June 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1090-1: moderate: update for python-keystoneclient
by opensuse-security＠opensuse.org 27 Jun '13

27 Jun '13

openSUSE Security Update: update for python-keystoneclient ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1090-1 Rating: moderate References: #817415 Cross-References: CVE-2013-2013 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of python-keystoneclient fixes a security vulnerability. - Add CVE-2013-2013.patch: allow secure user password update (CVE-2013-2013, bnc#817415). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-541 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): python-keystoneclient-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.8.1 python-keystoneclient-doc-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.8.1 python-keystoneclient-test-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.8.1 References: http://support.novell.com/security/cve/CVE-2013-2013.html https://bugzilla.novell.com/817415

1 0

openSUSE-SU-2013:1089-1: moderate: update for openstack-keystone
by opensuse-security＠opensuse.org 27 Jun '13

27 Jun '13

openSUSE Security Update: update for openstack-keystone ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1089-1 Rating: moderate References: #821201 #823783 Cross-References: CVE-2013-2104 CVE-2013-2157 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of openstack-keystone fixes two security vulnerabilities. - Add CVE-2013-2104.patch: fix missing expiration check in Keystone PKI token validation (CVE-2013-2104, bnc#821201) - Add CVE-2013-2157.patch: fix authentication bypass when using LDAP backend (CVE-2013-2157, bnc#823783) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-540 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): openstack-keystone-2012.2.4+git.1363796849.255b1d4-3.16.1 openstack-keystone-doc-2012.2.4+git.1363796849.255b1d4-3.16.1 openstack-keystone-test-2012.2.4+git.1363796849.255b1d4-3.16.1 python-keystone-2012.2.4+git.1363796849.255b1d4-3.16.1 References: http://support.novell.com/security/cve/CVE-2013-2104.html http://support.novell.com/security/cve/CVE-2013-2157.html https://bugzilla.novell.com/821201 https://bugzilla.novell.com/823783

1 0

openSUSE-SU-2013:1087-1: moderate: update for openstack-nova
by opensuse-security＠opensuse.org 27 Jun '13

27 Jun '13

openSUSE Security Update: update for openstack-nova ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1087-1 Rating: moderate References: #819349 Cross-References: CVE-2013-2030 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of openstack-nova fixes a security vulnerability. - Add CVE-2013-2030.patch: fix insecure keystone middleware tmpdir by default (CVE-2013-2030, bnc#819349). - Use explicit keystone-signing dir to workaround lp#1181157. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-539 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): python-greenlet-0.4.0-3.3.1 python-greenlet-debuginfo-0.4.0-3.3.1 python-greenlet-debugsource-0.4.0-3.3.1 - openSUSE 12.3 (noarch): openstack-nova-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-api-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-cert-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-compute-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-doc-2012.2.4+git.1363297910.9561484-2.10.4 openstack-nova-network-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-novncproxy-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-objectstore-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-scheduler-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-test-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-vncproxy-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-volume-2012.2.4+git.1363297910.9561484-2.10.1 python-greenlet-devel-0.4.0-3.3.1 python-nova-2012.2.4+git.1363297910.9561484-2.10.1 References: http://support.novell.com/security/cve/CVE-2013-2030.html https://bugzilla.novell.com/819349

