June 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1090-1: moderate: update for python-keystoneclient
by opensuse-security＠opensuse.org 27 Jun '13

27 Jun '13

openSUSE Security Update: update for python-keystoneclient ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1090-1 Rating: moderate References: #817415 Cross-References: CVE-2013-2013 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of python-keystoneclient fixes a security vulnerability. - Add CVE-2013-2013.patch: allow secure user password update (CVE-2013-2013, bnc#817415). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-541 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): python-keystoneclient-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.8.1 python-keystoneclient-doc-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.8.1 python-keystoneclient-test-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.8.1 References: http://support.novell.com/security/cve/CVE-2013-2013.html https://bugzilla.novell.com/817415

1 0

openSUSE-SU-2013:1089-1: moderate: update for openstack-keystone
by opensuse-security＠opensuse.org 27 Jun '13

27 Jun '13

openSUSE Security Update: update for openstack-keystone ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1089-1 Rating: moderate References: #821201 #823783 Cross-References: CVE-2013-2104 CVE-2013-2157 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of openstack-keystone fixes two security vulnerabilities. - Add CVE-2013-2104.patch: fix missing expiration check in Keystone PKI token validation (CVE-2013-2104, bnc#821201) - Add CVE-2013-2157.patch: fix authentication bypass when using LDAP backend (CVE-2013-2157, bnc#823783) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-540 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): openstack-keystone-2012.2.4+git.1363796849.255b1d4-3.16.1 openstack-keystone-doc-2012.2.4+git.1363796849.255b1d4-3.16.1 openstack-keystone-test-2012.2.4+git.1363796849.255b1d4-3.16.1 python-keystone-2012.2.4+git.1363796849.255b1d4-3.16.1 References: http://support.novell.com/security/cve/CVE-2013-2104.html http://support.novell.com/security/cve/CVE-2013-2157.html https://bugzilla.novell.com/821201 https://bugzilla.novell.com/823783

1 0

openSUSE-SU-2013:1087-1: moderate: update for openstack-nova
by opensuse-security＠opensuse.org 27 Jun '13

27 Jun '13

openSUSE Security Update: update for openstack-nova ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1087-1 Rating: moderate References: #819349 Cross-References: CVE-2013-2030 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of openstack-nova fixes a security vulnerability. - Add CVE-2013-2030.patch: fix insecure keystone middleware tmpdir by default (CVE-2013-2030, bnc#819349). - Use explicit keystone-signing dir to workaround lp#1181157. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-539 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): python-greenlet-0.4.0-3.3.1 python-greenlet-debuginfo-0.4.0-3.3.1 python-greenlet-debugsource-0.4.0-3.3.1 - openSUSE 12.3 (noarch): openstack-nova-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-api-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-cert-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-compute-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-doc-2012.2.4+git.1363297910.9561484-2.10.4 openstack-nova-network-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-novncproxy-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-objectstore-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-scheduler-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-test-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-vncproxy-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-volume-2012.2.4+git.1363297910.9561484-2.10.1 python-greenlet-devel-0.4.0-3.3.1 python-nova-2012.2.4+git.1363297910.9561484-2.10.1 References: http://support.novell.com/security/cve/CVE-2013-2030.html https://bugzilla.novell.com/819349

1 0

openSUSE-SU-2013:1086-1: moderate: wireshark
by opensuse-security＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Security Update: wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1086-1 Rating: moderate References: #823932 Cross-References: CVE-2013-3555 CVE-2013-3556 CVE-2013-3557 CVE-2013-3558 CVE-2013-3559 CVE-2013-3560 CVE-2013-3561 CVE-2013-3562 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update of wireshark includes several security and bug fixes. - update to 1.8.8 [bnc#823932] + vulnerabilities fixed: * The CAPWAP dissector could crash. wnpa-sec-2013-32 * The GMR-1 BCCH dissector could crash. wnpa-sec-2013-33 * The PPP dissector could crash. wnpa-sec-2013-34 * The NBAP dissector could crash. wnpa-sec-2013-35 * The RDP dissector could crash. wnpa-sec-2013-36 * The GSM CBCH dissector could crash. wnpa-sec-2013-37 * The Assa Abloy R3 dissector could consume excessive memory and CPU. wnpa-sec-2013-38 * The HTTP dissector could overrun the stack. wnpa-sec-2013-39 * The Ixia IxVeriWave file parser could overflow the heap. wnpa-sec-2013-40 * The DCP ETSI dissector could crash. wnpa-sec-2013-41 + Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.8.8.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-97 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): wireshark-1.8.8-49.1 wireshark-debuginfo-1.8.8-49.1 wireshark-debugsource-1.8.8-49.1 wireshark-devel-1.8.8-49.1 References: http://support.novell.com/security/cve/CVE-2013-3555.html http://support.novell.com/security/cve/CVE-2013-3556.html http://support.novell.com/security/cve/CVE-2013-3557.html http://support.novell.com/security/cve/CVE-2013-3558.html http://support.novell.com/security/cve/CVE-2013-3559.html http://support.novell.com/security/cve/CVE-2013-3560.html http://support.novell.com/security/cve/CVE-2013-3561.html http://support.novell.com/security/cve/CVE-2013-3562.html https://bugzilla.novell.com/823932

1 0

openSUSE-SU-2013:1085-1: moderate: update for libraw
by opensuse-security＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Security Update: update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1085-1 Rating: moderate References: #822665 Cross-References: CVE-2013-2126 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of libraw fixes a security issue. - security update: * CVE-2013-2126.patch [bnc#822665] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-537 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (x86_64): libraw-debugsource-0.14.7-3.4.1 libraw-devel-0.14.7-3.4.1 libraw-devel-static-0.14.7-3.4.1 libraw-tools-0.14.7-3.4.1 libraw-tools-debuginfo-0.14.7-3.4.1 libraw5-0.14.7-3.4.1 libraw5-debuginfo-0.14.7-3.4.1 - openSUSE 12.3 (i586): libraw-debugsource-0.14.7-3.4.2 libraw-devel-0.14.7-3.4.2 libraw-devel-static-0.14.7-3.4.2 libraw-tools-0.14.7-3.4.2 libraw-tools-debuginfo-0.14.7-3.4.2 libraw5-0.14.7-3.4.2 libraw5-debuginfo-0.14.7-3.4.2 References: http://support.novell.com/security/cve/CVE-2013-2126.html https://bugzilla.novell.com/822665

1 0

openSUSE-SU-2013:1084-1: moderate: update for wireshark
by opensuse-security＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Security Update: update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1084-1 Rating: moderate References: #823932 Cross-References: CVE-2013-3555 CVE-2013-3556 CVE-2013-3557 CVE-2013-3558 CVE-2013-3559 CVE-2013-3560 CVE-2013-3561 CVE-2013-3562 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update of wireshark includes several security and bug fixes. - update to 1.8.8 [bnc#823932] + vulnerabilities fixed: * The CAPWAP dissector could crash. wnpa-sec-2013-32 * The GMR-1 BCCH dissector could crash. wnpa-sec-2013-33 * The PPP dissector could crash. wnpa-sec-2013-34 * The NBAP dissector could crash. wnpa-sec-2013-35 * The RDP dissector could crash. wnpa-sec-2013-36 * The GSM CBCH dissector could crash. wnpa-sec-2013-37 * The Assa Abloy R3 dissector could consume excessive memory and CPU. wnpa-sec-2013-38 * The HTTP dissector could overrun the stack. wnpa-sec-2013-39 * The Ixia IxVeriWave file parser could overflow the heap. wnpa-sec-2013-40 * The DCP ETSI dissector could crash. wnpa-sec-2013-41 + Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.8.8.html wnpa-sec-2013-24 CVE-2013-3555 wnpa-sec-2013-25 CVE-2013-3556 CVE-2013-3557 wnpa-sec-2013-26 CVE-2013-3558 wnpa-sec-2013-27 CVE-2013-3559 wnpa-sec-2013-28 CVE-2013-3560 wnpa-sec-2013-29 CVE-2013-3561 CVE-2013-3562 wnpa-sec-2013-30 CVE-2013-3561 wnpa-sec-2013-31 CVE-2013-3561 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-536 - openSUSE 12.2: zypper in -t patch openSUSE-2013-536 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): wireshark-1.8.8-1.12.1 wireshark-debuginfo-1.8.8-1.12.1 wireshark-debugsource-1.8.8-1.12.1 wireshark-devel-1.8.8-1.12.1 - openSUSE 12.2 (i586 x86_64): wireshark-1.8.8-1.31.1 wireshark-debuginfo-1.8.8-1.31.1 wireshark-debugsource-1.8.8-1.31.1 wireshark-devel-1.8.8-1.31.1 References: http://support.novell.com/security/cve/CVE-2013-3555.html http://support.novell.com/security/cve/CVE-2013-3556.html http://support.novell.com/security/cve/CVE-2013-3557.html http://support.novell.com/security/cve/CVE-2013-3558.html http://support.novell.com/security/cve/CVE-2013-3559.html http://support.novell.com/security/cve/CVE-2013-3560.html http://support.novell.com/security/cve/CVE-2013-3561.html http://support.novell.com/security/cve/CVE-2013-3562.html https://bugzilla.novell.com/823932

1 0

openSUSE-SU-2013:1083-1: moderate: update for darktable
by opensuse-security＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Security Update: update for darktable ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1083-1 Rating: moderate References: #823114 Cross-References: CVE-2013-2126 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of darktable fixes a problem inside the embedded libraw version. - Fix for CVE-2013-2126 * added backported patch from git master 0001-fixed-error-handling-for-broken-full-color-images.patch fixes bnc#823114- Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-538 - openSUSE 12.2: zypper in -t patch openSUSE-2013-538 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (x86_64): darktable-1.1.3-1.5.3 darktable-debuginfo-1.1.3-1.5.3 darktable-debugsource-1.1.3-1.5.3 darktable-doc-1.1.3-1.5.3 - openSUSE 12.3 (i586): darktable-1.1.3-1.5.4 darktable-debuginfo-1.1.3-1.5.4 darktable-debugsource-1.1.3-1.5.4 darktable-doc-1.1.3-1.5.4 - openSUSE 12.2 (i586 x86_64): darktable-1.0.5-3.9.3 darktable-debuginfo-1.0.5-3.9.3 darktable-debugsource-1.0.5-3.9.3 References: http://support.novell.com/security/cve/CVE-2013-2126.html https://bugzilla.novell.com/823114

