March 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:0407-1: important: pidgin: various security fixes
by opensuse-security＠opensuse.org 07 Mar '13

07 Mar '13

openSUSE Security Update: pidgin: various security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0407-1 Rating: important References: #804742 Cross-References: CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: pidgin was updated to fix security issues: - Fix a crash when receiving UPnP responses with abnormally long values. (CVE-2013-0274) - Fix a crash in Sametime when a malicious server sends us an abnormally long user ID. (CVE-2013-0273) - Fix a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution.(CVE-2013-0272) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-35 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): finch-2.7.10-4.53.1 finch-debuginfo-2.7.10-4.53.1 finch-devel-2.7.10-4.53.1 libpurple-2.7.10-4.53.1 libpurple-debuginfo-2.7.10-4.53.1 libpurple-devel-2.7.10-4.53.1 libpurple-meanwhile-2.7.10-4.53.1 libpurple-meanwhile-debuginfo-2.7.10-4.53.1 libpurple-tcl-2.7.10-4.53.1 libpurple-tcl-debuginfo-2.7.10-4.53.1 pidgin-2.7.10-4.53.1 pidgin-debuginfo-2.7.10-4.53.1 pidgin-debugsource-2.7.10-4.53.1 pidgin-devel-2.7.10-4.53.1 pidgin-evolution-2.7.10-4.53.1 pidgin-evolution-debuginfo-2.7.10-4.53.1 - openSUSE 11.4 (noarch): libpurple-lang-2.7.10-4.53.1 References: http://support.novell.com/security/cve/CVE-2013-0272.html http://support.novell.com/security/cve/CVE-2013-0273.html http://support.novell.com/security/cve/CVE-2013-0274.html https://bugzilla.novell.com/804742

1 0

openSUSE-RU-2013:0406-1: kdebase4: Several fixes for kickoff
by maintenance＠opensuse.org 07 Mar '13

07 Mar '13

openSUSE Recommended Update: kdebase4: Several fixes for kickoff ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0406-1 Rating: low References: #356553 #641916 #725829 #803179 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes some issues with openSUSE's patches to the KDE application launcher ("Kickoff"): - bnc#803179: sort entries by genericName if "Show applications by name" is switched off - bnc#356553: add ":F" to the sortOrder list if it isn't included to make sure collapsed entries are really shown - bnc#641916: display program icon instead of submenu icon when using reduced menu depth - bnc#725829: don't set name to null if it is equal to genericName or genericName is empty Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-36 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): kde4-kgreeter-plugins-4.6.0-10.18.1 kde4-kgreeter-plugins-debuginfo-4.6.0-10.18.1 kdebase4-workspace-4.6.0-10.18.1 kdebase4-workspace-branding-upstream-4.6.0-10.18.1 kdebase4-workspace-debuginfo-4.6.0-10.18.1 kdebase4-workspace-debugsource-4.6.0-10.18.1 kdebase4-workspace-devel-4.6.0-10.18.1 kdebase4-workspace-devel-debuginfo-4.6.0-10.18.1 kdebase4-workspace-google-gadgets-4.6.0-10.18.1 kdebase4-workspace-google-gadgets-debuginfo-4.6.0-10.18.1 kdebase4-workspace-ksysguardd-4.6.0-10.18.1 kdebase4-workspace-ksysguardd-debuginfo-4.6.0-10.18.1 kdebase4-workspace-liboxygenstyle-4.6.0-10.18.1 kdebase4-workspace-liboxygenstyle-debuginfo-4.6.0-10.18.1 kdelibs4-4.6.0-6.69.1 kdelibs4-branding-upstream-4.6.0-6.69.1 kdelibs4-core-4.6.0-6.69.1 kdelibs4-core-debuginfo-4.6.0-6.69.1 kdelibs4-debuginfo-4.6.0-6.69.1 kdelibs4-debugsource-4.6.0-6.69.1 kdelibs4-doc-4.6.0-6.69.1 kdelibs4-doc-debuginfo-4.6.0-6.69.1 kdm-4.6.0-10.18.1 kdm-branding-upstream-4.6.0-10.18.1 kdm-debuginfo-4.6.0-10.18.1 kwin-4.6.0-10.18.1 kwin-debuginfo-4.6.0-10.18.1 libkde4-4.6.0-6.69.1 libkde4-debuginfo-4.6.0-6.69.1 libkde4-devel-4.6.0-6.69.1 libkdecore4-4.6.0-6.69.1 libkdecore4-debuginfo-4.6.0-6.69.1 libkdecore4-devel-4.6.0-6.69.1 libkdecore4-devel-debuginfo-4.6.0-6.69.1 libksuseinstall-devel-4.6.0-6.69.1 libksuseinstall1-4.6.0-6.69.1 libksuseinstall1-debuginfo-4.6.0-6.69.1 - openSUSE 11.4 (x86_64): kdebase4-workspace-liboxygenstyle-32bit-4.6.0-10.18.1 kdebase4-workspace-liboxygenstyle-debuginfo-32bit-4.6.0-10.18.1 libkde4-32bit-4.6.0-6.69.1 libkde4-debuginfo-32bit-4.6.0-6.69.1 libkdecore4-32bit-4.6.0-6.69.1 libkdecore4-debuginfo-32bit-4.6.0-6.69.1 libksuseinstall1-32bit-4.6.0-6.69.1 libksuseinstall1-debuginfo-32bit-4.6.0-6.69.1 - openSUSE 11.4 (noarch): kdebase4-wallpapers-4.6.0-5.18.1 - openSUSE 11.4 (ia64): kdebase4-workspace-liboxygenstyle-debuginfo-x86-4.6.0-10.18.1 kdebase4-workspace-liboxygenstyle-x86-4.6.0-10.18.1 libkde4-debuginfo-x86-4.6.0-6.69.1 libkde4-x86-4.6.0-6.69.1 libkdecore4-debuginfo-x86-4.6.0-6.69.1 libkdecore4-x86-4.6.0-6.69.1 libksuseinstall1-debuginfo-x86-4.6.0-6.69.1 libksuseinstall1-x86-4.6.0-6.69.1 References: https://bugzilla.novell.com/356553 https://bugzilla.novell.com/641916 https://bugzilla.novell.com/725829 https://bugzilla.novell.com/803179

1 0

openSUSE-SU-2013:0405-1: important: pidgin: various security fixes
by opensuse-security＠opensuse.org 07 Mar '13