1 0

openSUSE-SU-2013:1086-1: moderate: wireshark
by opensuse-security＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Security Update: wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1086-1 Rating: moderate References: #823932 Cross-References: CVE-2013-3555 CVE-2013-3556 CVE-2013-3557 CVE-2013-3558 CVE-2013-3559 CVE-2013-3560 CVE-2013-3561 CVE-2013-3562 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update of wireshark includes several security and bug fixes. - update to 1.8.8 [bnc#823932] + vulnerabilities fixed: * The CAPWAP dissector could crash. wnpa-sec-2013-32 * The GMR-1 BCCH dissector could crash. wnpa-sec-2013-33 * The PPP dissector could crash. wnpa-sec-2013-34 * The NBAP dissector could crash. wnpa-sec-2013-35 * The RDP dissector could crash. wnpa-sec-2013-36 * The GSM CBCH dissector could crash. wnpa-sec-2013-37 * The Assa Abloy R3 dissector could consume excessive memory and CPU. wnpa-sec-2013-38 * The HTTP dissector could overrun the stack. wnpa-sec-2013-39 * The Ixia IxVeriWave file parser could overflow the heap. wnpa-sec-2013-40 * The DCP ETSI dissector could crash. wnpa-sec-2013-41 + Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.8.8.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-97 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): wireshark-1.8.8-49.1 wireshark-debuginfo-1.8.8-49.1 wireshark-debugsource-1.8.8-49.1 wireshark-devel-1.8.8-49.1 References: http://support.novell.com/security/cve/CVE-2013-3555.html http://support.novell.com/security/cve/CVE-2013-3556.html http://support.novell.com/security/cve/CVE-2013-3557.html http://support.novell.com/security/cve/CVE-2013-3558.html http://support.novell.com/security/cve/CVE-2013-3559.html http://support.novell.com/security/cve/CVE-2013-3560.html http://support.novell.com/security/cve/CVE-2013-3561.html http://support.novell.com/security/cve/CVE-2013-3562.html https://bugzilla.novell.com/823932

1 0

openSUSE-SU-2013:1085-1: moderate: update for libraw
by opensuse-security＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Security Update: update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1085-1 Rating: moderate References: #822665 Cross-References: CVE-2013-2126 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of libraw fixes a security issue. - security update: * CVE-2013-2126.patch [bnc#822665] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-537 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (x86_64): libraw-debugsource-0.14.7-3.4.1 libraw-devel-0.14.7-3.4.1 libraw-devel-static-0.14.7-3.4.1 libraw-tools-0.14.7-3.4.1 libraw-tools-debuginfo-0.14.7-3.4.1 libraw5-0.14.7-3.4.1 libraw5-debuginfo-0.14.7-3.4.1 - openSUSE 12.3 (i586): libraw-debugsource-0.14.7-3.4.2 libraw-devel-0.14.7-3.4.2 libraw-devel-static-0.14.7-3.4.2 libraw-tools-0.14.7-3.4.2 libraw-tools-debuginfo-0.14.7-3.4.2 libraw5-0.14.7-3.4.2 libraw5-debuginfo-0.14.7-3.4.2 References: http://support.novell.com/security/cve/CVE-2013-2126.html https://bugzilla.novell.com/822665

1 0

openSUSE-SU-2013:1084-1: moderate: update for wireshark
by opensuse-security＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Security Update: update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1084-1 Rating: moderate References: #823932 Cross-References: CVE-2013-3555 CVE-2013-3556 CVE-2013-3557 CVE-2013-3558 CVE-2013-3559 CVE-2013-3560 CVE-2013-3561 CVE-2013-3562 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update of wireshark includes several security and bug fixes. - update to 1.8.8 [bnc#823932] + vulnerabilities fixed: * The CAPWAP dissector could crash. wnpa-sec-2013-32 * The GMR-1 BCCH dissector could crash. wnpa-sec-2013-33 * The PPP dissector could crash. wnpa-sec-2013-34 * The NBAP dissector could crash. wnpa-sec-2013-35 * The RDP dissector could crash. wnpa-sec-2013-36 * The GSM CBCH dissector could crash. wnpa-sec-2013-37 * The Assa Abloy R3 dissector could consume excessive memory and CPU. wnpa-sec-2013-38 * The HTTP dissector could overrun the stack. wnpa-sec-2013-39 * The Ixia IxVeriWave file parser could overflow the heap. wnpa-sec-2013-40 * The DCP ETSI dissector could crash. wnpa-sec-2013-41 + Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.8.8.html wnpa-sec-2013-24 CVE-2013-3555 wnpa-sec-2013-25 CVE-2013-3556 CVE-2013-3557 wnpa-sec-2013-26 CVE-2013-3558 wnpa-sec-2013-27 CVE-2013-3559 wnpa-sec-2013-28 CVE-2013-3560 wnpa-sec-2013-29 CVE-2013-3561 CVE-2013-3562 wnpa-sec-2013-30 CVE-2013-3561 wnpa-sec-2013-31 CVE-2013-3561 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-536 - openSUSE 12.2: zypper in -t patch openSUSE-2013-536 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): wireshark-1.8.8-1.12.1 wireshark-debuginfo-1.8.8-1.12.1 wireshark-debugsource-1.8.8-1.12.1 wireshark-devel-1.8.8-1.12.1 - openSUSE 12.2 (i586 x86_64): wireshark-1.8.8-1.31.1 wireshark-debuginfo-1.8.8-1.31.1 wireshark-debugsource-1.8.8-1.31.1 wireshark-devel-1.8.8-1.31.1 References: http://support.novell.com/security/cve/CVE-2013-3555.html http://support.novell.com/security/cve/CVE-2013-3556.html http://support.novell.com/security/cve/CVE-2013-3557.html http://support.novell.com/security/cve/CVE-2013-3558.html http://support.novell.com/security/cve/CVE-2013-3559.html http://support.novell.com/security/cve/CVE-2013-3560.html http://support.novell.com/security/cve/CVE-2013-3561.html http://support.novell.com/security/cve/CVE-2013-3562.html https://bugzilla.novell.com/823932

