June 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1045-1: kernel update to iSCSI heap overflow
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: kernel update to iSCSI heap overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1045-1 Rating: low References: #821560 Cross-References: CVE-2013-2850 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes remote buffer overflow in the iSCSI target Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-94 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): kernel-debug-3.0.74-40.1 kernel-debug-base-3.0.74-40.1 kernel-debug-base-debuginfo-3.0.74-40.1 kernel-debug-debuginfo-3.0.74-40.1 kernel-debug-debugsource-3.0.74-40.1 kernel-debug-devel-3.0.74-40.1 kernel-debug-devel-debuginfo-3.0.74-40.1 kernel-debug-hmac-3.0.74-40.1 kernel-default-3.0.74-40.1 kernel-default-base-3.0.74-40.1 kernel-default-base-debuginfo-3.0.74-40.1 kernel-default-debuginfo-3.0.74-40.1 kernel-default-debugsource-3.0.74-40.1 kernel-default-devel-3.0.74-40.1 kernel-default-devel-debuginfo-3.0.74-40.1 kernel-default-hmac-3.0.74-40.1 kernel-desktop-3.0.74-40.1 kernel-desktop-base-3.0.74-40.1 kernel-desktop-base-debuginfo-3.0.74-40.1 kernel-desktop-debuginfo-3.0.74-40.1 kernel-desktop-debugsource-3.0.74-40.1 kernel-desktop-devel-3.0.74-40.1 kernel-desktop-devel-debuginfo-3.0.74-40.1 kernel-desktop-hmac-3.0.74-40.1 kernel-ec2-3.0.74-40.1 kernel-ec2-base-3.0.74-40.1 kernel-ec2-base-debuginfo-3.0.74-40.1 kernel-ec2-debuginfo-3.0.74-40.1 kernel-ec2-debugsource-3.0.74-40.1 kernel-ec2-devel-3.0.74-40.1 kernel-ec2-devel-debuginfo-3.0.74-40.1 kernel-ec2-extra-3.0.74-40.1 kernel-ec2-extra-debuginfo-3.0.74-40.1 kernel-ec2-hmac-3.0.74-40.1 kernel-source-3.0.74-40.1 kernel-source-vanilla-3.0.74-40.1 kernel-syms-3.0.74-40.1 kernel-trace-3.0.74-40.1 kernel-trace-base-3.0.74-40.1 kernel-trace-base-debuginfo-3.0.74-40.1 kernel-trace-debuginfo-3.0.74-40.1 kernel-trace-debugsource-3.0.74-40.1 kernel-trace-devel-3.0.74-40.1 kernel-trace-devel-debuginfo-3.0.74-40.1 kernel-trace-hmac-3.0.74-40.1 kernel-vanilla-3.0.74-40.1 kernel-vanilla-base-3.0.74-40.1 kernel-vanilla-base-debuginfo-3.0.74-40.1 kernel-vanilla-debuginfo-3.0.74-40.1 kernel-vanilla-debugsource-3.0.74-40.1 kernel-vanilla-devel-3.0.74-40.1 kernel-vanilla-devel-debuginfo-3.0.74-40.1 kernel-vanilla-hmac-3.0.74-40.1 kernel-xen-3.0.74-40.1 kernel-xen-base-3.0.74-40.1 kernel-xen-base-debuginfo-3.0.74-40.1 kernel-xen-debuginfo-3.0.74-40.1 kernel-xen-debugsource-3.0.74-40.1 kernel-xen-devel-3.0.74-40.1 kernel-xen-devel-debuginfo-3.0.74-40.1 kernel-xen-hmac-3.0.74-40.1 - openSUSE 11.4 (noarch): kernel-docs-3.0.74-40.3 - openSUSE 11.4 (i586): kernel-pae-3.0.74-40.1 kernel-pae-base-3.0.74-40.1 kernel-pae-base-debuginfo-3.0.74-40.1 kernel-pae-debuginfo-3.0.74-40.1 kernel-pae-debugsource-3.0.74-40.1 kernel-pae-devel-3.0.74-40.1 kernel-pae-devel-debuginfo-3.0.74-40.1 kernel-pae-hmac-3.0.74-40.1 kernel-vmi-3.0.74-40.1 kernel-vmi-base-3.0.74-40.1 kernel-vmi-base-debuginfo-3.0.74-40.1 kernel-vmi-debuginfo-3.0.74-40.1 kernel-vmi-debugsource-3.0.74-40.1 kernel-vmi-devel-3.0.74-40.1 kernel-vmi-devel-debuginfo-3.0.74-40.1 kernel-vmi-hmac-3.0.74-40.1 References: http://support.novell.com/security/cve/CVE-2013-2850.html https://bugzilla.novell.com/821560