07 Mar '13

openSUSE Security Update: pidgin: various security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0405-1 Rating: important References: #804742 Cross-References: CVE-2013-0271 CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: pidgin was updated to fix security issues: - Fix a crash when receiving UPnP responses with abnormally long values. (CVE-2013-0274) - Fix a crash in Sametime when a malicious server sends us an abnormally long user ID. (CVE-2013-0273) - Fix a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution.(CVE-2013-0272) - Fix a bug where a remote MXit user could possibly specify a local file path to be written to. (CVE-2013-0271) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-177 - openSUSE 12.1: zypper in -t patch openSUSE-2013-177 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): finch-2.10.6-1.4.1 finch-debuginfo-2.10.6-1.4.1 finch-devel-2.10.6-1.4.1 libpurple-2.10.6-1.4.1 libpurple-debuginfo-2.10.6-1.4.1 libpurple-devel-2.10.6-1.4.1 libpurple-meanwhile-2.10.6-1.4.1 libpurple-meanwhile-debuginfo-2.10.6-1.4.1 libpurple-tcl-2.10.6-1.4.1 libpurple-tcl-debuginfo-2.10.6-1.4.1 pidgin-2.10.6-1.4.1 pidgin-debuginfo-2.10.6-1.4.1 pidgin-debugsource-2.10.6-1.4.1 pidgin-devel-2.10.6-1.4.1 pidgin-evolution-2.10.6-1.4.1 pidgin-evolution-debuginfo-2.10.6-1.4.1 - openSUSE 12.2 (noarch): libpurple-branding-upstream-2.10.6-1.4.1 libpurple-lang-2.10.6-1.4.1 - openSUSE 12.1 (i586 x86_64): finch-2.10.1-8.18.1 finch-debuginfo-2.10.1-8.18.1 finch-devel-2.10.1-8.18.1 libpurple-2.10.1-8.18.1 libpurple-debuginfo-2.10.1-8.18.1 libpurple-devel-2.10.1-8.18.1 libpurple-meanwhile-2.10.1-8.18.1 libpurple-meanwhile-debuginfo-2.10.1-8.18.1 libpurple-tcl-2.10.1-8.18.1 libpurple-tcl-debuginfo-2.10.1-8.18.1 pidgin-2.10.1-8.18.1 pidgin-debuginfo-2.10.1-8.18.1 pidgin-debugsource-2.10.1-8.18.1 pidgin-devel-2.10.1-8.18.1 pidgin-evolution-2.10.1-8.18.1 pidgin-evolution-debuginfo-2.10.1-8.18.1 - openSUSE 12.1 (noarch): libpurple-branding-upstream-2.10.1-8.18.1 libpurple-lang-2.10.1-8.18.1 References: http://support.novell.com/security/cve/CVE-2013-0271.html http://support.novell.com/security/cve/CVE-2013-0272.html http://support.novell.com/security/cve/CVE-2013-0273.html http://support.novell.com/security/cve/CVE-2013-0274.html https://bugzilla.novell.com/804742

1 0

openSUSE-SU-2013:0404-1: moderate: libqt4: fix a information disclosure
by opensuse-security＠opensuse.org 07 Mar '13

07 Mar '13

openSUSE Security Update: libqt4: fix a information disclosure ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0404-1 Rating: moderate References: #802634 Cross-References: CVE-2013-0254 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libqt4 was updated to fix a information disclosure via QSharedMemory (CVE-2013-0254). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-178 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): libqt4-4.7.4-19.21.1 libqt4-debuginfo-4.7.4-19.21.1 libqt4-debugsource-4.7.4-19.21.1 libqt4-devel-4.7.4-19.21.1 libqt4-devel-debuginfo-4.7.4-19.21.1 libqt4-private-headers-devel-4.7.4-19.21.1 libqt4-qt3support-4.7.4-19.21.1 libqt4-qt3support-debuginfo-4.7.4-19.21.1 libqt4-sql-4.7.4-19.21.1 libqt4-sql-debuginfo-4.7.4-19.21.1 libqt4-sql-sqlite-4.7.4-19.21.1 libqt4-sql-sqlite-debuginfo-4.7.4-19.21.1 libqt4-x11-4.7.4-19.21.1 libqt4-x11-debuginfo-4.7.4-19.21.1 - openSUSE 12.1 (x86_64): libqt4-32bit-4.7.4-19.21.1 libqt4-debuginfo-32bit-4.7.4-19.21.1 libqt4-qt3support-32bit-4.7.4-19.21.1 libqt4-qt3support-debuginfo-32bit-4.7.4-19.21.1 libqt4-sql-32bit-4.7.4-19.21.1 libqt4-sql-debuginfo-32bit-4.7.4-19.21.1 libqt4-sql-sqlite-32bit-4.7.4-19.21.1 libqt4-sql-sqlite-debuginfo-32bit-4.7.4-19.21.1 libqt4-x11-32bit-4.7.4-19.21.1 libqt4-x11-debuginfo-32bit-4.7.4-19.21.1 - openSUSE 12.1 (ia64): libqt4-debuginfo-x86-4.7.4-19.21.1 libqt4-qt3support-debuginfo-x86-4.7.4-19.21.1 libqt4-qt3support-x86-4.7.4-19.21.1 libqt4-sql-debuginfo-x86-4.7.4-19.21.1 libqt4-sql-sqlite-debuginfo-x86-4.7.4-19.21.1 libqt4-sql-sqlite-x86-4.7.4-19.21.1 libqt4-sql-x86-4.7.4-19.21.1 libqt4-x11-debuginfo-x86-4.7.4-19.21.1 libqt4-x11-x86-4.7.4-19.21.1 libqt4-x86-4.7.4-19.21.1 References: http://support.novell.com/security/cve/CVE-2013-0254.html https://bugzilla.novell.com/802634

1 0

openSUSE-SU-2013:0403-1: moderate: libqt4: fix information disclosure via QSharedMemory
by opensuse-security＠opensuse.org 07 Mar '13

