March 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2013:0521-2: pidgin-otr: release for pidgin version update
by maintenance＠opensuse.org 22 Mar '13

22 Mar '13

openSUSE Recommended Update: pidgin-otr: release for pidgin version update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0521-2 Rating: low References: #806975 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: pidgin-otr was updated to match the pidgin version update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-239 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): pidgin-otr-4.0.0-2.4.1 pidgin-otr-debuginfo-4.0.0-2.4.1 pidgin-otr-debugsource-4.0.0-2.4.1 References: https://bugzilla.novell.com/806975

1 0

openSUSE-SU-2013:0522-1: moderate: nss-pam-ldapd: fixed FD_SET overflow
by opensuse-security＠opensuse.org 22 Mar '13

22 Mar '13

openSUSE Security Update: nss-pam-ldapd: fixed FD_SET overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0522-1 Rating: moderate References: #804682 Cross-References: CVE-2013-0288 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: nss-pam-ldap was updated to fix a FD_SET overflow, happening when more than 1024 filedescriptors are opened. (CVE-2013-0288) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-240 - openSUSE 12.1: zypper in -t patch openSUSE-2013-240 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): nss-pam-ldapd-0.7.13-11.5.1 nss-pam-ldapd-debuginfo-0.7.13-11.5.1 nss-pam-ldapd-debugsource-0.7.13-11.5.1 - openSUSE 12.2 (x86_64): nss-pam-ldapd-32bit-0.7.13-11.5.1 nss-pam-ldapd-debuginfo-32bit-0.7.13-11.5.1 - openSUSE 12.1 (i586 x86_64): nss-pam-ldapd-0.7.13-8.5.1 nss-pam-ldapd-debuginfo-0.7.13-8.5.1 nss-pam-ldapd-debugsource-0.7.13-8.5.1 - openSUSE 12.1 (x86_64): nss-pam-ldapd-32bit-0.7.13-8.5.1 nss-pam-ldapd-debuginfo-32bit-0.7.13-8.5.1 - openSUSE 12.1 (ia64): nss-pam-ldapd-debuginfo-x86-0.7.13-8.5.1 nss-pam-ldapd-x86-0.7.13-8.5.1 References: http://support.novell.com/security/cve/CVE-2013-0288.html https://bugzilla.novell.com/804682

1 0

openSUSE-RU-2013:0521-1: pidgin-otr: release for pidgin version update
by maintenance＠opensuse.org 22 Mar '13

22 Mar '13

openSUSE Recommended Update: pidgin-otr: release for pidgin version update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0521-1 Rating: low References: #806975 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: pidgin-otr was updated to match the pidgin version update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-239 - openSUSE 12.1: zypper in -t patch openSUSE-2013-239 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): pidgin-otr-3.2.1-2.4.1 pidgin-otr-debuginfo-3.2.1-2.4.1 pidgin-otr-debugsource-3.2.1-2.4.1 - openSUSE 12.1 (i586 x86_64): pidgin-otr-3.2.0-151.8.1 pidgin-otr-debuginfo-3.2.0-151.8.1 pidgin-otr-debugsource-3.2.0-151.8.1 References: https://bugzilla.novell.com/806975

1 0

openSUSE-SU-2013:0518-1: moderate: telepathy-gabble: fixed a remote denial of service
by opensuse-security＠opensuse.org 22 Mar '13

22 Mar '13

openSUSE Security Update: telepathy-gabble: fixed a remote denial of service ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0518-1 Rating: moderate References: #807449 Cross-References: CVE-2013-1769 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: telepathy-gabble was updated to fix a remote denial of service attack using NULL ptr dereferences during hashing. (CVE-2013-1769). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-238 - openSUSE 12.2: zypper in -t patch openSUSE-2013-238 - openSUSE 12.1: zypper in -t patch openSUSE-2013-238 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): telepathy-gabble-0.17.1-2.4.1 telepathy-gabble-debuginfo-0.17.1-2.4.1 telepathy-gabble-debugsource-0.17.1-2.4.1 telepathy-gabble-xmpp-console-0.17.1-2.4.1 telepathy-gabble-xmpp-console-debuginfo-0.17.1-2.4.1 - openSUSE 12.2 (i586 x86_64): telepathy-gabble-0.16.0-3.4.1 telepathy-gabble-debuginfo-0.16.0-3.4.1 telepathy-gabble-debugsource-0.16.0-3.4.1 telepathy-gabble-xmpp-console-0.16.0-3.4.1 telepathy-gabble-xmpp-console-debuginfo-0.16.0-3.4.1 - openSUSE 12.1 (i586 x86_64): telepathy-gabble-0.13.7-2.4.1 telepathy-gabble-debuginfo-0.13.7-2.4.1 telepathy-gabble-debugsource-0.13.7-2.4.1 telepathy-gabble-doc-0.13.7-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1769.html https://bugzilla.novell.com/807449