1 0

openSUSE-RU-2013:1082-1: libstorage: Two fixes
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: libstorage: Two fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1082-1 Rating: low References: #810305 #825503 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with libstorage: - bnc#825503: adapt to changed functionality of losetup - bnc#810305: fix wrong size calculation when deleting thin LVs Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-535 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libstorage-debugsource-2.23.11-1.8.1 libstorage-devel-2.23.11-1.8.1 libstorage-python-2.23.11-1.8.1 libstorage-python-debuginfo-2.23.11-1.8.1 libstorage-ruby-2.23.11-1.8.1 libstorage-ruby-debuginfo-2.23.11-1.8.1 libstorage-testsuite-2.23.11-1.8.1 libstorage-testsuite-debuginfo-2.23.11-1.8.1 libstorage4-2.23.11-1.8.1 libstorage4-debuginfo-2.23.11-1.8.1 yast2-storage-2.23.9-1.7.1 yast2-storage-debuginfo-2.23.9-1.7.1 yast2-storage-debugsource-2.23.9-1.7.1 yast2-storage-devel-2.23.9-1.7.1 References: https://bugzilla.novell.com/810305 https://bugzilla.novell.com/825503

1 0

openSUSE-RU-2013:1081-1: important: icedtea-web: Regression-fix after the last openjdk
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: icedtea-web: Regression-fix after the last openjdk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1081-1 Rating: important References: #825880 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with icedtea-web: - bnc#825880: fix icedtea-web broken by last openjdk security update Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-533 - openSUSE 12.2: zypper in -t patch openSUSE-2013-533 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): icedtea-web-1.4-4.18.1 icedtea-web-debuginfo-1.4-4.18.1 icedtea-web-debugsource-1.4-4.18.1 - openSUSE 12.3 (noarch): icedtea-web-javadoc-1.4-4.18.1 - openSUSE 12.2 (i586 x86_64): icedtea-web-1.4-1.21.1 icedtea-web-debuginfo-1.4-1.21.1 icedtea-web-debugsource-1.4-1.21.1 - openSUSE 12.2 (noarch): icedtea-web-javadoc-1.4-1.21.1 References: https://bugzilla.novell.com/825880

1 0

openSUSE-RU-2013:1080-1: liferea: update to 1.8.14
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: liferea: update to 1.8.14 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1080-1 Rating: low References: #823576 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with liferea: - bnc#823576: Update to version * sf#1069: fixed broken rendering in tt-rss feeds + with combined 1.8.13 fixes: * Fixes missing item list update when browsing item URLs in Liferea * Fixes format string issues in several translations. * Added Hebrew translation of reference manual page * Added MimeType to .desktop file * sf#1040: In feed entries, spaces are replaced with "+" * sf#1051: Issues in RTL GUI of Liferea * sf#1038, sf#1074: Updates ttrss feeds over and over * Updated the default feedlists * Added Vietnamese translation * Updated translations - Update to version 1.8.12: * sf#1041: Some GPLv2 license headers were outdated * sf#1044: tt-rss API changed (we now support only 1.6 API) * Fixes XHTML errors caused by extra body tags from tt-rss - Changes from version 1.8.11: * Added Google Plus to social bookmarking options. * deb#668197: x-www-browser preference not working * sf#1037: Incorrect notifications for Google Reader * sf#1048: Removed all feedvalidator.org references from FAQ and XSLT as it was reported to host malware * Updated translations. - Update to version 1.8.10: * sf#3572660: Fix crash in google_source_remove_node * Prevents adding folders/search folders/newsbins to Google Reader. * Prevents sorting subscriptions in Google Reader * Fixes items not removed from search folder count when feed is removed. * Fixes search folder rebuilding (do not include comment items). * Fixes SELECT offset handling when rebuilding search folders. - Update to version 1.8.9: * sf#3564393: Added Instapaper.com to social bookmarking sites * sf#3567715: Fix crash on network online status changes * Fixes preferences dialog not showing up a second time. * Fixes reloading item when browsing inside the item view. - Update to version 1.8.8: * sf#3557513: Fixes crash on empty links in auto-load-link mode * Ensure node ids are in DB node relation on startup. * Fixes search folder counter update on feed removal. * Include AM_PROG_AR in configure.ac to work with automake 1.12. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-531 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): liferea-1.8.14-2.9.1 liferea-debuginfo-1.8.14-2.9.1 liferea-debugsource-1.8.14-2.9.1 - openSUSE 12.2 (noarch): liferea-lang-1.8.14-2.9.1 References: https://bugzilla.novell.com/823576

1 0

openSUSE-RU-2013:1079-1: liferea: update to 1.8.14
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: liferea: update to 1.8.14 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1079-1 Rating: low References: #823576 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with liferea: - bnc#823576: Update to version * sf#1069: broken rendering in tt-rss feeds + with combined 1.8.13 fixes: * Fixes missing item list update when browsing item URLs in Liferea * Fixes format string issues in several translations. * Added Hebrew translation of reference manual page * Added MimeType to .desktop file * sf#1040: In feed entries, spaces are replaced with "+" * sf#1051: Issues in RTL GUI of Liferea * sf#1038, sf#1074: Updates ttrss feeds over and over * Updated the default feedlists * Added Vietnamese translation * Updated translations Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-530 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): liferea-1.8.14-2.7.1 liferea-debuginfo-1.8.14-2.7.1 liferea-debugsource-1.8.14-2.7.1 - openSUSE 12.3 (noarch): liferea-lang-1.8.14-2.7.1 References: https://bugzilla.novell.com/823576

1 0

openSUSE-RU-2013:1078-1: moderate: perl-X500-DN: don't set $Parse::RecDescent::skip to 'undef'
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: perl-X500-DN: don't set $Parse::RecDescent::skip to 'undef' ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1078-1 Rating: moderate References: #799660 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with perl-X500-DN: - bnc#799660: don't set $Parse::RecDescent::skip to 'undef' (e.g. this makes yast2-ldap-server configurable again) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-532 - openSUSE 12.2: zypper in -t patch openSUSE-2013-532 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): perl-X500-DN-0.29-100.4.1 - openSUSE 12.2 (i586 x86_64): perl-X500-DN-0.29-98.4.1 References: https://bugzilla.novell.com/799660

1 0

openSUSE-RU-2013:1077-1: libxml2: fix a leak in lzma code
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: libxml2: fix a leak in lzma code ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1077-1 Rating: low References: #823792 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with libxml2: - bnc#823792: fix a leak in lzma code Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-534 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libxml2-2-2.7.8+git20120223-8.26.1 libxml2-2-debuginfo-2.7.8+git20120223-8.26.1 libxml2-debugsource-2.7.8+git20120223-8.26.1 libxml2-devel-2.7.8+git20120223-8.26.1 libxml2-tools-2.7.8+git20120223-8.26.1 libxml2-tools-debuginfo-2.7.8+git20120223-8.26.1 python-libxml2-2.7.8+git20120223-8.26.1 python-libxml2-debuginfo-2.7.8+git20120223-8.26.1 python-libxml2-debugsource-2.7.8+git20120223-8.26.1 - openSUSE 12.2 (x86_64): libxml2-2-32bit-2.7.8+git20120223-8.26.1 libxml2-2-debuginfo-32bit-2.7.8+git20120223-8.26.1 libxml2-devel-32bit-2.7.8+git20120223-8.26.1 - openSUSE 12.2 (noarch): libxml2-doc-2.7.8+git20120223-8.26.1 References: https://bugzilla.novell.com/823792

1 0

openSUSE-SU-2013:1072-1: moderate: update for openconnect
by opensuse-security＠opensuse.org 24 Jun '13

24 Jun '13

openSUSE Security Update: update for openconnect ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1072-1 Rating: moderate References: #767616 Cross-References: CVE-2012-3291 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This openconnect update to version 3.20 includes several security and bug fixes. - fix bnc#767616 - fix for CVE-2012-3291 - make vpnc mandatory during build, following upstream changes - package documentation in a -doc package - Update to version 3.20 * Cope with non-keepalive HTTP response on authentication success. * Fix progress callback with incorrect cbdata which caused KDE crash. - Update to version 3.19 * Enable native TPM support when built with GnuTLS. * Enable PKCS#11 token support when built with GnuTLS. * Eliminate all SSL library exposure through libopenconnect. * Parse split DNS information, provide $CISCO_SPLIT_DNS environment variable to vpnc-script. * Attempt to provide new-style MTU information to server (on Linux only, unless specified on command line). * Allow building against GnuTLS, including DTLS support. * Add --with-pkgconfigdir= option to configure for FreeBSD's benefit (fd#48743). - Update to version 3.18 * Fix autohate breakage with --disable-nls... hopefully. * Fix buffer overflow in banner handling. - Update to version 3.17 * Work around time() brokenness on Solaris. * Fix interface plumbing on Solaris 10. * Provide asprintf() function for (unpatched) Solaris 10. * Make vpnc-script mandatory, like it is for vpnc * Don't set Legacy IP address on tun device; let vpnc-script do it. * Detect OpenSSL even without pkg-config. * Stop building static library by default. * Invoke vpnc-script with "pre-init" reason to load tun module if necessary. - Update to version 3.16 * Fix build failure on Debian/kFreeBSD and Hurd. * Fix memory leak of deflated packets. * Fix memory leak of zlib state on CSTP reconnect. * Eliminate memcpy() calls on packets from DTLS and tunnel device. * Use I_LINK instead of I_PLINK on Solaris to plumb interface for Legacy IP. * Plumb interface for IPv6 on Solaris, instead of expecting vpnc-script to do it. * Refer to vpnc-script and help web pages in openconnect output. * Fix potential crash when processing libproxy results. * Be more conservative in detecting libproxy without pkg-config. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-529 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): openconnect-3.20-2.4.1 openconnect-debuginfo-3.20-2.4.1 openconnect-debugsource-3.20-2.4.1 openconnect-devel-3.20-2.4.1 openconnect-doc-3.20-2.4.1 - openSUSE 12.2 (noarch): openconnect-lang-3.20-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-3291.html https://bugzilla.novell.com/767616

1 0

openSUSE-RU-2013:1071-1: important: mdadm: Two fixes
by maintenance＠opensuse.org 24 Jun '13

