openSUSE Security Update: update for python-keystoneclient
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1090-1
Rating: moderate
References: #817415
Cross-References: CVE-2013-2013
Affected Products:
openSUSE 12.3
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update of python-keystoneclient fixes a security
vulnerability.
- Add CVE-2013-2013.patch: allow secure user password
update (CVE-2013-2013, bnc#817415).
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-541
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (noarch):
python-keystoneclient-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.8.1
python-keystoneclient-doc-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.8.1
python-keystoneclient-test-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.8.1
References:
http://support.novell.com/security/cve/CVE-2013-2013.htmlhttps://bugzilla.novell.com/817415
openSUSE Security Update: update for openstack-keystone
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1089-1
Rating: moderate
References: #821201 #823783
Cross-References: CVE-2013-2104 CVE-2013-2157
Affected Products:
openSUSE 12.3
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update of openstack-keystone fixes two security
vulnerabilities.
- Add CVE-2013-2104.patch: fix missing expiration check in
Keystone PKI token validation (CVE-2013-2104, bnc#821201)
- Add CVE-2013-2157.patch: fix authentication bypass when
using LDAP backend (CVE-2013-2157, bnc#823783)
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-540
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (noarch):
openstack-keystone-2012.2.4+git.1363796849.255b1d4-3.16.1
openstack-keystone-doc-2012.2.4+git.1363796849.255b1d4-3.16.1
openstack-keystone-test-2012.2.4+git.1363796849.255b1d4-3.16.1
python-keystone-2012.2.4+git.1363796849.255b1d4-3.16.1
References:
http://support.novell.com/security/cve/CVE-2013-2104.htmlhttp://support.novell.com/security/cve/CVE-2013-2157.htmlhttps://bugzilla.novell.com/821201https://bugzilla.novell.com/823783
openSUSE Security Update: update for openstack-nova
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1087-1
Rating: moderate
References: #819349
Cross-References: CVE-2013-2030
Affected Products:
openSUSE 12.3
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update of openstack-nova fixes a security
vulnerability.
- Add CVE-2013-2030.patch: fix insecure keystone middleware
tmpdir by default (CVE-2013-2030, bnc#819349).
- Use explicit keystone-signing dir to workaround
lp#1181157.
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-539
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (i586 x86_64):
python-greenlet-0.4.0-3.3.1
python-greenlet-debuginfo-0.4.0-3.3.1
python-greenlet-debugsource-0.4.0-3.3.1
- openSUSE 12.3 (noarch):
openstack-nova-2012.2.4+git.1363297910.9561484-2.10.1
openstack-nova-api-2012.2.4+git.1363297910.9561484-2.10.1
openstack-nova-cert-2012.2.4+git.1363297910.9561484-2.10.1
openstack-nova-compute-2012.2.4+git.1363297910.9561484-2.10.1
openstack-nova-doc-2012.2.4+git.1363297910.9561484-2.10.4
openstack-nova-network-2012.2.4+git.1363297910.9561484-2.10.1
openstack-nova-novncproxy-2012.2.4+git.1363297910.9561484-2.10.1
openstack-nova-objectstore-2012.2.4+git.1363297910.9561484-2.10.1
openstack-nova-scheduler-2012.2.4+git.1363297910.9561484-2.10.1
openstack-nova-test-2012.2.4+git.1363297910.9561484-2.10.1
openstack-nova-vncproxy-2012.2.4+git.1363297910.9561484-2.10.1
openstack-nova-volume-2012.2.4+git.1363297910.9561484-2.10.1
python-greenlet-devel-0.4.0-3.3.1
python-nova-2012.2.4+git.1363297910.9561484-2.10.1
References:
http://support.novell.com/security/cve/CVE-2013-2030.htmlhttps://bugzilla.novell.com/819349
openSUSE Security Update: wireshark
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1086-1
Rating: moderate
References: #823932
Cross-References: CVE-2013-3555 CVE-2013-3556 CVE-2013-3557
CVE-2013-3558 CVE-2013-3559 CVE-2013-3560
CVE-2013-3561 CVE-2013-3562
Affected Products:
openSUSE 11.4
______________________________________________________________________________
An update that fixes 8 vulnerabilities is now available.
Description:
This update of wireshark includes several security and bug
fixes.