1 0

openSUSE-RU-2013:0515-1: moderate: pidgin-branding-openSUSE: update to match the current pidgin version
by maintenance＠opensuse.org 21 Mar '13

21 Mar '13

openSUSE Recommended Update: pidgin-branding-openSUSE: update to match the current pidgin version ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0515-1 Rating: moderate References: #804742 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The pidgin branding was updated to match the last pidgin version update(bnc#804742). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-236 - openSUSE 12.2: zypper in -t patch openSUSE-2013-236 - openSUSE 12.1: zypper in -t patch openSUSE-2013-236 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): libpurple-branding-openSUSE-12.2-4.4.1 - openSUSE 12.2 (noarch): libpurple-branding-openSUSE-12.2-2.4.1 - openSUSE 12.1 (noarch): libpurple-branding-openSUSE-12.1-4.5.1 References: https://bugzilla.novell.com/804742

1 0

openSUSE-RU-2013:0514-1: freeradius-server: fixed a bug in the logrotate script
by maintenance＠opensuse.org 21 Mar '13

21 Mar '13

openSUSE Recommended Update: freeradius-server: fixed a bug in the logrotate script ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0514-1 Rating: low References: #797292 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for freeradius-server: - bnc#797292: fixed a bug in the logrotate script Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-234 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): freeradius-server-2.2.0-3.4.1 freeradius-server-debuginfo-2.2.0-3.4.1 freeradius-server-debugsource-2.2.0-3.4.1 freeradius-server-devel-2.2.0-3.4.1 freeradius-server-dialupadmin-2.2.0-3.4.1 freeradius-server-doc-2.2.0-3.4.1 freeradius-server-libs-2.2.0-3.4.1 freeradius-server-libs-debuginfo-2.2.0-3.4.1 freeradius-server-utils-2.2.0-3.4.1 freeradius-server-utils-debuginfo-2.2.0-3.4.1 References: https://bugzilla.novell.com/797292

1 0

openSUSE-RU-2013:0513-1: xtrabackup: Update to 2.0.5 and fixed path of MySQL 5.5 xtrabackup binary
by maintenance＠opensuse.org 21 Mar '13

21 Mar '13

openSUSE Recommended Update: xtrabackup: Update to 2.0.5 and fixed path of MySQL 5.5 xtrabackup binary ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0513-1 Rating: low References: Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues for xtrabackup: - bnc#809505: fix path of MySQL 5.5 xtrabackup binary - update to 2.0.5 - new features: + New option --defaults-extra-file to read options before the standard defaults-file, e.g. for separate username/passwords crontab or a script somewhere in the system. - bugs fixed: + In case of streaming backups, innobackupex would resume the XtraBackup process and then wait for it to finish before running UNLOCK TABLES. This caused database to be unnecessarily locked with FLUSH TABLES WITH READ LOCK. Innobackupex now waits only till log copying is finished to unlock the databases. + innobackupex error messages referencing the data directory have been extended to show the path of the data directory mentioned in the error message. + Partitioned tables were not correctly handled by the --databases, --include, --tables-file options of innobackupex, and by the --tables and --tables-file options of XtraBackup. + When built-in compression was used, XtraBackup was doing unbuffered writes to the destination file or stream in very small chunks which in return caused inefficient I/O. + Unnecessary long sleep() in innobackupex lead to FLUSH TABLES WITH READ LOCK taking too long. + If innobackupex would crash it would leave the xtrabackup_suspended file on the filesystem. This could then cause innobackupex to think XtraBackup has suspended itself the moment it started, and then when XtraBackup actually does suspend itself, innobackupex would wait for it to end and wouldn’t re-remove the suspend file, leading to a wait deadlock. + innobackupex would fail to recognize MariaDB 5.2 and MariaDB 5.3 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-233 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): xtrabackup-2.0.5-2.4.1 xtrabackup-debuginfo-2.0.5-2.4.1 xtrabackup-debugsource-2.0.5-2.4.1 References:

