June 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1090-1: moderate: update for python-keystoneclient
by opensuse-security＠opensuse.org 27 Jun '13

27 Jun '13

openSUSE Security Update: update for python-keystoneclient ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1090-1 Rating: moderate References: #817415 Cross-References: CVE-2013-2013 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of python-keystoneclient fixes a security vulnerability. - Add CVE-2013-2013.patch: allow secure user password update (CVE-2013-2013, bnc#817415). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-541 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): python-keystoneclient-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.8.1 python-keystoneclient-doc-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.8.1 python-keystoneclient-test-0.2.1.3.gd37a3fb+git.1357543650.d37a3fb-2.8.1 References: http://support.novell.com/security/cve/CVE-2013-2013.html https://bugzilla.novell.com/817415

1 0

openSUSE-SU-2013:1089-1: moderate: update for openstack-keystone
by opensuse-security＠opensuse.org 27 Jun '13

27 Jun '13

openSUSE Security Update: update for openstack-keystone ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1089-1 Rating: moderate References: #821201 #823783 Cross-References: CVE-2013-2104 CVE-2013-2157 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of openstack-keystone fixes two security vulnerabilities. - Add CVE-2013-2104.patch: fix missing expiration check in Keystone PKI token validation (CVE-2013-2104, bnc#821201) - Add CVE-2013-2157.patch: fix authentication bypass when using LDAP backend (CVE-2013-2157, bnc#823783) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-540 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): openstack-keystone-2012.2.4+git.1363796849.255b1d4-3.16.1 openstack-keystone-doc-2012.2.4+git.1363796849.255b1d4-3.16.1 openstack-keystone-test-2012.2.4+git.1363796849.255b1d4-3.16.1 python-keystone-2012.2.4+git.1363796849.255b1d4-3.16.1 References: http://support.novell.com/security/cve/CVE-2013-2104.html http://support.novell.com/security/cve/CVE-2013-2157.html https://bugzilla.novell.com/821201 https://bugzilla.novell.com/823783

1 0

openSUSE-SU-2013:1087-1: moderate: update for openstack-nova
by opensuse-security＠opensuse.org 27 Jun '13

27 Jun '13

openSUSE Security Update: update for openstack-nova ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1087-1 Rating: moderate References: #819349 Cross-References: CVE-2013-2030 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of openstack-nova fixes a security vulnerability. - Add CVE-2013-2030.patch: fix insecure keystone middleware tmpdir by default (CVE-2013-2030, bnc#819349). - Use explicit keystone-signing dir to workaround lp#1181157. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-539 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): python-greenlet-0.4.0-3.3.1 python-greenlet-debuginfo-0.4.0-3.3.1 python-greenlet-debugsource-0.4.0-3.3.1 - openSUSE 12.3 (noarch): openstack-nova-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-api-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-cert-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-compute-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-doc-2012.2.4+git.1363297910.9561484-2.10.4 openstack-nova-network-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-novncproxy-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-objectstore-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-scheduler-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-test-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-vncproxy-2012.2.4+git.1363297910.9561484-2.10.1 openstack-nova-volume-2012.2.4+git.1363297910.9561484-2.10.1 python-greenlet-devel-0.4.0-3.3.1 python-nova-2012.2.4+git.1363297910.9561484-2.10.1 References: http://support.novell.com/security/cve/CVE-2013-2030.html https://bugzilla.novell.com/819349

