March 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:0532-1: moderate: almanah: encrypt database when app closes
by opensuse-security＠opensuse.org 25 Mar '13

25 Mar '13

openSUSE Security Update: almanah: encrypt database when app closes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0532-1 Rating: moderate References: #809140 Cross-References: CVE-2013-1853 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Almanah was updated to encrypt the database when the application closes. (bgo#695117, bnc#809140, CVE-2013-1853). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-241 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): almanah-0.10.1-2.4.1 almanah-debuginfo-0.10.1-2.4.1 almanah-debugsource-0.10.1-2.4.1 - openSUSE 12.3 (noarch): almanah-lang-0.10.1-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1853.html https://bugzilla.novell.com/809140

1 0

openSUSE-RU-2013:0531-1: nagios: Update to version 3.5.0
by maintenance＠opensuse.org 25 Mar '13

25 Mar '13

openSUSE Recommended Update: nagios: Update to version 3.5.0 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0531-1 Rating: low References: #809180 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for nagios: - bnc#809180: - adapt static html pages to reflect the current version - update to 3.5.0: + The "configuration" page of the webui doesn't use entity encoding when displaying the "command expansion" item + Nagios Core 3.4.4 seg fault (core dump) on restart after removing config for running service + Updated CGI utility functions to support UTF-8 characters + Fixed bug where selecting Command Expansion from Configuration CGI page would display commands instead + status.cgi crashes with segfault when there are german ulauts (äöüß) in the hostname or the servicename + Scheduled Downtime Notifications Resent On Nagios Restart/reload - provide monitoring_daemon in the init script to allow other init scripts to depend on it Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-248 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): nagios-3.5.0-2.6.1 nagios-debuginfo-3.5.0-2.6.1 nagios-debugsource-3.5.0-2.6.1 nagios-devel-3.5.0-2.6.1 nagios-www-3.5.0-2.6.1 nagios-www-dch-3.5.0-2.6.1 nagios-www-debuginfo-3.5.0-2.6.1 - openSUSE 12.3 (noarch): nagios-rpm-macros-0.06-2.4.1 References: https://bugzilla.novell.com/809180

1 0

openSUSE-RU-2013:0530-1: nagios: Update to 3.5.0 and several fixes
by maintenance＠opensuse.org 25 Mar '13

25 Mar '13

openSUSE Recommended Update: nagios: Update to 3.5.0 and several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0530-1 Rating: low References: #809180 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues for nagios: - bnc#809180: - adapt static html pages to reflect the current version - update to 3.5.0: + The "configuration" page of the webui doesn't use entity encoding when displaying the "command expansion" item + Nagios Core 3.4.4 seg fault (core dump) on restart after removing config for running service + Updated CGI utility functions to support UTF-8 characters + Fixed bug where selecting Command Expansion from Configuration CGI page would display commands instead + status.cgi crashes with segfault when there are german ulauts (äöüß) in the hostname or the servicename + Scheduled Downtime Notifications Resent On Nagios Restart/reload - provide 'monitoring_daemon' in the init script to allow other init scripts to depend on it - update to 3.4.4: + service checks get duplicated on reload + Added NULL pointer checks to CGI code. + Fixed buffer overflow vulnerability in CGI code. - refreshed patches - added new subpackage nagios-www-dch (don't call home): + add plain html pages to allow users to disable PHP and loading of external references + re-added documentation (no external link any more) - use new rpm macros for basic user-/groupadd commands: %%nagios_user_group_add, %%nagios_command_user_group_add - update to 3.4.3: + Applied fix for pagination and sorting on status.cgi + Fixed issue where deleting a downtime could cause Nagios to crash + Corrected logic so that end times for flexible downtimes are calculated from the downtime start rather than the current time in the case where Nagios is restarted + Fixed issue introduced by fix for bug #124 where flexible downtimes are not taken into account on Nagios restart. + If a service reports no performance data, the perfdata log file has no line indicating the test. + Fixed link for unhandled unreachable host problems on tactical overview page + Fixed bug #345 with wild card searches not paging properly on status.cgi + Fixed bug #343 on status.cgi where Service Group Summary can potentially show wrong totals + Fixed memory leaks on SIGHUP - refreshed patches - just require php not php5 to allow a switch to php53 - do not compress logfiles per default to allow searching via webinterface - init script now uses daemonchk.cgi to check for status (if present) - Use usermod instead of groupmod when suse_version > 1220 due to pwdutils/shadow switch. - Fix useradd invocation: -o is useless without -u and newer versions of pwdutils/shadowutils fail on this now. - add virtual provides 'monitoring_daemon' and 'monitoring_webfrontend' to allow 3rd party packages to run also with compatible solutions like icinga Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-249 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): nagios-3.5.0-2.15.1 nagios-debuginfo-3.5.0-2.15.1 nagios-debugsource-3.5.0-2.15.1 nagios-devel-3.5.0-2.15.1 nagios-www-3.5.0-2.15.1 nagios-www-dch-3.5.0-2.15.1 nagios-www-debuginfo-3.5.0-2.15.1 - openSUSE 12.2 (noarch): nagios-rpm-macros-0.06-2.8.1 References: https://bugzilla.novell.com/809180