- update to 1.8.8 [bnc#823932]
+ vulnerabilities fixed:
* The CAPWAP dissector could crash. wnpa-sec-2013-32
* The GMR-1 BCCH dissector could crash. wnpa-sec-2013-33
* The PPP dissector could crash. wnpa-sec-2013-34
* The NBAP dissector could crash. wnpa-sec-2013-35
* The RDP dissector could crash. wnpa-sec-2013-36
* The GSM CBCH dissector could crash. wnpa-sec-2013-37
* The Assa Abloy R3 dissector could consume excessive
memory and CPU. wnpa-sec-2013-38
* The HTTP dissector could overrun the stack.
wnpa-sec-2013-39
* The Ixia IxVeriWave file parser could overflow the
heap. wnpa-sec-2013-40
* The DCP ETSI dissector could crash. wnpa-sec-2013-41
+ Further bug fixes and updated protocol support as
listed in:
https://www.wireshark.org/docs/relnotes/wireshark-1.8.8.html
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 11.4:
zypper in -t patch 2013-97
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 11.4 (i586 x86_64):
wireshark-1.8.8-49.1
wireshark-debuginfo-1.8.8-49.1
wireshark-debugsource-1.8.8-49.1
wireshark-devel-1.8.8-49.1
References:
http://support.novell.com/security/cve/CVE-2013-3555.htmlhttp://support.novell.com/security/cve/CVE-2013-3556.htmlhttp://support.novell.com/security/cve/CVE-2013-3557.htmlhttp://support.novell.com/security/cve/CVE-2013-3558.htmlhttp://support.novell.com/security/cve/CVE-2013-3559.htmlhttp://support.novell.com/security/cve/CVE-2013-3560.htmlhttp://support.novell.com/security/cve/CVE-2013-3561.htmlhttp://support.novell.com/security/cve/CVE-2013-3562.htmlhttps://bugzilla.novell.com/823932
openSUSE Security Update: update for libraw
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1085-1
Rating: moderate
References: #822665
Cross-References: CVE-2013-2126
Affected Products:
openSUSE 12.3
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update of libraw fixes a security issue.
- security update:
* CVE-2013-2126.patch [bnc#822665]
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-537
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (x86_64):
libraw-debugsource-0.14.7-3.4.1
libraw-devel-0.14.7-3.4.1
libraw-devel-static-0.14.7-3.4.1
libraw-tools-0.14.7-3.4.1
libraw-tools-debuginfo-0.14.7-3.4.1
libraw5-0.14.7-3.4.1
libraw5-debuginfo-0.14.7-3.4.1
- openSUSE 12.3 (i586):
libraw-debugsource-0.14.7-3.4.2
libraw-devel-0.14.7-3.4.2
libraw-devel-static-0.14.7-3.4.2
libraw-tools-0.14.7-3.4.2
libraw-tools-debuginfo-0.14.7-3.4.2
libraw5-0.14.7-3.4.2
libraw5-debuginfo-0.14.7-3.4.2
References:
http://support.novell.com/security/cve/CVE-2013-2126.htmlhttps://bugzilla.novell.com/822665
openSUSE Security Update: update for wireshark
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1084-1
Rating: moderate
References: #823932
Cross-References: CVE-2013-3555 CVE-2013-3556 CVE-2013-3557
CVE-2013-3558 CVE-2013-3559 CVE-2013-3560
CVE-2013-3561 CVE-2013-3562
Affected Products:
openSUSE 12.3
openSUSE 12.2
______________________________________________________________________________
An update that fixes 8 vulnerabilities is now available.
Description:
This update of wireshark includes several security and bug
fixes.
- update to 1.8.8 [bnc#823932]
+ vulnerabilities fixed:
* The CAPWAP dissector could crash. wnpa-sec-2013-32
* The GMR-1 BCCH dissector could crash. wnpa-sec-2013-33
* The PPP dissector could crash. wnpa-sec-2013-34
* The NBAP dissector could crash. wnpa-sec-2013-35
* The RDP dissector could crash. wnpa-sec-2013-36
* The GSM CBCH dissector could crash. wnpa-sec-2013-37
* The Assa Abloy R3 dissector could consume excessive
memory and CPU. wnpa-sec-2013-38
* The HTTP dissector could overrun the stack.
