February 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:0261-1: moderate: kernel: update to 3.4.28
by opensuse-security＠opensuse.org 09 Feb '13

09 Feb '13

openSUSE Security Update: kernel: update to 3.4.28 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0261-1 Rating: moderate References: #569991 #770763 #771392 #773831 #774859 #776925 #778630 #780624 #781327 #783615 #783965 #784192 #792500 #793671 #799209 Cross-References: CVE-2012-3520 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has 14 fixes is now available. Description: The Linux kernel was updated to 3.4.28 fixing various bugs and security issues. Following bugs were fixed: - sysctl: Fixed vm.dirty_ratio sysctl name for desktop flavors - bridge: Pull ip header into skb->data before looking into ip header (bnc#799209). - x86: Hyper-V: register clocksource only if its advertised (bnc#792500). - patches.fixes/thp-memcg-split-hugepage-for-memcg-oom-on-cow. patch: thp, memcg: split hugepage for memcg oom on cow (bnc#793671). - x86-64: fix hypercall page unwind info. - frontends: handle backend CLOSED without CLOSING. - xenbus: fix overflow check in xenbus_dev_write(). - x86: don't corrupt %eip when returning from a signal handler. - Update Xen patches to 3.4.19. - rpm/kernel-binary.spec.in: Do not remove fillup from the buildsystem (bnc#781327) - rpm/config.sh: Set ARM project for IBS - Refresh patches.xen/xen-x86-EFI (fix build after update to 3.4.17). - ARM: Update config files: omap2plus: Set omapdrm as =y to allow for console=tty - rpm/config.sh: Add openSUSE:12.2:ARM:Update OBS project - ARM: Update config files: Disable HVC_DCC, refresh config files - fix mmc on vexpress (kernel-default on armv7hl) for 3.4. - rpm/kernel-binary.spec.in: Require coreutils in kernel-*-devel (bnc#783615) - ARM: Update config files: Fix default config - ARM: Update config files: Fix default config to work with vexpress - Btrfs: fix enospc problems when deleting a subvol - btrfs: enospc debugging messages - ALSA: hda - Fix silent headphone output from Toshiba P200 (bnc#569991). - ALSA: hda - Add inv-dmic model to possible Realtek codecs (bnc#569991). - ALSA: hda - Add inverted mic quirks for Asus U41SV, Acer 1810TZ and AOD260 (bnc#569991). - ALSA: hda - Add the inverted digital mic workaround to Realtek codecs (bnc#569991). - rpm/kernel-binary.spec.in: Use a macro instead of /etc/IGNORE-KABI-BADNESS - rpm/kernel-binary.spec.in: Also check for /etc/IGNORE-KABI-BADNESS file This allows to control the kabi checker from outside of the package. - memcg: oom: fix totalpages calculation for swappiness==0 (bnc#783965). - ext4: completed_io locking cleanup. - ext4: endless truncate due to nonlocked dio readers. - ext4: ext4_inode_info diet. - ext4: fix ext4_flush_completed_IO wait semantics. - ext4: fix ext_remove_space for punch_hole case. - ext4: fix unwritten counter leakage. - ext4: give i_aiodio_unwritten a more appropriate name. - ext4: punch_hole should wait for DIO writers. - ext4: race-condition protection for ext4_convert_unwritten_extents_endio. - ext4: serialize dio nonlocked reads with defrag workers. - ext4: serialize fallocate with ext4_convert_unwritten_extents. - ext4: serialize unlocked dio reads with truncate. - x86/kbuild: archscripts depends on scripts_basic. - kbuild: Fix gcc -x syntax (bnc#773831). - Disable hyper-v patch to avoid kABI changes: Drivers: hv: Explicitly size elements of protocol structures - Hyper-V KVP IP injection (fate#31441) - drivers: net: Remove casts to same type. - drivers: hv: remove IRQF_SAMPLE_RANDOM which is now a no-op. - hyperv: Move wait completion msg code into rndis_filter_halt_device(). - hyperv: Add comments for the extended buffer after RNDIS message. - Drivers: hv: Cleanup the guest ID computation. - Drivers: hv: vmbus: Use the standard format string to format GUIDs. - Drivers: hv: Add KVP definitions for IP address injection. - Drivers: hv: kvp: Cleanup error handling in KVP. - Drivers: hv: Explicitly size elements of protocol structures. - Drivers: hv: kvp: Support the new IP injection messages. - Tools: hv: Prepare to expand kvp_get_ip_address() functionality. - Tools: hv: Further refactor kvp_get_ip_address(). - Tools: hv: Gather address family information. - Tools: hv: Gather subnet information. - Tools: hv: Represent the ipv6 mask using CIDR notation. - Tools: hv: Gather ipv[4,6] gateway information. - hv: fail the