April 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:0671-1: moderate: update for roundcubemail
by opensuse-security＠opensuse.org 12 Apr '13

12 Apr '13

openSUSE Security Update: update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0671-1 Rating: moderate References: #812568 Cross-References: CVE-2013-1904 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Update to version 0.8.6 (bnc#812568) * Fix security issue in save-pref command (CVE-2013-1904) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-332 - openSUSE 12.2: zypper in -t patch openSUSE-2013-332 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): roundcubemail-0.8.6-1.4.1 - openSUSE 12.2 (noarch): roundcubemail-0.8.6-3.12.1 References: http://support.novell.com/security/cve/CVE-2013-1904.html https://bugzilla.novell.com/812568

1 0

openSUSE-SU-2013:0668-1: moderate: update for rubygem-activesupport-2_3
by opensuse-security＠opensuse.org 10 Apr '13

10 Apr '13

openSUSE Security Update: update for rubygem-activesupport-2_3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0668-1 Rating: moderate References: #809932 Cross-References: CVE-2013-1854 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Changes in rubygem-activesupport-2_3: - add patch to fix security issue: - bug-809932_2-3-attribute_symbols.patch: fix CVE-2013-1854: rubygem-activerecord*: Symbol DoS vulnerability in Active Record (bnc#809932) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-65 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): rubygem-activesupport-2_3-2.3.17-32.1 rubygem-activesupport-2_3-doc-2.3.17-32.1 References: http://support.novell.com/security/cve/CVE-2013-1854.html https://bugzilla.novell.com/809932

1 0

openSUSE-SU-2013:0667-1: moderate: update for rubygem-activerecord-2_3
by opensuse-security＠opensuse.org 10 Apr '13

10 Apr '13

openSUSE Security Update: update for rubygem-activerecord-2_3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0667-1 Rating: moderate References: #809932 Cross-References: CVE-2013-1854 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Changes in rubygem-activerecord-2_3: - add patch to fix security issue: - bug-809932_2-3-attribute_symbols.patch: fix CVE-2013-1854: rubygem-activerecord*: Symbol DoS vulnerability in Active Record (bnc#809932) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-66 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): rubygem-activerecord-2_3-2.3.17-35.1 rubygem-activerecord-2_3-doc-2.3.17-35.1 rubygem-activerecord-2_3-testsuite-2.3.17-35.1 References: http://support.novell.com/security/cve/CVE-2013-1854.html https://bugzilla.novell.com/809932

1 0

openSUSE-SU-2013:0666-1: moderate: bind: update to 9.9.2-P2 security release
by opensuse-security＠opensuse.org 10 Apr '13

10 Apr '13

openSUSE Security Update: bind: update to 9.9.2-P2 security release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0666-1 Rating: moderate References: #710430 #715881 #716745 #718441 #738156 #743758 #772946 #792926 #811876 Cross-References: CVE-2011-1907 CVE-2012-3868 CVE-2012-5688 CVE-2013-2266 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves four vulnerabilities and has 5 fixes is now available. Description: bind was updated to 9.9.2-P2, fixing a security issue in regular expression handling. [CVE-2013-2266] [RT #32688] https://kb.isc.org/article/AA-00871 (bnc#811876) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-67 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): bind-9.9.2P2-45.1 bind-chrootenv-9.9.2P2-45.1 bind-debuginfo-9.9.2P2-45.1 bind-debugsource-9.9.2P2-45.1 bind-devel-9.9.2P2-45.1 bind-libs-9.9.2P2-45.1 bind-libs-debuginfo-9.9.2P2-45.1 bind-lwresd-9.9.2P2-45.1 bind-lwresd-debuginfo-9.9.2P2-45.1 bind-utils-9.9.2P2-45.1 bind-utils-debuginfo-9.9.2P2-45.1 - openSUSE 11.4 (x86_64): bind-libs-32bit-9.9.2P2-45.1 bind-libs-debuginfo-32bit-9.9.2P2-45.1 - openSUSE 11.4 (noarch): bind-doc-9.9.2P2-45.1 - openSUSE 11.4 (ia64): bind-libs-debuginfo-x86-9.9.2P2-45.1 bind-libs-x86-9.9.2P2-45.1 References: http://support.novell.com/security/cve/CVE-2011-1907.html http://support.novell.com/security/cve/CVE-2012-3868.html http://support.novell.com/security/cve/CVE-2012-5688.html http://support.novell.com/security/cve/CVE-2013-2266.html https://bugzilla.novell.com/710430 https://bugzilla.novell.com/715881 https://bugzilla.novell.com/716745 https://bugzilla.novell.com/718441 https://bugzilla.novell.com/738156 https://bugzilla.novell.com/743758 https://bugzilla.novell.com/772946 https://bugzilla.novell.com/792926 https://bugzilla.novell.com/811876

