March 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:0462-1: moderate: RubyOnRails: security version update to 2.3.17
by opensuse-security＠opensuse.org 14 Mar '13

14 Mar '13

openSUSE Security Update: RubyOnRails: security version update to 2.3.17 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0462-1 Rating: moderate References: #798452 #803336 #803339 Cross-References: CVE-2013-0183 CVE-2013-0184 CVE-2013-0262 CVE-2013-0263 CVE-2013-0276 CVE-2013-0277 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: The Ruby on Rails 2.3 stack was updated to 2.3.17. The Ruby Rack was updated to 1.1.6. The updates fix various security issues and bugs. - update to version 2.3.17 (bnc#803336, bnc#803339) CVE-2013-0276 CVE-2013-0277: - update to version 2.3.17 (bnc#803336, bnc#803339) CVE-2013-0276 CVE-2013-0277: - Fix issue with attr_protected where malformed input could circumvent protection - Fix Serialized Attributes YAML Vulnerability - update to version 2.3.17 (bnc#803336, bnc#803339) CVE-2013-0276 CVE-2013-0277: - Fix issue with attr_protected where malformed input could circumvent protection - Fix Serialized Attributes YAML Vulnerability - update to 1.1.6 (bnc#802794) * Fix CVE-2013-0263, timing attack against Rack::Session::Cookie Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-42 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): rubygem-actionmailer-2_3-2.3.17-0.24.1 rubygem-actionmailer-2_3-doc-2.3.17-0.24.1 rubygem-actionmailer-2_3-testsuite-2.3.17-0.24.1 rubygem-actionpack-2_3-2.3.17-31.1 rubygem-actionpack-2_3-doc-2.3.17-31.1 rubygem-actionpack-2_3-testsuite-2.3.17-31.1 rubygem-activerecord-2_3-2.3.17-27.1 rubygem-activerecord-2_3-doc-2.3.17-27.1 rubygem-activerecord-2_3-testsuite-2.3.17-27.1 rubygem-activeresource-2_3-2.3.17-24.1 rubygem-activeresource-2_3-doc-2.3.17-24.1 rubygem-activeresource-2_3-testsuite-2.3.17-24.1 rubygem-activesupport-2_3-2.3.17-24.1 rubygem-activesupport-2_3-doc-2.3.17-24.1 rubygem-rack-1.1.6-16.1 rubygem-rails-2_3-2.3.17-20.1 rubygem-rails-2_3-doc-2.3.17-20.1 - openSUSE 11.4 (noarch): rubygem-actionmailer-2.3.17-14.1 rubygem-actionpack-2.3.17-14.1 rubygem-activerecord-2.3.17-14.1 rubygem-activeresource-2.3.17-14.1 rubygem-activesupport-2.3.17-14.1 rubygem-rails-2.3.17-14.1 References: http://support.novell.com/security/cve/CVE-2013-0183.html http://support.novell.com/security/cve/CVE-2013-0184.html http://support.novell.com/security/cve/CVE-2013-0262.html http://support.novell.com/security/cve/CVE-2013-0263.html http://support.novell.com/security/cve/CVE-2013-0276.html http://support.novell.com/security/cve/CVE-2013-0277.html https://bugzilla.novell.com/798452 https://bugzilla.novell.com/803336 https://bugzilla.novell.com/803339

1 0

openSUSE-SU-2013:0459-1: critical: flash-player: update to version 11.2.202.275
by opensuse-security＠opensuse.org 14 Mar '13

14 Mar '13

openSUSE Security Update: flash-player: update to version 11.2.202.275 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0459-1 Rating: critical References: #808973 Cross-References: CVE-2013-0646 CVE-2013-0650 CVE-2013-1371 CVE-2013-1375 Affected Products: openSUSE 12.3:NonFree openSUSE 12.2:NonFree openSUSE 12.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.275: (bnc#808973) * APSB13-09, CVE-2013-0646, CVE-2013-0650, CVE-2013-1371, CVE-2013-1375 More information can be found on: http://www.adobe.com/support/security/bulletins/apsb13-09.ht ml Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2013-205 - openSUSE 12.2:NonFree: zypper in -t patch openSUSE-2013-205 - openSUSE 12.1: zypper in -t patch openSUSE-2013-205 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.275-2.12.1 flash-player-gnome-11.2.202.275-2.12.1 flash-player-kde4-11.2.202.275-2.12.1 - openSUSE 12.2:NonFree (i586 x86_64): flash-player-11.2.202.275-1.34.1 flash-player-gnome-11.2.202.275-1.34.1 flash-player-kde4-11.2.202.275-1.34.1 - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.275-58.1 flash-player-gnome-11.2.202.275-58.1 flash-player-kde4-11.2.202.275-58.1 References: http://support.novell.com/security/cve/CVE-2013-0646.html http://support.novell.com/security/cve/CVE-2013-0650.html http://support.novell.com/security/cve/CVE-2013-1371.html http://support.novell.com/security/cve/CVE-2013-1375.html https://bugzilla.novell.com/808973