07 Mar '13

openSUSE Security Update: libqt4: fix information disclosure via QSharedMemory ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0403-1 Rating: moderate References: #802634 Cross-References: CVE-2013-0254 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libqt4 was updated to fix a information disclosure via QSharedMemory (CVE-2013-0254). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-179 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libqt4-4.8.1-2.16.1 libqt4-debuginfo-4.8.1-2.16.1 libqt4-debugsource-4.8.1-2.16.1 libqt4-devel-4.8.1-2.16.1 libqt4-devel-debuginfo-4.8.1-2.16.1 libqt4-devel-doc-4.8.1-2.16.2 libqt4-devel-doc-debuginfo-4.8.1-2.16.2 libqt4-devel-doc-debugsource-4.8.1-2.16.2 libqt4-private-headers-devel-4.8.1-2.16.1 libqt4-qt3support-4.8.1-2.16.1 libqt4-qt3support-debuginfo-4.8.1-2.16.1 libqt4-sql-4.8.1-2.16.1 libqt4-sql-debuginfo-4.8.1-2.16.1 libqt4-sql-mysql-4.8.1-2.16.1 libqt4-sql-mysql-debuginfo-4.8.1-2.16.1 libqt4-sql-plugins-debugsource-4.8.1-2.16.1 libqt4-sql-postgresql-4.8.1-2.16.1 libqt4-sql-postgresql-debuginfo-4.8.1-2.16.1 libqt4-sql-sqlite-4.8.1-2.16.1 libqt4-sql-sqlite-debuginfo-4.8.1-2.16.1 libqt4-sql-unixODBC-4.8.1-2.16.1 libqt4-sql-unixODBC-debuginfo-4.8.1-2.16.1 libqt4-x11-4.8.1-2.16.1 libqt4-x11-debuginfo-4.8.1-2.16.1 qt4-x11-tools-4.8.1-2.16.2 qt4-x11-tools-debuginfo-4.8.1-2.16.2 - openSUSE 12.2 (x86_64): libqt4-32bit-4.8.1-2.16.1 libqt4-debuginfo-32bit-4.8.1-2.16.1 libqt4-qt3support-32bit-4.8.1-2.16.1 libqt4-qt3support-debuginfo-32bit-4.8.1-2.16.1 libqt4-sql-32bit-4.8.1-2.16.1 libqt4-sql-debuginfo-32bit-4.8.1-2.16.1 libqt4-sql-mysql-32bit-4.8.1-2.16.1 libqt4-sql-mysql-debuginfo-32bit-4.8.1-2.16.1 libqt4-sql-postgresql-32bit-4.8.1-2.16.1 libqt4-sql-postgresql-debuginfo-32bit-4.8.1-2.16.1 libqt4-sql-sqlite-32bit-4.8.1-2.16.1 libqt4-sql-sqlite-debuginfo-32bit-4.8.1-2.16.1 libqt4-sql-unixODBC-32bit-4.8.1-2.16.1 libqt4-sql-unixODBC-debuginfo-32bit-4.8.1-2.16.1 libqt4-x11-32bit-4.8.1-2.16.1 libqt4-x11-debuginfo-32bit-4.8.1-2.16.1 - openSUSE 12.2 (noarch): libqt4-devel-doc-data-4.8.1-2.16.2 References: http://support.novell.com/security/cve/CVE-2013-0254.html https://bugzilla.novell.com/802634

1 0

openSUSE-SU-2013:0396-1: important: kernel: security and bugfix update
by opensuse-security＠opensuse.org 05 Mar '13

05 Mar '13

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0396-1 Rating: important References: #714906 #720226 #733148 #755546 #762693 #765524 #768506 #769784 #769896 #770695 #773406 #773831 #774285 #774523 #774859 #776144 #778630 #779432 #781134 #783515 #784192 #786013 #787168 #792500 #793671 #797175 #799209 #800280 #801178 #801782 #802153 #802642 #804154 #804652 #804738 Cross-References: CVE-2012-0957 CVE-2012-2745 CVE-2012-3412 CVE-2012-4530 CVE-2013-0160 CVE-2013-0216 CVE-2013-0231 CVE-2013-0268 CVE-2013-0309 CVE-2013-0871 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves 10 vulnerabilities and has 25 fixes is now available. Description: The Linux kernel was updated to fix various bugs and security issues: CVE-2013-0871: Race condition in the ptrace functionality in the Linux kernel allowed local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death. CVE-2013-0160: Avoid a side channel attack on /dev/ptmx (keyboard input timing). CVE-2012-5374: Fixed a local denial of service in the BTRFS hashing code. CVE-2013-0309: arch/x86/include/asm/pgtable.h in the Linux kernel, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application. CVE-2013-0268: The msr_open function in arch/x86/kernel/msr.c in the Linux kernel allowed local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c. CVE-2012-0957: The override_release function in kernel/sys.c in the Linux kernel allowed local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality. CVE-2013-0216: The Xen netback functionality in the Linux kernel allowed guest OS users to cause a denial of service (loop) by triggering ring pointer corruption. CVE-2013-0231: The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel allowed guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. NOTE: some of these details are obtained from third party information. CVE-2012-4530: The load_script function in fs/binfmt_script.c in the Linux kernel did not properly handle recursion, which allowed local users to obtain sensitive information from kernel stack memory via a crafted application. CVE-2012-4508: Race condition in fs/ext4/extents.c in the Linux kernel allowed local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized. CVE-2012-3412: The sfc (aka Solarflare Solarstorm) driver in the Linux kernel allowed remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value. CVE-2012-2745: The copy_creds function in kernel/cred.c in the Linux kernel provided an invalid replacement session keyring to a child process, which allowed local users to cause a denial of service (panic) via a crafted application that uses the fork system call. CVE-2012-3375: The epoll_ctl system call in fs/eventpoll.c in the Linux kernel did not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allowed local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. CVE-2012-3400: Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel allowed remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-176 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): kernel-debug-3.1.10-1.19.1 kernel-debug-base-3.1.10-1.19.1 kernel-debug-base-debuginfo-3.1.10-1.19.1 kernel-debug-debuginfo-3.1.10-1.19.1 kernel-debug-debugsource-3.1.10-1.19.1 kernel-debug-devel-3.1.10-1.19.1 kernel-debug-devel-debuginfo-3.1.10-1.19.1 kernel-default-3.1.10-1.19.1 kernel-default-base-3.1.10-1.19.1 kernel-default-base-debuginfo-3.1.10-1.19.1 kernel-default-debuginfo-3.1.10-1.19.1 kernel-default-debugsource-3.1.10-1.19.1 kernel-default-devel-3.1.10-1.19.1 kernel-default-devel-debuginfo-3.1.10-1.19.1 kernel-desktop-3.1.10-1.19.1 kernel-desktop-base-3.1.10-1.19.1 kernel-desktop-base-debuginfo-3.1.10-1.19.1 kernel-desktop-debuginfo-3.1.10-1.19.1 kernel-desktop-debugsource-3.1.10-1.19.1 kernel-desktop-devel-3.1.10-1.19.1 kernel-desktop-devel-debuginfo-3.1.10-1.19.1 kernel-ec2-3.1.10-1.19.1 kernel-ec2-base-3.1.10-1.19.1 kernel-ec2-base-debuginfo-3.1.10-1.19.1 kernel-ec2-debuginfo-3.1.10-1.19.1 kernel-ec2-debugsource-3.1.10-1.19.1 kernel-ec2-devel-3.1.10-1.19.1 kernel-ec2-devel-debuginfo-3.1.10-1.19.1 kernel-ec2-extra-3.1.10-1.19.1 kernel-ec2-extra-debuginfo-3.1.10-1.19.1 kernel-syms-3.1.10-1.19.1 kernel-trace-3.1.10-1.19.1 kernel-trace-base-3.1.10-1.19.1 kernel-trace-base-debuginfo-3.1.10-1.19.1 kernel-trace-debuginfo-3.1.10-1.19.1 kernel-trace-debugsource-3.1.10-1.19.1 kernel-trace-devel-3.1.10-1.19.1 kernel-trace-devel-debuginfo-3.1.10-1.19.1 kernel-vanilla-3.1.10-1.19.1 kernel-vanilla-base-3.1.10-1.19.1 kernel-vanilla-base-debuginfo-3.1.10-1.19.1 kernel-vanilla-debuginfo-3.1.10-1.19.1 kernel-vanilla-debugsource-3.1.10-1.19.1 kernel-vanilla-devel-3.1.10-1.19.1 kernel-vanilla-devel-debuginfo-3.1.10-1.19.1 kernel-xen-3.1.10-1.19.1 kernel-xen-base-3.1.10-1.19.1 kernel-xen-base-debuginfo-3.1.10-1.19.1 kernel-xen-debuginfo-3.1.10-1.19.1 kernel-xen-debugsource-3.1.10-1.19.1 kernel-xen-devel-3.1.10-1.19.1 kernel-xen-devel-debuginfo-3.1.10-1.19.1 - openSUSE 12.1 (noarch): kernel-devel-3.1.10-1.19.1 kernel-docs-3.1.10-1.19.2 kernel-source-3.1.10-1.19.1 kernel-source-vanilla-3.1.10-1.19.1 - openSUSE 12.1 (i586): kernel-pae-3.1.10-1.19.1 kernel-pae-base-3.1.10-1.19.1 kernel-pae-base-debuginfo-3.1.10-1.19.1 kernel-pae-debuginfo-3.1.10-1.19.1 kernel-pae-debugsource-3.1.10-1.19.1 kernel-pae-devel-3.1.10-1.19.1 kernel-pae-devel-debuginfo-3.1.10-1.19.1 References: http://support.novell.com/security/cve/CVE-2012-0957.html http://support.novell.com/security/cve/CVE-2012-2745.html http://support.novell.com/security/cve/CVE-2012-3412.html http://support.novell.com/security/cve/CVE-2012-4530.html http://support.novell.com/security/cve/CVE-2013-0160.html http://support.novell.com/security/cve/CVE-2013-0216.html http://support.novell.com/security/cve/CVE-2013-0231.html http://support.novell.com/security/cve/CVE-2013-0268.html http://support.novell.com/security/cve/CVE-2013-0309.html http://support.novell.com/security/cve/CVE-2013-0871.html https://bugzilla.novell.com/714906 https://bugzilla.novell.com/720226 https://bugzilla.novell.com/733148 https://bugzilla.novell.com/755546 https://bugzilla.novell.com/762693 https://bugzilla.novell.com/765524 https://bugzilla.novell.com/768506 https://bugzilla.novell.com/769784 https://bugzilla.novell.com/769896 https://bugzilla.novell.com/770695 https://bugzilla.novell.com/773406 https://bugzilla.novell.com/773831 https://bugzilla.novell.com/774285 https://bugzilla.novell.com/774523 https://bugzilla.novell.com/774859 https://bugzilla.novell.com/776144 https://bugzilla.novell.com/778630 https://bugzilla.novell.com/779432 https://bugzilla.novell.com/781134 https://bugzilla.novell.com/783515 https://bugzilla.novell.com/784192 https://bugzilla.novell.com/786013 https://bugzilla.novell.com/787168 https://bugzilla.novell.com/792500 https://bugzilla.novell.com/793671 https://bugzilla.novell.com/797175 https://bugzilla.novell.com/799209 https://bugzilla.novell.com/800280 https://bugzilla.novell.com/801178 https://bugzilla.novell.com/801782 https://bugzilla.novell.com/802153 https://bugzilla.novell.com/802642 https://bugzilla.novell.com/804154 https://bugzilla.novell.com/804652 https://bugzilla.novell.com/804738