1 0

openSUSE-SU-2013:1083-1: moderate: update for darktable
by opensuse-security＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Security Update: update for darktable ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1083-1 Rating: moderate References: #823114 Cross-References: CVE-2013-2126 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of darktable fixes a problem inside the embedded libraw version. - Fix for CVE-2013-2126 * added backported patch from git master 0001-fixed-error-handling-for-broken-full-color-images.patch fixes bnc#823114- Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-538 - openSUSE 12.2: zypper in -t patch openSUSE-2013-538 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (x86_64): darktable-1.1.3-1.5.3 darktable-debuginfo-1.1.3-1.5.3 darktable-debugsource-1.1.3-1.5.3 darktable-doc-1.1.3-1.5.3 - openSUSE 12.3 (i586): darktable-1.1.3-1.5.4 darktable-debuginfo-1.1.3-1.5.4 darktable-debugsource-1.1.3-1.5.4 darktable-doc-1.1.3-1.5.4 - openSUSE 12.2 (i586 x86_64): darktable-1.0.5-3.9.3 darktable-debuginfo-1.0.5-3.9.3 darktable-debugsource-1.0.5-3.9.3 References: http://support.novell.com/security/cve/CVE-2013-2126.html https://bugzilla.novell.com/823114

1 0

openSUSE-RU-2013:1082-1: libstorage: Two fixes
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: libstorage: Two fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1082-1 Rating: low References: #810305 #825503 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with libstorage: - bnc#825503: adapt to changed functionality of losetup - bnc#810305: fix wrong size calculation when deleting thin LVs Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-535 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libstorage-debugsource-2.23.11-1.8.1 libstorage-devel-2.23.11-1.8.1 libstorage-python-2.23.11-1.8.1 libstorage-python-debuginfo-2.23.11-1.8.1 libstorage-ruby-2.23.11-1.8.1 libstorage-ruby-debuginfo-2.23.11-1.8.1 libstorage-testsuite-2.23.11-1.8.1 libstorage-testsuite-debuginfo-2.23.11-1.8.1 libstorage4-2.23.11-1.8.1 libstorage4-debuginfo-2.23.11-1.8.1 yast2-storage-2.23.9-1.7.1 yast2-storage-debuginfo-2.23.9-1.7.1 yast2-storage-debugsource-2.23.9-1.7.1 yast2-storage-devel-2.23.9-1.7.1 References: https://bugzilla.novell.com/810305 https://bugzilla.novell.com/825503

1 0

openSUSE-RU-2013:1081-1: important: icedtea-web: Regression-fix after the last openjdk
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: icedtea-web: Regression-fix after the last openjdk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1081-1 Rating: important References: #825880 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with icedtea-web: - bnc#825880: fix icedtea-web broken by last openjdk security update Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-533 - openSUSE 12.2: zypper in -t patch openSUSE-2013-533 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): icedtea-web-1.4-4.18.1 icedtea-web-debuginfo-1.4-4.18.1 icedtea-web-debugsource-1.4-4.18.1 - openSUSE 12.3 (noarch): icedtea-web-javadoc-1.4-4.18.1 - openSUSE 12.2 (i586 x86_64): icedtea-web-1.4-1.21.1 icedtea-web-debuginfo-1.4-1.21.1 icedtea-web-debugsource-1.4-1.21.1 - openSUSE 12.2 (noarch): icedtea-web-javadoc-1.4-1.21.1 References: https://bugzilla.novell.com/825880