24 Jun '13

openSUSE Recommended Update: mdadm: Two fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1071-1 Rating: important References: #793954 #821366 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with mdadm: - bnc#793954: + avoid some races during array assembled- particularly at boot + make sure systemd-udev-trigger runs before boot.md to avoid races - bnc#821366: mdmon@.service - allow mdmon to be started by systemd, so systemd doesn't kill it Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-528 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): mdadm-3.2.6-3.4.1 mdadm-debuginfo-3.2.6-3.4.1 mdadm-debugsource-3.2.6-3.4.1 References: https://bugzilla.novell.com/793954 https://bugzilla.novell.com/821366

1 0

openSUSE-RU-2013:1070-1: xorg-x11-Xvnc: Build with GLX extension
by maintenance＠opensuse.org 24 Jun '13

24 Jun '13

openSUSE Recommended Update: xorg-x11-Xvnc: Build with GLX extension ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1070-1 Rating: low References: #823625 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with xorg-x11-Xvnc: - bnc#823625: Build with GLX extension. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-527 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): xorg-x11-Xvnc-7.6_1.0.1-3.4.4 xorg-x11-Xvnc-debuginfo-7.6_1.0.1-3.4.4 xorg-x11-Xvnc-debugsource-7.6_1.0.1-3.4.4 References: https://bugzilla.novell.com/823625

1 0

openSUSE-RU-2013:1069-1: dosfstools: fix dosfslabel crash
by maintenance＠opensuse.org 24 Jun '13

24 Jun '13

openSUSE Recommended Update: dosfstools: fix dosfslabel crash ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1069-1 Rating: low References: #824025 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes fixes the following issue with dosfstools: - bnc#824025: dosfslabel was crashing when allocating new rootdir entry. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-525 - openSUSE 12.2: zypper in -t patch openSUSE-2013-525 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): dosfstools-3.0.10-26.4.1 dosfstools-debuginfo-3.0.10-26.4.1 dosfstools-debugsource-3.0.10-26.4.1 - openSUSE 12.2 (i586 x86_64): dosfstools-3.0.10-22.4.1 dosfstools-debuginfo-3.0.10-22.4.1 dosfstools-debugsource-3.0.10-22.4.1 References: https://bugzilla.novell.com/824025

1 0

openSUSE-RU-2013:1068-1: moderate: logwatch: understand newer rsyslog-timestamps
by maintenance＠opensuse.org 24 Jun '13

24 Jun '13

openSUSE Recommended Update: logwatch: understand newer rsyslog-timestamps ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1068-1 Rating: moderate References: #818842 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This udpate fixes the following issue with logwatch: - bnc#818842: Parse rsyslog-timestamps Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-526 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): logwatch-7.4.0-8.5.1 References: https://bugzilla.novell.com/818842

1 0

openSUSE-SU-2013:1065-1: moderate: update for phpMyAdmin
by opensuse-security＠opensuse.org 21 Jun '13

21 Jun '13

openSUSE Security Update: update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1065-1 Rating: moderate References: #814678 #824301 #824302 Cross-References: CVE-2013-1937 CVE-2013-3238 CVE-2013-3239 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update of phpMyAdmin fixes several security issues. - update to 3.5.8.1 (2013-04-24) * [security] Remote code execution (preg_replace), reported by Janek Vind (see PMASA-2013-2) * [security] Locally Saved SQL Dump File Multiple File Extension Remote Code Execution, reported by Janek Vind (see PMASA-2013-3) - fix for bnc#824301 * PMASA-2013-2 (CVE-2013-3238) - fix for bnc#824302 * PMASA-2013-3 (CVE-2013-3239) - update to 3.5.8 (2013-04-08) * sf#3828 MariaDB reported as MySQL * sf#3854 Incorrect header for Safari 6.0 * sf#3705 Attempt to open trigger for edit gives NULL * Use HTML5 DOCTYPE * [security] Self-XSS on GIS visualisation page, reported by Janek Vind see PMASA-2013-1 * sf#3800 Incorrect keyhandler behaviour #2 - fix for bnc#814678 * PMASA-2013-1 (CVE-2013-1937) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-524 - openSUSE 12.2: zypper in -t patch openSUSE-2013-524 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): phpMyAdmin-3.5.8.1-1.4.1 - openSUSE 12.2 (noarch): phpMyAdmin-3.5.8.1-1.12.1 References: http://support.novell.com/security/cve/CVE-2013-1937.html http://support.novell.com/security/cve/CVE-2013-3238.html http://support.novell.com/security/cve/CVE-2013-3239.html https://bugzilla.novell.com/814678 https://bugzilla.novell.com/824301 https://bugzilla.novell.com/824302

1 0

openSUSE-SU-2013:1064-1: moderate: update for python-pymongo, python3-pymongo
by opensuse-security＠opensuse.org 21 Jun '13

21 Jun '13

openSUSE Security Update: update for python-pymongo, python3-pymongo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1064-1 Rating: moderate References: #822798 Cross-References: CVE-2013-2132 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of pymongo fixes a null pointer issue. - Add Fix-null-pointer-when-decoding-invalid-DBRef.patch * Fixed user-triggerable NULL pointer dereference due to utter plebbery (CVE-2013-2132, bnc#822798) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-522 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): python-pymongo-2.4.1-2.4.1 python-pymongo-debuginfo-2.4.1-2.4.1 python-pymongo-debugsource-2.4.1-2.4.1 python3-pymongo-2.4.1-2.4.1 python3-pymongo-debuginfo-2.4.1-2.4.1 python3-pymongo-debugsource-2.4.1-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-2132.html https://bugzilla.novell.com/822798

1 0

openSUSE-SU-2013:1063-1: moderate: update for flash-player
by opensuse-security＠opensuse.org 21 Jun '13

21 Jun '13

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1063-1 Rating: moderate References: #824512 Cross-References: CVE-2013-3343 Affected Products: openSUSE 12.3:NonFree openSUSE 12.2:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This updates of Adobe Flash Player addresses current security problems. - Update to 11.2.202.291: (bnc#824512) * APSB13-16, CVE-2013-3343 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2013-523 - openSUSE 12.2:NonFree: zypper in -t patch openSUSE-2013-523 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.291-2.28.1 flash-player-gnome-11.2.202.291-2.28.1 flash-player-kde4-11.2.202.291-2.28.1 - openSUSE 12.2:NonFree (i586 x86_64): flash-player-11.2.202.291-1.52.1 flash-player-gnome-11.2.202.291-1.52.1 flash-player-kde4-11.2.202.291-1.52.1 References: http://support.novell.com/security/cve/CVE-2013-3343.html https://bugzilla.novell.com/824512

1 0

openSUSE-RU-2013:1057-1: moderate: systemd: several fixes
by maintenance＠opensuse.org 20 Jun '13

20 Jun '13

openSUSE Recommended Update: systemd: several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1057-1 Rating: moderate References: #808144 #808319 #809420 #820454 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following issues with systemd: - bnc#808144: allow removal of some specific symlinks created when enabling services - bnc#820454: fix potential memory corruption - bnc#809420: ensure /boot/sysctl.conf-<kernel_release> is handled - bnc#808319: update logind-nvidia-acl.diff to apply ACL to /dev/nvidia* Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-520 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libgudev-1_0-0-195-13.29.1 libgudev-1_0-0-debuginfo-195-13.29.1 libgudev-1_0-devel-195-13.29.1 libudev-devel-195-13.29.1 libudev-mini-devel-195-13.29.1 libudev-mini1-195-13.29.1 libudev-mini1-debuginfo-195-13.29.1 libudev1-195-13.29.1 libudev1-debuginfo-195-13.29.1 systemd-195-13.29.1 systemd-analyze-195-13.29.1 systemd-debuginfo-195-13.29.1 systemd-debugsource-195-13.29.1 systemd-devel-195-13.29.1 systemd-logger-195-13.29.1 systemd-mini-195-13.29.1 systemd-mini-analyze-195-13.29.1 systemd-mini-debuginfo-195-13.29.1 systemd-mini-debugsource-195-13.29.1 systemd-mini-devel-195-13.29.1 systemd-mini-sysvinit-195-13.29.1 systemd-sysvinit-195-13.29.1 typelib-1_0-GUdev-1_0-195-13.29.1 udev-195-13.29.1 udev-debuginfo-195-13.29.1 udev-mini-195-13.29.1 udev-mini-debuginfo-195-13.29.1 - openSUSE 12.3 (x86_64): libgudev-1_0-0-32bit-195-13.29.1 libgudev-1_0-0-debuginfo-32bit-195-13.29.1 libudev1-32bit-195-13.29.1 libudev1-debuginfo-32bit-195-13.29.1 systemd-32bit-195-13.29.1 systemd-debuginfo-32bit-195-13.29.1 References: https://bugzilla.novell.com/808144 https://bugzilla.novell.com/808319 https://bugzilla.novell.com/809420 https://bugzilla.novell.com/820454

1 0

openSUSE-RU-2013:1056-1: acpid: let init handle process stopping
by maintenance＠opensuse.org 20 Jun '13

20 Jun '13

openSUSE Recommended Update: acpid: let init handle process stopping ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1056-1 Rating: low References: #819914 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with acpid: - bnc#819914: Remove ExecStop from systemd service file and let init handle process stopping, otherwise the service may hang during shutdown Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-521 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): acpid-2.0.17-2.4.1 acpid-debuginfo-2.0.17-2.4.1 acpid-debugsource-2.0.17-2.4.1 References: https://bugzilla.novell.com/819914

1 0

openSUSE-RU-2013:1055-1: moderate: systemd: several fixes
by maintenance＠opensuse.org 20 Jun '13

20 Jun '13

openSUSE Recommended Update: systemd: several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1055-1 Rating: moderate References: #793411 #796171 #804575 #808144 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following issues with systemd: - bnc#808144: allow removal of some specific symlinks created when enabling services - bnc#804575: handle rbind mount correctly - bnc#793411: + update parse-multiline-env-file.patch to correctly handle commented line + correctly parse multiline environment files - bnc#796171: ensure some mounts points are not umounted before initscripts Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-519 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): systemd-44-10.15.1 systemd-analyze-44-10.15.1 systemd-debuginfo-44-10.15.1 systemd-debugsource-44-10.15.1 systemd-devel-44-10.15.1 systemd-gtk-44-10.15.1 systemd-gtk-debuginfo-44-10.15.1 systemd-gtk-debugsource-44-10.15.1 systemd-sysvinit-44-10.15.1 - openSUSE 12.2 (x86_64): systemd-32bit-44-10.15.1 systemd-debuginfo-32bit-44-10.15.1 References: https://bugzilla.novell.com/793411 https://bugzilla.novell.com/796171 https://bugzilla.novell.com/804575 https://bugzilla.novell.com/808144