1 0

openSUSE-SU-2013:0395-1: important: kernel: fixed local privilege escalation
by opensuse-security＠opensuse.org 05 Mar '13

05 Mar '13

openSUSE Security Update: kernel: fixed local privilege escalation ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0395-1 Rating: important References: #797175 #799209 #800280 #801178 #801782 #802153 #804738 #805633 Cross-References: CVE-2012-5374 CVE-2013-0160 CVE-2013-0216 CVE-2013-0231 CVE-2013-1763 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: The Linux kernel was updated to 3.4.33 and to fix a local root privilege escalation and various other security and non-security bugs. CVE-2013-1763: A out of bounds access in sock_diag could be used by local attackers to execute code in kernel context and so become root. CVE-2013-0160: The atime of /dev/ptmx is no longer updated, avoiding side channel attacks via user typing speed. CVE-2012-5374: Denial of service via btrfs hashes could have been used by local attackers to cause a compute denial of service. CVE-2013-0216: Fixed a problem in XEN netback: shutdown the ring if it contains garbage. CVE-2013-0231: Fixed a problem in XEN pciback: rate limit error messages from xen_pcibk_enable_msi(x). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-175 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): kernel-default-3.4.33-2.24.1 kernel-default-base-3.4.33-2.24.1 kernel-default-base-debuginfo-3.4.33-2.24.1 kernel-default-debuginfo-3.4.33-2.24.1 kernel-default-debugsource-3.4.33-2.24.1 kernel-default-devel-3.4.33-2.24.1 kernel-default-devel-debuginfo-3.4.33-2.24.1 kernel-syms-3.4.33-2.24.1 - openSUSE 12.2 (i686 x86_64): kernel-debug-3.4.33-2.24.1 kernel-debug-base-3.4.33-2.24.1 kernel-debug-base-debuginfo-3.4.33-2.24.1 kernel-debug-debuginfo-3.4.33-2.24.1 kernel-debug-debugsource-3.4.33-2.24.1 kernel-debug-devel-3.4.33-2.24.1 kernel-debug-devel-debuginfo-3.4.33-2.24.1 kernel-desktop-3.4.33-2.24.1 kernel-desktop-base-3.4.33-2.24.1 kernel-desktop-base-debuginfo-3.4.33-2.24.1 kernel-desktop-debuginfo-3.4.33-2.24.1 kernel-desktop-debugsource-3.4.33-2.24.1 kernel-desktop-devel-3.4.33-2.24.1 kernel-desktop-devel-debuginfo-3.4.33-2.24.1 kernel-ec2-3.4.33-2.24.1 kernel-ec2-base-3.4.33-2.24.1 kernel-ec2-base-debuginfo-3.4.33-2.24.1 kernel-ec2-debuginfo-3.4.33-2.24.1 kernel-ec2-debugsource-3.4.33-2.24.1 kernel-ec2-devel-3.4.33-2.24.1 kernel-ec2-devel-debuginfo-3.4.33-2.24.1 kernel-ec2-extra-3.4.33-2.24.1 kernel-ec2-extra-debuginfo-3.4.33-2.24.1 kernel-trace-3.4.33-2.24.1 kernel-trace-base-3.4.33-2.24.1 kernel-trace-base-debuginfo-3.4.33-2.24.1 kernel-trace-debuginfo-3.4.33-2.24.1 kernel-trace-debugsource-3.4.33-2.24.1 kernel-trace-devel-3.4.33-2.24.1 kernel-trace-devel-debuginfo-3.4.33-2.24.1 kernel-vanilla-3.4.33-2.24.1 kernel-vanilla-debuginfo-3.4.33-2.24.1 kernel-vanilla-debugsource-3.4.33-2.24.1 kernel-vanilla-devel-3.4.33-2.24.1 kernel-vanilla-devel-debuginfo-3.4.33-2.24.1 kernel-xen-3.4.33-2.24.1 kernel-xen-base-3.4.33-2.24.1 kernel-xen-base-debuginfo-3.4.33-2.24.1 kernel-xen-debuginfo-3.4.33-2.24.1 kernel-xen-debugsource-3.4.33-2.24.1 kernel-xen-devel-3.4.33-2.24.1 kernel-xen-devel-debuginfo-3.4.33-2.24.1 - openSUSE 12.2 (noarch): kernel-devel-3.4.33-2.24.1 kernel-docs-3.4.33-2.24.2 kernel-source-3.4.33-2.24.1 kernel-source-vanilla-3.4.33-2.24.1 - openSUSE 12.2 (i686): kernel-pae-3.4.33-2.24.1 kernel-pae-base-3.4.33-2.24.1 kernel-pae-base-debuginfo-3.4.33-2.24.1 kernel-pae-debuginfo-3.4.33-2.24.1 kernel-pae-debugsource-3.4.33-2.24.1 kernel-pae-devel-3.4.33-2.24.1 kernel-pae-devel-debuginfo-3.4.33-2.24.1 References: http://support.novell.com/security/cve/CVE-2012-5374.html http://support.novell.com/security/cve/CVE-2013-0160.html http://support.novell.com/security/cve/CVE-2013-0216.html http://support.novell.com/security/cve/CVE-2013-0231.html http://support.novell.com/security/cve/CVE-2013-1763.html https://bugzilla.novell.com/797175 https://bugzilla.novell.com/799209 https://bugzilla.novell.com/800280 https://bugzilla.novell.com/801178 https://bugzilla.novell.com/801782 https://bugzilla.novell.com/802153 https://bugzilla.novell.com/804738 https://bugzilla.novell.com/805633