1 0

openSUSE-RU-2013:1080-1: liferea: update to 1.8.14
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: liferea: update to 1.8.14 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1080-1 Rating: low References: #823576 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with liferea: - bnc#823576: Update to version * sf#1069: fixed broken rendering in tt-rss feeds + with combined 1.8.13 fixes: * Fixes missing item list update when browsing item URLs in Liferea * Fixes format string issues in several translations. * Added Hebrew translation of reference manual page * Added MimeType to .desktop file * sf#1040: In feed entries, spaces are replaced with "+" * sf#1051: Issues in RTL GUI of Liferea * sf#1038, sf#1074: Updates ttrss feeds over and over * Updated the default feedlists * Added Vietnamese translation * Updated translations - Update to version 1.8.12: * sf#1041: Some GPLv2 license headers were outdated * sf#1044: tt-rss API changed (we now support only 1.6 API) * Fixes XHTML errors caused by extra body tags from tt-rss - Changes from version 1.8.11: * Added Google Plus to social bookmarking options. * deb#668197: x-www-browser preference not working * sf#1037: Incorrect notifications for Google Reader * sf#1048: Removed all feedvalidator.org references from FAQ and XSLT as it was reported to host malware * Updated translations. - Update to version 1.8.10: * sf#3572660: Fix crash in google_source_remove_node * Prevents adding folders/search folders/newsbins to Google Reader. * Prevents sorting subscriptions in Google Reader * Fixes items not removed from search folder count when feed is removed. * Fixes search folder rebuilding (do not include comment items). * Fixes SELECT offset handling when rebuilding search folders. - Update to version 1.8.9: * sf#3564393: Added Instapaper.com to social bookmarking sites * sf#3567715: Fix crash on network online status changes * Fixes preferences dialog not showing up a second time. * Fixes reloading item when browsing inside the item view. - Update to version 1.8.8: * sf#3557513: Fixes crash on empty links in auto-load-link mode * Ensure node ids are in DB node relation on startup. * Fixes search folder counter update on feed removal. * Include AM_PROG_AR in configure.ac to work with automake 1.12. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-531 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): liferea-1.8.14-2.9.1 liferea-debuginfo-1.8.14-2.9.1 liferea-debugsource-1.8.14-2.9.1 - openSUSE 12.2 (noarch): liferea-lang-1.8.14-2.9.1 References: https://bugzilla.novell.com/823576

1 0

openSUSE-RU-2013:1079-1: liferea: update to 1.8.14
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: liferea: update to 1.8.14 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1079-1 Rating: low References: #823576 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with liferea: - bnc#823576: Update to version * sf#1069: broken rendering in tt-rss feeds + with combined 1.8.13 fixes: * Fixes missing item list update when browsing item URLs in Liferea * Fixes format string issues in several translations. * Added Hebrew translation of reference manual page * Added MimeType to .desktop file * sf#1040: In feed entries, spaces are replaced with "+" * sf#1051: Issues in RTL GUI of Liferea * sf#1038, sf#1074: Updates ttrss feeds over and over * Updated the default feedlists * Added Vietnamese translation * Updated translations Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-530 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): liferea-1.8.14-2.7.1 liferea-debuginfo-1.8.14-2.7.1 liferea-debugsource-1.8.14-2.7.1 - openSUSE 12.3 (noarch): liferea-lang-1.8.14-2.7.1 References: https://bugzilla.novell.com/823576