1 0

openSUSE-SU-2013:1086-1: moderate: wireshark
by opensuse-security＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Security Update: wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1086-1 Rating: moderate References: #823932 Cross-References: CVE-2013-3555 CVE-2013-3556 CVE-2013-3557 CVE-2013-3558 CVE-2013-3559 CVE-2013-3560 CVE-2013-3561 CVE-2013-3562 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update of wireshark includes several security and bug fixes. - update to 1.8.8 [bnc#823932] + vulnerabilities fixed: * The CAPWAP dissector could crash. wnpa-sec-2013-32 * The GMR-1 BCCH dissector could crash. wnpa-sec-2013-33 * The PPP dissector could crash. wnpa-sec-2013-34 * The NBAP dissector could crash. wnpa-sec-2013-35 * The RDP dissector could crash. wnpa-sec-2013-36 * The GSM CBCH dissector could crash. wnpa-sec-2013-37 * The Assa Abloy R3 dissector could consume excessive memory and CPU. wnpa-sec-2013-38 * The HTTP dissector could overrun the stack. wnpa-sec-2013-39 * The Ixia IxVeriWave file parser could overflow the heap. wnpa-sec-2013-40 * The DCP ETSI dissector could crash. wnpa-sec-2013-41 + Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.8.8.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-97 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): wireshark-1.8.8-49.1 wireshark-debuginfo-1.8.8-49.1 wireshark-debugsource-1.8.8-49.1 wireshark-devel-1.8.8-49.1 References: http://support.novell.com/security/cve/CVE-2013-3555.html http://support.novell.com/security/cve/CVE-2013-3556.html http://support.novell.com/security/cve/CVE-2013-3557.html http://support.novell.com/security/cve/CVE-2013-3558.html http://support.novell.com/security/cve/CVE-2013-3559.html http://support.novell.com/security/cve/CVE-2013-3560.html http://support.novell.com/security/cve/CVE-2013-3561.html http://support.novell.com/security/cve/CVE-2013-3562.html https://bugzilla.novell.com/823932

1 0

openSUSE-SU-2013:1085-1: moderate: update for libraw
by opensuse-security＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Security Update: update for libraw ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1085-1 Rating: moderate References: #822665 Cross-References: CVE-2013-2126 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of libraw fixes a security issue. - security update: * CVE-2013-2126.patch [bnc#822665] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-537 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (x86_64): libraw-debugsource-0.14.7-3.4.1 libraw-devel-0.14.7-3.4.1 libraw-devel-static-0.14.7-3.4.1 libraw-tools-0.14.7-3.4.1 libraw-tools-debuginfo-0.14.7-3.4.1 libraw5-0.14.7-3.4.1 libraw5-debuginfo-0.14.7-3.4.1 - openSUSE 12.3 (i586): libraw-debugsource-0.14.7-3.4.2 libraw-devel-0.14.7-3.4.2 libraw-devel-static-0.14.7-3.4.2 libraw-tools-0.14.7-3.4.2 libraw-tools-debuginfo-0.14.7-3.4.2 libraw5-0.14.7-3.4.2 libraw5-debuginfo-0.14.7-3.4.2 References: http://support.novell.com/security/cve/CVE-2013-2126.html https://bugzilla.novell.com/822665