1 0

openSUSE-RU-2013:0455-1: important: timezone: update to 2013b
by maintenance＠opensuse.org 14 Mar '13

14 Mar '13

openSUSE Recommended Update: timezone: update to 2013b ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0455-1 Rating: important References: Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This udpate fixes the following issues for timezone: - tzcode and tzdata 2013b * Haiti uses US daylight-saving rules this year, and presumably future years. This changes time stamps starting today.· * Paraguay will end DST on March 24 this year. * Morocco does not observe DST during Ramadan. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-204 - openSUSE 12.2: zypper in -t patch openSUSE-2013-204 - openSUSE 12.1: zypper in -t patch openSUSE-2013-204 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): timezone-2013b-2.9.1 timezone-debuginfo-2013b-2.9.1 timezone-debugsource-2013b-2.9.1 - openSUSE 12.3 (noarch): timezone-java-2013b-2.9.1 - openSUSE 12.2 (i586 x86_64): timezone-2013b-1.16.1 timezone-debuginfo-2013b-1.16.1 timezone-debugsource-2013b-1.16.1 - openSUSE 12.2 (noarch): timezone-java-2013b-1.16.1 - openSUSE 12.1 (i586 x86_64): timezone-2013b-1.18.1 timezone-debuginfo-2013b-1.18.1 timezone-debugsource-2013b-1.18.1 - openSUSE 12.1 (noarch): timezone-java-2013b-1.18.1 References:

1 0

openSUSE-SU-2013:0454-1: moderate: chromium: updated to 27.0.1425
by opensuse-security＠opensuse.org 14 Mar '13