1 0

openSUSE-RU-2013:0665-1: mozc: fix icons in fcitx
by maintenance＠opensuse.org 10 Apr '13

10 Apr '13

openSUSE Recommended Update: mozc: fix icons in fcitx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0665-1 Rating: low References: #813016 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with mozc: - bnc#813016: fix icons in fcitx. This is important for UX among Japanese users Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-328 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): fcitx-mozc-1.6.1187.102-2.4.1 fcitx-mozc-debuginfo-1.6.1187.102-2.4.1 ibus-mozc-1.6.1187.102-2.4.1 ibus-mozc-candidate-window-1.6.1187.102-2.4.1 ibus-mozc-candidate-window-debuginfo-1.6.1187.102-2.4.1 ibus-mozc-debuginfo-1.6.1187.102-2.4.1 mozc-1.6.1187.102-2.4.1 mozc-debuginfo-1.6.1187.102-2.4.1 mozc-debugsource-1.6.1187.102-2.4.1 mozc-gui-tools-1.6.1187.102-2.4.1 mozc-gui-tools-debuginfo-1.6.1187.102-2.4.1 References: https://bugzilla.novell.com/813016

1 0

openSUSE-SU-2013:0664-1: moderate: update for rubygem-activesupport-2_3
by opensuse-security＠opensuse.org 10 Apr '13

10 Apr '13

openSUSE Security Update: update for rubygem-activesupport-2_3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0664-1 Rating: moderate References: #809932 Cross-References: CVE-2013-1854 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Changes in rubygem-activesupport-2_3: - add patch to fix security issue: - bug-809932_2-3-attribute_symbols.patch: fix CVE-2013-1854: rubygem-activerecord*: Symbol DoS vulnerability in Active Record (bnc#809932) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-327 - openSUSE 12.1: zypper in -t patch openSUSE-2013-327 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): rubygem-activesupport-2_3-2.3.17-3.17.1 rubygem-activesupport-2_3-doc-2.3.17-3.17.1 - openSUSE 12.1 (i586 x86_64): rubygem-activesupport-2_3-2.3.17-3.21.1 rubygem-activesupport-2_3-doc-2.3.17-3.21.1 References: http://support.novell.com/security/cve/CVE-2013-1854.html https://bugzilla.novell.com/809932

1 0

openSUSE-RU-2013:0663-1: moderate: grub2: Two fixes
by maintenance＠opensuse.org 10 Apr '13

10 Apr '13

openSUSE Recommended Update: grub2: Two fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0663-1 Rating: moderate References: #809038 #811608 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with grub2: - bnc#811608: fixed potential failure of chainloading efi loader in secureboot enabled mode - bnc#809038: corretly set chainloaded image device handle in secure boot mode - fixed ppc-build Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-323 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): grub2-2.00-19.13.1 grub2-debuginfo-2.00-19.13.1 grub2-debugsource-2.00-19.13.1 grub2-efi-2.00-19.13.1 grub2-i386-pc-2.00-19.13.1 grub2-i386-pc-debuginfo-2.00-19.13.1 - openSUSE 12.3 (x86_64): grub2-x86_64-efi-2.00-19.13.1 grub2-x86_64-efi-debuginfo-2.00-19.13.1 - openSUSE 12.3 (i586): grub2-i386-efi-2.00-19.13.1 grub2-i386-efi-debuginfo-2.00-19.13.1 References: https://bugzilla.novell.com/809038 https://bugzilla.novell.com/811608

1 0

openSUSE-SU-2013:0662-1: moderate: update for rubygem-actionpack-2_3
by opensuse-security＠opensuse.org 10 Apr '13