1 0

openSUSE-SU-2013:1084-1: moderate: update for wireshark
by opensuse-security＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Security Update: update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1084-1 Rating: moderate References: #823932 Cross-References: CVE-2013-3555 CVE-2013-3556 CVE-2013-3557 CVE-2013-3558 CVE-2013-3559 CVE-2013-3560 CVE-2013-3561 CVE-2013-3562 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update of wireshark includes several security and bug fixes. - update to 1.8.8 [bnc#823932] + vulnerabilities fixed: * The CAPWAP dissector could crash. wnpa-sec-2013-32 * The GMR-1 BCCH dissector could crash. wnpa-sec-2013-33 * The PPP dissector could crash. wnpa-sec-2013-34 * The NBAP dissector could crash. wnpa-sec-2013-35 * The RDP dissector could crash. wnpa-sec-2013-36 * The GSM CBCH dissector could crash. wnpa-sec-2013-37 * The Assa Abloy R3 dissector could consume excessive memory and CPU. wnpa-sec-2013-38 * The HTTP dissector could overrun the stack. wnpa-sec-2013-39 * The Ixia IxVeriWave file parser could overflow the heap. wnpa-sec-2013-40 * The DCP ETSI dissector could crash. wnpa-sec-2013-41 + Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.8.8.html wnpa-sec-2013-24 CVE-2013-3555 wnpa-sec-2013-25 CVE-2013-3556 CVE-2013-3557 wnpa-sec-2013-26 CVE-2013-3558 wnpa-sec-2013-27 CVE-2013-3559 wnpa-sec-2013-28 CVE-2013-3560 wnpa-sec-2013-29 CVE-2013-3561 CVE-2013-3562 wnpa-sec-2013-30 CVE-2013-3561 wnpa-sec-2013-31 CVE-2013-3561 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-536 - openSUSE 12.2: zypper in -t patch openSUSE-2013-536 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): wireshark-1.8.8-1.12.1 wireshark-debuginfo-1.8.8-1.12.1 wireshark-debugsource-1.8.8-1.12.1 wireshark-devel-1.8.8-1.12.1 - openSUSE 12.2 (i586 x86_64): wireshark-1.8.8-1.31.1 wireshark-debuginfo-1.8.8-1.31.1 wireshark-debugsource-1.8.8-1.31.1 wireshark-devel-1.8.8-1.31.1 References: http://support.novell.com/security/cve/CVE-2013-3555.html http://support.novell.com/security/cve/CVE-2013-3556.html http://support.novell.com/security/cve/CVE-2013-3557.html http://support.novell.com/security/cve/CVE-2013-3558.html http://support.novell.com/security/cve/CVE-2013-3559.html http://support.novell.com/security/cve/CVE-2013-3560.html http://support.novell.com/security/cve/CVE-2013-3561.html http://support.novell.com/security/cve/CVE-2013-3562.html https://bugzilla.novell.com/823932

1 0

openSUSE-SU-2013:1083-1: moderate: update for darktable
by opensuse-security＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Security Update: update for darktable ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1083-1 Rating: moderate References: #823114 Cross-References: CVE-2013-2126 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of darktable fixes a problem inside the embedded libraw version. - Fix for CVE-2013-2126 * added backported patch from git master 0001-fixed-error-handling-for-broken-full-color-images.patch fixes bnc#823114- Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-538 - openSUSE 12.2: zypper in -t patch openSUSE-2013-538 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (x86_64): darktable-1.1.3-1.5.3 darktable-debuginfo-1.1.3-1.5.3 darktable-debugsource-1.1.3-1.5.3 darktable-doc-1.1.3-1.5.3 - openSUSE 12.3 (i586): darktable-1.1.3-1.5.4 darktable-debuginfo-1.1.3-1.5.4 darktable-debugsource-1.1.3-1.5.4 darktable-doc-1.1.3-1.5.4 - openSUSE 12.2 (i586 x86_64): darktable-1.0.5-3.9.3 darktable-debuginfo-1.0.5-3.9.3 darktable-debugsource-1.0.5-3.9.3 References: http://support.novell.com/security/cve/CVE-2013-2126.html https://bugzilla.novell.com/823114

1 0

openSUSE-RU-2013:1082-1: libstorage: Two fixes
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: libstorage: Two fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1082-1 Rating: low References: #810305 #825503 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with libstorage: - bnc#825503: adapt to changed functionality of losetup - bnc#810305: fix wrong size calculation when deleting thin LVs Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-535 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libstorage-debugsource-2.23.11-1.8.1 libstorage-devel-2.23.11-1.8.1 libstorage-python-2.23.11-1.8.1 libstorage-python-debuginfo-2.23.11-1.8.1 libstorage-ruby-2.23.11-1.8.1 libstorage-ruby-debuginfo-2.23.11-1.8.1 libstorage-testsuite-2.23.11-1.8.1 libstorage-testsuite-debuginfo-2.23.11-1.8.1 libstorage4-2.23.11-1.8.1 libstorage4-debuginfo-2.23.11-1.8.1 yast2-storage-2.23.9-1.7.1 yast2-storage-debuginfo-2.23.9-1.7.1 yast2-storage-debugsource-2.23.9-1.7.1 yast2-storage-devel-2.23.9-1.7.1 References: https://bugzilla.novell.com/810305 https://bugzilla.novell.com/825503