1 0

openSUSE-RU-2013:1078-1: moderate: perl-X500-DN: don't set $Parse::RecDescent::skip to 'undef'
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: perl-X500-DN: don't set $Parse::RecDescent::skip to 'undef' ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1078-1 Rating: moderate References: #799660 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with perl-X500-DN: - bnc#799660: don't set $Parse::RecDescent::skip to 'undef' (e.g. this makes yast2-ldap-server configurable again) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-532 - openSUSE 12.2: zypper in -t patch openSUSE-2013-532 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): perl-X500-DN-0.29-100.4.1 - openSUSE 12.2 (i586 x86_64): perl-X500-DN-0.29-98.4.1 References: https://bugzilla.novell.com/799660

1 0

openSUSE-RU-2013:1077-1: libxml2: fix a leak in lzma code
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: libxml2: fix a leak in lzma code ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1077-1 Rating: low References: #823792 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with libxml2: - bnc#823792: fix a leak in lzma code Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-534 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libxml2-2-2.7.8+git20120223-8.26.1 libxml2-2-debuginfo-2.7.8+git20120223-8.26.1 libxml2-debugsource-2.7.8+git20120223-8.26.1 libxml2-devel-2.7.8+git20120223-8.26.1 libxml2-tools-2.7.8+git20120223-8.26.1 libxml2-tools-debuginfo-2.7.8+git20120223-8.26.1 python-libxml2-2.7.8+git20120223-8.26.1 python-libxml2-debuginfo-2.7.8+git20120223-8.26.1 python-libxml2-debugsource-2.7.8+git20120223-8.26.1 - openSUSE 12.2 (x86_64): libxml2-2-32bit-2.7.8+git20120223-8.26.1 libxml2-2-debuginfo-32bit-2.7.8+git20120223-8.26.1 libxml2-devel-32bit-2.7.8+git20120223-8.26.1 - openSUSE 12.2 (noarch): libxml2-doc-2.7.8+git20120223-8.26.1 References: https://bugzilla.novell.com/823792

1 0

openSUSE-SU-2013:1072-1: moderate: update for openconnect
by opensuse-security＠opensuse.org 24 Jun '13

24 Jun '13

openSUSE Security Update: update for openconnect ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1072-1 Rating: moderate References: #767616 Cross-References: CVE-2012-3291 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This openconnect update to version 3.20 includes several security and bug fixes. - fix bnc#767616 - fix for CVE-2012-3291 - make vpnc mandatory during build, following upstream changes - package documentation in a -doc package - Update to version 3.20 * Cope with non-keepalive HTTP response on authentication success. * Fix progress callback with incorrect cbdata which caused KDE crash. - Update to version 3.19 * Enable native TPM support when built with GnuTLS. * Enable PKCS#11 token support when built with GnuTLS. * Eliminate all SSL library exposure through libopenconnect. * Parse split DNS information, provide $CISCO_SPLIT_DNS environment variable to vpnc-script. * Attempt to provide new-style MTU information to server (on Linux only, unless specified on command line). * Allow building against GnuTLS, including DTLS support. * Add --with-pkgconfigdir= option to configure for FreeBSD's benefit (fd#48743). - Update to version 3.18 * Fix autohate breakage with --disable-nls... hopefully. * Fix buffer overflow in banner handling. - Update to version 3.17 * Work around time() brokenness on Solaris. * Fix interface plumbing on Solaris 10. * Provide asprintf() function for (unpatched) Solaris 10. * Make vpnc-script mandatory, like it is for vpnc * Don't set Legacy IP address on tun device; let vpnc-script do it. * Detect OpenSSL even without pkg-config. * Stop building static library by default. * Invoke vpnc-script with "pre-init" reason to load tun module if necessary. - Update to version 3.16 * Fix build failure on Debian/kFreeBSD and Hurd. * Fix memory leak of deflated packets. * Fix memory leak of zlib state on CSTP reconnect. * Eliminate memcpy() calls on packets from DTLS and tunnel device. * Use I_LINK instead of I_PLINK on Solaris to plumb interface for Legacy IP. * Plumb interface for IPv6 on Solaris, instead of expecting vpnc-script to do it. * Refer to vpnc-script and help web pages in openconnect output. * Fix potential crash when processing libproxy results. * Be more conservative in detecting libproxy without pkg-config. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-529 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): openconnect-3.20-2.4.1 openconnect-debuginfo-3.20-2.4.1 openconnect-debugsource-3.20-2.4.1 openconnect-devel-3.20-2.4.1 openconnect-doc-3.20-2.4.1 - openSUSE 12.2 (noarch): openconnect-lang-3.20-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-3291.html https://bugzilla.novell.com/767616