1 0

openSUSE-RU-2013:0393-1: osc: Update to 0.139.1
by maintenance＠opensuse.org 05 Mar '13

05 Mar '13

openSUSE Recommended Update: osc: Update to 0.139.1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0393-1 Rating: low References: Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues for osc: - 0.139.1: - do not crash on invalid authentification setup - update to 0.139.0: - bugfixes for owner search - support generic emulator virtualization - added "--host" argument to "osc build" (used to perform the build on a remote host) - "search --maintained" is obsolete. Abort on usage. - "maintainer --user" support to search for all official maintained instance for given user or group - added support to abort a commit after displaying a default commit message in $EDITOR. As a result other commands like "submitrequest" will also ask if the user wants to proceed if the default comment/message wasn't changed. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-174 - openSUSE 12.1: zypper in -t patch openSUSE-2013-174 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (noarch): osc-0.139.1-1.9.1 - openSUSE 12.1 (noarch): osc-0.139.1-2.12.1 References:

1 0

openSUSE-RU-2013:0392-1: sssd: Resolve user retrieval problems when encountering binary data in LDAP attributes
by maintenance＠opensuse.org 05 Mar '13

05 Mar '13

openSUSE Recommended Update: sssd: Resolve user retrieval problems when encountering binary data in LDAP attributes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0392-1 Rating: low References: #806078 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for sssd: - bnc#806078: Resolve user retrieval problems when encountering binary data in LDAP attributes Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-173 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libipa_hbac-devel-1.8.5-2.12.2 libipa_hbac0-1.8.5-2.12.2 libipa_hbac0-debuginfo-1.8.5-2.12.2 python-ipa_hbac-1.8.5-2.12.2 python-ipa_hbac-debuginfo-1.8.5-2.12.2 python-sssd-config-1.8.5-2.12.2 python-sssd-config-debuginfo-1.8.5-2.12.2 sssd-1.8.5-2.12.2 sssd-debuginfo-1.8.5-2.12.2 sssd-debugsource-1.8.5-2.12.2 sssd-ipa-provider-1.8.5-2.12.2 sssd-ipa-provider-debuginfo-1.8.5-2.12.2 sssd-tools-1.8.5-2.12.2 sssd-tools-debuginfo-1.8.5-2.12.2 - openSUSE 12.2 (x86_64): sssd-32bit-1.8.5-2.12.2 sssd-debuginfo-32bit-1.8.5-2.12.2 References: https://bugzilla.novell.com/806078

1 0

openSUSE-RU-2013:0391-1: moderate: gnome-control-center: fix setting timezone and toggling ntp
by maintenance＠opensuse.org 05 Mar '13

05 Mar '13

openSUSE Recommended Update: gnome-control-center: fix setting timezone and toggling ntp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0391-1 Rating: moderate References: #796055 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for gnome-control-center: - bnc#796055: fixed timezone and NTP settings Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-172 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): gnome-control-center-3.4.3.1-3.19.1 gnome-control-center-debuginfo-3.4.3.1-3.19.1 gnome-control-center-debugsource-3.4.3.1-3.19.1 gnome-control-center-devel-3.4.3.1-3.19.1 gnome-control-center-user-faces-3.4.3.1-3.19.1 gnome-settings-daemon-3.4.2-3.8.1 gnome-settings-daemon-debuginfo-3.4.2-3.8.1 gnome-settings-daemon-debugsource-3.4.2-3.8.1 gnome-settings-daemon-devel-3.4.2-3.8.1 - openSUSE 12.2 (noarch): gnome-control-center-branding-openSUSE-12.2-2.4.2 gnome-control-center-branding-upstream-3.4.3.1-3.19.1 gnome-control-center-lang-3.4.3.1-3.19.1 gnome-settings-daemon-lang-3.4.2-3.8.1 References: https://bugzilla.novell.com/796055

1 0

openSUSE-RU-2013:0386-1: yast2-ncurses: Show patch descriptions correctly
by maintenance＠opensuse.org 04 Mar '13

04 Mar '13

openSUSE Recommended Update: yast2-ncurses: Show patch descriptions correctly ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0386-1 Rating: low References: #803466 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for yast2-ncurses: - bnc#803466: Show patch descriptions correctly Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-171 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): yast2-ncurses-2.22.5-1.4.1 yast2-ncurses-debuginfo-2.22.5-1.4.1 yast2-ncurses-debugsource-2.22.5-1.4.1 yast2-ncurses-devel-2.22.5-1.4.1 yast2-ncurses-pkg-2.22.8-2.4.1 yast2-ncurses-pkg-debuginfo-2.22.8-2.4.1 yast2-ncurses-pkg-debugsource-2.22.8-2.4.1 References: https://bugzilla.novell.com/803466

1 0

openSUSE-SU-2013:0382-1: moderate: git: check SSL certificates during imap-send
by opensuse-security＠opensuse.org 01 Mar '13