probing immediately when we are not in hyperv platform. - hv: vmbus_drv: detect hyperv through x86_hyper. - Tools: hv: Get rid of some unused variables. - Tools: hv: Correctly type string variables. - Tools: hv: Add an example script to retrieve DNS entries. - Tools: hv: Gather DNS information. - Drivers: hv: kvp: Copy the address family information. - Tools: hv: Add an example script to retrieve dhcp state. - Tools: hv: Gather DHCP information. - Tools: hv: Add an example script to configure an interface. - Tools: hv: Implement the KVP verb - KVP_OP_SET_IP_INFO. - Tools: hv: Rename the function kvp_get_ip_address(). - Tools: hv: Implement the KVP verb - KVP_OP_GET_IP_INFO. - tools/hv: Fix file handle leak. - tools/hv: Fix exit() error code. - tools/hv: Check for read/write errors. - tools/hv: Parse /etc/os-release. - hyperv: Fix the max_xfer_size in RNDIS initialization. - hyperv: Fix the missing return value in rndis_filter_set_packet_filter(). - hyperv: Fix page buffer handling in rndis_filter_send_request(). - hyperv: Remove extra allocated space for recv_pkt_list elements. - hyperv: Report actual status in receive completion packet. - hyperv: Add buffer for extended info after the RNDIS response message. - rpm/kernel-binary.spec.in: enable Conflicts for apparmor, udev and lvm2 also for vanilla kernel - rpm/kernel-binary.spec.in: add Conflicht: hyper-v < 4 to make sure the daemon is in sync with the kernel (bnc#770763 , fate#314441) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-94 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): kernel-default-3.4.28-2.20.1 kernel-default-base-3.4.28-2.20.1 kernel-default-base-debuginfo-3.4.28-2.20.1 kernel-default-debuginfo-3.4.28-2.20.1 kernel-default-debugsource-3.4.28-2.20.1 kernel-default-devel-3.4.28-2.20.1 kernel-default-devel-debuginfo-3.4.28-2.20.1 kernel-syms-3.4.28-2.20.1 - openSUSE 12.2 (i686 x86_64): kernel-debug-3.4.28-2.20.1 kernel-debug-base-3.4.28-2.20.1 kernel-debug-base-debuginfo-3.4.28-2.20.1 kernel-debug-debuginfo-3.4.28-2.20.1 kernel-debug-debugsource-3.4.28-2.20.1 kernel-debug-devel-3.4.28-2.20.1 kernel-debug-devel-debuginfo-3.4.28-2.20.1 kernel-desktop-3.4.28-2.20.1 kernel-desktop-base-3.4.28-2.20.1 kernel-desktop-base-debuginfo-3.4.28-2.20.1 kernel-desktop-debuginfo-3.4.28-2.20.1 kernel-desktop-debugsource-3.4.28-2.20.1 kernel-desktop-devel-3.4.28-2.20.1 kernel-desktop-devel-debuginfo-3.4.28-2.20.1 kernel-ec2-3.4.28-2.20.1 kernel-ec2-base-3.4.28-2.20.1 kernel-ec2-base-debuginfo-3.4.28-2.20.1 kernel-ec2-debuginfo-3.4.28-2.20.1 kernel-ec2-debugsource-3.4.28-2.20.1 kernel-ec2-devel-3.4.28-2.20.1 kernel-ec2-devel-debuginfo-3.4.28-2.20.1 kernel-ec2-extra-3.4.28-2.20.1 kernel-ec2-extra-debuginfo-3.4.28-2.20.1 kernel-trace-3.4.28-2.20.1 kernel-trace-base-3.4.28-2.20.1 kernel-trace-base-debuginfo-3.4.28-2.20.1 kernel-trace-debuginfo-3.4.28-2.20.1 kernel-trace-debugsource-3.4.28-2.20.1 kernel-trace-devel-3.4.28-2.20.1 kernel-trace-devel-debuginfo-3.4.28-2.20.1 kernel-vanilla-3.4.28-2.20.1 kernel-vanilla-debuginfo-3.4.28-2.20.1 kernel-vanilla-debugsource-3.4.28-2.20.1 kernel-vanilla-devel-3.4.28-2.20.1 kernel-vanilla-devel-debuginfo-3.4.28-2.20.1 kernel-xen-3.4.28-2.20.1 kernel-xen-base-3.4.28-2.20.1 kernel-xen-base-debuginfo-3.4.28-2.20.1 kernel-xen-debuginfo-3.4.28-2.20.1 kernel-xen-debugsource-3.4.28-2.20.1 kernel-xen-devel-3.4.28-2.20.1 kernel-xen-devel-debuginfo-3.4.28-2.20.1 - openSUSE 12.2 (noarch): kernel-devel-3.4.28-2.20.1 kernel-docs-3.4.28-2.20.2 kernel-source-3.4.28-2.20.1 kernel-source-vanilla-3.4.28-2.20.1 - openSUSE 12.2 (i686): kernel-pae-3.4.28-2.20.1 kernel-pae-base-3.4.28-2.20.1 kernel-pae-base-debuginfo-3.4.28-2.20.1 kernel-pae-debuginfo-3.4.28-2.20.1 kernel-pae-debugsource-3.4.28-2.20.1 kernel-pae-devel-3.4.28-2.20.1 kernel-pae-devel-debuginfo-3.4.28-2.20.1 References: http://support.novell.com/security/cve/CVE-2012-3520.html https://bugzilla.novell.com/569991 https://bugzilla.novell.com/770763 https://bugzilla.novell.com/771392 https://bugzilla.novell.com/773831 https://bugzilla.novell.com/774859 https://bugzilla.novell.com/776925 https://bugzilla.novell.com/778630 https://bugzilla.novell.com/780624 https://bugzilla.novell.com/781327 https://bugzilla.novell.com/783615 https://bugzilla.novell.com/783965 https://bugzilla.novell.com/784192 https://bugzilla.novell.com/792500 https://bugzilla.novell.com/793671 https://bugzilla.novell.com/799209

