May 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:0797-1:
by opensuse-security＠opensuse.org 16 May '13

16 May '13

openSUSE Security Update: ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0797-1 Rating: low References: #819916 Cross-References: CVE-2013-2728 CVE-2013-3324 CVE-2013-3325 CVE-2013-3326 CVE-2013-3327 CVE-2013-3328 CVE-2013-3329 CVE-2013-3330 CVE-2013-3331 CVE-2013-3332 CVE-2013-3333 CVE-2013-3334 CVE-2013-3335 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: No description available. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-425 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.285-66.1 flash-player-gnome-11.2.202.285-66.1 flash-player-kde4-11.2.202.285-66.1 References: http://support.novell.com/security/cve/CVE-2013-2728.html http://support.novell.com/security/cve/CVE-2013-3324.html http://support.novell.com/security/cve/CVE-2013-3325.html http://support.novell.com/security/cve/CVE-2013-3326.html http://support.novell.com/security/cve/CVE-2013-3327.html http://support.novell.com/security/cve/CVE-2013-3328.html http://support.novell.com/security/cve/CVE-2013-3329.html http://support.novell.com/security/cve/CVE-2013-3330.html http://support.novell.com/security/cve/CVE-2013-3331.html http://support.novell.com/security/cve/CVE-2013-3332.html http://support.novell.com/security/cve/CVE-2013-3333.html http://support.novell.com/security/cve/CVE-2013-3334.html http://support.novell.com/security/cve/CVE-2013-3335.html https://bugzilla.novell.com/819916

1 0

openSUSE-RU-2013:0788-1: python-py2pack: Update to 0.4.3.4
by maintenance＠opensuse.org 14 May '13

14 May '13

openSUSE Recommended Update: python-py2pack: Update to 0.4.3.4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0788-1 Rating: low References: Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update pushes python-py2pack to the current version 0.4.3.4. - 0.4.3.4: + catch more doc files - 0.4.3.3: + Various bugfixes - 0.4.3: + Generate SPDX-style licenses + Find documentation files from local tarball + Detect C extensions from local tarball Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-419 - openSUSE 12.1: zypper in -t patch openSUSE-2013-419 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (noarch): python-py2pack-0.4.3.4-2.4.1 - openSUSE 12.1 (noarch): python-py2pack-0.4.3.4-2.4.1 References:

1 0

openSUSE-RU-2013:0787-1: iscsitarget: list previous config file location as a %ghost file
by maintenance＠opensuse.org 14 May '13

14 May '13

openSUSE Recommended Update: iscsitarget: list previous config file location as a %ghost file ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0787-1 Rating: low References: #801469 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with iscsitarget: - bnc#801469: updated spec file to list previous config file location as a %ghost file Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-422 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): iscsitarget-1.4.20.3-2.20.1 iscsitarget-debuginfo-1.4.20.3-2.20.1 iscsitarget-debugsource-1.4.20.3-2.20.1 iscsitarget-kmp-default-1.4.20.3_k3.4.33_2.24-2.20.1 iscsitarget-kmp-default-debuginfo-1.4.20.3_k3.4.33_2.24-2.20.1 iscsitarget-kmp-desktop-1.4.20.3_k3.4.33_2.24-2.20.1 iscsitarget-kmp-desktop-debuginfo-1.4.20.3_k3.4.33_2.24-2.20.1 iscsitarget-kmp-xen-1.4.20.3_k3.4.33_2.24-2.20.1 iscsitarget-kmp-xen-debuginfo-1.4.20.3_k3.4.33_2.24-2.20.1 - openSUSE 12.2 (i586): iscsitarget-kmp-pae-1.4.20.3_k3.4.33_2.24-2.20.1 iscsitarget-kmp-pae-debuginfo-1.4.20.3_k3.4.33_2.24-2.20.1 References: https://bugzilla.novell.com/801469

1 0

openSUSE-SU-2013:0778-1: moderate: update for python-httplib2
by opensuse-security＠opensuse.org 10 May '13

10 May '13

openSUSE Security Update: update for python-httplib2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0778-1 Rating: moderate References: #818100 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update of python-httplib2 fixed broken SSL certification verification. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-415 - openSUSE 12.1: zypper in -t patch openSUSE-2013-415 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (noarch): python-httplib2-0.7.4-2.7.1 - openSUSE 12.1 (noarch): python-httplib2-0.7.1-3.7.1 References: https://bugzilla.novell.com/818100