1 0

openSUSE-RU-2013:0512-1: moderate: nss_ldap: ldap.conf is now part of nss_ldap since pwdutils was dropped
by maintenance＠opensuse.org 21 Mar '13

21 Mar '13

openSUSE Recommended Update: nss_ldap: ldap.conf is now part of nss_ldap since pwdutils was dropped ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0512-1 Rating: moderate References: #809245 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues for nss_ldap: - bnc#809245: ldap.conf is now part of nss_ldap since pwdutils was dropped - removed no longer needed %post scriptlet Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-235 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): nss_ldap-265-19.5.1 nss_ldap-debuginfo-265-19.5.1 nss_ldap-debugsource-265-19.5.1 - openSUSE 12.3 (x86_64): nss_ldap-32bit-265-19.5.1 nss_ldap-debuginfo-32bit-265-19.5.1 References: https://bugzilla.novell.com/809245

1 0

openSUSE-SU-2013:0511-1: important: pidgin: 2.10.7 update to fix security issues and bugs
by opensuse-security＠opensuse.org 21 Mar '13

21 Mar '13

openSUSE Security Update: pidgin: 2.10.7 update to fix security issues and bugs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0511-1 Rating: important References: #804742 #806975 Cross-References: CVE-2013-0271 CVE-2013-0272 CVE-2013-0273 CVE-2013-0274 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Pidgin was updated to 2.10.7 to fix various security issues and the bug that IRC did not work at all in 12.3. Changes: - Add pidgin-irc-sasl.patch: link irc module to SASL. Allows the IRC module to be loaded (bnc#806975). - Update to version 2.10.7 (bnc#804742): + Alien hatchery: - No changes + General: - The configure script will now exit with status 1 when specifying invalid protocol plugins using the --with-static-prpls and --with-dynamic-prpls arguments. (pidgin.im#15316) + libpurple: - Fix a crash when receiving UPnP responses with abnormally long values. (CVE-2013-0274) - Don't link directly to libgcrypt when building with GnuTLS support. (pidgin.im#15329) - Fix UPnP mappings on routers that return empty <URLBase/> elements in their response. (pidgin.im#15373) - Tcl plugin uses saner, race-free plugin loading. - Fix the Tcl signals-test plugin for savedstatus-changed. (pidgin.im#15443) + Pidgin: - Make Pidgin more friendly to non-X11 GTK+, such as MacPorts' +no_x11 variant. + Gadu-Gadu: - Fix a crash at startup with large contact list. Avatar support for buddies will be disabled until 3.0.0. (pidgin.im#15226, pidgin.im#14305) + IRC: - Support for SASL authentication. (pidgin.im#13270) - Print topic setter information at channel join. (pidgin.im#13317) + MSN: - Fix SSL certificate issue when signing into MSN for some users. - Fix a crash when removing a user before its icon is loaded. (pidgin.im#15217) + MXit: - Fix a bug where a remote MXit user could possibly specify a local file path to be written to. (CVE-2013-0271) - Fix a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution. (CVE-2013-0272) - Display farewell messages in a different colour to distinguish them from normal messages. - Add support for typing notification. - Add support for the Relationship Status profile attribute. - Remove all reference to Hidden Number. - Ignore new invites to join a GroupChat if you're already joined, or still have a pending invite. - The buddy's name was not centered vertically in the buddy-list if they did not have a status-message or mood set. - Fix decoding of font-size changes in the markup of received messages. - Increase the maximum file size that can be transferred to 1 MB. - When setting an avatar image, no longer downscale it to 96x96. + Sametime: - Fix a crash in Sametime when a malicious server sends us an abnormally long user ID. (CVE-2013-0273) + Yahoo!: - Fix a double-free in profile/picture loading code. (pidgin.im#15053) - Fix retrieving server-side buddy aliases. (pidgin.im#15381) + Plugins: - The Voice/Video Settings plugin supports using the sndio GStreamer backends. (pidgin.im#14414) - Fix a crash in the Contact Availability Detection plugin. (pidgin.im#15327) - Make the Message Notification plugin more friendly to non-X11 GTK+, such as MacPorts' +no_x11 variant. + Windows-Specific Changes: - Compile with secure flags (pidgin.im#15290) - Installer downloads GTK+ Runtime and Debug Symbols more securely. (pidgin.im#15277) - Updates to a number of dependencies, some of which have security related fixes. (pidgin.im#14571, pidgin.im#15285, pidgin.im#15286) . ATK 1.32.0-2 . Cyrus SASL 2.1.25 . expat 2.1.0-1 . freetype 2.4.10-1 . gettext 0.18.1.1-2 . Glib 2.28.8-1 . libpng 1.4.12-1 . libxml2 2.9.0-1 . NSS 3.13.6 and NSPR 4.9.2 . Pango 1.29.4-1 . SILC 1.1.10 . zlib 1.2.5-2 - Patch libmeanwhile (sametime library) to fix crash. (pidgin.im#12637) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-231 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): finch-2.10.7-4.4.1 finch-debuginfo-2.10.7-4.4.1 finch-devel-2.10.7-4.4.1 libpurple-2.10.7-4.4.1 libpurple-debuginfo-2.10.7-4.4.1 libpurple-devel-2.10.7-4.4.1 libpurple-meanwhile-2.10.7-4.4.1 libpurple-meanwhile-debuginfo-2.10.7-4.4.1 libpurple-tcl-2.10.7-4.4.1 libpurple-tcl-debuginfo-2.10.7-4.4.1 pidgin-2.10.7-4.4.1 pidgin-debuginfo-2.10.7-4.4.1 pidgin-debugsource-2.10.7-4.4.1 pidgin-devel-2.10.7-4.4.1 - openSUSE 12.3 (noarch): libpurple-branding-upstream-2.10.7-4.4.1 libpurple-lang-2.10.7-4.4.1 References: http://support.novell.com/security/cve/CVE-2013-0271.html http://support.novell.com/security/cve/CVE-2013-0272.html http://support.novell.com/security/cve/CVE-2013-0273.html http://support.novell.com/security/cve/CVE-2013-0274.html https://bugzilla.novell.com/804742 https://bugzilla.novell.com/806975