01 Mar '13

openSUSE Security Update: git: check SSL certificates during imap-send ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0382-1 Rating: moderate References: #804730 Cross-References: CVE-2013-0308 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: git imap-send was fixed to do SSL host verification. This can be disabled if necessary in the config file. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-34 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): git-1.7.3.4-4.11.1 git-arch-1.7.3.4-4.11.1 git-core-1.7.3.4-4.11.1 git-core-debuginfo-1.7.3.4-4.11.1 git-cvs-1.7.3.4-4.11.1 git-daemon-1.7.3.4-4.11.1 git-daemon-debuginfo-1.7.3.4-4.11.1 git-debugsource-1.7.3.4-4.11.1 git-email-1.7.3.4-4.11.1 git-gui-1.7.3.4-4.11.1 git-remote-helpers-1.7.3.4-4.11.1 git-svn-1.7.3.4-4.11.1 git-web-1.7.3.4-4.11.1 gitk-1.7.3.4-4.11.1 References: http://support.novell.com/security/cve/CVE-2013-0308.html https://bugzilla.novell.com/804730

1 0

openSUSE-SU-2013:0381-1: moderate: PackageKit: forbid downgrading packages during update
by opensuse-security＠opensuse.org 01 Mar '13

01 Mar '13

openSUSE Security Update: PackageKit: forbid downgrading packages during update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0381-1 Rating: moderate References: #804983 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: PackageKit was fixed to add a patch to forbid update to downgrade (bnc#804983) As the update operation is allowed for logged in regular users, they could install old package versions which might have been still affected by already fixed security problems. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-169 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): PackageKit-0.7.4-2.21.1 PackageKit-backend-zypp-0.7.4-2.21.1 PackageKit-backend-zypp-debuginfo-0.7.4-2.21.1 PackageKit-browser-plugin-0.7.4-2.21.1 PackageKit-browser-plugin-debuginfo-0.7.4-2.21.1 PackageKit-debuginfo-0.7.4-2.21.1 PackageKit-debugsource-0.7.4-2.21.1 PackageKit-devel-0.7.4-2.21.1 PackageKit-devel-debuginfo-0.7.4-2.21.1 PackageKit-gstreamer-plugin-0.7.4-2.21.1 PackageKit-gstreamer-plugin-debuginfo-0.7.4-2.21.1 PackageKit-gtk3-module-0.7.4-2.21.1 PackageKit-gtk3-module-debuginfo-0.7.4-2.21.1 libpackagekit-glib2-14-0.7.4-2.21.1 libpackagekit-glib2-14-debuginfo-0.7.4-2.21.1 libpackagekit-glib2-devel-0.7.4-2.21.1 libpackagekit-qt2-2-0.7.4-2.21.1 libpackagekit-qt2-2-debuginfo-0.7.4-2.21.1 libpackagekit-qt2-devel-0.7.4-2.21.1 typelib-1_0-PackageKitGlib-1_0-0.7.4-2.21.1 typelib-1_0-PackageKitPlugin-1_0-0.7.4-2.21.1 - openSUSE 12.2 (x86_64): libpackagekit-glib2-14-32bit-0.7.4-2.21.1 libpackagekit-glib2-14-debuginfo-32bit-0.7.4-2.21.1 libpackagekit-glib2-devel-32bit-0.7.4-2.21.1 libpackagekit-qt2-2-32bit-0.7.4-2.21.1 libpackagekit-qt2-2-debuginfo-32bit-0.7.4-2.21.1 libpackagekit-qt2-devel-32bit-0.7.4-2.21.1 - openSUSE 12.2 (noarch): PackageKit-branding-upstream-0.7.4-2.21.1 PackageKit-lang-0.7.4-2.21.1 References: https://bugzilla.novell.com/804983

1 0

openSUSE-SU-2013:0380-1: moderate: git: check SSL certificates during imap-send
by opensuse-security＠opensuse.org 01 Mar '13

01 Mar '13

openSUSE Security Update: git: check SSL certificates during imap-send ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0380-1 Rating: moderate References: #804730 Cross-References: CVE-2013-0308 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: git imap-send was fixed to do SSL host verification. This can be disabled if necessary in the config file. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-170 - openSUSE 12.1: zypper in -t patch openSUSE-2013-170 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): git-1.7.10.4-2.8.1 git-arch-1.7.10.4-2.8.1 git-core-1.7.10.4-2.8.1 git-core-debuginfo-1.7.10.4-2.8.1 git-cvs-1.7.10.4-2.8.1 git-daemon-1.7.10.4-2.8.1 git-daemon-debuginfo-1.7.10.4-2.8.1 git-debugsource-1.7.10.4-2.8.1 git-email-1.7.10.4-2.8.1 git-gui-1.7.10.4-2.8.1 git-remote-helpers-1.7.10.4-2.8.1 git-svn-1.7.10.4-2.8.1 git-web-1.7.10.4-2.8.1 gitk-1.7.10.4-2.8.1 - openSUSE 12.1 (i586 x86_64): git-1.7.7-3.4.1 git-arch-1.7.7-3.4.1 git-core-1.7.7-3.4.1 git-core-debuginfo-1.7.7-3.4.1 git-cvs-1.7.7-3.4.1 git-daemon-1.7.7-3.4.1 git-daemon-debuginfo-1.7.7-3.4.1 git-debugsource-1.7.7-3.4.1 git-email-1.7.7-3.4.1 git-gui-1.7.7-3.4.1 git-remote-helpers-1.7.7-3.4.1 git-svn-1.7.7-3.4.1 git-web-1.7.7-3.4.1 gitk-1.7.7-3.4.1 References: http://support.novell.com/security/cve/CVE-2013-0308.html https://bugzilla.novell.com/804730

1 0

openSUSE-SU-2013:0378-1: important: java-1_6_0-openjdk: update to icedtea 1.12.3
by opensuse-security＠opensuse.org 01 Mar '13

01 Mar '13

openSUSE Security Update: java-1_6_0-openjdk: update to icedtea 1.12.3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0378-1 Rating: important References: #801972 #804654 Cross-References: CVE-2013-0169 CVE-2013-1486 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_6_0-openjdk was updated to IcedTea 1.12.3 (bnc#804654) containing security and bugfixes: * Security fixes - S8006446: Restrict MBeanServer access (CVE-2013-1486) - S8006777: Improve TLS handling of invalid messages Lucky 13 (CVE-2013-0169) - S8007688: Blacklist known bad certificate (issued by DigiCert) * Backports - S8007393: Possible race condition after JDK-6664509 - S8007611: logging behavior in applet changed * Bug fixes - PR1319: Support GIF lib v5. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-33 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-debuginfo-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-debugsource-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-demo-debuginfo-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-devel-debuginfo-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b27.1.12.3-29.1 java-1_6_0-openjdk-src-1.6.0.0_b27.1.12.3-29.1 References: http://support.novell.com/security/cve/CVE-2013-0169.html http://support.novell.com/security/cve/CVE-2013-1486.html https://bugzilla.novell.com/801972 https://bugzilla.novell.com/804654

1 0

openSUSE-SU-2013:0377-1: critical: java-1_7_0-openjdk: update to 2.3.6
by opensuse-security＠opensuse.org 01 Mar '13