1 0

openSUSE-RU-2013:0260-1: gummi: Update to version 0.6.5
by maintenance＠opensuse.org 09 Feb '13

09 Feb '13

openSUSE Recommended Update: gummi: Update to version 0.6.5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0260-1 Rating: low References: #796277 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Gummi was updated to version 0.6.5. - Update to version 0.6.5: + Bugs fixed: - Fixed empty build logs when special characters were included - Fixed a rare deadlock situation on program exit - Fixed regression in spell-checking language listing - Fixed regression in killing inresponsive compilation processes - Correctly close file descriptors for child processes - Implemented --version CLI argument - Several translation updates - Added Hungarian translation - Update to version 0.6.4: + Bugs fixed: - Replaced faulty importer implementation with a toolbar variant - Fixed an issue where the previewer would not display correctly - dvi script uses exit status to signal compilation status - Improved the reported messages for some errors. - Better TeXLive version detection - Fixed a reference problem that could lead to a crash - Search window is correctly centered in GNOME 3 - Tab markup not enabled when project loading fails - Minor UI tweaks to the project & bibliography panels - Minor UI tweaks to the snippet configuration interface Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-93 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): gummi-0.6.5-2.4.1 gummi-debuginfo-0.6.5-2.4.1 gummi-debugsource-0.6.5-2.4.1 References: https://bugzilla.novell.com/796277