1 0

openSUSE-RU-2013:0529-1: cdemu: Update to 2.0.0
by maintenance＠opensuse.org 25 Mar '13

25 Mar '13

openSUSE Recommended Update: cdemu: Update to 2.0.0 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0529-1 Rating: low References: #809181 #809862 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues for cdemu-client, cdemu-daemon and libmirage: - tracker bnc#809862 - cdemu-client: + changed packaging-format from bz2 to xz - cdemu-daemon: + Update to new upstream release 2.0.0 (up from 1.5.0) * Support for ISZ, CSO, DMG, GBI, ECM, gzip and xz formats * Partial support for 1-track MDX + bnc#809181: Resolves a problem with autostarting cdemu-daemon - libmirage: + bnc#809181: resolve excess CPU usage during CDDA readout + make images created by readcd(1) usable again + Update to new upstream release 2.0.0 (up from 1.5.0) * Added ISZ, CSO and DMG file filters * Converted DAA parser to a file filter and added support for the related GBI format * Converted audio fragment to a file filter * Added file filter machinery and converted existing code to use it * Image analyzer displays disc structures * Added support for gobject introspection * Added support for GZIP and XZ compressed images * Added support for ECM'ed files * Improved CIF parser * Partial support for (one track) MDX images * Improved GVFS support Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-244 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): cdemu-daemon-2.0.0-5.5.1 cdemu-daemon-debuginfo-2.0.0-5.5.1 cdemu-daemon-debugsource-2.0.0-5.5.1 libmirage-2_0-2.0.0-4.5.1 libmirage-2_0-debuginfo-2.0.0-4.5.1 libmirage-debugsource-2.0.0-4.5.1 libmirage-devel-2.0.0-4.5.1 libmirage7-2.0.0-4.5.1 libmirage7-debuginfo-2.0.0-4.5.1 typelib-1_0-libmirage-2_0-2.0.0-4.5.1 - openSUSE 12.3 (noarch): cdemu-client-2.0.0-2.4.1 libmirage-data-2.0.0-4.5.1 References: https://bugzilla.novell.com/809181 https://bugzilla.novell.com/809862

1 0

openSUSE-RU-2013:0528-1: cdemu: Update to 2.0.0
by maintenance＠opensuse.org 25 Mar '13

25 Mar '13

openSUSE Recommended Update: cdemu: Update to 2.0.0 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0528-1 Rating: low References: #809181 #809862 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This udpate fixes the following issues for libmirage, cdemu-daemon and cdemu-client: (tracker bnc#809862) - cdemu-client: + Update to new upstream release 2.0.0 (up from 1.5.0) * Support for ISZ, CSO, DMG, GBI, ECM, gzip and xz formats * Partial support for 1-track MDX - cdemu-daemon: + Update to new upstream release 2.0.0 (up from 1.5.0) * Support for ISZ, CSO, DMG, GBI, ECM, gzip and xz formats * Partial support for 1-track MDX + bnc#809181: Resolves a problem with autostarting cdemu-daemon + Remove cdemud-launch helper, this caused too much confusion - libmirage: + bnc#809181: resolve excess CPU usage during CDDA readout + make images created by readcd(1) usable again + Update to new upstream release 2.0.0 (up from 1.5.0) * Added ISZ, CSO and DMG file filters * Converted DAA parser to a file filter and added support for the related GBI format * Converted audio fragment to a file filter * Added file filter machinery and converted existing code to use it * Image analyzer displays disc structures * Added support for gobject introspection * Added support for GZIP and XZ compressed images * Added support for ECM'ed files * Improved CIF parser * Partial support for (one track) MDX images * Improved GVFS support Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-245 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): cdemu-daemon-2.0.0-2.5.1 cdemu-daemon-debuginfo-2.0.0-2.5.1 cdemu-daemon-debugsource-2.0.0-2.5.1 libmirage-2_0-2.0.0-2.5.1 libmirage-2_0-debuginfo-2.0.0-2.5.1 libmirage-debugsource-2.0.0-2.5.1 libmirage-devel-2.0.0-2.5.1 libmirage7-2.0.0-2.5.1 libmirage7-debuginfo-2.0.0-2.5.1 typelib-1_0-libmirage-2_0-2.0.0-2.5.1 - openSUSE 12.2 (noarch): cdemu-client-2.0.0-2.5.1 libmirage-data-2.0.0-2.5.1 References: https://bugzilla.novell.com/809181 https://bugzilla.novell.com/809862