1 0

openSUSE-RU-2013:1054-1: important: nfs-utils: avoid unmount filesystems after update
by maintenance＠opensuse.org 20 Jun '13

20 Jun '13

openSUSE Recommended Update: nfs-utils: avoid unmount filesystems after update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1054-1 Rating: important References: #825150 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with nfs-utils: - bnc#825150: Guard against blank lines in /run/nfs/bind.mounts causing all filesystems from being unmounted. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-518 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): nfs-client-1.2.7-2.10.1 nfs-client-debuginfo-1.2.7-2.10.1 nfs-doc-1.2.7-2.10.1 nfs-kernel-server-1.2.7-2.10.1 nfs-kernel-server-debuginfo-1.2.7-2.10.1 nfs-utils-debugsource-1.2.7-2.10.1 References: https://bugzilla.novell.com/825150

1 0

openSUSE-RU-2013:1050-1: sudo: fixed man-page
by maintenance＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Recommended Update: sudo: fixed man-page ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1050-1 Rating: low References: #823292 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with the man-page of sudo: - bnc#823292: fix the default flag settings in manual to reflect changes caused by sudo-sudoers.patch Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-517 - openSUSE 12.2: zypper in -t patch openSUSE-2013-517 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): sudo-1.8.6p3-3.9.1 sudo-debuginfo-1.8.6p3-3.9.1 sudo-debugsource-1.8.6p3-3.9.1 sudo-devel-1.8.6p3-3.9.1 - openSUSE 12.2 (i586 x86_64): sudo-1.8.5p2-2.8.1 sudo-debuginfo-1.8.5p2-2.8.1 sudo-debugsource-1.8.5p2-2.8.1 sudo-devel-1.8.5p2-2.8.1 References: https://bugzilla.novell.com/823292

1 0

openSUSE-SU-2013:1049-1: moderate: update for autotrace
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: update for autotrace ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1049-1 Rating: moderate References: #815382 Cross-References: CVE-2013-1953 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of autotrace fixes a buffer overflow issue. - Fix stack-based buffer overflow in bmp parser (CVE-2013-1953.patch, bnc#815382, CVE-2013-1953). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-96 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): autotrace-0.31.1-629.1 autotrace-debuginfo-0.31.1-629.1 autotrace-debugsource-0.31.1-629.1 autotrace-devel-0.31.1-629.1 References: http://support.novell.com/security/cve/CVE-2013-1953.html https://bugzilla.novell.com/815382

1 0

openSUSE-SU-2013:1048-1: moderate: This update of nfs-utils fixed a DNS spoofing issue.
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: This update of nfs-utils fixed a DNS spoofing issue. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1048-1 Rating: moderate References: #813464 Cross-References: CVE-2013-1923 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: bnc#813464: VUL-0: CVE-2013-1923: nfs-utils: rpc-gssd is vulnerable to DNS spoofing cve#CVE-2013-1923: Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-95 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): nfs-client-1.2.3-11.30.1 nfs-client-debuginfo-1.2.3-11.30.1 nfs-doc-1.2.3-11.30.1 nfs-kernel-server-1.2.3-11.30.1 References: http://support.novell.com/security/cve/CVE-2013-1923.html https://bugzilla.novell.com/813464

1 0

openSUSE-SU-2013:1047-1: moderate: update for libX11
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: update for libX11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1047-1 Rating: moderate References: #815451 #821664 Cross-References: CVE-2013-1981 CVE-2013-1997 CVE-2013-2004 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update of libX11 fixes several security issues. - U_0001-integer-overflow-in-_XQueryFont-on-32-bit-platforms-. patch, U_0002-integer-overflow-in-_XF86BigfontQueryFont-CVE-2013-1. patch, U_0003-integer-overflow-in-XListFontsWithInfo-CVE-2013-1981. patch, U_0004-integer-overflow-in-XGetMotionEvents-CVE-2013-1981-4. patch, U_0005-integer-overflow-in-XListHosts-CVE-2013-1981-5-13.pat ch, U_0006-Integer-overflows-in-stringSectionSize-cause-buffer-. patch, U_0007-integer-overflow-in-ReadInFile-in-Xrm.c-CVE-2013-198. patch, U_0008-integer-truncation-in-_XimParseStringFile-CVE-2013-1. patch, U_0009-integer-overflows-in-TransFileName-CVE-2013-1981-9-1. patch, U_0010-integer-overflow-in-XGetWindowProperty-CVE-2013-1981. patch, U_0011-integer-overflow-in-XGetImage-CVE-2013-1981-11-13.pat ch, U_0012-integer-overflow-in-XGetPointerMapping-XGetKeyboardM. patch, U_0013-integer-overflow-in-XGetModifierMapping-CVE-2013-198. patch * integer overflow in various functions, integer truncation in _XimParseStringFile() [CVE-2013-1981] (bnc#821664, bnc#815451) - U_0001-unvalidated-lengths-in-XAllocColorCells-CVE-2013-199. patch, U_0002-unvalidated-index-in-_XkbReadGetDeviceInfoReply-CVE-. patch, U_0003-unvalidated-indexes-in-_XkbReadGeomShapes-CVE-2013-1. patch, U_0004-unvalidated-indexes-in-_XkbReadGetGeometryReply-CVE-. patch, U_0005-unvalidated-index-in-_XkbReadKeySyms-CVE-2013-1997-5. patch, U_0006-unvalidated-index-in-_XkbReadKeyActions-CVE-2013-199. patch, U_0007-unvalidated-index-in-_XkbReadKeyBehaviors-CVE-2013-1. patch, U_0008-unvalidated-index-in-_XkbReadModifierMap-CVE-2013-19. patch, U_0009-unvalidated-index-in-_XkbReadExplicitComponents-CVE-. patch, U_0010-unvalidated-index-in-_XkbReadVirtualModMap-CVE-2013-. patch, U_0011-unvalidated-index-length-in-_XkbReadGetNamesReply-CV. patch, U_0012-unvalidated-length-in-_XimXGetReadData-CVE-2013-1997. patch, U_0013-Avoid-overflows-in-XListFonts-CVE-2013-1997-13-15.pat ch, U_0014-Avoid-overflows-in-XGetFontPath-CVE-2013-1997-14-15.p atch, U_0015-Avoid-overflows-in-XListExtensions-CVE-2013-1997-15-. patch * unvalidated index/length in various functions; Avoid overflows in XListFonts(), XGetFontPath(), XListExtensions() [CVE-2013-1997] (bnc##821664, bnc#815451) - U_0001-Unbounded-recursion-in-GetDatabase-when-parsing-incl. patch, U_0002-Unbounded-recursion-in-_XimParseStringFile-when-pars. patch * Unbounded recursion in GetDatabase(), _XimParseStringFile when parsing include files [CVE-2013-2004] (bnc##821664, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-516 - openSUSE 12.2: zypper in -t patch openSUSE-2013-516 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libX11-6-1.5.0-4.7.1 libX11-6-debuginfo-1.5.0-4.7.1 libX11-debugsource-1.5.0-4.7.1 libX11-devel-1.5.0-4.7.1 libX11-xcb1-1.5.0-4.7.1 libX11-xcb1-debuginfo-1.5.0-4.7.1 - openSUSE 12.3 (x86_64): libX11-6-32bit-1.5.0-4.7.1 libX11-6-debuginfo-32bit-1.5.0-4.7.1 libX11-devel-32bit-1.5.0-4.7.1 libX11-xcb1-32bit-1.5.0-4.7.1 libX11-xcb1-debuginfo-32bit-1.5.0-4.7.1 - openSUSE 12.3 (noarch): libX11-data-1.5.0-4.7.1 - openSUSE 12.2 (i586 x86_64): libX11-6-1.5.0-2.7.1 libX11-6-debuginfo-1.5.0-2.7.1 libX11-debugsource-1.5.0-2.7.1 libX11-devel-1.5.0-2.7.1 libX11-xcb1-1.5.0-2.7.1 libX11-xcb1-debuginfo-1.5.0-2.7.1 - openSUSE 12.2 (x86_64): libX11-6-32bit-1.5.0-2.7.1 libX11-6-debuginfo-32bit-1.5.0-2.7.1 libX11-devel-32bit-1.5.0-2.7.1 libX11-xcb1-32bit-1.5.0-2.7.1 libX11-xcb1-debuginfo-32bit-1.5.0-2.7.1 - openSUSE 12.2 (noarch): libX11-data-1.5.0-2.7.1 References: http://support.novell.com/security/cve/CVE-2013-1981.html http://support.novell.com/security/cve/CVE-2013-1997.html http://support.novell.com/security/cve/CVE-2013-2004.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821664

1 0

openSUSE-SU-2013:1046-1: moderate: update for libXp
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: update for libXp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1046-1 Rating: moderate References: #815451 #821668 Cross-References: CVE-2013-2062 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXp fixes several integer overflow issues: - U_0001-integer-overflow-in-XpGetAttributes-XpGetOneAttribut. patch, U_0002-integer-overflows-in-XpGetPrinterList-CVE-2013-2062-. patch, U_0003-integer-overflows-in-XpQueryScreens-CVE-2013-2062-3-. patch * integer overflow(s) in XpGetAttributes/XpGetOneAttribute, XpGetPrinterList() and XpQueryScreens() [CVE-2013-2062] (bnc#821668, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-514 - openSUSE 12.2: zypper in -t patch openSUSE-2013-514 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXp-debugsource-1.0.1-4.6.1 libXp-devel-1.0.1-4.6.1 libXp6-1.0.1-4.6.1 libXp6-debuginfo-1.0.1-4.6.1 - openSUSE 12.3 (x86_64): libXp-devel-32bit-1.0.1-4.6.1 libXp6-32bit-1.0.1-4.6.1 libXp6-debuginfo-32bit-1.0.1-4.6.1 - openSUSE 12.2 (i586 x86_64): libXp-debugsource-1.0.1-2.7.1 libXp-devel-1.0.1-2.7.1 libXp6-1.0.1-2.7.1 libXp6-debuginfo-1.0.1-2.7.1 - openSUSE 12.2 (x86_64): libXp-devel-32bit-1.0.1-2.7.1 libXp6-32bit-1.0.1-2.7.1 libXp6-debuginfo-32bit-1.0.1-2.7.1 References: http://support.novell.com/security/cve/CVE-2013-2062.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821668