01 Mar '13

openSUSE Security Update: java-1_7_0-openjdk: update to 2.3.6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0377-1 Rating: critical References: #803379 Cross-References: CVE-2013-0424 CVE-2013-0425 CVE-2013-0426 CVE-2013-0427 CVE-2013-0428 CVE-2013-0429 CVE-2013-0431 CVE-2013-0432 CVE-2013-0433 CVE-2013-0434 CVE-2013-0435 CVE-2013-0440 CVE-2013-0441 CVE-2013-0442 CVE-2013-0443 CVE-2013-0444 CVE-2013-0450 CVE-2013-1475 CVE-2013-1476 CVE-2013-1478 CVE-2013-1480 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: java-1_7_0-openjdk was updated to icedtea-2.3.6 (bnc#803379) containing various security and bugfixes: * Security fixes - S6563318, CVE-2013-0424: RMI data sanitization - S6664509, CVE-2013-0425: Add logging context - S6664528, CVE-2013-0426: Find log level matching its name or value given at construction time - S6776941: CVE-2013-0427: Improve thread pool shutdown - S7141694, CVE-2013-0429: Improving CORBA internals - S7173145: Improve in-memory representation of splashscreens - S7186945: Unpack200 improvement - S7186946: Refine unpacker resource usage - S7186948: Improve Swing data validation - S7186952, CVE-2013-0432: Improve clipboard access - S7186954: Improve connection performance - S7186957: Improve Pack200 data validation - S7192392, CVE-2013-0443: Better validation of client keys - S7192393, CVE-2013-0440: Better Checking of order of TLS Messages - S7192977, CVE-2013-0442: Issue in toolkit thread - S7197546, CVE-2013-0428: (proxy) Reflect about creating reflective proxies - S7200491: Tighten up JTable layout code - S7200493, CVE-2013-0444: Improve cache handling - S7200499: Better data validation for options - S7200500: Launcher better input validation - S7201064: Better dialogue checking - S7201066, CVE-2013-0441: Change modifiers on unused fields - S7201068, CVE-2013-0435: Better handling of UI elements - S7201070: Serialization to conform to protocol - S7201071, CVE-2013-0433: InetSocketAddress serialization issue - S8000210: Improve JarFile code quality - S8000537, CVE-2013-0450: Contextualize RequiredModelMBean class - S8000539, CVE-2013-0431: Introspect JMX data handling - S8000540, CVE-2013-1475: Improve IIOP type reuse management - S8000631, CVE-2013-1476: Restrict access to class constructor - S8001235, CVE-2013-0434: Improve JAXP HTTP handling - S8001242: Improve RMI HTTP conformance - S8001307: Modify ACC_SUPER behavior - S8001972, CVE-2013-1478: Improve image processing - S8002325, CVE-2013-1480: Improve management of images * Backports - S7057320: test/java/util/concurrent/Executors/AutoShutdown.java failing intermittently - S7083664: TEST_BUG: test hard code of using c:/temp but this dir might not exist - S7107613: scalability blocker in javax.crypto.CryptoPermissions - S7107616: scalability blocker in javax.crypto.JceSecurityManager - S7146424: Wildcard expansion for single entry classpath - S7160609: [macosx] JDK crash in libjvm.dylib ( C [GeForceGLDriver+0x675a] gldAttachDrawable+0x941) - S7160951: [macosx] ActionListener called twice for JMenuItem using ScreenMenuBar - S7162488: VM not printing unknown -XX options - S7169395: Exception throws due to the changes in JDK 7 object tranversal and break backward compatibility - S7175616: Port fix for TimeZone from JDK 8 to JDK 7 - S7176485: (bf) Allow temporary buffer cache to grow to IOV_MAX - S7179908: Fork hs23.3 hsx from hs22.2 for jdk7u7 and reinitialize build number - S7184326: TEST_BUG: java/awt/Frame/7024749/bug7024749.java has a typo - S7185245: Licensee source bundle tries to compile JFR - S7185471: Avoid key expansion when AES cipher is re-init w/ the same key - S7186371: [macosx] Main menu shortcuts not displayed (7u6 regression) - S7187834: [macosx] Usage of private API in macosx 2d implementation causes Apple Store rejection - S7188114: (launcher) need an alternate command line parser for Windows - S7189136: Fork hs23.5 hsx from hs23.4 for jdk7u9 and reinitialize build number - S7189350: Fix failed for CR 7162144 - S7190550: REGRESSION: Some closed/com/oracle/jfr/api tests fail to compile becuse of fix 7185245 - S7193219: JComboBox serialization fails in JDK 1.7 - S7193977: REGRESSION:Java 7's JavaBeans persistence ignoring the "transient" flag on properties - S7195106: REGRESSION : There is no way to get Icon inf, once Softreference is released - S7195301: XML Signature DOM implementation should not use instanceof to determine type of Node - S7195931: UnsatisfiedLinkError on PKCS11.C_GetOperationState while using NSS from jre7u6+ - S7197071: Makefiles for various security providers aren't including the default manifest. - S7197652: Impossible to run any signed JNLP applications or applets, OCSP off by default - S7198146: Another new regression test does not compile on windows-amd64 - S7198570: (tz) Support tzdata2012f - S7198640: new hotspot build - hs23.6-b04 - S7199488: [TEST] runtime/7158800/InternTest.java failed due to false-positive on PID match. - S7199645: Increment build # of hs23.5 to b02 - S7199669: Update tags in .hgtags file for CPU release rename - S7200720: crash in net.dll during NTLM authentication - S7200742: (se) Selector.select does not block when starting Coherence (sol11u1) - S7200762: [macosx] Stuck in sun.java2d.opengl.CGLGraphicsConfig.getMaxTextureSize(Native Method) - S8000285: Deadlock between PostEventQueue.noEvents, EventQueue.isDispatchThread and SwingUtilities.invokeLater - S8000286: [macosx] Views keep scrolling back to the drag position after DnD - S8000297: REGRESSION: closed/java/awt/EventQueue/PostEventOrderingTest.java fails - S8000307: Jre7cert: focusgained does not get called for all focus req when do alt + tab - S8000822: Fork hs23.7 hsx from hs23.6 for jdk7u11 and reinitialize build number - S8001124: jdk7u ProblemList.txt updates (10/2012) - S8001242: Improve RMI HTTP conformance - S8001808: Create a test for 8000327 - S8001876: Create regtest for 8000283 - S8002068: Build broken: corba code changes unable to use new JDK 7 classes - S8002091: tools/launcher/ToolsOpts.java test started to fail since 7u11 b01 on Windows - S8002114: fix failed for JDK-7160951: [macosx] ActionListener called twice for JMenuItem using ScreenMenuBar - S8002225: (tz) Support tzdata2012i - S8003402: (dc) test/java/nio/channels/DatagramChannel/SendToUnresovled.java failing after 7u11 cleanup issues - S8003403: Test ShortRSAKeyWithinTLS and ClientJSSEServerJSSE failing after 7u11 cleanup - S8003948: NTLM/Negotiate authentication problem - S8004175: Restricted packages added in java.security are missing in java.security-{macosx, solaris, windows} - S8004302: javax/xml/soap/Test7013971.java fails since jdk6u39b01 - S8004341: Two JCK tests fails with 7u11 b06 - S8005615: Java Logger fails to load tomcat logger implementation (JULI) * Bug fixes - Fix build using Zero's HotSpot so all patches apply again. - PR1295: jamvm parallel unpack failure * removed icedtea-2.3.2-fix-extract-jamvm-dependency.patch - removed icedtea-2.3.3-refresh-6924259-string_offset.patch - few missing /openjdk/%{origin}/ changes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-165 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.6-3.26.1 java-1_7_0-openjdk-debuginfo-1.7.0.6-3.26.1 java-1_7_0-openjdk-debugsource-1.7.0.6-3.26.1 java-1_7_0-openjdk-demo-1.7.0.6-3.26.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.6-3.26.1 java-1_7_0-openjdk-devel-1.7.0.6-3.26.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.6-3.26.1 java-1_7_0-openjdk-javadoc-1.7.0.6-3.26.1 java-1_7_0-openjdk-src-1.7.0.6-3.26.1 References: http://support.novell.com/security/cve/CVE-2013-0424.html http://support.novell.com/security/cve/CVE-2013-0425.html http://support.novell.com/security/cve/CVE-2013-0426.html http://support.novell.com/security/cve/CVE-2013-0427.html http://support.novell.com/security/cve/CVE-2013-0428.html http://support.novell.com/security/cve/CVE-2013-0429.html http://support.novell.com/security/cve/CVE-2013-0431.html http://support.novell.com/security/cve/CVE-2013-0432.html http://support.novell.com/security/cve/CVE-2013-0433.html http://support.novell.com/security/cve/CVE-2013-0434.html http://support.novell.com/security/cve/CVE-2013-0435.html http://support.novell.com/security/cve/CVE-2013-0440.html http://support.novell.com/security/cve/CVE-2013-0441.html http://support.novell.com/security/cve/CVE-2013-0442.html http://support.novell.com/security/cve/CVE-2013-0443.html http://support.novell.com/security/cve/CVE-2013-0444.html http://support.novell.com/security/cve/CVE-2013-0450.html http://support.novell.com/security/cve/CVE-2013-1475.html http://support.novell.com/security/cve/CVE-2013-1476.html http://support.novell.com/security/cve/CVE-2013-1478.html http://support.novell.com/security/cve/CVE-2013-1480.html https://bugzilla.novell.com/803379