1 0

openSUSE-RU-2013:0258-1: parkverbot: Update to version 1.1
by maintenance＠opensuse.org 07 Feb '13

07 Feb '13

openSUSE Recommended Update: parkverbot: Update to version 1.1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0258-1 Rating: low References: #801367 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues for parkverbot: - Update to new upstream release 1.1 (bugfix release) * Fixed passing wrong type to ioctl, which made a 32-bit parkverbot exit and not run at all (bnc#801367) * Read all disks, rather than a single one, per interval - systemd is not a runtime requirement - Verify GPG signature. - Replace bad signature by a new one Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-91 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): parkverbot-1.1-2.4.1 parkverbot-debuginfo-1.1-2.4.1 parkverbot-debugsource-1.1-2.4.1 References: https://bugzilla.novell.com/801367

1 0

openSUSE-RU-2013:0257-1: dhcp: Several bugfixes
by maintenance＠opensuse.org 07 Feb '13

07 Feb '13

openSUSE Recommended Update: dhcp: Several bugfixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0257-1 Rating: low References: #784640 #788787 #791280 #791289 #794578 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update fixes the following issues for dhcp: - bnc#794578: - Applied a patch to ignore SIGPIPE instead to die in socket code before the errno==EPIPE checks are reached - Applied several obvious memleak and segfault fixes from 4.2.5rc1 and a correction of code to calculate timing values in dhcpv6 client to compare rebind value to infinity instead of renew - bnc#791289: - Fixed discovery of interfaces, which have only addresses with a label assigned (linux 2.0 "alias interfaces" compatibility) by switching to use the getifaddrs() as on BSD - bnc#788787: - Fixed parse buffer handling code to not avoid truncation of config > ~8k from bigger ldap objects. Fixed to free the ldap config buffer passed to the config parser and append new config, while the parser is in saved state - Fixed subclass name-ref and data quoting/escaping - Fixed memory leaks on ldap_read_config errors - bnc#791280: - Fixed dhclient-script to discard MTU lower-equal 576 rather than lower-than - bnc#784640: - dhcp-ldap: fixed a memleak while subnet range processing, fixed to reset bufix variable in ldap_read_function to 0 and to set buflen to the complete length (do not discard last character, usually \n). This caused a parsing error at further run of the function, e.g. while processing the second dhcpService container that the dhcpServer object may refer to Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-92 - openSUSE 12.1: zypper in -t patch openSUSE-2013-92 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): dhcp-4.2.4.P2-0.1.8.1 dhcp-client-4.2.4.P2-0.1.8.1 dhcp-client-debuginfo-4.2.4.P2-0.1.8.1 dhcp-debuginfo-4.2.4.P2-0.1.8.1 dhcp-debugsource-4.2.4.P2-0.1.8.1 dhcp-devel-4.2.4.P2-0.1.8.1 dhcp-doc-4.2.4.P2-0.1.8.1 dhcp-relay-4.2.4.P2-0.1.8.1 dhcp-relay-debuginfo-4.2.4.P2-0.1.8.1 dhcp-server-4.2.4.P2-0.1.8.1 dhcp-server-debuginfo-4.2.4.P2-0.1.8.1 - openSUSE 12.1 (i586 x86_64): dhcp-4.2.4.P2-0.6.17.1 dhcp-client-4.2.4.P2-0.6.17.1 dhcp-client-debuginfo-4.2.4.P2-0.6.17.1 dhcp-debuginfo-4.2.4.P2-0.6.17.1 dhcp-debugsource-4.2.4.P2-0.6.17.1 dhcp-devel-4.2.4.P2-0.6.17.1 dhcp-doc-4.2.4.P2-0.6.17.1 dhcp-relay-4.2.4.P2-0.6.17.1 dhcp-relay-debuginfo-4.2.4.P2-0.6.17.1 dhcp-server-4.2.4.P2-0.6.17.1 dhcp-server-debuginfo-4.2.4.P2-0.6.17.1 References: https://bugzilla.novell.com/784640 https://bugzilla.novell.com/788787 https://bugzilla.novell.com/791280 https://bugzilla.novell.com/791289 https://bugzilla.novell.com/794578