1 0

openSUSE-SU-2013:0777-1: moderate: java-1_6_0-openjdk to Icedtea6-1.12.5
by opensuse-security＠opensuse.org 10 May '13

10 May '13

openSUSE Security Update: java-1_6_0-openjdk to Icedtea6-1.12.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0777-1 Rating: moderate References: #817157 Cross-References: CVE-2013-0401 CVE-2013-1488 CVE-2013-1518 CVE-2013-1537 CVE-2013-1557 CVE-2013-1569 CVE-2013-2383 CVE-2013-2384 CVE-2013-2415 CVE-2013-2417 CVE-2013-2419 CVE-2013-2420 CVE-2013-2421 CVE-2013-2422 CVE-2013-2424 CVE-2013-2426 CVE-2013-2429 CVE-2013-2430 CVE-2013-2431 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: java-1_6_0-openjdk was updated to 1.12.5 (bnc#817157) * Security fixes - S6657673, CVE-2013-1518: Issues with JAXP - S7200507: Refactor Introspector internals - S8000724, CVE-2013-2417: Improve networking serialization - S8001031, CVE-2013-2419: Better font processing - S8001040, CVE-2013-1537: Rework RMI model - S8001322: Refactor deserialization - S8001329, CVE-2013-1557: Augment RMI logging - S8003335: Better handling of Finalizer thread - S8003445: Adjust JAX-WS to focus on API - S8003543, CVE-2013-2415: Improve processing of MTOM attachments - S8004261: Improve input validation - S8004336, CVE-2013-2431: Better handling of method handle intrinsic frames - S8004986, CVE-2013-2383: Better handling of glyph table - S8004987, CVE-2013-2384: Improve font layout - S8004994, CVE-2013-1569: Improve checking of glyph table - S8005432: Update access to JAX-WS - S8005943: (process) Improved Runtime.exec - S8006309: More reliable control panel operation - S8006435, CVE-2013-2424: Improvements in JMX - S8006790: Improve checking for windows - S8006795: Improve font warning messages - S8007406: Improve accessibility of AccessBridge - S8007617, CVE-2013-2420: Better validation of images - S8007667, CVE-2013-2430: Better image reading - S8007918, CVE-2013-2429: Better image writing - S8009063, CVE-2013-2426: Improve reliability of ConcurrentHashMap - S8009305, CVE-2013-0401: Improve AWT data transfer - S8009699, CVE-2013-2421: Methodhandle lookup - S8009814, CVE-2013-1488: Better driver management - S8009857, CVE-2013-2422: Problem with plugin - RH952389: Temporary files created with insecure permissions * Backports - S7197906: BlockOffsetArray::power_to_cards_back() needs to handle > 32 bit shifts - S7036559: ConcurrentHashMap footprint and contention improvements - S5102804: Memory leak in Introspector.getBeanInfo(Class) for custom BeanInfo: Class param (with WeakCache from S6397609) - S6501644: sync LayoutEngine *code* structure to match ICU - S6886358: layout code update - S6963811: Deadlock-prone locking changes in Introspector - S7017324: Kerning crash in JDK 7 since ICU layout update - S7064279: Introspector.getBeanInfo() should release some resources in timely manner - S8004302: javax/xml/soap/Test7013971.java fails since jdk6u39b01 - S7133220: Additional patches to JAXP 1.4.5 update 1 for 7u4 (partial for S6657673) - S8009530: ICU Kern table support broken * Bug fixes - OJ3: Fix get_stack_bounds memory leak (alternate fix for S7197906) - PR1362: Fedora 19 / rawhide FTBFS SIGILL - PR1338: Remove dependence on libXp - PR1339: Simplify the rhino class rewriter to avoid use of concurrency - PR1336: Bootstrap failure on Fedora 17/18 - PR1319: Correct #ifdef to #if - PR1402: Support glibc < 2.17 with AArch64 patch - Give xalan/xerces access to their own internal packages. * New features - JAXP, JAXWS & JAF supplied as patches rather than drops to aid subsequent patching. - PR1380: Add AArch64 support to Zero - openjdk-7-src-b147-awt-crasher.patch (bnc#792951) - fix build for non-jit packages Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-410 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b27.1.12.5-36.2 java-1_6_0-openjdk-debuginfo-1.6.0.0_b27.1.12.5-36.2 java-1_6_0-openjdk-debugsource-1.6.0.0_b27.1.12.5-36.2 java-1_6_0-openjdk-demo-1.6.0.0_b27.1.12.5-36.2 java-1_6_0-openjdk-demo-debuginfo-1.6.0.0_b27.1.12.5-36.2 java-1_6_0-openjdk-devel-1.6.0.0_b27.1.12.5-36.2 java-1_6_0-openjdk-devel-debuginfo-1.6.0.0_b27.1.12.5-36.2 java-1_6_0-openjdk-javadoc-1.6.0.0_b27.1.12.5-36.2 java-1_6_0-openjdk-src-1.6.0.0_b27.1.12.5-36.2 References: http://support.novell.com/security/cve/CVE-2013-0401.html http://support.novell.com/security/cve/CVE-2013-1488.html http://support.novell.com/security/cve/CVE-2013-1518.html http://support.novell.com/security/cve/CVE-2013-1537.html http://support.novell.com/security/cve/CVE-2013-1557.html http://support.novell.com/security/cve/CVE-2013-1569.html http://support.novell.com/security/cve/CVE-2013-2383.html http://support.novell.com/security/cve/CVE-2013-2384.html http://support.novell.com/security/cve/CVE-2013-2415.html http://support.novell.com/security/cve/CVE-2013-2417.html http://support.novell.com/security/cve/CVE-2013-2419.html http://support.novell.com/security/cve/CVE-2013-2420.html http://support.novell.com/security/cve/CVE-2013-2421.html http://support.novell.com/security/cve/CVE-2013-2422.html http://support.novell.com/security/cve/CVE-2013-2424.html http://support.novell.com/security/cve/CVE-2013-2426.html http://support.novell.com/security/cve/CVE-2013-2429.html http://support.novell.com/security/cve/CVE-2013-2430.html http://support.novell.com/security/cve/CVE-2013-2431.html https://bugzilla.novell.com/817157

