitions with metadata cached in Windows (when FastBoot is enabled) from being mounted, so avoiding filesystem corruption. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-99 - openSUSE 12.1: zypper in -t patch openSUSE-2013-99 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libntfs-3g-devel-2012.1.15-4.4.1 libntfs-3g83-2012.1.15-4.4.1 libntfs-3g83-debuginfo-2012.1.15-4.4.1 ntfs-3g-2012.1.15-4.4.1 ntfs-3g-debuginfo-2012.1.15-4.4.1 ntfs-3g_ntfsprogs-debugsource-2012.1.15-4.4.1 ntfsprogs-2012.1.15-4.4.1 ntfsprogs-debuginfo-2012.1.15-4.4.1 - openSUSE 12.1 (i586 x86_64): libntfs-3g-devel-2011.4.12-3.4.1 libntfs-3g81-2011.4.12-3.4.1 libntfs-3g81-debuginfo-2011.4.12-3.4.1 ntfs-3g-2011.4.12-3.4.1 ntfs-3g-debuginfo-2011.4.12-3.4.1 ntfs-3g_ntfsprogs-debugsource-2011.4.12-3.4.1 ntfsprogs-2011.4.12-3.4.1 ntfsprogs-debuginfo-2011.4.12-3.4.1 References: https://bugzilla.novell.com/798337

1 0

openSUSE-RU-2013:0265-1: gconf2: update to version 3.2.3
by maintenance＠opensuse.org 11 Feb '13

11 Feb '13

openSUSE Recommended Update: gconf2: update to version 3.2.3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0265-1 Rating: low References: #731663 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: gconf2 was updated to 3.2.3, fixing some small bugs. Changes: - Update to version 3.2.3: + Fix assert introduced in 3.2.2 (bgo#662991). - Changes from version 3.2.2: + Avoid crash when there is no reply to messages in gconf_engine_notify_remove (bgo#661372). + Clean-up ORBit vs DBus logic. - Changes from version 3.2.1: + Fix "Configuration server couldn't be contacted" errors (bgo#659835). + Build fix for -Werror=format-security. + Updated translations. - Fixes a bug where window from a different workspace would peek up behind current workspace window in the current workspace activities overview (bnc#731663). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-98 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): MozillaFirefox-branding-basedonopensuse-12.1-6.3.1 PackageKit-branding-basedonopensuse-12.1-6.3.1 bootsplash-branding-basedonopensuse-12.1-6.3.1 branding-basedonopensuse-12.1-6.3.1 compiz-branding-basedonopensuse-12.1-6.3.1 dynamic-wallpaper-branding-basedonopensuse-12.1-6.3.1 epiphany-branding-basedonopensuse-12.1-6.3.1 exo-branding-basedonopensuse-12.1-6.3.1 gconf-polkit-3.2.3-2.6.1 gconf-polkit-debuginfo-3.2.3-2.6.1 gconf-sanity-check-3.2.3-2.6.1 gconf-sanity-check-debuginfo-3.2.3-2.6.1 gconf2-3.2.3-2.6.1 gconf2-branding-basedonopensuse-12.1-6.3.1 gconf2-debuginfo-3.2.3-2.6.1 gconf2-debugsource-3.2.3-2.6.1 gconf2-devel-3.2.3-2.6.1 gdm-branding-basedonopensuse-12.1-6.3.1 gfxboot-branding-basedonopensuse-12.1-6.3.1 gimp-branding-basedonopensuse-12.1-6.3.1 gio-branding-basedonopensuse-12.1-6.3.1 gnome-control-center-branding-basedonopensuse-12.1-6.3.1 gnome-menus-branding-basedonopensuse-12.1-6.3.1 gnome-panel-branding-basedonopensuse-12.1-6.3.1 gtk2-branding-basedonopensuse-12.1-6.3.1 gtk3-branding-basedonopensuse-12.1-6.3.1 hicolor-icon-theme-branding-basedonopensuse-12.1-6.3.1 install-initrd-branding-basedonopensuse-12.1-6.3.1 kdebase3-SuSE-branding-basedonopensuse-12.1-6.3.1 kdebase4-runtime-branding-basedonopensuse-12.1-6.3.1 kdebase4-workspace-branding-basedonopensuse-12.1-6.3.1 kdelibs4-branding-basedonopensuse-12.1-6.3.1 kdm-branding-basedonopensuse-12.1-6.3.1 kio_sysinfo-branding-basedonopensuse-12.1-6.3.1 ksplashx-branding-basedonopensuse-12.1-6.3.1 libgarcon-branding-basedonopensuse-12.1-6.3.1 libpurple-branding-basedonopensuse-12.1-6.3.1 libreoffice-branding-basedonopensuse-12.1-6.3.1 libsocialweb-branding-basedonopensuse-12.1-6.3.1 libxfce4ui-branding-basedonopensuse-12.1-6.3.1 lightdm-gtk-greeter-branding-basedonopensuse-12.1-6.3.1 lxde-common-branding-basedonopensuse-12.1-6.3.1 splashy-branding-basedonopensuse-12.1-6.3.1 susegreeter-branding-basedonopensuse-12.1-6.3.1 systemd-presets-branding-basedonopensuse-12.1-6.3.1 thunar-volman-branding-basedonopensuse-12.1-6.3.1 wallpaper-branding-basedonopensuse-12.1-6.3.1 xfce4-notifyd-branding-basedonopensuse-12.1-6.3.1 xfce4-panel-branding-basedonopensuse-12.1-6.3.1 xfce4-session-branding-basedonopensuse-12.1-6.3.1 xfce4-settings-branding-basedonopensuse-12.1-6.3.1 xfce4-splash-branding-basedonopensuse-12.1-6.3.1 xfdesktop-branding-basedonopensuse-12.1-6.3.1 xfwm4-branding-basedonopensuse-12.1-6.3.1 yast2-branding-basedonopensuse-12.1-6.3.1 yast2-qt-branding-basedonopensuse-12.1-6.3.1 - openSUSE 12.1 (x86_64): gconf2-32bit-3.2.3-2.6.1 gconf2-debuginfo-32bit-3.2.3-2.6.1 - openSUSE 12.1 (noarch): gconf2-branding-SLED-11-6.3.1 gconf2-branding-SLES-11-6.3.1 gconf2-branding-openSUSE-12.1-6.3.1 gconf2-lang-3.2.3-2.6.1 novell-sound-theme-11-6.3.1 - openSUSE 12.1 (ia64): gconf2-debuginfo-x86-3.2.3-2.6.1 gconf2-x86-3.2.3-2.6.1 References: https://bugzilla.novell.com/731663

1 0