1 0

openSUSE-SU-2013:1045-1: kernel update to iSCSI heap overflow
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: kernel update to iSCSI heap overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1045-1 Rating: low References: #821560 Cross-References: CVE-2013-2850 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes remote buffer overflow in the iSCSI target Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-94 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): kernel-debug-3.0.74-40.1 kernel-debug-base-3.0.74-40.1 kernel-debug-base-debuginfo-3.0.74-40.1 kernel-debug-debuginfo-3.0.74-40.1 kernel-debug-debugsource-3.0.74-40.1 kernel-debug-devel-3.0.74-40.1 kernel-debug-devel-debuginfo-3.0.74-40.1 kernel-debug-hmac-3.0.74-40.1 kernel-default-3.0.74-40.1 kernel-default-base-3.0.74-40.1 kernel-default-base-debuginfo-3.0.74-40.1 kernel-default-debuginfo-3.0.74-40.1 kernel-default-debugsource-3.0.74-40.1 kernel-default-devel-3.0.74-40.1 kernel-default-devel-debuginfo-3.0.74-40.1 kernel-default-hmac-3.0.74-40.1 kernel-desktop-3.0.74-40.1 kernel-desktop-base-3.0.74-40.1 kernel-desktop-base-debuginfo-3.0.74-40.1 kernel-desktop-debuginfo-3.0.74-40.1 kernel-desktop-debugsource-3.0.74-40.1 kernel-desktop-devel-3.0.74-40.1 kernel-desktop-devel-debuginfo-3.0.74-40.1 kernel-desktop-hmac-3.0.74-40.1 kernel-ec2-3.0.74-40.1 kernel-ec2-base-3.0.74-40.1 kernel-ec2-base-debuginfo-3.0.74-40.1 kernel-ec2-debuginfo-3.0.74-40.1 kernel-ec2-debugsource-3.0.74-40.1 kernel-ec2-devel-3.0.74-40.1 kernel-ec2-devel-debuginfo-3.0.74-40.1 kernel-ec2-extra-3.0.74-40.1 kernel-ec2-extra-debuginfo-3.0.74-40.1 kernel-ec2-hmac-3.0.74-40.1 kernel-source-3.0.74-40.1 kernel-source-vanilla-3.0.74-40.1 kernel-syms-3.0.74-40.1 kernel-trace-3.0.74-40.1 kernel-trace-base-3.0.74-40.1 kernel-trace-base-debuginfo-3.0.74-40.1 kernel-trace-debuginfo-3.0.74-40.1 kernel-trace-debugsource-3.0.74-40.1 kernel-trace-devel-3.0.74-40.1 kernel-trace-devel-debuginfo-3.0.74-40.1 kernel-trace-hmac-3.0.74-40.1 kernel-vanilla-3.0.74-40.1 kernel-vanilla-base-3.0.74-40.1 kernel-vanilla-base-debuginfo-3.0.74-40.1 kernel-vanilla-debuginfo-3.0.74-40.1 kernel-vanilla-debugsource-3.0.74-40.1 kernel-vanilla-devel-3.0.74-40.1 kernel-vanilla-devel-debuginfo-3.0.74-40.1 kernel-vanilla-hmac-3.0.74-40.1 kernel-xen-3.0.74-40.1 kernel-xen-base-3.0.74-40.1 kernel-xen-base-debuginfo-3.0.74-40.1 kernel-xen-debuginfo-3.0.74-40.1 kernel-xen-debugsource-3.0.74-40.1 kernel-xen-devel-3.0.74-40.1 kernel-xen-devel-debuginfo-3.0.74-40.1 kernel-xen-hmac-3.0.74-40.1 - openSUSE 11.4 (noarch): kernel-docs-3.0.74-40.3 - openSUSE 11.4 (i586): kernel-pae-3.0.74-40.1 kernel-pae-base-3.0.74-40.1 kernel-pae-base-debuginfo-3.0.74-40.1 kernel-pae-debuginfo-3.0.74-40.1 kernel-pae-debugsource-3.0.74-40.1 kernel-pae-devel-3.0.74-40.1 kernel-pae-devel-debuginfo-3.0.74-40.1 kernel-pae-hmac-3.0.74-40.1 kernel-vmi-3.0.74-40.1 kernel-vmi-base-3.0.74-40.1 kernel-vmi-base-debuginfo-3.0.74-40.1 kernel-vmi-debuginfo-3.0.74-40.1 kernel-vmi-debugsource-3.0.74-40.1 kernel-vmi-devel-3.0.74-40.1 kernel-vmi-devel-debuginfo-3.0.74-40.1 kernel-vmi-hmac-3.0.74-40.1 References: http://support.novell.com/security/cve/CVE-2013-2850.html https://bugzilla.novell.com/821560

1 0

openSUSE-SU-2013:1044-1: moderate: update for autotrace
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: update for autotrace ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1044-1 Rating: moderate References: #815382 Cross-References: CVE-2013-1953 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of autotrace fixes a buffer overflow issue. - Fix stack-based buffer overflow in bmp parser (CVE-2013-1953.patch, bnc#815382, CVE-2013-1953). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-515 - openSUSE 12.2: zypper in -t patch openSUSE-2013-515 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): autotrace-0.31.1-637.4.1 autotrace-debuginfo-0.31.1-637.4.1 autotrace-debugsource-0.31.1-637.4.1 autotrace-devel-0.31.1-637.4.1 libautotrace3-0.31.1-637.4.1 libautotrace3-debuginfo-0.31.1-637.4.1 - openSUSE 12.2 (i586 x86_64): autotrace-0.31.1-635.4.1 autotrace-debuginfo-0.31.1-635.4.1 autotrace-debugsource-0.31.1-635.4.1 autotrace-devel-0.31.1-635.4.1 libautotrace3-0.31.1-635.4.1 libautotrace3-debuginfo-0.31.1-635.4.1 References: http://support.novell.com/security/cve/CVE-2013-1953.html https://bugzilla.novell.com/815382

1 0

openSUSE-SU-2013:1043-1: critical: kernel
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1043-1 Rating: critical References: #790920 #821560 #822722 Cross-References: CVE-2013-2850 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: The openSUSE 12.3 kernel was updated to fix a critical security issue and two reiserfs bugs. CVE-2013-2850: Incorrect strncpy usage in the network listening part of the iscsi target driver could have been used by remote attackers to crash the kernel or execute code. This required the iscsi target running on the machine and the attacker able to make a network connection to it (aka not filtered by firewalls). Bugs fixed: - reiserfs: fix spurious multiple-fill in reiserfs_readdir_dentry (bnc#822722). - reiserfs: fix problems with chowning setuid file w/ xattrs (bnc#790920). - iscsi-target: fix heap buffer overflow on error (CVE-2013-2850, bnc#821560). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-513 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): kernel-default-3.7.10-1.16.1 kernel-default-base-3.7.10-1.16.1 kernel-default-devel-3.7.10-1.16.1 kernel-syms-3.7.10-1.16.1 - openSUSE 12.3 (i686 x86_64): kernel-debug-3.7.10-1.16.1 kernel-debug-base-3.7.10-1.16.1 kernel-debug-devel-3.7.10-1.16.1 kernel-desktop-3.7.10-1.16.1 kernel-desktop-base-3.7.10-1.16.1 kernel-desktop-devel-3.7.10-1.16.1 kernel-ec2-3.7.10-1.16.1 kernel-ec2-base-3.7.10-1.16.1 kernel-ec2-base-debuginfo-3.7.10-1.16.1 kernel-ec2-debuginfo-3.7.10-1.16.1 kernel-ec2-debugsource-3.7.10-1.16.1 kernel-ec2-devel-3.7.10-1.16.1 kernel-ec2-devel-debuginfo-3.7.10-1.16.1 kernel-trace-3.7.10-1.16.1 kernel-trace-base-3.7.10-1.16.1 kernel-trace-devel-3.7.10-1.16.1 kernel-vanilla-3.7.10-1.16.1 kernel-vanilla-devel-3.7.10-1.16.1 kernel-xen-3.7.10-1.16.1 kernel-xen-base-3.7.10-1.16.1 kernel-xen-devel-3.7.10-1.16.1 - openSUSE 12.3 (noarch): kernel-devel-3.7.10-1.16.1 kernel-docs-3.7.10-1.16.1 kernel-source-3.7.10-1.16.1 kernel-source-vanilla-3.7.10-1.16.1 - openSUSE 12.3 (i686): kernel-debug-base-debuginfo-3.7.10-1.16.1 kernel-debug-debuginfo-3.7.10-1.16.1 kernel-debug-debugsource-3.7.10-1.16.1 kernel-debug-devel-debuginfo-3.7.10-1.16.1 kernel-desktop-base-debuginfo-3.7.10-1.16.1 kernel-desktop-debuginfo-3.7.10-1.16.1 kernel-desktop-debugsource-3.7.10-1.16.1 kernel-desktop-devel-debuginfo-3.7.10-1.16.1 kernel-pae-3.7.10-1.16.1 kernel-pae-base-3.7.10-1.16.1 kernel-pae-base-debuginfo-3.7.10-1.16.1 kernel-pae-debuginfo-3.7.10-1.16.1 kernel-pae-debugsource-3.7.10-1.16.1 kernel-pae-devel-3.7.10-1.16.1 kernel-pae-devel-debuginfo-3.7.10-1.16.1 kernel-trace-base-debuginfo-3.7.10-1.16.1 kernel-trace-debuginfo-3.7.10-1.16.1 kernel-trace-debugsource-3.7.10-1.16.1 kernel-trace-devel-debuginfo-3.7.10-1.16.1 kernel-vanilla-debuginfo-3.7.10-1.16.1 kernel-vanilla-debugsource-3.7.10-1.16.1 kernel-vanilla-devel-debuginfo-3.7.10-1.16.1 kernel-xen-base-debuginfo-3.7.10-1.16.1 kernel-xen-debuginfo-3.7.10-1.16.1 kernel-xen-debugsource-3.7.10-1.16.1 kernel-xen-devel-debuginfo-3.7.10-1.16.1 - openSUSE 12.3 (i586): kernel-default-base-debuginfo-3.7.10-1.16.1 kernel-default-debuginfo-3.7.10-1.16.1 kernel-default-debugsource-3.7.10-1.16.1 kernel-default-devel-debuginfo-3.7.10-1.16.1 References: http://support.novell.com/security/cve/CVE-2013-2850.html https://bugzilla.novell.com/790920 https://bugzilla.novell.com/821560 https://bugzilla.novell.com/822722