1 0

openSUSE-SU-2013:0256-1: moderate: libqt4: various SSL / certificate related fixes.
by opensuse-security＠opensuse.org 07 Feb '13

07 Feb '13

openSUSE Security Update: libqt4: various SSL / certificate related fixes. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0256-1 Rating: moderate References: #784197 #797006 Cross-References: CVE-2012-6093 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: libqt4 was updated to fix various issues regarding to SSL and certificates. * various more compromised SSL root and intermediate certificates were blacklisted * Fix wrong error reporting when using a binary incompatible version of openSSL (bnc#797006, CVE-2012-6093) Bugfixes done: * enable linked support for OpenSSL * Add fix for qdbusviewer not matching args (bnc#784197) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-89 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libqt4-4.8.1-2.12.1 libqt4-debuginfo-4.8.1-2.12.1 libqt4-debugsource-4.8.1-2.12.1 libqt4-devel-4.8.1-2.12.1 libqt4-devel-debuginfo-4.8.1-2.12.1 libqt4-devel-doc-4.8.1-2.12.2 libqt4-devel-doc-debuginfo-4.8.1-2.12.2 libqt4-devel-doc-debugsource-4.8.1-2.12.2 libqt4-private-headers-devel-4.8.1-2.12.1 libqt4-qt3support-4.8.1-2.12.1 libqt4-qt3support-debuginfo-4.8.1-2.12.1 libqt4-sql-4.8.1-2.12.1 libqt4-sql-debuginfo-4.8.1-2.12.1 libqt4-sql-mysql-4.8.1-2.12.1 libqt4-sql-mysql-debuginfo-4.8.1-2.12.1 libqt4-sql-plugins-debugsource-4.8.1-2.12.1 libqt4-sql-postgresql-4.8.1-2.12.1 libqt4-sql-postgresql-debuginfo-4.8.1-2.12.1 libqt4-sql-sqlite-4.8.1-2.12.1 libqt4-sql-sqlite-debuginfo-4.8.1-2.12.1 libqt4-sql-unixODBC-4.8.1-2.12.1 libqt4-sql-unixODBC-debuginfo-4.8.1-2.12.1 libqt4-x11-4.8.1-2.12.1 libqt4-x11-debuginfo-4.8.1-2.12.1 qt4-qtscript-0.2.0-2.5.1 qt4-qtscript-debuginfo-0.2.0-2.5.1 qt4-qtscript-doc-0.2.0-2.5.1 qt4-x11-tools-4.8.1-2.12.2 qt4-x11-tools-debuginfo-4.8.1-2.12.2 - openSUSE 12.2 (x86_64): libqt4-32bit-4.8.1-2.12.1 libqt4-debuginfo-32bit-4.8.1-2.12.1 libqt4-qt3support-32bit-4.8.1-2.12.1 libqt4-qt3support-debuginfo-32bit-4.8.1-2.12.1 libqt4-sql-32bit-4.8.1-2.12.1 libqt4-sql-debuginfo-32bit-4.8.1-2.12.1 libqt4-sql-mysql-32bit-4.8.1-2.12.1 libqt4-sql-mysql-debuginfo-32bit-4.8.1-2.12.1 libqt4-sql-postgresql-32bit-4.8.1-2.12.1 libqt4-sql-postgresql-debuginfo-32bit-4.8.1-2.12.1 libqt4-sql-sqlite-32bit-4.8.1-2.12.1 libqt4-sql-sqlite-debuginfo-32bit-4.8.1-2.12.1 libqt4-sql-unixODBC-32bit-4.8.1-2.12.1 libqt4-sql-unixODBC-debuginfo-32bit-4.8.1-2.12.1 libqt4-x11-32bit-4.8.1-2.12.1 libqt4-x11-debuginfo-32bit-4.8.1-2.12.1 - openSUSE 12.2 (noarch): libqt4-devel-doc-data-4.8.1-2.12.2 References: http://support.novell.com/security/cve/CVE-2012-6093.html https://bugzilla.novell.com/784197 https://bugzilla.novell.com/797006