1 0

openSUSE-SU-2013:1044-1: moderate: update for autotrace
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: update for autotrace ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1044-1 Rating: moderate References: #815382 Cross-References: CVE-2013-1953 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of autotrace fixes a buffer overflow issue. - Fix stack-based buffer overflow in bmp parser (CVE-2013-1953.patch, bnc#815382, CVE-2013-1953). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-515 - openSUSE 12.2: zypper in -t patch openSUSE-2013-515 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): autotrace-0.31.1-637.4.1 autotrace-debuginfo-0.31.1-637.4.1 autotrace-debugsource-0.31.1-637.4.1 autotrace-devel-0.31.1-637.4.1 libautotrace3-0.31.1-637.4.1 libautotrace3-debuginfo-0.31.1-637.4.1 - openSUSE 12.2 (i586 x86_64): autotrace-0.31.1-635.4.1 autotrace-debuginfo-0.31.1-635.4.1 autotrace-debugsource-0.31.1-635.4.1 autotrace-devel-0.31.1-635.4.1 libautotrace3-0.31.1-635.4.1 libautotrace3-debuginfo-0.31.1-635.4.1 References: http://support.novell.com/security/cve/CVE-2013-1953.html https://bugzilla.novell.com/815382

1 0

openSUSE-SU-2013:1043-1: critical: kernel
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1043-1 Rating: critical References: #790920 #821560 #822722 Cross-References: CVE-2013-2850 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: The openSUSE 12.3 kernel was updated to fix a critical security issue and two reiserfs bugs. CVE-2013-2850: Incorrect strncpy usage in the network listening part of the iscsi target driver could have been used by remote attackers to crash the kernel or execute code. This required the iscsi target running on the machine and the attacker able to make a network connection to it (aka not filtered by firewalls). Bugs fixed: - reiserfs: fix spurious multiple-fill in reiserfs_readdir_dentry (bnc#822722). - reiserfs: fix problems with chowning setuid file w/ xattrs (bnc#790920). - iscsi-target: fix heap buffer overflow on error (CVE-2013-2850, bnc#821560). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-513 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): kernel-default-3.7.10-1.16.1 kernel-default-base-3.7.10-1.16.1 kernel-default-devel-3.7.10-1.16.1 kernel-syms-3.7.10-1.16.1 - openSUSE 12.3 (i686 x86_64): kernel-debug-3.7.10-1.16.1 kernel-debug-base-3.7.10-1.16.1 kernel-debug-devel-3.7.10-1.16.1 kernel-desktop-3.7.10-1.16.1 kernel-desktop-base-3.7.10-1.16.1 kernel-desktop-devel-3.7.10-1.16.1 kernel-ec2-3.7.10-1.16.1 kernel-ec2-base-3.7.10-1.16.1 kernel-ec2-base-debuginfo-3.7.10-1.16.1 kernel-ec2-debuginfo-3.7.10-1.16.1 kernel-ec2-debugsource-3.7.10-1.16.1 kernel-ec2-devel-3.7.10-1.16.1 kernel-ec2-devel-debuginfo-3.7.10-1.16.1 kernel-trace-3.7.10-1.16.1 kernel-trace-base-3.7.10-1.16.1 kernel-trace-devel-3.7.10-1.16.1 kernel-vanilla-3.7.10-1.16.1 kernel-vanilla-devel-3.7.10-1.16.1 kernel-xen-3.7.10-1.16.1 kernel-xen-base-3.7.10-1.16.1 kernel-xen-devel-3.7.10-1.16.1 - openSUSE 12.3 (noarch): kernel-devel-3.7.10-1.16.1 kernel-docs-3.7.10-1.16.1 kernel-source-3.7.10-1.16.1 kernel-source-vanilla-3.7.10-1.16.1 - openSUSE 12.3 (i686): kernel-debug-base-debuginfo-3.7.10-1.16.1 kernel-debug-debuginfo-3.7.10-1.16.1 kernel-debug-debugsource-3.7.10-1.16.1 kernel-debug-devel-debuginfo-3.7.10-1.16.1 kernel-desktop-base-debuginfo-3.7.10-1.16.1 kernel-desktop-debuginfo-3.7.10-1.16.1 kernel-desktop-debugsource-3.7.10-1.16.1 kernel-desktop-devel-debuginfo-3.7.10-1.16.1 kernel-pae-3.7.10-1.16.1 kernel-pae-base-3.7.10-1.16.1 kernel-pae-base-debuginfo-3.7.10-1.16.1 kernel-pae-debuginfo-3.7.10-1.16.1 kernel-pae-debugsource-3.7.10-1.16.1 kernel-pae-devel-3.7.10-1.16.1 kernel-pae-devel-debuginfo-3.7.10-1.16.1 kernel-trace-base-debuginfo-3.7.10-1.16.1 kernel-trace-debuginfo-3.7.10-1.16.1 kernel-trace-debugsource-3.7.10-1.16.1 kernel-trace-devel-debuginfo-3.7.10-1.16.1 kernel-vanilla-debuginfo-3.7.10-1.16.1 kernel-vanilla-debugsource-3.7.10-1.16.1 kernel-vanilla-devel-debuginfo-3.7.10-1.16.1 kernel-xen-base-debuginfo-3.7.10-1.16.1 kernel-xen-debuginfo-3.7.10-1.16.1 kernel-xen-debugsource-3.7.10-1.16.1 kernel-xen-devel-debuginfo-3.7.10-1.16.1 - openSUSE 12.3 (i586): kernel-default-base-debuginfo-3.7.10-1.16.1 kernel-default-debuginfo-3.7.10-1.16.1 kernel-default-debugsource-3.7.10-1.16.1 kernel-default-devel-debuginfo-3.7.10-1.16.1 References: http://support.novell.com/security/cve/CVE-2013-2850.html https://bugzilla.novell.com/790920 https://bugzilla.novell.com/821560 https://bugzilla.novell.com/822722