1 0

openSUSE-SU-2013:0376-1: moderate: ruby19 to 1.9.3 p385
by opensuse-security＠opensuse.org 01 Mar '13

01 Mar '13

openSUSE Security Update: ruby19 to 1.9.3 p385 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0376-1 Rating: moderate References: #783511 #789983 #791199 #802406 Cross-References: CVE-2012-4464 CVE-2012-4466 CVE-2012-4522 CVE-2012-5371 CVE-2013-0256 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: ruby19 was updated to fix various bugs and security issues: Update to 1.9.3 p385 (bnc#802406) - XSS exploit of RDoc documentation generated by rdoc (CVE-2013-0256) - for other changes see /usr/share/doc/packages/ruby19/Changelog Update to 1.9.3 p327 (bnc#789983) - CVE-2012-5371 and plenty of other fixes Update to 1.9.3 p286 (bnc#783511, bnc#791199) - This release includes some security fixes, and many other bug fixes. $SAFE escaping vulnerability about Exception#to_s / NameError#to_s (CVE-2012-4464, CVE-2012-4466) - Unintentional file creation caused by inserting an illegal NUL character many other bug fixes. (CVE-2012-4522) Also following bugfixes and packaging fixes were done: - make sure the rdoc output is more stable for build-compare (new patch ruby-sort-rdoc-output.patch) - readd the private header *atomic.h - remove build depencency on ca certificates - only causing cycles - one more header needed for rubygem-ruby-debug-base19 - install vm_core.h and its dependencies as ruby-devel-extra - move the provides to the ruby package instead - add provides for the internal gems - restore the old ruby macros and the gem wrapper script - gem_install_wrapper no longer necessary Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-167 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): ruby19-1.9.3.p385-3.18.1 ruby19-debuginfo-1.9.3.p385-3.18.1 ruby19-debugsource-1.9.3.p385-3.18.1 ruby19-devel-1.9.3.p385-3.18.1 ruby19-devel-extra-1.9.3.p385-3.18.1 ruby19-tk-1.9.3.p385-3.18.1 ruby19-tk-debuginfo-1.9.3.p385-3.18.1 - openSUSE 12.2 (noarch): ruby19-doc-ri-1.9.3.p385-3.18.1 References: http://support.novell.com/security/cve/CVE-2012-4464.html http://support.novell.com/security/cve/CVE-2012-4466.html http://support.novell.com/security/cve/CVE-2012-4522.html http://support.novell.com/security/cve/CVE-2012-5371.html http://support.novell.com/security/cve/CVE-2013-0256.html https://bugzilla.novell.com/783511 https://bugzilla.novell.com/789983 https://bugzilla.novell.com/791199 https://bugzilla.novell.com/802406

1 0

openSUSE-SU-2013:0375-1: important: java-1_6_0-openjdk: update to icedtea 1.12.3
by opensuse-security＠opensuse.org 01 Mar '13

01 Mar '13

openSUSE Security Update: java-1_6_0-openjdk: update to icedtea 1.12.3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0375-1 Rating: important References: #804654 Cross-References: CVE-2013-0169 CVE-2013-1486 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_6_0-openjdk was updated to IcedTea 1.12.3 (bnc#804654) containing security and bugfixes: * Security fixes - S8006446: Restrict MBeanServer access (CVE-2013-1486) - S8006777: Improve TLS handling of invalid messages Lucky 13 (CVE-2013-0169) - S8007688: Blacklist known bad certificate (issued by DigiCert) * Backports - S8007393: Possible race condition after JDK-6664509 - S8007611: logging behavior in applet changed * Bug fixes - PR1319: Support GIF lib v5. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-164 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-debuginfo-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-debugsource-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-demo-debuginfo-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-devel-debuginfo-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b27.1.12.3-28.1 java-1_6_0-openjdk-src-1.6.0.0_b27.1.12.3-28.1 References: http://support.novell.com/security/cve/CVE-2013-0169.html http://support.novell.com/security/cve/CVE-2013-1486.html https://bugzilla.novell.com/804654

1 0

openSUSE-SU-2013:0374-1: moderate: rubygem-devise: updated to version 1.5.4
by opensuse-security＠opensuse.org 01 Mar '13

01 Mar '13

openSUSE Security Update: rubygem-devise: updated to version 1.5.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0374-1 Rating: moderate References: #800955 Cross-References: CVE-2013-0233 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rubygem-devise was updated to version 1.5.4 fixing bugs and security issue: * wrong records may be read when sending specifically crafted requests (bnc#800955) (CVE-2013-0233) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-166 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): rubygem-devise-1.5.4-2.4.1 rubygem-devise-doc-1.5.4-2.4.1 rubygem-devise-testsuite-1.5.4-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-0233.html https://bugzilla.novell.com/800955

1 0