1 0

openSUSE-SU-2013:0255-1: moderate: update for libupnp
by opensuse-security＠opensuse.org 07 Feb '13

07 Feb '13

openSUSE Security Update: update for libupnp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0255-1 Rating: moderate References: #801061 Cross-References: CVE-2012-5958 CVE-2012-5959 CVE-2012-5960 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: - Update to version 1.6.18 (bnc#801061) + Security fix for CERT issue VU#922681 This patch addresses three possible buffer overflows in function unique_service_name(). The three issues have the folowing CVE numbers: CVE-2012-5958 Issue #2: Stack buffer overflow of Tempbuf CVE-2012-5959 Issue #4: Stack buffer overflow of Event->UDN CVE-2012-5960 Issue #8: Stack buffer overflow of Event->UDN + Notice that the following issues have already been dealt by previous work: CVE-2012-5961 Issue #1: Stack buffer overflow of Evt->UDN CVE-2012-5962 Issue #3: Stack buffer overflow of Evt->DeviceType CVE-2012-5963 Issue #5: Stack buffer overflow of Event->UDN CVE-2012-5964 Issue #6: Stack buffer overflow of Event->DeviceType CVE-2012-5965 Issue #7: Stack buffer overflow of Event->DeviceType Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-90 - openSUSE 12.1: zypper in -t patch openSUSE-2013-90 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libupnp-debugsource-1.6.18-6.4.1 libupnp-devel-1.6.18-6.4.1 libupnp6-1.6.18-6.4.1 libupnp6-debuginfo-1.6.18-6.4.1 - openSUSE 12.2 (x86_64): libupnp6-32bit-1.6.18-6.4.1 libupnp6-debuginfo-32bit-1.6.18-6.4.1 - openSUSE 12.1 (i586 x86_64): libupnp-devel-1.6.18-2.4.1 libupnp6-1.6.18-2.4.1 libupnp6-debuginfo-1.6.18-2.4.1 libupnp6-debugsource-1.6.18-2.4.1 - openSUSE 12.1 (x86_64): libupnp6-32bit-1.6.18-2.4.1 libupnp6-debuginfo-32bit-1.6.18-2.4.1 - openSUSE 12.1 (ia64): libupnp6-debuginfo-x86-1.6.18-2.4.1 libupnp6-x86-1.6.18-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-5958.html http://support.novell.com/security/cve/CVE-2012-5959.html http://support.novell.com/security/cve/CVE-2012-5960.html https://bugzilla.novell.com/801061

1 0

openSUSE-SU-2013:0248-1: moderate: update for apache2
by opensuse-security＠opensuse.org 05 Feb '13