1 0

openSUSE-SU-2013:1042-1: critical: kernel: security and bugfix update
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1042-1 Rating: critical References: #790920 #803931 #815745 #818327 #819519 #819789 #821560 #822722 Cross-References: CVE-2013-0290 CVE-2013-2094 CVE-2013-2850 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has 5 fixes is now available. Description: The openSUSE 12.2 kernel was updated to fix security issue and other bugs. Security issues fixed: CVE-2013-2850: Incorrect strncpy usage in the network listening part of the iscsi target driver could have been used by remote attackers to crash the kernel or execute code. This required the iscsi target running on the machine and the attacker able to make a network connection to it (aka not filtered by firewalls). CVE-2013-2094: The perf_swevent_init function in kernel/events/core.c in the Linux kernel used an incorrect integer data type, which allowed local users to gain privileges via a crafted perf_event_open system call. CVE-2013-0290: The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel did not properly handle the MSG_PEEK flag with zero-length data, which allowed local users to cause a denial of service (infinite loop and system hang) via a crafted application. Bugs fixed: - reiserfs: fix spurious multiple-fill in reiserfs_readdir_dentry (bnc#822722). - reiserfs: fix problems with chowning setuid file w/ xattrs (bnc#790920). - qlge: fix dma map leak when the last chunk is not allocated (bnc#819519). - Update config files: disable UCB1400 on all but ARM Currently UCB1400 is only used on ARM OMAP systems, and part of the code is dead code that can't even be modularized. - CONFIG_UCB1400_CORE=n - CONFIG_TOUCHSCREEN_UCB1400=n - CONFIG_GPIO_UCB1400=n - mm/mmap: check for RLIMIT_AS before unmapping (bnc#818327). - unix/stream: fix peeking with an offset larger than data in queue (bnc#803931 CVE-2013-0290). - unix/dgram: fix peeking with an offset larger than data in queue (bnc#803931 CVE-2013-0290). - unix/dgram: peek beyond 0-sized skbs (bnc#803931 CVE-2013-0290). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-512 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): kernel-default-3.4.47-2.38.1 kernel-default-base-3.4.47-2.38.1 kernel-default-base-debuginfo-3.4.47-2.38.1 kernel-default-debuginfo-3.4.47-2.38.1 kernel-default-debugsource-3.4.47-2.38.1 kernel-default-devel-3.4.47-2.38.1 kernel-default-devel-debuginfo-3.4.47-2.38.1 kernel-syms-3.4.47-2.38.1 - openSUSE 12.2 (i686 x86_64): kernel-debug-3.4.47-2.38.1 kernel-debug-base-3.4.47-2.38.1 kernel-debug-base-debuginfo-3.4.47-2.38.1 kernel-debug-debuginfo-3.4.47-2.38.1 kernel-debug-debugsource-3.4.47-2.38.1 kernel-debug-devel-3.4.47-2.38.1 kernel-debug-devel-debuginfo-3.4.47-2.38.1 kernel-desktop-3.4.47-2.38.1 kernel-desktop-base-3.4.47-2.38.1 kernel-desktop-base-debuginfo-3.4.47-2.38.1 kernel-desktop-debuginfo-3.4.47-2.38.1 kernel-desktop-debugsource-3.4.47-2.38.1 kernel-desktop-devel-3.4.47-2.38.1 kernel-desktop-devel-debuginfo-3.4.47-2.38.1 kernel-ec2-3.4.47-2.38.1 kernel-ec2-base-3.4.47-2.38.1 kernel-ec2-base-debuginfo-3.4.47-2.38.1 kernel-ec2-debuginfo-3.4.47-2.38.1 kernel-ec2-debugsource-3.4.47-2.38.1 kernel-ec2-devel-3.4.47-2.38.1 kernel-ec2-devel-debuginfo-3.4.47-2.38.1 kernel-ec2-extra-3.4.47-2.38.1 kernel-ec2-extra-debuginfo-3.4.47-2.38.1 kernel-trace-3.4.47-2.38.1 kernel-trace-base-3.4.47-2.38.1 kernel-trace-base-debuginfo-3.4.47-2.38.1 kernel-trace-debuginfo-3.4.47-2.38.1 kernel-trace-debugsource-3.4.47-2.38.1 kernel-trace-devel-3.4.47-2.38.1 kernel-trace-devel-debuginfo-3.4.47-2.38.1 kernel-vanilla-3.4.47-2.38.1 kernel-vanilla-debuginfo-3.4.47-2.38.1 kernel-vanilla-debugsource-3.4.47-2.38.1 kernel-vanilla-devel-3.4.47-2.38.1 kernel-vanilla-devel-debuginfo-3.4.47-2.38.1 kernel-xen-3.4.47-2.38.1 kernel-xen-base-3.4.47-2.38.1 kernel-xen-base-debuginfo-3.4.47-2.38.1 kernel-xen-debuginfo-3.4.47-2.38.1 kernel-xen-debugsource-3.4.47-2.38.1 kernel-xen-devel-3.4.47-2.38.1 kernel-xen-devel-debuginfo-3.4.47-2.38.1 - openSUSE 12.2 (noarch): kernel-devel-3.4.47-2.38.1 kernel-docs-3.4.47-2.38.2 kernel-source-3.4.47-2.38.1 kernel-source-vanilla-3.4.47-2.38.1 - openSUSE 12.2 (i686): kernel-pae-3.4.47-2.38.1 kernel-pae-base-3.4.47-2.38.1 kernel-pae-base-debuginfo-3.4.47-2.38.1 kernel-pae-debuginfo-3.4.47-2.38.1 kernel-pae-debugsource-3.4.47-2.38.1 kernel-pae-devel-3.4.47-2.38.1 kernel-pae-devel-debuginfo-3.4.47-2.38.1 References: http://support.novell.com/security/cve/CVE-2013-0290.html http://support.novell.com/security/cve/CVE-2013-2094.html http://support.novell.com/security/cve/CVE-2013-2850.html https://bugzilla.novell.com/790920 https://bugzilla.novell.com/803931 https://bugzilla.novell.com/815745 https://bugzilla.novell.com/818327 https://bugzilla.novell.com/819519 https://bugzilla.novell.com/819789 https://bugzilla.novell.com/821560 https://bugzilla.novell.com/822722

1 0

openSUSE-SU-2013:1041-1: moderate: update for libXxf86vm
by opensuse-security＠opensuse.org 19 Jun '13