1 0

openSUSE-SU-2013:0776-1: moderate: update for xorg-x11-server
by opensuse-security＠opensuse.org 10 May '13

10 May '13

openSUSE Security Update: update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0776-1 Rating: moderate References: #814653 Cross-References: CVE-2013-1940 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - U_xf86-fix-flush-input-to-work-with-Linux-evdev-device.patch * So when we VT switch back and attempt to flush the input devices, we don't succeed because evdev won't return part of an event, since we were only asking for 4 bytes, we'd only get -EINVAL back. This could later cause events to be flushed that we shouldn't have gotten. This is a fix for CVE-2013-1940. (bnc#814653) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-411 - openSUSE 12.1: zypper in -t patch openSUSE-2013-411 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): xorg-x11-Xvnc-7.6_1.12.3-1.29.1 xorg-x11-Xvnc-debuginfo-7.6_1.12.3-1.29.1 xorg-x11-server-7.6_1.12.3-1.29.1 xorg-x11-server-debuginfo-7.6_1.12.3-1.29.1 xorg-x11-server-debugsource-7.6_1.12.3-1.29.1 xorg-x11-server-extra-7.6_1.12.3-1.29.1 xorg-x11-server-extra-debuginfo-7.6_1.12.3-1.29.1 xorg-x11-server-sdk-7.6_1.12.3-1.29.1 - openSUSE 12.1 (i586 x86_64): xorg-x11-Xvnc-7.6_1.10.4-36.9.2 xorg-x11-Xvnc-debuginfo-7.6_1.10.4-36.9.2 xorg-x11-server-7.6_1.10.4-36.9.2 xorg-x11-server-debuginfo-7.6_1.10.4-36.9.2 xorg-x11-server-debugsource-7.6_1.10.4-36.9.2 xorg-x11-server-extra-7.6_1.10.4-36.9.2 xorg-x11-server-extra-debuginfo-7.6_1.10.4-36.9.2 xorg-x11-server-sdk-7.6_1.10.4-36.9.2 References: http://support.novell.com/security/cve/CVE-2013-1940.html https://bugzilla.novell.com/814653

1 0

openSUSE-SU-2013:0775-1: moderate: update for strongswan
by opensuse-security＠opensuse.org 10 May '13