1 0

openSUSE-SU-2013:1042-1: critical: kernel: security and bugfix update
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1042-1 Rating: critical References: #790920 #803931 #815745 #818327 #819519 #819789 #821560 #822722 Cross-References: CVE-2013-0290 CVE-2013-2094 CVE-2013-2850 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has 5 fixes is now available. Description: The openSUSE 12.2 kernel was updated to fix security issue and other bugs. Security issues fixed: CVE-2013-2850: Incorrect strncpy usage in the network listening part of the iscsi target driver could have been used by remote attackers to crash the kernel or execute code. This required the iscsi target running on the machine and the attacker able to make a network connection to it (aka not filtered by firewalls). CVE-2013-2094: The perf_swevent_init function in kernel/events/core.c in the Linux kernel used an incorrect integer data type, which allowed local users to gain privileges via a crafted perf_event_open system call. CVE-2013-0290: The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel did not properly handle the MSG_PEEK flag with zero-length data, which allowed local users to cause a denial of service (infinite loop and system hang) via a crafted application. Bugs fixed: - reiserfs: fix spurious multiple-fill in reiserfs_readdir_dentry (bnc#822722). - reiserfs: fix problems with chowning setuid file w/ xattrs (bnc#790920). - qlge: fix dma map leak when the last chunk is not allocated (bnc#819519). - Update config files: disable UCB1400 on all but ARM Currently UCB1400 is only used on ARM OMAP systems, and part of the code is dead code that can't even be modularized. - CONFIG_UCB1400_CORE=n - CONFIG_TOUCHSCREEN_UCB1400=n - CONFIG_GPIO_UCB1400=n - mm/mmap: check for RLIMIT_AS before unmapping (bnc#818327). - unix/stream: fix peeking with an offset larger than data in queue (bnc#803931 CVE-2013-0290). - unix/dgram: fix peeking with an offset larger than data in queue (bnc#803931 CVE-2013-0290). - unix/dgram: peek beyond 0-sized skbs (bnc#803931 CVE-2013-0290). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-512 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): kernel-default-3.4.47-2.38.1 kernel-default-base-3.4.47-2.38.1 kernel-default-base-debuginfo-3.4.47-2.38.1 kernel-default-debuginfo-3.4.47-2.38.1 kernel-default-debugsource-3.4.47-2.38.1 kernel-default-devel-3.4.47-2.38.1 kernel-default-devel-debuginfo-3.4.47-2.38.1 kernel-syms-3.4.47-2.38.1 - openSUSE 12.2 (i686 x86_64): kernel-debug-3.4.47-2.38.1 kernel-debug-base-3.4.47-2.38.1 kernel-debug-base-debuginfo-3.4.47-2.38.1 kernel-debug-debuginfo-3.4.47-2.38.1 kernel-debug-debugsource-3.4.47-2.38.1 kernel-debug-devel-3.4.47-2.38.1 kernel-debug-devel-debuginfo-3.4.47-2.38.1 kernel-desktop-3.4.47-2.38.1 kernel-desktop-base-3.4.47-2.38.1 kernel-desktop-base-debuginfo-3.4.47-2.38.1 kernel-desktop-debuginfo-3.4.47-2.38.1 kernel-desktop-debugsource-3.4.47-2.38.1 kernel-desktop-devel-3.4.47-2.38.1 kernel-desktop-devel-debuginfo-3.4.47-2.38.1 kernel-ec2-3.4.47-2.38.1 kernel-ec2-base-3.4.47-2.38.1 kernel-ec2-base-debuginfo-3.4.47-2.38.1 kernel-ec2-debuginfo-3.4.47-2.38.1 kernel-ec2-debugsource-3.4.47-2.38.1 kernel-ec2-devel-3.4.47-2.38.1 kernel-ec2-devel-debuginfo-3.4.47-2.38.1 kernel-ec2-extra-3.4.47-2.38.1 kernel-ec2-extra-debuginfo-3.4.47-2.38.1 kernel-trace-3.4.47-2.38.1 kernel-trace-base-3.4.47-2.38.1 kernel-trace-base-debuginfo-3.4.47-2.38.1 kernel-trace-debuginfo-3.4.47-2.38.1 kernel-trace-debugsource-3.4.47-2.38.1 kernel-trace-devel-3.4.47-2.38.1 kernel-trace-devel-debuginfo-3.4.47-2.38.1 kernel-vanilla-3.4.47-2.38.1 kernel-vanilla-debuginfo-3.4.47-2.38.1 kernel-vanilla-debugsource-3.4.47-2.38.1 kernel-vanilla-devel-3.4.47-2.38.1 kernel-vanilla-devel-debuginfo-3.4.47-2.38.1 kernel-xen-3.4.47-2.38.1 kernel-xen-base-3.4.47-2.38.1 kernel-xen-base-debuginfo-3.4.47-2.38.1 kernel-xen-debuginfo-3.4.47-2.38.1 kernel-xen-debugsource-3.4.47-2.38.1 kernel-xen-devel-3.4.47-2.38.1 kernel-xen-devel-debuginfo-3.4.47-2.38.1 - openSUSE 12.2 (noarch): kernel-devel-3.4.47-2.38.1 kernel-docs-3.4.47-2.38.2 kernel-source-3.4.47-2.38.1 kernel-source-vanilla-3.4.47-2.38.1 - openSUSE 12.2 (i686): kernel-pae-3.4.47-2.38.1 kernel-pae-base-3.4.47-2.38.1 kernel-pae-base-debuginfo-3.4.47-2.38.1 kernel-pae-debuginfo-3.4.47-2.38.1 kernel-pae-debugsource-3.4.47-2.38.1 kernel-pae-devel-3.4.47-2.38.1 kernel-pae-devel-debuginfo-3.4.47-2.38.1 References: http://support.novell.com/security/cve/CVE-2013-0290.html http://support.novell.com/security/cve/CVE-2013-2094.html http://support.novell.com/security/cve/CVE-2013-2850.html https://bugzilla.novell.com/790920 https://bugzilla.novell.com/803931 https://bugzilla.novell.com/815745 https://bugzilla.novell.com/818327 https://bugzilla.novell.com/819519 https://bugzilla.novell.com/819789 https://bugzilla.novell.com/821560 https://bugzilla.novell.com/822722

1 0

openSUSE-SU-2013:1041-1: moderate: update for libXxf86vm
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: update for libXxf86vm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1041-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-2001 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXxf86vm fixes a memory corruption issue. - U_0001-memory-corruption-in-XF86VidModeGetGammaRamp-CVE-201. patch * memory corruption in XF86VidModeGetGammaRamp() [CVE-2013-2001] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-511 - openSUSE 12.2: zypper in -t patch openSUSE-2013-511 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXxf86vm-debugsource-1.1.2-4.6.1 libXxf86vm-devel-1.1.2-4.6.1 libXxf86vm1-1.1.2-4.6.1 libXxf86vm1-debuginfo-1.1.2-4.6.1 - openSUSE 12.3 (x86_64): libXxf86vm-devel-32bit-1.1.2-4.6.1 libXxf86vm1-32bit-1.1.2-4.6.1 libXxf86vm1-debuginfo-32bit-1.1.2-4.6.1 - openSUSE 12.2 (i586 x86_64): libXxf86vm-debugsource-1.1.2-2.7.1 libXxf86vm-devel-1.1.2-2.7.1 libXxf86vm1-1.1.2-2.7.1 libXxf86vm1-debuginfo-1.1.2-2.7.1 - openSUSE 12.2 (x86_64): libXxf86vm-devel-32bit-1.1.2-2.7.1 libXxf86vm1-32bit-1.1.2-2.7.1 libXxf86vm1-debuginfo-32bit-1.1.2-2.7.1 References: http://support.novell.com/security/cve/CVE-2013-2001.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1040-1: moderate: update for flash-player
by opensuse-security＠opensuse.org 18 Jun '13

18 Jun '13

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1040-1 Rating: moderate References: #824512 Cross-References: CVE-2013-3343 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This updates of Adobe Flash Player addresses current security problems. - Update to 11.2.202.291: (bnc#824512) * APSB13-16, CVE-2013-3343 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-93 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.291-67.1 flash-player-gnome-11.2.202.291-67.1 flash-player-kde4-11.2.202.291-67.1 References: http://support.novell.com/security/cve/CVE-2013-3343.html https://bugzilla.novell.com/824512

1 0

openSUSE-RU-2013:1035-1: pam_ssh: restore credentials before exiting from pam sm open session
by maintenance＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Recommended Update: pam_ssh: restore credentials before exiting from pam sm open session ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1035-1 Rating: low References: #727246 #823484 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issue with pam_ssh: - bnc#823484: restore credentials before exiting from pam sm open session Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-92 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): pam_ssh-1.97-22.1 pam_ssh-debuginfo-1.97-22.1 pam_ssh-debugsource-1.97-22.1 - openSUSE 11.4 (x86_64): pam_ssh-32bit-1.97-22.1 pam_ssh-debuginfo-32bit-1.97-22.1 - openSUSE 11.4 (ia64): pam_ssh-debuginfo-x86-1.97-22.1 pam_ssh-x86-1.97-22.1 References: https://bugzilla.novell.com/727246 https://bugzilla.novell.com/823484