1 0

openSUSE-RU-2013:1071-1: important: mdadm: Two fixes
by maintenance＠opensuse.org 24 Jun '13

24 Jun '13

openSUSE Recommended Update: mdadm: Two fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1071-1 Rating: important References: #793954 #821366 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with mdadm: - bnc#793954: + avoid some races during array assembled- particularly at boot + make sure systemd-udev-trigger runs before boot.md to avoid races - bnc#821366: mdmon@.service - allow mdmon to be started by systemd, so systemd doesn't kill it Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-528 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): mdadm-3.2.6-3.4.1 mdadm-debuginfo-3.2.6-3.4.1 mdadm-debugsource-3.2.6-3.4.1 References: https://bugzilla.novell.com/793954 https://bugzilla.novell.com/821366

1 0

openSUSE-RU-2013:1070-1: xorg-x11-Xvnc: Build with GLX extension
by maintenance＠opensuse.org 24 Jun '13

24 Jun '13

openSUSE Recommended Update: xorg-x11-Xvnc: Build with GLX extension ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1070-1 Rating: low References: #823625 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with xorg-x11-Xvnc: - bnc#823625: Build with GLX extension. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-527 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): xorg-x11-Xvnc-7.6_1.0.1-3.4.4 xorg-x11-Xvnc-debuginfo-7.6_1.0.1-3.4.4 xorg-x11-Xvnc-debugsource-7.6_1.0.1-3.4.4 References: https://bugzilla.novell.com/823625

1 0

openSUSE-RU-2013:1069-1: dosfstools: fix dosfslabel crash
by maintenance＠opensuse.org 24 Jun '13

24 Jun '13

openSUSE Recommended Update: dosfstools: fix dosfslabel crash ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1069-1 Rating: low References: #824025 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes fixes the following issue with dosfstools: - bnc#824025: dosfslabel was crashing when allocating new rootdir entry. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-525 - openSUSE 12.2: zypper in -t patch openSUSE-2013-525 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): dosfstools-3.0.10-26.4.1 dosfstools-debuginfo-3.0.10-26.4.1 dosfstools-debugsource-3.0.10-26.4.1 - openSUSE 12.2 (i586 x86_64): dosfstools-3.0.10-22.4.1 dosfstools-debuginfo-3.0.10-22.4.1 dosfstools-debugsource-3.0.10-22.4.1 References: https://bugzilla.novell.com/824025

1 0

openSUSE-RU-2013:1068-1: moderate: logwatch: understand newer rsyslog-timestamps
by maintenance＠opensuse.org 24 Jun '13

24 Jun '13

openSUSE Recommended Update: logwatch: understand newer rsyslog-timestamps ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1068-1 Rating: moderate References: #818842 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This udpate fixes the following issue with logwatch: - bnc#818842: Parse rsyslog-timestamps Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-526 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): logwatch-7.4.0-8.5.1 References: https://bugzilla.novell.com/818842

1 0

openSUSE-SU-2013:1065-1: moderate: update for phpMyAdmin
by opensuse-security＠opensuse.org 21 Jun '13