10 May '13

openSUSE Security Update: update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0775-1 Rating: moderate References: #815236 Cross-References: CVE-2013-2944 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Applied upstream patch for security vulnerability discovered by Kevin Wojtysiak in ECDSA signature verification of the strongswan openssl plugin (bnc#815236, CVE-2013-2944) [0003-Check-return-value-of-ECDSA_Verify-correctly.patch] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-413 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): strongswan-4.6.4-2.8.1 strongswan-debugsource-4.6.4-2.8.1 strongswan-ikev1-4.6.4-2.8.1 strongswan-ikev1-debuginfo-4.6.4-2.8.1 strongswan-ikev2-4.6.4-2.8.1 strongswan-ikev2-debuginfo-4.6.4-2.8.1 strongswan-ipsec-4.6.4-2.8.1 strongswan-ipsec-debuginfo-4.6.4-2.8.1 strongswan-libs0-4.6.4-2.8.1 strongswan-libs0-debuginfo-4.6.4-2.8.1 strongswan-mysql-4.6.4-2.8.1 strongswan-mysql-debuginfo-4.6.4-2.8.1 strongswan-nm-4.6.4-2.8.1 strongswan-nm-debuginfo-4.6.4-2.8.1 strongswan-sqlite-4.6.4-2.8.1 strongswan-sqlite-debuginfo-4.6.4-2.8.1 - openSUSE 12.2 (noarch): strongswan-doc-4.6.4-2.8.1 References: http://support.novell.com/security/cve/CVE-2013-2944.html https://bugzilla.novell.com/815236

1 0

openSUSE-SU-2013:0774-1: moderate: update for strongswan
by opensuse-security＠opensuse.org 10 May '13

10 May '13

openSUSE Security Update: update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0774-1 Rating: moderate References: #815236 Cross-References: CVE-2013-2944 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Applied upstream patch for security vulnerability discovered by Kevin Wojtysiak in ECDSA signature verification of the strongswan openssl plugin (bnc#815236, CVE-2013-2944) [0003-Check-return-value-of-ECDSA_Verify-correctly.patch] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-414 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): strongswan-4.5.3-5.11.1 strongswan-debugsource-4.5.3-5.11.1 strongswan-doc-4.5.3-5.11.1 strongswan-ikev1-4.5.3-5.11.1 strongswan-ikev1-debuginfo-4.5.3-5.11.1 strongswan-ikev2-4.5.3-5.11.1 strongswan-ikev2-debuginfo-4.5.3-5.11.1 strongswan-ipsec-4.5.3-5.11.1 strongswan-ipsec-debuginfo-4.5.3-5.11.1 strongswan-libs0-4.5.3-5.11.1 strongswan-libs0-debuginfo-4.5.3-5.11.1 strongswan-mysql-4.5.3-5.11.1 strongswan-mysql-debuginfo-4.5.3-5.11.1 strongswan-nm-4.5.3-5.11.1 strongswan-nm-debuginfo-4.5.3-5.11.1 strongswan-sqlite-4.5.3-5.11.1 strongswan-sqlite-debuginfo-4.5.3-5.11.1 References: http://support.novell.com/security/cve/CVE-2013-2944.html https://bugzilla.novell.com/815236

1 0

openSUSE-RU-2013:0752-1: moderate: bash-completion: Fix some missing tilde escapes resulting in hangs
by maintenance＠opensuse.org 06 May '13

06 May '13

openSUSE Recommended Update: bash-completion: Fix some missing tilde escapes resulting in hangs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0752-1 Rating: moderate References: #794686 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with bash-completion: - bnc#794686: Fix some missing tilde escapes resulting in hangs Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-407 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (noarch): bash-completion-1.99-2.5.1 References: https://bugzilla.novell.com/794686

1 0

openSUSE-RU-2013:0751-1: moderate: hawk: Fixed loading main status page
by maintenance＠opensuse.org 06 May '13

06 May '13

openSUSE Recommended Update: hawk: Fixed loading main status page ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0751-1 Rating: moderate References: #800338 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with hawk: - bnc#800338: Force UTF-8 encoding to fix ActionView::TemplateError when loading main status page - Workaround deprecated Gem::SourceIndex#add_spec (required to work with rubygems 1.8) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-405 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): hawk-0.5.2-3.6.1 hawk-debuginfo-0.5.2-3.6.1 hawk-debugsource-0.5.2-3.6.1 hawk-templates-0.5.2-3.6.1 References: https://bugzilla.novell.com/800338

1 0