wnpa-sec-2013-39
* The Ixia IxVeriWave file parser could overflow the
heap. wnpa-sec-2013-40
* The DCP ETSI dissector could crash. wnpa-sec-2013-41
+ Further bug fixes and updated protocol support as
listed in:
https://www.wireshark.org/docs/relnotes/wireshark-1.8.8.html
wnpa-sec-2013-24 CVE-2013-3555 wnpa-sec-2013-25
CVE-2013-3556 CVE-2013-3557 wnpa-sec-2013-26 CVE-2013-3558
wnpa-sec-2013-27 CVE-2013-3559 wnpa-sec-2013-28
CVE-2013-3560 wnpa-sec-2013-29 CVE-2013-3561 CVE-2013-3562
wnpa-sec-2013-30 CVE-2013-3561 wnpa-sec-2013-31
CVE-2013-3561
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-536
- openSUSE 12.2:
zypper in -t patch openSUSE-2013-536
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (i586 x86_64):
wireshark-1.8.8-1.12.1
wireshark-debuginfo-1.8.8-1.12.1
wireshark-debugsource-1.8.8-1.12.1
wireshark-devel-1.8.8-1.12.1
- openSUSE 12.2 (i586 x86_64):
wireshark-1.8.8-1.31.1
wireshark-debuginfo-1.8.8-1.31.1
wireshark-debugsource-1.8.8-1.31.1
wireshark-devel-1.8.8-1.31.1
References:
http://support.novell.com/security/cve/CVE-2013-3555.htmlhttp://support.novell.com/security/cve/CVE-2013-3556.htmlhttp://support.novell.com/security/cve/CVE-2013-3557.htmlhttp://support.novell.com/security/cve/CVE-2013-3558.htmlhttp://support.novell.com/security/cve/CVE-2013-3559.htmlhttp://support.novell.com/security/cve/CVE-2013-3560.htmlhttp://support.novell.com/security/cve/CVE-2013-3561.htmlhttp://support.novell.com/security/cve/CVE-2013-3562.htmlhttps://bugzilla.novell.com/823932
openSUSE Security Update: update for darktable
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1083-1
Rating: moderate
References: #823114
Cross-References: CVE-2013-2126
Affected Products:
openSUSE 12.3
openSUSE 12.2
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update of darktable fixes a problem inside the
embedded libraw version.
- Fix for CVE-2013-2126
* added backported patch from git master
0001-fixed-error-handling-for-broken-full-color-images.patch
fixes bnc#823114-
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-538
- openSUSE 12.2:
zypper in -t patch openSUSE-2013-538
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (x86_64):
darktable-1.1.3-1.5.3
darktable-debuginfo-1.1.3-1.5.3
darktable-debugsource-1.1.3-1.5.3
darktable-doc-1.1.3-1.5.3
- openSUSE 12.3 (i586):
darktable-1.1.3-1.5.4
darktable-debuginfo-1.1.3-1.5.4
darktable-debugsource-1.1.3-1.5.4
darktable-doc-1.1.3-1.5.4
- openSUSE 12.2 (i586 x86_64):
darktable-1.0.5-3.9.3
darktable-debuginfo-1.0.5-3.9.3
darktable-debugsource-1.0.5-3.9.3
References:
http://support.novell.com/security/cve/CVE-2013-2126.htmlhttps://bugzilla.novell.com/823114
openSUSE Recommended Update: libstorage: Two fixes
______________________________________________________________________________
Announcement ID: openSUSE-RU-2013:1082-1
Rating: low
References: #810305 #825503
Affected Products:
openSUSE 12.3
______________________________________________________________________________
An update that has two recommended fixes can now be
installed.
Description:
This update fixes the following issues with libstorage:
- bnc#825503: adapt to changed functionality of losetup
- bnc#810305: fix wrong size calculation when deleting thin
LVs
Patch Instructions:
To install this openSUSE Recommended Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-535
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (i586 x86_64):
libstorage-debugsource-2.23.11-1.8.1
libstorage-devel-2.23.11-1.8.1
libstorage-python-2.23.11-1.8.1
libstorage-python-debuginfo-2.23.11-1.8.1
libstorage-ruby-2.23.11-1.8.1
libstorage-ruby-debuginfo-2.23.11-1.8.1
libstorage-testsuite-2.23.11-1.8.1
libstorage-testsuite-debuginfo-2.23.11-1.8.1
libstorage4-2.23.11-1.8.1
libstorage4-debuginfo-2.23.11-1.8.1
yast2-storage-2.23.9-1.7.1
yast2-storage-debuginfo-2.23.9-1.7.1
yast2-storage-debugsource-2.23.9-1.7.1
yast2-storage-devel-2.23.9-1.7.1
References:
https://bugzilla.novell.com/810305https://bugzilla.novell.com/825503
openSUSE Recommended Update: icedtea-web: Regression-fix after the last openjdk
______________________________________________________________________________
Announcement ID: openSUSE-RU-2013:1081-1
Rating: important
References: #825880
Affected Products:
openSUSE 12.3
openSUSE 12.2
______________________________________________________________________________
An update that has one recommended fix can now be installed.