05 Feb '13

openSUSE Security Update: update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0248-1 Rating: moderate References: Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: - ignore case when checking against SNI server names. [bnc#798733] httpd-2.2.x-bnc798733-SNI_ignorecase.diff - better cleanup of busy count after recovering from failure [bnc#789828] httpd-2.2.x-bnc789828-mod_balancer.diff - httpd-2.2.x-bnc788121-CVE-2012-4557-mod_proxy_ajp_timeout.di ff: backend timeouts should not affect the entire worker. [bnc#788121] - httpd-2.2.x-envvars.diff obsoletes httpd-2.0.54-envvars.dif: Fix for low profile bug CVE-2012-0883 about improper LD_LIBRARY_PATH handling. [bnc#757710] - httpd-2.2.x-bnc777260-CVE-2012-2687-mod_negotiation_filename _xss.diff Escape filename for the case that uploads are allowed with untrusted user's control over filenames and mod_negotiation enabled on the same directory. CVE-2012-2687 [bnc#777260] - httpd-2.2.x-CVE-2011-3368_CVE-2011-4317-bnc722545.diff reworked to reflect the upstream changes. This will prevent the "Invalid URI in request OPTIONS *" messages in the error log. [bnc#722545] - /etc/init.d/apache2: new argument "check-reload". Exits 1 if httpd2 runs on deleted binaries such as after package update, else 0. This is used by equally modified /etc/logrotate.d/apache2, which uses "/etc/init.d/apache2 check-reload" in its prerotate script. These changes prevent httpd2 from being (gracefully) reloaded by logrotate, executed by cron, if new binaries have been installed. Instead, a warning is printed on stdout and is being logged to the syslogs. If this happens, apache's logs are NOT rotated, and the running processes are left untouched. This limits the maximum damage of log rotation to unrotated logs. "/etc/init.d/apache2 restart" (or "rcapache2 restart") must be executed manually in such a case. [bnc#728876] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-17 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-2.2.17-4.64.1 apache2-debuginfo-2.2.17-4.64.1 apache2-debugsource-2.2.17-4.64.1 apache2-devel-2.2.17-4.64.1 apache2-event-2.2.17-4.64.1 apache2-event-debuginfo-2.2.17-4.64.1 apache2-example-certificates-2.2.17-4.64.1 apache2-example-pages-2.2.17-4.64.1 apache2-itk-2.2.17-4.64.1 apache2-itk-debuginfo-2.2.17-4.64.1 apache2-prefork-2.2.17-4.64.1 apache2-prefork-debuginfo-2.2.17-4.64.1 apache2-utils-2.2.17-4.64.1 apache2-utils-debuginfo-2.2.17-4.64.1 apache2-worker-2.2.17-4.64.1 apache2-worker-debuginfo-2.2.17-4.64.1 - openSUSE 11.4 (noarch): apache2-doc-2.2.17-4.64.1 References:

1 0

openSUSE-SU-2013:0245-1: moderate: update for apache2
by opensuse-security＠opensuse.org 05 Feb '13

05 Feb '13

openSUSE Security Update: update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0245-1 Rating: moderate References: #777260 #798733 Cross-References: CVE-2012-2687 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: - httpd-2.2.x-bnc798733-SNI_ignorecase.diff: ignore case when checking against SNI server names. [bnc#798733] - httpd-2.2.x-bnc777260-CVE-2012-2687-mod_negotiation_filename _xss.diff Escape filename for the case that uploads are allowed with untrusted user's control over filenames and mod_negotiation enabled on the same directory. CVE-2012-2687 [bnc#777260] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-81 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): apache2-2.2.22-4.10.1 apache2-debuginfo-2.2.22-4.10.1 apache2-debugsource-2.2.22-4.10.1 apache2-devel-2.2.22-4.10.1 apache2-event-2.2.22-4.10.1 apache2-event-debuginfo-2.2.22-4.10.1 apache2-example-pages-2.2.22-4.10.1 apache2-itk-2.2.22-4.10.1 apache2-itk-debuginfo-2.2.22-4.10.1 apache2-prefork-2.2.22-4.10.1 apache2-prefork-debuginfo-2.2.22-4.10.1 apache2-utils-2.2.22-4.10.1 apache2-utils-debuginfo-2.2.22-4.10.1 apache2-worker-2.2.22-4.10.1 apache2-worker-debuginfo-2.2.22-4.10.1 - openSUSE 12.2 (noarch): apache2-doc-2.2.22-4.10.1 References: http://support.novell.com/security/cve/CVE-2012-2687.html https://bugzilla.novell.com/777260 https://bugzilla.novell.com/798733