1 0

openSUSE-SU-2013:0510-1: moderate: typo3-cms-4_5/typo3-cms-4_6/typo3-cms-4_7: security and bugfix updates
by opensuse-security＠opensuse.org 21 Mar '13

21 Mar '13

openSUSE Security Update: typo3-cms-4_5/typo3-cms-4_6/typo3-cms-4_7: security and bugfix updates ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0510-1 Rating: moderate References: #808528 Cross-References: CVE-2013-1842 CVE-2013-1843 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The Typo3 CMS versions were updated to receive security and bug fixes. - Raised to version 4.5.25 * bugfix: External URL regression by jumpurl security fix (Helmut Hummel), t3#46071 - Raised to version 4.5.24 * Raise submodule pointer (TYPO3 Release Team) * security: Open redirection with jumpurl (Franz G. Jahn), t3#28587, bnc#808528, CVE-2013-1843 * bugfix: Check minitems for TCAtree (Georg Ringer), t3#25003 * bugfix: Keep hyphens in custom HTML5 attributes (Jigal van Hemert), t3#34371 * Revert "[BUGFIX] FE session records are never removed" (Oliver Hader), t3#45570 - security fix: Typo3 Extbase Framework SQL Injection, bnc#808528, CVE-2013-1842 - Raised to version 4.5.23 * Raise submodule pointer * bugfix: t3lib_iconWorks must check if array exists before using it, t3#24248 * bugfix: BE user switch impossible when in adminOnly mode, t3#32686 * bugfix: Excludefieds must exclude admin only tables, t3#34460 * bugfix: TypoLink: absolute urls when installed in subfolder, t3#33214 * Raise submodule pointer * bugfix: [Cache][PDO] Duplicate cache entry possible, t3#34129 * bugfix: IE9 compatibility clear cache menu, t3#36364 * bugfix: Hook call modifyDBRow in ContentContentObject, t3#44416 * bugfix: Fix misspelling in RTE meta menu, t3#43886 * bugfix: load TCA before manipulation, t3#38505 * DataHandler::getAutoVersionId() should be public, t3#45050 * bugfix: Load date-time picker in scheduler module, t3#31027 * bugfix: Quick Edit triggers warnings of missing key uid, t3#42845 * Raise submodule pointer * bugfix: Fix warnings in em on tab Maintenance, t3#39680 * bugfix: Correct TCA inclusion for uploads rendering, t3#44145 * bugfix: Update description on changed error reporting defaults, t3#38240 * bugfix: Fix typos in stdWrap_crop description, t3#43919 * bugfix: Apc Cache backend has side effects, t3#38135 * bugfix: Invalid call to t3lib_TCEmain::processRemapStack(), t3#44301 * Raise submodule pointer * bugfix: Suggest wizard is behind form inputs, t3#42092 * bugfix: phpdoc: $urlParameters can be a string, t3#44263 * bugfix: FE session records are never removed, t3#34964 * bugfix: INTincScript_loadJSCode() causes PHP warnings, t3#32278 * bugfix: Enable the RTE with WebKit version 534 on iOS and Android, t3#43603 * bugfix: Remove HTML in RuntimeException from sysext 'install', t3#38472 * bugfix: Fix wrong column title in web>list for field colpos, t3#25113 * bugfix: SqlParser: trim all kinds of whitespaces, t3#43470 * Remove typo3.pageModule.js, t3#43459 * bugfix: Installer: Reference images wrong, t3#42292 * bugfix: Page Information shows incorrect number of total hits, t3#41608 * bugfix: Old logo on "Install Tool is locked" page, t3#42908 * openid: Update php-openid to 2.2.2, t3#42236 * Group excludefields by table, t3#34098 * bugfix: Hide version selector if workspaces are used, t3#43264 * Raise submodule pointer - Raised verstion to 4.6.18 * bugfix: External URL regression by jumpurl security fix (Helmut