1 0

openSUSE-SU-2013:1034-1: moderate: update for libFS
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libFS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1034-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1996 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libFS fixes an integer overflow issue. - U_0001-Sign-extension-issue-and-integer-overflow-in-FSOpenS. patch * Sign extension issue and integer overflow in FSOpenServer() [CVE-2013-1996] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-501 - openSUSE 12.2: zypper in -t patch openSUSE-2013-501 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libFS-debugsource-1.0.4-5.4.1 libFS-devel-1.0.4-5.4.1 libFS6-1.0.4-5.4.1 libFS6-debuginfo-1.0.4-5.4.1 - openSUSE 12.3 (x86_64): libFS-devel-32bit-1.0.4-5.4.1 libFS6-32bit-1.0.4-5.4.1 libFS6-debuginfo-32bit-1.0.4-5.4.1 - openSUSE 12.2 (i586 x86_64): libFS-debugsource-1.0.4-2.4.1 libFS-devel-1.0.4-2.4.1 libFS6-1.0.4-2.4.1 libFS6-debuginfo-1.0.4-2.4.1 - openSUSE 12.2 (x86_64): libFS-devel-32bit-1.0.4-2.4.1 libFS6-32bit-1.0.4-2.4.1 libFS6-debuginfo-32bit-1.0.4-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1996.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1033-1: moderate: update for libXi
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1033-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1984 CVE-2013-1995 CVE-2013-1998 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update of libXi fixes several integer overflow issues. - U_0001-integer-overflow-in-XGetDeviceControl-CVE-2013-1984-. patch, U_0002-integer-overflow-in-XGetFeedbackControl-CVE-2013-198. patch, U_0003-integer-overflow-in-XGetDeviceDontPropagateList-CVE-. patch, U_0004-integer-overflow-in-XGetDeviceMotionEvents-CVE-2013-. patch, U_0005-integer-overflow-in-XIGetProperty-CVE-2013-1984-5-8.p atch, U_0006-integer-overflow-in-XIGetSelectedEvents-CVE-2013-198. patch, U_0007-Avoid-integer-overflow-in-XGetDeviceProperties-CVE-2. patch, U_0008-Avoid-integer-overflow-in-XListInputDevices-CVE-2013. patch * integer overflow in various functions [CVE-2013-1984] (bnc#821663, bnc#815451) - U_0001-sign-extension-issue-in-XListInputDevices-CVE-2013-1. patch * sign extension issue in XListInputDevices() [CVE-2013-1995] (bnc#821663, bnc#815451) - U_0001-Stack-buffer-overflow-in-XGetDeviceButtonMapping-CVE. patch, U_0002-memory-corruption-in-_XIPassiveGrabDevice-CVE-2013-1. patch, U_0003-unvalidated-lengths-in-XQueryDeviceState-CVE-2013-19. patch * Stack buffer overflow in XGetDeviceButtonMapping(), memory corruption in _XIPassiveGrabDevice(), unvalidated lengths in XQueryDeviceState() [CVE-2013-1998] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-503 - openSUSE 12.2: zypper in -t patch openSUSE-2013-503 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXi-debugsource-1.6.1-4.4.1 libXi-devel-1.6.1-4.4.1 libXi6-1.6.1-4.4.1 libXi6-debuginfo-1.6.1-4.4.1 - openSUSE 12.3 (x86_64): libXi-devel-32bit-1.6.1-4.4.1 libXi6-32bit-1.6.1-4.4.1 libXi6-debuginfo-32bit-1.6.1-4.4.1 - openSUSE 12.2 (i586 x86_64): libXi-debugsource-1.6.1-2.4.1 libXi-devel-1.6.1-2.4.1 libXi6-1.6.1-2.4.1 libXi6-debuginfo-1.6.1-2.4.1 - openSUSE 12.2 (x86_64): libXi-devel-32bit-1.6.1-2.4.1 libXi6-32bit-1.6.1-2.4.1 libXi6-debuginfo-32bit-1.6.1-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1984.html http://support.novell.com/security/cve/CVE-2013-1995.html http://support.novell.com/security/cve/CVE-2013-1998.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1032-1: moderate: update for libXtst
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXtst ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1032-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-2063 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXtst fixes an integer overflow issue. - U_0001-integer-overflow-in-XRecordGetContext-CVE-2013-2063.p atch * integer overflow in XRecordGetContext() [CVE-2013-2063] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-507 - openSUSE 12.2: zypper in -t patch openSUSE-2013-507 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXtst-debugsource-1.2.1-4.4.1 libXtst-devel-1.2.1-4.4.1 libXtst6-1.2.1-4.4.1 libXtst6-debuginfo-1.2.1-4.4.1 - openSUSE 12.3 (x86_64): libXtst-devel-32bit-1.2.1-4.4.1 libXtst6-32bit-1.2.1-4.4.1 libXtst6-debuginfo-32bit-1.2.1-4.4.1 - openSUSE 12.2 (i586 x86_64): libXtst-debugsource-1.2.1-2.4.1 libXtst-devel-1.2.1-2.4.1 libXtst6-1.2.1-2.4.1 libXtst6-debuginfo-1.2.1-2.4.1 - openSUSE 12.2 (x86_64): libXtst-devel-32bit-1.2.1-2.4.1 libXtst6-32bit-1.2.1-2.4.1 libXtst6-debuginfo-32bit-1.2.1-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-2063.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1031-1: moderate: update for libXcursor
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXcursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1031-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-2003 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXcursor fixes an integer overflow issue. - U_0001-signedness-bug-integer-overflow-in-_XcursorFileHeade. patch * signedness bug & integer overflow in _XcursorFileHeaderCreate() [CVE-2013-2003] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-502 - openSUSE 12.2: zypper in -t patch openSUSE-2013-502 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXcursor-debugsource-1.1.13-4.4.1 libXcursor-devel-1.1.13-4.4.1 libXcursor1-1.1.13-4.4.1 libXcursor1-debuginfo-1.1.13-4.4.1 - openSUSE 12.3 (x86_64): libXcursor-devel-32bit-1.1.13-4.4.1 libXcursor1-32bit-1.1.13-4.4.1 libXcursor1-debuginfo-32bit-1.1.13-4.4.1 - openSUSE 12.2 (i586 x86_64): libXcursor-debugsource-1.1.13-2.4.1 libXcursor-devel-1.1.13-2.4.1 libXcursor1-1.1.13-2.4.1 libXcursor1-debuginfo-1.1.13-2.4.1 - openSUSE 12.2 (x86_64): libXcursor-devel-32bit-1.1.13-2.4.1 libXcursor1-32bit-1.1.13-2.4.1 libXcursor1-debuginfo-32bit-1.1.13-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-2003.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1030-1: moderate: update for libXxf86dga
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXxf86dga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1030-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1991 CVE-2013-2000 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of libXxf86dga fixes several buffer and integer overflow issues. - U_0001-integer-overflow-in-XDGAQueryModes-CVE-2013-1991-1-2. patch, U_0002-integer-overflow-underflow-in-XDGASetMode-CVE-2013-1. patch * integer overflow in XDGAQueryModes(); integer overflow & underflow in XDGASetMode() [CVE-2013-1991] (bnc#821663, bnc#815451) - U_0001-buffer-overflow-in-XDGAQueryModes-CVE-2013-2000-1-2.p atch, U_0002-buffer-overflow-in-XDGASetMode-CVE-2013-2000-2-2.patc h * buffer overflow in XDGAQueryModes(), XDGASetMode() [CVE-2013-2000] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-509 - openSUSE 12.2: zypper in -t patch openSUSE-2013-509 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXxf86dga-debugsource-1.1.3-4.4.1 libXxf86dga-devel-1.1.3-4.4.1 libXxf86dga1-1.1.3-4.4.1 libXxf86dga1-debuginfo-1.1.3-4.4.1 - openSUSE 12.3 (x86_64): libXxf86dga-devel-32bit-1.1.3-4.4.1 libXxf86dga1-32bit-1.1.3-4.4.1 libXxf86dga1-debuginfo-32bit-1.1.3-4.4.1 - openSUSE 12.2 (i586 x86_64): libXxf86dga-debugsource-1.1.3-2.4.1 libXxf86dga-devel-1.1.3-2.4.1 libXxf86dga1-1.1.3-2.4.1 libXxf86dga1-debuginfo-1.1.3-2.4.1 - openSUSE 12.2 (x86_64): libXxf86dga-devel-32bit-1.1.3-2.4.1 libXxf86dga1-32bit-1.1.3-2.4.1 libXxf86dga1-debuginfo-32bit-1.1.3-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1991.html http://support.novell.com/security/cve/CVE-2013-2000.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1029-1: moderate: update for libdmx
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libdmx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1029-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1992 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libdmx fixes several integer overflow issues. - U_0001-integer-overflow-in-DMXGetScreenAttributes-CVE-2013-. patch, U_0002-integer-overflow-in-DMXGetWindowAttributes-CVE-2013-. patch, U_0003-integer-overflow-in-DMXGetInputAttributes-CVE-2013-1. patch, * integer overflow in DMXGetScreenAttributes(), DMXGetWindowAttributes(), DMXGetInputAttributes() [CVE-2013-1992] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-510 - openSUSE 12.2: zypper in -t patch openSUSE-2013-510 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libdmx-debugsource-1.1.2-4.4.1 libdmx-devel-1.1.2-4.4.1 libdmx1-1.1.2-4.4.1 libdmx1-debuginfo-1.1.2-4.4.1 - openSUSE 12.3 (x86_64): libdmx-devel-32bit-1.1.2-4.4.1 libdmx1-32bit-1.1.2-4.4.1 libdmx1-debuginfo-32bit-1.1.2-4.4.1 - openSUSE 12.2 (i586 x86_64): libdmx-debugsource-1.1.2-2.4.1 libdmx-devel-1.1.2-2.4.1 libdmx1-1.1.2-2.4.1 libdmx1-debuginfo-1.1.2-2.4.1 - openSUSE 12.2 (x86_64): libdmx-devel-32bit-1.1.2-2.4.1 libdmx1-32bit-1.1.2-2.4.1 libdmx1-debuginfo-32bit-1.1.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1992.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1028-1: moderate: update for libXrandr
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXrandr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1028-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1986 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXrandr fixes several integer overflow issues. - U_0001-integer-overflow-in-XRRQueryOutputProperty-CVE-2013-. patch, U_0003-integer-overflow-in-XRRGetOutputProperty-CVE-2013-19. patch, * integer overflow in XRRQueryOutputProperty(), XRRGetProviderProperty() [CVE-2013-1986] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-505 - openSUSE 12.2: zypper in -t patch openSUSE-2013-505 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXrandr-debugsource-1.4.0-2.4.1 libXrandr-devel-1.4.0-2.4.1 libXrandr2-1.4.0-2.4.1 libXrandr2-debuginfo-1.4.0-2.4.1 - openSUSE 12.3 (x86_64): libXrandr-devel-32bit-1.4.0-2.4.1 libXrandr2-32bit-1.4.0-2.4.1 libXrandr2-debuginfo-32bit-1.4.0-2.4.1 - openSUSE 12.2 (i586 x86_64): libXrandr-debugsource-1.3.2-2.4.1 libXrandr-devel-1.3.2-2.4.1 libXrandr2-1.3.2-2.4.1 libXrandr2-debuginfo-1.3.2-2.4.1 - openSUSE 12.2 (x86_64): libXrandr-devel-32bit-1.3.2-2.4.1 libXrandr2-32bit-1.3.2-2.4.1 libXrandr2-debuginfo-32bit-1.3.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1986.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1027-1: moderate: update for libXres
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXres ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1027-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1988 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXres fixes several integer overflow issues. - U_0001-integer-overflow-in-XResQueryClients-CVE-2013-1988-1. patch, U_0002-integer-overflow-in-XResQueryClientResources-CVE-201. patch * integer overflow in XResQueryClients(), XResQueryClientResources() [CVE-2013-1988] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-506 - openSUSE 12.2: zypper in -t patch openSUSE-2013-506 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXRes1-1.0.6-4.4.1 libXRes1-debuginfo-1.0.6-4.4.1 libXres-debugsource-1.0.6-4.4.1 libXres-devel-1.0.6-4.4.1 - openSUSE 12.3 (x86_64): libXRes1-32bit-1.0.6-4.4.1 libXRes1-debuginfo-32bit-1.0.6-4.4.1 libXres-devel-32bit-1.0.6-4.4.1 - openSUSE 12.2 (i586 x86_64): libXRes1-1.0.6-2.4.1 libXRes1-debuginfo-1.0.6-2.4.1 libXres-debugsource-1.0.6-2.4.1 libXres-devel-1.0.6-2.4.1 - openSUSE 12.2 (x86_64): libXRes1-32bit-1.0.6-2.4.1 libXRes1-debuginfo-32bit-1.0.6-2.4.1 libXres-devel-32bit-1.0.6-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1988.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1026-1: moderate: update for libXinerama
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXinerama ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1026-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1985 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXinerama fixes an integer overflow issue. - U_0001-integer-overflow-in-XineramaQueryScreens-CVE-2013-19. patch * integer overflow in XineramaQueryScreens() [CVE-2013-1985] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-504 - openSUSE 12.2: zypper in -t patch openSUSE-2013-504 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXinerama-debugsource-1.1.2-4.4.1 libXinerama-devel-1.1.2-4.4.1 libXinerama1-1.1.2-4.4.1 libXinerama1-debuginfo-1.1.2-4.4.1 - openSUSE 12.3 (x86_64): libXinerama-devel-32bit-1.1.2-4.4.1 libXinerama1-32bit-1.1.2-4.4.1 libXinerama1-debuginfo-32bit-1.1.2-4.4.1 - openSUSE 12.2 (i586 x86_64): libXinerama-debugsource-1.1.2-2.4.1 libXinerama-devel-1.1.2-2.4.1 libXinerama1-1.1.2-2.4.1 libXinerama1-debuginfo-1.1.2-2.4.1 - openSUSE 12.2 (x86_64): libXinerama-devel-32bit-1.1.2-2.4.1 libXinerama1-32bit-1.1.2-2.4.1 libXinerama1-debuginfo-32bit-1.1.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1985.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1025-1: moderate: update for libXvMC
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXvMC ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1025-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1990 CVE-2013-1999 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of libXvMC fixes several integer overflow issues. - U_0001-integer-overflow-in-XvMCListSurfaceTypes-CVE-2013-19. patch, U_0002-integer-overflow-in-XvMCListSubpictureTypes-CVE-2013. patch * integer overflow in XvMCListSurfaceTypes(), XvMCListSubpictureTypes() [CVE-2013-1990] (bnc#821663, bnc#815451) - U_0001-Multiple-unvalidated-assumptions-in-XvMCGetDRInfo-CV. patch * Multiple unvalidated assumptions in XvMCGetDRInfo() [CVE-2013-1999] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-508 - openSUSE 12.2: zypper in -t patch openSUSE-2013-508 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXvMC-debugsource-1.0.7-4.4.1 libXvMC-devel-1.0.7-4.4.1 libXvMC1-1.0.7-4.4.1 libXvMC1-debuginfo-1.0.7-4.4.1 - openSUSE 12.3 (x86_64): libXvMC-devel-32bit-1.0.7-4.4.1 libXvMC1-32bit-1.0.7-4.4.1 libXvMC1-debuginfo-32bit-1.0.7-4.4.1 - openSUSE 12.2 (i586 x86_64): libXvMC-debugsource-1.0.7-2.4.1 libXvMC-devel-1.0.7-2.4.1 libXvMC1-1.0.7-2.4.1 libXvMC1-debuginfo-1.0.7-2.4.1 - openSUSE 12.2 (x86_64): libXvMC-devel-32bit-1.0.7-2.4.1 libXvMC1-32bit-1.0.7-2.4.1 libXvMC1-debuginfo-32bit-1.0.7-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1990.html http://support.novell.com/security/cve/CVE-2013-1999.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-RU-2013:1024-1: cairo: fix memory leak
by maintenance＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Recommended Update: cairo: fix memory leak ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1024-1 Rating: low References: #824538 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with cairo: - bnc#824538: Add cairo-xlib-memleak.patch to fix a memory leak Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-499 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): cairo-debugsource-1.12.8-2.4.1 cairo-devel-1.12.8-2.4.1 cairo-tools-1.12.8-2.4.1 cairo-tools-debuginfo-1.12.8-2.4.1 libcairo-gobject2-1.12.8-2.4.1 libcairo-gobject2-debuginfo-1.12.8-2.4.1 libcairo-script-interpreter2-1.12.8-2.4.1 libcairo-script-interpreter2-debuginfo-1.12.8-2.4.1 libcairo2-1.12.8-2.4.1 libcairo2-debuginfo-1.12.8-2.4.1 - openSUSE 12.3 (x86_64): cairo-devel-32bit-1.12.8-2.4.1 libcairo-gobject2-32bit-1.12.8-2.4.1 libcairo-gobject2-debuginfo-32bit-1.12.8-2.4.1 libcairo-script-interpreter2-32bit-1.12.8-2.4.1 libcairo-script-interpreter2-debuginfo-32bit-1.12.8-2.4.1 libcairo2-32bit-1.12.8-2.4.1 libcairo2-debuginfo-32bit-1.12.8-2.4.1 References: https://bugzilla.novell.com/824538