1 0

openSUSE-RU-2013:0244-1: sysstat: Fix sadf timestamp XML
by maintenance＠opensuse.org 05 Feb '13

05 Feb '13

openSUSE Recommended Update: sysstat: Fix sadf timestamp XML ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0244-1 Rating: low References: #800978 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for sysstat: - bnc#800978: Fix sadf timestamp XML Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-82 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): sysstat-10.0.2-20.25.1 sysstat-debuginfo-10.0.2-20.25.1 sysstat-debugsource-10.0.2-20.25.1 sysstat-isag-10.0.2-20.25.1 References: https://bugzilla.novell.com/800978

1 0

openSUSE-SU-2013:0243-1: moderate: update for apache2
by opensuse-security＠opensuse.org 05 Feb '13

05 Feb '13

openSUSE Security Update: update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0243-1 Rating: moderate References: #722545 #757710 #777260 #788121 #789828 #798733 Cross-References: CVE-2011-3368 CVE-2011-4317 CVE-2012-0883 CVE-2012-2687 CVE-2012-4557 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: - ignore case when checking against SNI server names. [bnc#798733] httpd-2.2.x-bnc798733-SNI_ignorecase.diff - better cleanup of busy count after recovering from failure [bnc#789828] httpd-2.2.x-bnc789828-mod_balancer.diff - httpd-2.2.x-bnc788121-CVE-2012-4557-mod_proxy_ajp_timeout.di ff: backend timeouts should not affect the entire worker. [bnc#788121] - httpd-2.2.x-envvars.diff obsoletes httpd-2.0.54-envvars.dif: Fix for low profile bug CVE-2012-0883 about improper LD_LIBRARY_PATH handling. [bnc#757710] - httpd-2.2.x-bnc777260-CVE-2012-2687-mod_negotiation_filename _xss.diff Escape filename for the case that uploads are allowed with untrusted user's control over filenames and mod_negotiation enabled on the same directory. CVE-2012-2687 [bnc#777260] - httpd-2.2.x-CVE-2011-3368_CVE-2011-4317-bnc722545.diff reworked to reflect the upstream changes. This will prevent the "Invalid URI in request OPTIONS *" messages in the error log. [bnc#722545] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-80 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): apache2-2.2.21-3.9.1 apache2-debuginfo-2.2.21-3.9.1 apache2-debugsource-2.2.21-3.9.1 apache2-devel-2.2.21-3.9.1 apache2-event-2.2.21-3.9.1 apache2-event-debuginfo-2.2.21-3.9.1 apache2-example-pages-2.2.21-3.9.1 apache2-itk-2.2.21-3.9.1 apache2-itk-debuginfo-2.2.21-3.9.1 apache2-prefork-2.2.21-3.9.1 apache2-prefork-debuginfo-2.2.21-3.9.1 apache2-utils-2.2.21-3.9.1 apache2-utils-debuginfo-2.2.21-3.9.1 apache2-worker-2.2.21-3.9.1 apache2-worker-debuginfo-2.2.21-3.9.1 - openSUSE 12.1 (noarch): apache2-doc-2.2.21-3.9.1 References: http://support.novell.com/security/cve/CVE-2011-3368.html http://support.novell.com/security/cve/CVE-2011-4317.html http://support.novell.com/security/cve/CVE-2012-0883.html http://support.novell.com/security/cve/CVE-2012-2687.html http://support.novell.com/security/cve/CVE-2012-4557.html https://bugzilla.novell.com/722545 https://bugzilla.novell.com/757710 https://bugzilla.novell.com/777260 https://bugzilla.novell.com/788121 https://bugzilla.novell.com/789828 https://bugzilla.novell.com/798733

1 0