1 0

openSUSE-RU-2013:1081-1: important: icedtea-web: Regression-fix after the last openjdk
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: icedtea-web: Regression-fix after the last openjdk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1081-1 Rating: important References: #825880 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with icedtea-web: - bnc#825880: fix icedtea-web broken by last openjdk security update Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-533 - openSUSE 12.2: zypper in -t patch openSUSE-2013-533 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): icedtea-web-1.4-4.18.1 icedtea-web-debuginfo-1.4-4.18.1 icedtea-web-debugsource-1.4-4.18.1 - openSUSE 12.3 (noarch): icedtea-web-javadoc-1.4-4.18.1 - openSUSE 12.2 (i586 x86_64): icedtea-web-1.4-1.21.1 icedtea-web-debuginfo-1.4-1.21.1 icedtea-web-debugsource-1.4-1.21.1 - openSUSE 12.2 (noarch): icedtea-web-javadoc-1.4-1.21.1 References: https://bugzilla.novell.com/825880

1 0

openSUSE-RU-2013:1080-1: liferea: update to 1.8.14
by maintenance＠opensuse.org 26 Jun '13

26 Jun '13

openSUSE Recommended Update: liferea: update to 1.8.14 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1080-1 Rating: low References: #823576 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with liferea: - bnc#823576: Update to version * sf#1069: fixed broken rendering in tt-rss feeds + with combined 1.8.13 fixes: * Fixes missing item list update when browsing item URLs in Liferea * Fixes format string issues in several translations. * Added Hebrew translation of reference manual page * Added MimeType to .desktop file * sf#1040: In feed entries, spaces are replaced with "+" * sf#1051: Issues in RTL GUI of Liferea * sf#1038, sf#1074: Updates ttrss feeds over and over * Updated the default feedlists * Added Vietnamese translation * Updated translations - Update to version 1.8.12: * sf#1041: Some GPLv2 license headers were outdated * sf#1044: tt-rss API changed (we now support only 1.6 API) * Fixes XHTML errors caused by extra body tags from tt-rss - Changes from version 1.8.11: * Added Google Plus to social bookmarking options. * deb#668197: x-www-browser preference not working * sf#1037: Incorrect notifications for Google Reader * sf#1048: Removed all feedvalidator.org references from FAQ and XSLT as it was reported to host malware * Updated translations. - Update to version 1.8.10: * sf#3572660: Fix crash in google_source_remove_node * Prevents adding folders/search folders/newsbins to Google Reader. * Prevents sorting subscriptions in Google Reader * Fixes items not removed from search folder count when feed is removed. * Fixes search folder rebuilding (do not include comment items). * Fixes SELECT offset handling when rebuilding search folders. - Update to version 1.8.9: * sf#3564393: Added Instapaper.com to social bookmarking sites * sf#3567715: Fix crash on network online status changes * Fixes preferences dialog not showing up a second time. * Fixes reloading item when browsing inside the item view. - Update to version 1.8.8: * sf#3557513: Fixes crash on empty links in auto-load-link mode * Ensure node ids are in DB node relation on startup. * Fixes search folder counter update on feed removal. * Include AM_PROG_AR in configure.ac to work with automake 1.12. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-531 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): liferea-1.8.14-2.9.1 liferea-debuginfo-1.8.14-2.9.1 liferea-debugsource-1.8.14-2.9.1 - openSUSE 12.2 (noarch): liferea-lang-1.8.14-2.9.1 References: https://bugzilla.novell.com/823576

1 0