14 Mar '13

openSUSE Security Update: chromium: updated to 27.0.1425 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0454-1 Rating: moderate References: #804986 Cross-References: CVE-2013-0879 CVE-2013-0880 CVE-2013-0881 CVE-2013-0882 CVE-2013-0883 CVE-2013-0884 CVE-2013-0885 CVE-2013-0886 CVE-2013-0887 CVE-2013-0888 CVE-2013-0889 CVE-2013-0890 CVE-2013-0891 CVE-2013-0892 CVE-2013-0893 CVE-2013-0894 CVE-2013-0895 CVE-2013-0896 CVE-2013-0897 CVE-2013-0898 CVE-2013-0899 CVE-2013-0900 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes 22 vulnerabilities is now available. Description: chromium was updated to version 27.0.1425 having both stability and security fixes: * Bug and stability fixes: - Fixed crash after clicking through malware warning. (Issue: 173986) - Fixed broken command line to create extensions with locale info (Issue: 176187) - Hosted apps in Chrome will always be opened from app launcher. (Issue: 176267) - Added modal confirmation dialog to the enterprise profile sign-in flow. (Issue: 171236) - Fixed a crash with autofill. (Issues: 175454, 176576) - Fixed issues with sign-in. (Issues: 175672, 175819, 175541, 176190) - Fixed spurious profile shortcuts created with a system-level install. (Issue: 177047) - Fixed the background tab flashing with certain themes. (Issue: 175426) * Security Fixes: (bnc#804986) - High CVE-2013-0879: Memory corruption with web audio node - High CVE-2013-0880: Use-after-free in database handling - Medium CVE-2013-0881: Bad read in Matroska handling - High CVE-2013-0882: Bad memory access with excessive SVG parameters. - Medium CVE-2013-0883: Bad read in Skia. - Low CVE-2013-0884: Inappropriate load of NaCl. - Medium CVE-2013-0885: Too many API permissions granted to web store - Medium CVE-2013-0886: Incorrect NaCl signal handling. - Low CVE-2013-0887: Developer tools process has too many permissions and places too much trust in the connected server - Medium CVE-2013-0888: Out-of-bounds read in Skia - Low CVE-2013-0889: Tighten user gesture check for dangerous file downloads. - High CVE-2013-0890: Memory safety issues across the IPC layer. - High CVE-2013-0891: Integer overflow in blob handling. - Medium CVE-2013-0892: Lower severity issues across the IPC layer - Medium CVE-2013-0893: Race condition in media handling. - High CVE-2013-0894: Buffer overflow in vorbis decoding. - High CVE-2013-0895: Incorrect path handling in file copying. - High CVE-2013-0896: Memory management issues in plug-in message handling - Low CVE-2013-0897: Off-by-one read in PDF - High CVE-2013-0898: Use-after-free in URL handling - Low CVE-2013-0899: Integer overflow in Opus handling - Medium CVE-2013-0900: Race condition in ICU * Make adjustment for autodetecting of the PepperFlash library. The package with the PepperFlash hopefully will be soon available through packman - Update to 26.0.1411 * Bug and stability fixes - Update to 26.0.1403 * Bug and stability fixes - Using system libxml2 requires system libxslt. - Using system MESA does not work in i586 for some reason. - Also use system MESA, factory version seems adecuate now. - Always use system libxml2. - Restrict the usage of system libraries instead of the bundled ones to new products, too much hassle otherwise. - Also link kerberos and libgps directly, do not dlopen them. - Avoid using dlopen on system libraries, rpm or the package Manager do not handle this at all. tested for a few weeks and implemented with a macro so it can be easily disabled if problems arise. - Use SOME system libraries instead of the bundled ones, tested for several weeks and implemented with a macro for easy enable/Disable in case of trouble. - Update to 26.0.1393 * Bug and stability fixes * Security fixes - Update to 26.0.1375 * Bug and stability fixes - Update to 26.0.1371 * Bug and stability fixes - Update to 26.0.1367 * Bug and stability fixes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-203 - openSUSE 12.1: zypper in -t patch openSUSE-2013-203 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): chromedriver-27.0.1425.0-1.35.1 chromedriver-debuginfo-27.0.1425.0-1.35.1 chromium-27.0.1425.0-1.35.1 chromium-debuginfo-27.0.1425.0-1.35.1 chromium-debugsource-27.0.1425.0-1.35.1 chromium-desktop-gnome-27.0.1425.0-1.35.1 chromium-desktop-kde-27.0.1425.0-1.35.1 chromium-ffmpegsumo-27.0.1425.0-1.35.1 chromium-ffmpegsumo-debuginfo-27.0.1425.0-1.35.1 chromium-suid-helper-27.0.1425.0-1.35.1 chromium-suid-helper-debuginfo-27.0.1425.0-1.35.1 - openSUSE 12.1 (i586 x86_64): chromedriver-27.0.1425.0-1.55.1 chromedriver-debuginfo-27.0.1425.0-1.55.1 chromium-27.0.1425.0-1.55.1 chromium-debuginfo-27.0.1425.0-1.55.1 chromium-debugsource-27.0.1425.0-1.55.1 chromium-desktop-gnome-27.0.1425.0-1.55.1 chromium-desktop-kde-27.0.1425.0-1.55.1 chromium-ffmpegsumo-27.0.1425.0-1.55.1 chromium-ffmpegsumo-debuginfo-27.0.1425.0-1.55.1 chromium-suid-helper-27.0.1425.0-1.55.1 chromium-suid-helper-debuginfo-27.0.1425.0-1.55.1 References: http://support.novell.com/security/cve/CVE-2013-0879.html http://support.novell.com/security/cve/CVE-2013-0880.html http://support.novell.com/security/cve/CVE-2013-0881.html http://support.novell.com/security/cve/CVE-2013-0882.html http://support.novell.com/security/cve/CVE-2013-0883.html http://support.novell.com/security/cve/CVE-2013-0884.html http://support.novell.com/security/cve/CVE-2013-0885.html http://support.novell.com/security/cve/CVE-2013-0886.html http://support.novell.com/security/cve/CVE-2013-0887.html http://support.novell.com/security/cve/CVE-2013-0888.html http://support.novell.com/security/cve/CVE-2013-0889.html http://support.novell.com/security/cve/CVE-2013-0890.html http://support.novell.com/security/cve/CVE-2013-0891.html http://support.novell.com/security/cve/CVE-2013-0892.html http://support.novell.com/security/cve/CVE-2013-0893.html http://support.novell.com/security/cve/CVE-2013-0894.html http://support.novell.com/security/cve/CVE-2013-0895.html http://support.novell.com/security/cve/CVE-2013-0896.html http://support.novell.com/security/cve/CVE-2013-0897.html http://support.novell.com/security/cve/CVE-2013-0898.html http://support.novell.com/security/cve/CVE-2013-0899.html http://support.novell.com/security/cve/CVE-2013-0900.html https://bugzilla.novell.com/804986