10 Apr '13

openSUSE Security Update: update for rubygem-actionpack-2_3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0662-1 Rating: moderate References: #809935 #809940 Cross-References: CVE-2013-1855 CVE-2013-1857 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Changes in rubygem-actionpack-2_3: - add 2 patches to fix security issues: - bug-809935_2-3-css_sanitize.patch: CVE-2013-1855: rubygem-actionpack*: XSS vulnerability in sanitize_css in Action Pack (bnc#809935) - bug-809940_2-3-sanitize_protocol.patch: CVE-2013-1857: rubygem-actionpack*: XSS Vulnerability in the `sanitize` helper of Ruby on Rails (bnc#809940) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-324 - openSUSE 12.1: zypper in -t patch openSUSE-2013-324 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): rubygem-actionpack-2_3-2.3.17-2.21.1 rubygem-actionpack-2_3-doc-2.3.17-2.21.1 rubygem-actionpack-2_3-testsuite-2.3.17-2.21.1 - openSUSE 12.1 (i586 x86_64): rubygem-actionpack-2_3-2.3.17-3.24.1 rubygem-actionpack-2_3-doc-2.3.17-3.24.1 rubygem-actionpack-2_3-testsuite-2.3.17-3.24.1 References: http://support.novell.com/security/cve/CVE-2013-1855.html http://support.novell.com/security/cve/CVE-2013-1857.html https://bugzilla.novell.com/809935 https://bugzilla.novell.com/809940

1 0

openSUSE-SU-2013:0661-1: moderate: update for rubygem-actionpack-3_2
by opensuse-security＠opensuse.org 10 Apr '13

10 Apr '13

openSUSE Security Update: update for rubygem-actionpack-3_2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0661-1 Rating: moderate References: #809935 #809940 Cross-References: CVE-2013-1855 CVE-2013-1857 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Changes in rubygem-actionpack-3_2: - add 2 patches to fix security issues: - bug-809935_3-2-css_sanitize.patch: CVE-2013-1855: rubygem-actionpack*: XSS vulnerability in sanitize_css in Action Pack (bnc#809935) - bug-809940_3-2-sanitize_protocol.patch: CVE-2013-1857: rubygem-actionpack*: XSS Vulnerability in the `sanitize` helper of Ruby on Rails (bnc#809940) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-329 - openSUSE 12.2: zypper in -t patch openSUSE-2013-329 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): rubygem-actionpack-3_2-3.2.12-1.4.1 rubygem-actionpack-3_2-doc-3.2.12-1.4.1 - openSUSE 12.2 (i586 x86_64): rubygem-actionpack-3_2-3.2.12-3.17.1 rubygem-actionpack-3_2-doc-3.2.12-3.17.1 References: http://support.novell.com/security/cve/CVE-2013-1855.html http://support.novell.com/security/cve/CVE-2013-1857.html https://bugzilla.novell.com/809935 https://bugzilla.novell.com/809940

1 0

openSUSE-SU-2013:0660-1: moderate: update for rubygem-activerecord-2_3
by opensuse-security＠opensuse.org 10 Apr '13

10 Apr '13

openSUSE Security Update: update for rubygem-activerecord-2_3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0660-1 Rating: moderate References: #809932 Cross-References: CVE-2013-1854 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Changes in rubygem-activerecord-2_3: - add patch to fix security issue: - bug-809932_2-3-attribute_symbols.patch: fix CVE-2013-1854: rubygem-activerecord*: Symbol DoS vulnerability in Active Record (bnc#809932) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-325 - openSUSE 12.1: zypper in -t patch openSUSE-2013-325 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): rubygem-activerecord-2_3-2.3.17-2.17.1 rubygem-activerecord-2_3-doc-2.3.17-2.17.1 rubygem-activerecord-2_3-testsuite-2.3.17-2.17.1 - openSUSE 12.1 (i586 x86_64): rubygem-activerecord-2_3-2.3.17-3.20.1 rubygem-activerecord-2_3-doc-2.3.17-3.20.1 rubygem-activerecord-2_3-testsuite-2.3.17-3.20.1 References: http://support.novell.com/security/cve/CVE-2013-1854.html https://bugzilla.novell.com/809932

1 0