21 Jun '13

openSUSE Security Update: update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1065-1 Rating: moderate References: #814678 #824301 #824302 Cross-References: CVE-2013-1937 CVE-2013-3238 CVE-2013-3239 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update of phpMyAdmin fixes several security issues. - update to 3.5.8.1 (2013-04-24) * [security] Remote code execution (preg_replace), reported by Janek Vind (see PMASA-2013-2) * [security] Locally Saved SQL Dump File Multiple File Extension Remote Code Execution, reported by Janek Vind (see PMASA-2013-3) - fix for bnc#824301 * PMASA-2013-2 (CVE-2013-3238) - fix for bnc#824302 * PMASA-2013-3 (CVE-2013-3239) - update to 3.5.8 (2013-04-08) * sf#3828 MariaDB reported as MySQL * sf#3854 Incorrect header for Safari 6.0 * sf#3705 Attempt to open trigger for edit gives NULL * Use HTML5 DOCTYPE * [security] Self-XSS on GIS visualisation page, reported by Janek Vind see PMASA-2013-1 * sf#3800 Incorrect keyhandler behaviour #2 - fix for bnc#814678 * PMASA-2013-1 (CVE-2013-1937) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-524 - openSUSE 12.2: zypper in -t patch openSUSE-2013-524 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): phpMyAdmin-3.5.8.1-1.4.1 - openSUSE 12.2 (noarch): phpMyAdmin-3.5.8.1-1.12.1 References: http://support.novell.com/security/cve/CVE-2013-1937.html http://support.novell.com/security/cve/CVE-2013-3238.html http://support.novell.com/security/cve/CVE-2013-3239.html https://bugzilla.novell.com/814678 https://bugzilla.novell.com/824301 https://bugzilla.novell.com/824302

1 0

openSUSE-SU-2013:1064-1: moderate: update for python-pymongo, python3-pymongo
by opensuse-security＠opensuse.org 21 Jun '13

21 Jun '13

openSUSE Security Update: update for python-pymongo, python3-pymongo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1064-1 Rating: moderate References: #822798 Cross-References: CVE-2013-2132 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of pymongo fixes a null pointer issue. - Add Fix-null-pointer-when-decoding-invalid-DBRef.patch * Fixed user-triggerable NULL pointer dereference due to utter plebbery (CVE-2013-2132, bnc#822798) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-522 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): python-pymongo-2.4.1-2.4.1 python-pymongo-debuginfo-2.4.1-2.4.1 python-pymongo-debugsource-2.4.1-2.4.1 python3-pymongo-2.4.1-2.4.1 python3-pymongo-debuginfo-2.4.1-2.4.1 python3-pymongo-debugsource-2.4.1-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-2132.html https://bugzilla.novell.com/822798

1 0

openSUSE-SU-2013:1063-1: moderate: update for flash-player
by opensuse-security＠opensuse.org 21 Jun '13

21 Jun '13

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1063-1 Rating: moderate References: #824512 Cross-References: CVE-2013-3343 Affected Products: openSUSE 12.3:NonFree openSUSE 12.2:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This updates of Adobe Flash Player addresses current security problems. - Update to 11.2.202.291: (bnc#824512) * APSB13-16, CVE-2013-3343 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2013-523 - openSUSE 12.2:NonFree: zypper in -t patch openSUSE-2013-523 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.291-2.28.1 flash-player-gnome-11.2.202.291-2.28.1 flash-player-kde4-11.2.202.291-2.28.1 - openSUSE 12.2:NonFree (i586 x86_64): flash-player-11.2.202.291-1.52.1 flash-player-gnome-11.2.202.291-1.52.1 flash-player-kde4-11.2.202.291-1.52.1 References: http://support.novell.com/security/cve/CVE-2013-3343.html https://bugzilla.novell.com/824512

1 0

openSUSE-RU-2013:1057-1: moderate: systemd: several fixes
by maintenance＠opensuse.org 20 Jun '13