1 0

openSUSE-RU-2013:0449-1: important: release-notes-openSUSE: Update to 12.3.5
by maintenance＠opensuse.org 13 Mar '13

13 Mar '13

openSUSE Recommended Update: release-notes-openSUSE: Update to 12.3.5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0449-1 Rating: important References: #804773 #808104 #808108 #808111 #808116 #808595 #808614 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: This update fixes the following issues for release-notes-openSUSE: - 12.3.5 (bnc#808614): * New entries: + bnc#808104: Crypted LVM in UEFI Mode Needs /boot Partition + bnc#808108: Enable Secure Boot in YaST Not Enabled by Default When in Secure Boot Mode + bnc#808111: No Network after Installation + bnc#808116: Wrong Bootloader When Installing from a Live Medium in a UEFI Environment + bnc#808595: openSUSE 12.3 Medium May Not Boot on Future Secure Boot Enabled Hardware * Update entries: + bnc#804773: Gnome: Workaround to Set Shift or Ctrl+Shift as a Shortcut Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-202 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): release-notes-openSUSE-12.3.6-1.6.1 References: https://bugzilla.novell.com/804773 https://bugzilla.novell.com/808104 https://bugzilla.novell.com/808108 https://bugzilla.novell.com/808111 https://bugzilla.novell.com/808116 https://bugzilla.novell.com/808595 https://bugzilla.novell.com/808614

1 0

openSUSE-RU-2013:0443-1: moderate: systemd: several fixes
by maintenance＠opensuse.org 13 Mar '13

13 Mar '13

openSUSE Recommended Update: systemd: several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0443-1 Rating: moderate References: #731601 #751253 #770182 #801423 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following issues for systemd: - bnc#801423: Update handle-racy-daemon.patch to fix assertion - bnc#751253, rh#810257: do not modify directory atime, which was preventing removing empty directories - bnc#731601: fix default swap priority - bnc#770182: don't limit tty VT to 12 - handle fastboot and forcefsck on kernel commandline properly. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-201 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): systemd-37-3.17.1 systemd-debuginfo-37-3.17.1 systemd-debugsource-37-3.17.1 systemd-devel-37-3.17.1 systemd-gtk-37-3.17.1 systemd-gtk-debuginfo-37-3.17.1 systemd-gtk-debugsource-37-3.17.1 systemd-sysvinit-37-3.17.1 - openSUSE 12.1 (x86_64): systemd-32bit-37-3.17.1 systemd-debuginfo-32bit-37-3.17.1 - openSUSE 12.1 (ia64): systemd-debuginfo-x86-37-3.17.1 systemd-x86-37-3.17.1 References: https://bugzilla.novell.com/731601 https://bugzilla.novell.com/751253 https://bugzilla.novell.com/770182 https://bugzilla.novell.com/801423

1 0

openSUSE-SU-2013:0438-1: important: java-1_6_0-openjdk: update to 1.12.4
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

openSUSE Security Update: java-1_6_0-openjdk: update to 1.12.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0438-1 Rating: important References: #807487 Cross-References: CVE-2013-0809 CVE-2013-1493 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: java-1_6_0-openjdk aka IcedTea was updated to 1.12.4 - S8007014, CVE-2013-0809: Improve image handling - S8007675, CVE-2013-1493: Improve color conversion Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-39 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-debuginfo-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-debugsource-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-demo-debuginfo-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-devel-debuginfo-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b27.1.12.4-33.1 java-1_6_0-openjdk-src-1.6.0.0_b27.1.12.4-33.1 References: http://support.novell.com/security/cve/CVE-2013-0809.html http://support.novell.com/security/cve/CVE-2013-1493.html https://bugzilla.novell.com/807487

1 0

openSUSE-RU-2013:0433-1: important: timezone: regular timezone updates to 2013a.
by maintenance＠opensuse.org 12 Mar '13