1 0

openSUSE-RU-2013:1023-1: plymouth: Several fixes
by maintenance＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Recommended Update: plymouth: Several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1023-1 Rating: low References: #811185 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with plymouth: - do not try to close negative fd. - bnc#811185: + do not leak fd when stopping redirection of /dev/console + redirect plymouth standard io to /dev/null - Add plymouth-exit-code.patch: ignore exit code in ExecStartPost. - Add plymouth-terminal-session-close.patch: do no try to close terminal session fd if already closed. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-500 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libply-boot-client2-0.8.8_git201211022126-4.6.1 libply-boot-client2-debuginfo-0.8.8_git201211022126-4.6.1 libply-splash-core2-0.8.8_git201211022126-4.6.1 libply-splash-core2-debuginfo-0.8.8_git201211022126-4.6.1 libply-splash-graphics2-0.8.8_git201211022126-4.6.1 libply-splash-graphics2-debuginfo-0.8.8_git201211022126-4.6.1 libply2-0.8.8_git201211022126-4.6.1 libply2-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-0.8.8_git201211022126-4.6.1 plymouth-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-debugsource-0.8.8_git201211022126-4.6.1 plymouth-devel-0.8.8_git201211022126-4.6.1 plymouth-dracut-0.8.8_git201211022126-4.6.1 plymouth-plugin-fade-throbber-0.8.8_git201211022126-4.6.1 plymouth-plugin-fade-throbber-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-plugin-label-0.8.8_git201211022126-4.6.1 plymouth-plugin-label-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-plugin-script-0.8.8_git201211022126-4.6.1 plymouth-plugin-script-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-plugin-space-flares-0.8.8_git201211022126-4.6.1 plymouth-plugin-space-flares-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-plugin-throbgress-0.8.8_git201211022126-4.6.1 plymouth-plugin-throbgress-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-plugin-two-step-0.8.8_git201211022126-4.6.1 plymouth-plugin-two-step-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-scripts-0.8.8_git201211022126-4.6.1 plymouth-utils-0.8.8_git201211022126-4.6.1 plymouth-utils-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-x11-renderer-0.8.8_git201211022126-4.6.1 plymouth-x11-renderer-debuginfo-0.8.8_git201211022126-4.6.1 - openSUSE 12.3 (noarch): plymouth-theme-fade-in-0.8.8_git201211022126-4.6.1 plymouth-theme-script-0.8.8_git201211022126-4.6.1 plymouth-theme-solar-0.8.8_git201211022126-4.6.1 plymouth-theme-spinfinity-0.8.8_git201211022126-4.6.1 plymouth-theme-spinner-0.8.8_git201211022126-4.6.1 References: https://bugzilla.novell.com/811185

1 0

openSUSE-RU-2013:1021-1: pam_ssh: restore credentials before exiting from pam sm open session
by maintenance＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Recommended Update: pam_ssh: restore credentials before exiting from pam sm open session ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1021-1 Rating: low References: #823484 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This udpate fixes the following issue with pam_ssh: - bnc#823484: restore credentials before exiting from pam sm open session Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-498 - openSUSE 12.2: zypper in -t patch openSUSE-2013-498 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): pam_ssh-1.97-23.4.1 pam_ssh-debuginfo-1.97-23.4.1 pam_ssh-debugsource-1.97-23.4.1 - openSUSE 12.3 (x86_64): pam_ssh-32bit-1.97-23.4.1 pam_ssh-debuginfo-32bit-1.97-23.4.1 - openSUSE 12.2 (i586 x86_64): pam_ssh-1.97-20.4.1 pam_ssh-debuginfo-1.97-20.4.1 pam_ssh-debugsource-1.97-20.4.1 - openSUSE 12.2 (x86_64): pam_ssh-32bit-1.97-20.4.1 pam_ssh-debuginfo-32bit-1.97-20.4.1 References: https://bugzilla.novell.com/823484

1 0