20 Jun '13

openSUSE Recommended Update: systemd: several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1057-1 Rating: moderate References: #808144 #808319 #809420 #820454 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following issues with systemd: - bnc#808144: allow removal of some specific symlinks created when enabling services - bnc#820454: fix potential memory corruption - bnc#809420: ensure /boot/sysctl.conf-<kernel_release> is handled - bnc#808319: update logind-nvidia-acl.diff to apply ACL to /dev/nvidia* Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-520 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libgudev-1_0-0-195-13.29.1 libgudev-1_0-0-debuginfo-195-13.29.1 libgudev-1_0-devel-195-13.29.1 libudev-devel-195-13.29.1 libudev-mini-devel-195-13.29.1 libudev-mini1-195-13.29.1 libudev-mini1-debuginfo-195-13.29.1 libudev1-195-13.29.1 libudev1-debuginfo-195-13.29.1 systemd-195-13.29.1 systemd-analyze-195-13.29.1 systemd-debuginfo-195-13.29.1 systemd-debugsource-195-13.29.1 systemd-devel-195-13.29.1 systemd-logger-195-13.29.1 systemd-mini-195-13.29.1 systemd-mini-analyze-195-13.29.1 systemd-mini-debuginfo-195-13.29.1 systemd-mini-debugsource-195-13.29.1 systemd-mini-devel-195-13.29.1 systemd-mini-sysvinit-195-13.29.1 systemd-sysvinit-195-13.29.1 typelib-1_0-GUdev-1_0-195-13.29.1 udev-195-13.29.1 udev-debuginfo-195-13.29.1 udev-mini-195-13.29.1 udev-mini-debuginfo-195-13.29.1 - openSUSE 12.3 (x86_64): libgudev-1_0-0-32bit-195-13.29.1 libgudev-1_0-0-debuginfo-32bit-195-13.29.1 libudev1-32bit-195-13.29.1 libudev1-debuginfo-32bit-195-13.29.1 systemd-32bit-195-13.29.1 systemd-debuginfo-32bit-195-13.29.1 References: https://bugzilla.novell.com/808144 https://bugzilla.novell.com/808319 https://bugzilla.novell.com/809420 https://bugzilla.novell.com/820454

1 0

openSUSE-RU-2013:1056-1: acpid: let init handle process stopping
by maintenance＠opensuse.org 20 Jun '13

20 Jun '13

openSUSE Recommended Update: acpid: let init handle process stopping ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1056-1 Rating: low References: #819914 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with acpid: - bnc#819914: Remove ExecStop from systemd service file and let init handle process stopping, otherwise the service may hang during shutdown Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-521 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): acpid-2.0.17-2.4.1 acpid-debuginfo-2.0.17-2.4.1 acpid-debugsource-2.0.17-2.4.1 References: https://bugzilla.novell.com/819914

1 0

openSUSE-RU-2013:1055-1: moderate: systemd: several fixes
by maintenance＠opensuse.org 20 Jun '13

20 Jun '13

openSUSE Recommended Update: systemd: several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1055-1 Rating: moderate References: #793411 #796171 #804575 #808144 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following issues with systemd: - bnc#808144: allow removal of some specific symlinks created when enabling services - bnc#804575: handle rbind mount correctly - bnc#793411: + update parse-multiline-env-file.patch to correctly handle commented line + correctly parse multiline environment files - bnc#796171: ensure some mounts points are not umounted before initscripts Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-519 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): systemd-44-10.15.1 systemd-analyze-44-10.15.1 systemd-debuginfo-44-10.15.1 systemd-debugsource-44-10.15.1 systemd-devel-44-10.15.1 systemd-gtk-44-10.15.1 systemd-gtk-debuginfo-44-10.15.1 systemd-gtk-debugsource-44-10.15.1 systemd-sysvinit-44-10.15.1 - openSUSE 12.2 (x86_64): systemd-32bit-44-10.15.1 systemd-debuginfo-32bit-44-10.15.1 References: https://bugzilla.novell.com/793411 https://bugzilla.novell.com/796171 https://bugzilla.novell.com/804575 https://bugzilla.novell.com/808144

1 0

openSUSE-RU-2013:1054-1: important: nfs-utils: avoid unmount filesystems after update
by maintenance＠opensuse.org 20 Jun '13

20 Jun '13

openSUSE Recommended Update: nfs-utils: avoid unmount filesystems after update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1054-1 Rating: important References: #825150 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with nfs-utils: - bnc#825150: Guard against blank lines in /run/nfs/bind.mounts causing all filesystems from being unmounted. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-518 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): nfs-client-1.2.7-2.10.1 nfs-client-debuginfo-1.2.7-2.10.1 nfs-doc-1.2.7-2.10.1 nfs-kernel-server-1.2.7-2.10.1 nfs-kernel-server-debuginfo-1.2.7-2.10.1 nfs-utils-debugsource-1.2.7-2.10.1 References: https://bugzilla.novell.com/825150

1 0