1 0

openSUSE-RU-2013:0527-1: octave: Fix native graphics support
by maintenance＠opensuse.org 25 Mar '13

25 Mar '13

openSUSE Recommended Update: octave: Fix native graphics support ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0527-1 Rating: low References: #808530 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues for octave: - bnc#808530: Fix native graphics support Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-247 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): octave-3.6.3-4.4.2 octave-debuginfo-3.6.3-4.4.2 octave-debugsource-3.6.3-4.4.2 octave-devel-3.6.3-4.4.2 References: https://bugzilla.novell.com/808530

1 0

openSUSE-RU-2013:0526-1: moderate: polkit-default-privs: move default rules to '90'
by maintenance＠opensuse.org 25 Mar '13

25 Mar '13

openSUSE Recommended Update: polkit-default-privs: move default rules to '90' ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0526-1 Rating: moderate References: #807097 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for polkit-default-privs: - bnc#807097: move default rules to '90' Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-246 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): polkit-default-privs-12.3-6.15.1 References: https://bugzilla.novell.com/807097

1 0

openSUSE-SU-2013:0524-1: moderate: nss-pam-ldapd: fixed FD_SET overflow
by opensuse-security＠opensuse.org 22 Mar '13

22 Mar '13

openSUSE Security Update: nss-pam-ldapd: fixed FD_SET overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0524-1 Rating: moderate References: #804682 Cross-References: CVE-2013-0288 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: nss-pam-ldap was updated to fix a FD_SET overflow, happening when more than 1024 filedescriptors are opened. (CVE-2013-0288) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-48 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): nss-pam-ldapd-0.7.13-6.1 nss-pam-ldapd-debuginfo-0.7.13-6.1 nss-pam-ldapd-debugsource-0.7.13-6.1 - openSUSE 11.4 (x86_64): nss-pam-ldapd-32bit-0.7.13-6.1 nss-pam-ldapd-debuginfo-32bit-0.7.13-6.1 - openSUSE 11.4 (ia64): nss-pam-ldapd-debuginfo-x86-0.7.13-6.1 nss-pam-ldapd-x86-0.7.13-6.1 References: http://support.novell.com/security/cve/CVE-2013-0288.html https://bugzilla.novell.com/804682

1 0

openSUSE-SU-2013:0523-1: moderate: krb5: security fix for PKINIT plugin
by opensuse-security＠opensuse.org 22 Mar '13

22 Mar '13

openSUSE Security Update: krb5: security fix for PKINIT plugin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0523-1 Rating: moderate References: #806715 Cross-References: CVE-2013-1415 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: krb5 was updated to fix a security issues in PKINIT: - fix PKINIT null pointer deref (CVE-2013-1415 bnc#806715) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-47 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): krb5-1.8.3-55.1 krb5-client-1.8.3-55.1 krb5-client-debuginfo-1.8.3-55.1 krb5-debuginfo-1.8.3-55.1 krb5-debugsource-1.8.3-55.1 krb5-devel-1.8.3-55.1 krb5-plugin-kdb-ldap-1.8.3-55.1 krb5-plugin-kdb-ldap-debuginfo-1.8.3-55.1 krb5-plugin-preauth-pkinit-1.8.3-55.1 krb5-plugin-preauth-pkinit-debuginfo-1.8.3-55.1 krb5-server-1.8.3-55.1 krb5-server-debuginfo-1.8.3-55.1 - openSUSE 11.4 (x86_64): krb5-32bit-1.8.3-55.1 krb5-debuginfo-32bit-1.8.3-55.1 krb5-devel-32bit-1.8.3-55.1 - openSUSE 11.4 (ia64): krb5-debuginfo-x86-1.8.3-55.1 krb5-x86-1.8.3-55.1 References: http://support.novell.com/security/cve/CVE-2013-1415.html https://bugzilla.novell.com/806715

1 0

openSUSE-SU-2013:0522-2: moderate: nss-pam-ldapd: fixed FD_SET overflow
by opensuse-security＠opensuse.org 22 Mar '13

22 Mar '13

openSUSE Security Update: nss-pam-ldapd: fixed FD_SET overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0522-2 Rating: moderate References: #804682 Cross-References: CVE-2013-0288 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: nss-pam-ldap was updated to fix a FD_SET overflow, happening when more than 1024 filedescriptors are opened. (CVE-2013-0288) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-240 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): nss-pam-ldapd-0.8.10-2.5.1 nss-pam-ldapd-debuginfo-0.8.10-2.5.1 nss-pam-ldapd-debugsource-0.8.10-2.5.1 - openSUSE 12.3 (x86_64): nss-pam-ldapd-32bit-0.8.10-2.5.1 nss-pam-ldapd-debuginfo-32bit-0.8.10-2.5.1 References: http://support.novell.com/security/cve/CVE-2013-0288.html https://bugzilla.novell.com/804682

1 0