Description:
This update fixes the following issue with icedtea-web:
- bnc#825880: fix icedtea-web broken by last openjdk
security update
Patch Instructions:
To install this openSUSE Recommended Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-533
- openSUSE 12.2:
zypper in -t patch openSUSE-2013-533
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (i586 x86_64):
icedtea-web-1.4-4.18.1
icedtea-web-debuginfo-1.4-4.18.1
icedtea-web-debugsource-1.4-4.18.1
- openSUSE 12.3 (noarch):
icedtea-web-javadoc-1.4-4.18.1
- openSUSE 12.2 (i586 x86_64):
icedtea-web-1.4-1.21.1
icedtea-web-debuginfo-1.4-1.21.1
icedtea-web-debugsource-1.4-1.21.1
- openSUSE 12.2 (noarch):
icedtea-web-javadoc-1.4-1.21.1
References:
https://bugzilla.novell.com/825880
openSUSE Recommended Update: liferea: update to 1.8.14
______________________________________________________________________________
Announcement ID: openSUSE-RU-2013:1080-1
Rating: low
References: #823576
Affected Products:
openSUSE 12.2
______________________________________________________________________________
An update that has one recommended fix can now be installed.
Description:
This update fixes the following issues with liferea:
- bnc#823576: Update to version
* sf#1069: fixed broken rendering in tt-rss feeds
+ with combined 1.8.13 fixes:
* Fixes missing item list update when browsing item
URLs in Liferea
* Fixes format string issues in several translations.
* Added Hebrew translation of reference manual page
* Added MimeType to .desktop file
* sf#1040: In feed entries, spaces are replaced with "+"
* sf#1051: Issues in RTL GUI of Liferea
* sf#1038, sf#1074: Updates ttrss feeds over and over
* Updated the default feedlists
* Added Vietnamese translation
* Updated translations
- Update to version 1.8.12:
* sf#1041: Some GPLv2 license headers were outdated
* sf#1044: tt-rss API changed (we now support only 1.6
API)
* Fixes XHTML errors caused by extra body tags from tt-rss
- Changes from version 1.8.11:
* Added Google Plus to social bookmarking options.
* deb#668197: x-www-browser preference not working
* sf#1037: Incorrect notifications for Google Reader
* sf#1048: Removed all feedvalidator.org references from
FAQ and XSLT as it was reported to host malware
* Updated translations.
- Update to version 1.8.10:
* sf#3572660: Fix crash in google_source_remove_node
* Prevents adding folders/search folders/newsbins to
Google Reader.
* Prevents sorting subscriptions in Google Reader
* Fixes items not removed from search folder count when
feed is removed.
* Fixes search folder rebuilding (do not include comment
items).
* Fixes SELECT offset handling when rebuilding search
folders.
- Update to version 1.8.9:
* sf#3564393: Added Instapaper.com to social bookmarking
sites
* sf#3567715: Fix crash on network online status changes
* Fixes preferences dialog not showing up a second time.
* Fixes reloading item when browsing inside the item view.
- Update to version 1.8.8:
* sf#3557513: Fixes crash on empty links in
auto-load-link mode
* Ensure node ids are in DB node relation on startup.
* Fixes search folder counter update on feed removal.
* Include AM_PROG_AR in configure.ac to work with
automake 1.12.
Patch Instructions:
To install this openSUSE Recommended Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.2:
zypper in -t patch openSUSE-2013-531
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.2 (i586 x86_64):
liferea-1.8.14-2.9.1
liferea-debuginfo-1.8.14-2.9.1
liferea-debugsource-1.8.14-2.9.1
- openSUSE 12.2 (noarch):
liferea-lang-1.8.14-2.9.1
References:
https://bugzilla.novell.com/823576