Hummel), t3#46071 - Raised version to 4.6.17 * Raise submodule pointer (TYPO3 Release Team) * security: Open redirection with jumpurl (Franz G. Jahn), t3#28587, bnc#808528, CVE-2013-1843 - security fix: Typo3 Extbase Framework SQL Injection, bnc#808528, CVE-2013-1842 - Raised version to 4.6.16 * bugfix: L10n fallback does not work for TS labels, t3#44099 * bugfix: L10n fallback does not work for ExtJS in BE, t3#44273 * Raise submodule pointer * bugfix: Allow "en" as language key, t3#42084 * Raise submodule pointer * bugfix: [Cache][PDO] Duplicate cache entry possible, t3#34129 * bugfix: IE9 compatibility clear cache menu, t3#36364 * bugfix: Hook call modifyDBRow in ContentContentObject, t3#44416 * bugfix: Fix misspelling in RTE meta menu, t3#43886 * bugfix: load TCA before manipulation, t3#38505 * bugfix: add check for empty form values in FORM View, t3#28606 * DataHandler::getAutoVersionId() should be public, t3#45050 * bugfix: Quick Edit triggers warnings of missing key uid, t3#42845 * Raise submodule pointer * bugfix: Fix warnings in em on tab Maintenance, t3#39680 * bugfix: Correct TCA inclusion for uploads rendering, t3#44145 * bugfix: Update description on changed error reporting defaults, t3#38240 * bugfix: Fix typos in stdWrap_crop description, t3#43919 * bugfix: Apc Cache backend has side effects, t3#38135 * bugfix: Invalid call to t3lib_TCEmain::processRemapStack(), t3#44301 * Raise submodule pointer * bugfix: Suggest wizard is behind form inputs, t3#42092 * bugfix: phpdoc: $urlParameters can be a string, t3#44263 * bugfix: FE session records are never removed, t3#34964 * bugfix: INTincScript_loadJSCode() causes PHP warnings, t3#32278 * bugfix: Fix broken logo file in Install Tool, t3#43426 * bugfix: Remove HTML in RuntimeException from sysext 'install', t3#38472 * bugfix: Fix wrong column title in web>list for field colpos, t3#25113 * bugfix: SqlParser: trim all kinds of whitespaces, t3#43470 * Remove typo3.pageModule.js, t3#43459 * bugfix: Installer: Reference images wrong, t3#42292 * bugfix: Page Information shows incorrect number of total hits, t3#41608 * bugfix: Old logo on "Install Tool is locked" page, t3#42908 * bugfix: Form values with newlines escaped in email, t3#32515 * openid: Update php-openid to 2.2.2, t3#42236 * bugfix: Wizard in HTML element moved to t3editor, t3#33813 * bugfix: Livesearch toolbar should close others, t3#32890 * bugfix: Hide version selector if workspaces are used, t3#43264 * bugfix: Subject field in FormWizard, t3#35787 * Raise submodule pointer * bugfix: Invalid behavior of search for integer in Backend search, t3#33700 * fluid, bugfix: Unit test fails with broken timezone, t3#45285 * fluid, bugfix: Date ViewHelper not using configured Timezones, t3#12769 * fluid, bugfix: Fix typo and improve backup of system settings, t3#45218 * fluid, bugfix: Remove PHP Error caused by setlocale call, t3#45118 * fluid, bugfix: Incomplete locale backup in unit test, t3#44835 * fluid, bugfix: selectViewHelper sorting should respect locales, t3#43445 * fluid, bugfix: Image viewhelper clears $GLOBALS['TSFE'] in backend context, t3#43446 * fluid, bugfix: AbstractFormFieldViewHelper always converts entities, t3#34091 * linkvalidator, bugfix: SQL error in getLinkCounts, t3#43322 * version, bugfix: Catchable fatal error when using the swap button, t3#42948 - Raised to version 4.7.10 * bugfix: External URL regression by jumpurl security