12 Mar '13

openSUSE Recommended Update: timezone: regular timezone updates to 2013a. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0433-1 Rating: important References: Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides the latest timezone information for your system. The changes in detail are: * Chile is changing its DST rules * Estimate Morocco 2013-2038 transitions for Ramadan * New alias Europe/Busingen for Europe/Zurich * New zones Asia/Khandyga, Asia/Ust-Nera * Libya moving to CET, but with DST. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-199 - openSUSE 12.2: zypper in -t patch openSUSE-2013-199 - openSUSE 12.1: zypper in -t patch openSUSE-2013-199 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): timezone-2013a-2.5.1 timezone-debuginfo-2013a-2.5.1 timezone-debugsource-2013a-2.5.1 - openSUSE 12.3 (noarch): timezone-java-2013a-2.5.1 - openSUSE 12.2 (i586 x86_64): timezone-2013a-1.12.1 timezone-debuginfo-2013a-1.12.1 timezone-debugsource-2013a-1.12.1 - openSUSE 12.2 (noarch): timezone-java-2013a-1.12.1 - openSUSE 12.1 (i586 x86_64): timezone-2013a-1.14.1 timezone-debuginfo-2013a-1.14.1 timezone-debugsource-2013a-1.14.1 - openSUSE 12.1 (noarch): timezone-java-2013a-1.14.1 References:

1 0

openSUSE-RU-2013:0432-1: moderate: Softwarestack update
by maintenance＠opensuse.org 12 Mar '13

12 Mar '13

openSUSE Recommended Update: Softwarestack update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0432-1 Rating: moderate References: #722551 #742633 #788863 #795076 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following issues for the Software management: - zypper: - bnc#795076: Add '--oldpackage' to allow rollback without malicious --force - bnc#742633, bnc#788863: zypper commandline args must not silently overrule locks - bnc#722551: Add missing --recommends to verify command - general: - translation-updates Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-200 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libqdialogsolver1-1.3.0-14.4.3 libqdialogsolver1-debuginfo-1.3.0-14.4.3 libqdialogsolver1-debugsource-1.3.0-14.4.3 libqdialogsolver1-devel-1.3.0-14.4.3 libzypp-11.8.0-2.8.2 libzypp-debuginfo-11.8.0-2.8.2 libzypp-debugsource-11.8.0-2.8.2 libzypp-devel-11.8.0-2.8.2 libzypp-testsuite-tools-4.2.11-14.8.1 zypper-1.7.11-1.9.1 zypper-debuginfo-1.7.11-1.9.1 zypper-debugsource-1.7.11-1.9.1 - openSUSE 12.2 (noarch): libzypp-testsuite-tools-data-4.2.11-14.8.1 zypper-aptitude-1.7.11-1.9.1 zypper-log-1.7.11-1.9.1 References: https://bugzilla.novell.com/722551 https://bugzilla.novell.com/742633 https://bugzilla.novell.com/788863 https://bugzilla.novell.com/795076

1 0

openSUSE-SU-2013:0431-1: important: Mozilla updates (FF 19.0.2, SM 2.16.1, TB 17.0.4)
by opensuse-security＠opensuse.org 12 Mar '13

12 Mar '13

openSUSE Security Update: Mozilla updates (FF 19.0.2, SM 2.16.1, TB 17.0.4) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0431-1 Rating: important References: #808243 Cross-References: CVE-2013-0787 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Update to - Firefox 19.0.2 - Seamonkey 2.16.1 - Thunderbird 17.0.4 which fix a use-after-free in HTML Editor which could allow for arbitrary code execution. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-38 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-19.0.2-65.1 MozillaFirefox-branding-upstream-19.0.2-65.1 MozillaFirefox-buildsymbols-19.0.2-65.1 MozillaFirefox-debuginfo-19.0.2-65.1 MozillaFirefox-debugsource-19.0.2-65.1 MozillaFirefox-devel-19.0.2-65.1 MozillaFirefox-translations-common-19.0.2-65.1 MozillaFirefox-translations-other-19.0.2-65.1 MozillaThunderbird-17.0.4-53.1 MozillaThunderbird-buildsymbols-17.0.4-53.1 MozillaThunderbird-debuginfo-17.0.4-53.1 MozillaThunderbird-debugsource-17.0.4-53.1 MozillaThunderbird-devel-17.0.4-53.1 MozillaThunderbird-devel-debuginfo-17.0.4-53.1 MozillaThunderbird-translations-common-17.0.4-53.1 MozillaThunderbird-translations-other-17.0.4-53.1 enigmail-1.5.1+17.0.4-53.1 enigmail-debuginfo-1.5.1+17.0.4-53.1 seamonkey-2.16.1-57.1 seamonkey-debuginfo-2.16.1-57.1 seamonkey-debugsource-2.16.1-57.1 seamonkey-dom-inspector-2.16.1-57.1 seamonkey-irc-2.16.1-57.1 seamonkey-translations-common-2.16.1-57.1 seamonkey-translations-other-2.16.1-57.1 seamonkey-venkman-2.16.1-57.1 References: http://support.novell.com/security/cve/CVE-2013-0787.html https://bugzilla.novell.com/808243

1 0