fix (Helmut Hummel), t3#46071 - Added rpmlintrc to suppress duplicated files warning. - Raised to version 4.7.9 * Raise submodule pointer (TYPO3 Release Team) * security: Open redirection with jumpurl (Franz G. Jahn), t3#28587, bnc#808528, CVE-2013-1843 * bugfix: Invalid RSA key when submitting form twice (Benjamin Mack), t3#40085 - security fix: Typo3 Extbase Framework SQL Injection, bnc#808528, CVE-2013-1842 - Raised to version 4.7.8 * bugfix: L10n fallback does not work for TS labels, t3#44099 * bugfix: L10n fallback does not work for ExtJS in BE, t3#44273 * Raise submodule pointer * bugix: Allow "en" as language key, t3#42084 * Raise submodule pointer * bugfix: [Cache][PDO] Duplicate cache entry possible, t3#34129 * bugfix: IE9 compatibility clear cache menu, t3#36364 * bugfix: Hook call modifyDBRow in ContentContentObject, t3#44416 * bugfix: Fix misspelling in RTE meta menu, t3#43886 * bugfix: load TCA before manipulation, t3#38505 * bugfix: add check for empty form values in FORM View, t3#28606 * DataHandler::getAutoVersionId() should be public, t3#45050 * bugfix: Possible warning in about module, t3#44892 * bugfix: Quick Edit triggers warnings of missing key uid, t3#42845 * Raise submodule pointer * bugfix: Fix warnings in em on tab Maintenance, t3#39680 * bugfix: EXT:felogin: Multiple bugs with preserveGETvars, t3#19938 * bugfix: Correct TCA inclusion for uploads rendering, t3#44145 * bugfix: array_merge_recursive_overrule: __UNSET for array values, t3#43874 * bugfix: Update description on changed error reporting defaults, t3#38240 * bugfix: Fix typos in stdWrap_crop description, t3#43919 * Add save only button to Scheduler task, t3#44152 * bugfix: Apc Cache backend has side effects, t3#38135 * bugfix: Invalid call to t3lib_TCEmain::processRemapStack(), t3#44301 * Raise submodule pointer * Suggest wizard is behind form inputs, t3#42092 * bugfix: phpdoc: $urlParameters can be a string, t3#44263 * bugfix: FE session records are never removed, t3#34964 * bugfix: INTincScript_loadJSCode() causes PHP warnings, t3#32278 * bugfix: Fix broken logo file in Install Tool, t3#43426 * bugfix: Enable the RTE with WebKit version 534 on iOS and Android, t3#43603 * bugfix: IE9 crashes after saving with RTE, t3#43766 * bugfix: Remove HTML in RuntimeException from sysext 'install', t3#38472 * bugfix: Compatibility fix for get_html_translation_table(), t3#39287 * bugfix: Fix wrong column title in web>list for field colpos, t3#25113 * bugfix: SqlParser: trim all kinds of whitespaces, t3#43470 * Remove typo3.pageModule.js, t3#43459 * bugfix: Installer: Reference images wrong, t3#42292 * bugfix: Page Information shows incorrect number of total hits, t3#41608 * bugfix: Old logo on "Install Tool is locked" page, t3#42908 * bugfix: Form values with newlines escaped in email, t3#32515 * openid: Update php-openid to 2.2.2, t3#42236 * bugfix: Hide version selector if workspaces are used. t3#43264 * bugfix: Subject field in FormWizard, t3#35787 * Raise submodule pointer * Invalid behavior of search for integer in Backend search, t3#33700 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-232 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): typo3-cms-4_5-4.5.25-2.4.1 typo3-cms-4_6-4.6.18-2.4.1 typo3-cms-4_7-4.7.10-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1842.html http://support.novell.com/security/cve/CVE-2013-1843.html https://bugzilla.novell.com/808528

1 0