19 Jun '13

openSUSE Security Update: update for libXxf86vm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1041-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-2001 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXxf86vm fixes a memory corruption issue. - U_0001-memory-corruption-in-XF86VidModeGetGammaRamp-CVE-201. patch * memory corruption in XF86VidModeGetGammaRamp() [CVE-2013-2001] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-511 - openSUSE 12.2: zypper in -t patch openSUSE-2013-511 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXxf86vm-debugsource-1.1.2-4.6.1 libXxf86vm-devel-1.1.2-4.6.1 libXxf86vm1-1.1.2-4.6.1 libXxf86vm1-debuginfo-1.1.2-4.6.1 - openSUSE 12.3 (x86_64): libXxf86vm-devel-32bit-1.1.2-4.6.1 libXxf86vm1-32bit-1.1.2-4.6.1 libXxf86vm1-debuginfo-32bit-1.1.2-4.6.1 - openSUSE 12.2 (i586 x86_64): libXxf86vm-debugsource-1.1.2-2.7.1 libXxf86vm-devel-1.1.2-2.7.1 libXxf86vm1-1.1.2-2.7.1 libXxf86vm1-debuginfo-1.1.2-2.7.1 - openSUSE 12.2 (x86_64): libXxf86vm-devel-32bit-1.1.2-2.7.1 libXxf86vm1-32bit-1.1.2-2.7.1 libXxf86vm1-debuginfo-32bit-1.1.2-2.7.1 References: http://support.novell.com/security/cve/CVE-2013-2001.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1040-1: moderate: update for flash-player
by opensuse-security＠opensuse.org 18 Jun '13

18 Jun '13

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1040-1 Rating: moderate References: #824512 Cross-References: CVE-2013-3343 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This updates of Adobe Flash Player addresses current security problems. - Update to 11.2.202.291: (bnc#824512) * APSB13-16, CVE-2013-3343 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-93 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.291-67.1 flash-player-gnome-11.2.202.291-67.1 flash-player-kde4-11.2.202.291-67.1 References: http://support.novell.com/security/cve/CVE-2013-3343.html https://bugzilla.novell.com/824512

1 0

openSUSE-RU-2013:1035-1: pam_ssh: restore credentials before exiting from pam sm open session
by maintenance＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Recommended Update: pam_ssh: restore credentials before exiting from pam sm open session ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1035-1 Rating: low References: #727246 #823484 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issue with pam_ssh: - bnc#823484: restore credentials before exiting from pam sm open session Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-92 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): pam_ssh-1.97-22.1 pam_ssh-debuginfo-1.97-22.1 pam_ssh-debugsource-1.97-22.1 - openSUSE 11.4 (x86_64): pam_ssh-32bit-1.97-22.1 pam_ssh-debuginfo-32bit-1.97-22.1 - openSUSE 11.4 (ia64): pam_ssh-debuginfo-x86-1.97-22.1 pam_ssh-x86-1.97-22.1 References: https://bugzilla.novell.com/727246 https://bugzilla.novell.com/823484

1 0

openSUSE-SU-2013:1034-1: moderate: update for libFS
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libFS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1034-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1996 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libFS fixes an integer overflow issue. - U_0001-Sign-extension-issue-and-integer-overflow-in-FSOpenS. patch * Sign extension issue and integer overflow in FSOpenServer() [CVE-2013-1996] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-501 - openSUSE 12.2: zypper in -t patch openSUSE-2013-501 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libFS-debugsource-1.0.4-5.4.1 libFS-devel-1.0.4-5.4.1 libFS6-1.0.4-5.4.1 libFS6-debuginfo-1.0.4-5.4.1 - openSUSE 12.3 (x86_64): libFS-devel-32bit-1.0.4-5.4.1 libFS6-32bit-1.0.4-5.4.1 libFS6-debuginfo-32bit-1.0.4-5.4.1 - openSUSE 12.2 (i586 x86_64): libFS-debugsource-1.0.4-2.4.1 libFS-devel-1.0.4-2.4.1 libFS6-1.0.4-2.4.1 libFS6-debuginfo-1.0.4-2.4.1 - openSUSE 12.2 (x86_64): libFS-devel-32bit-1.0.4-2.4.1 libFS6-32bit-1.0.4-2.4.1 libFS6-debuginfo-32bit-1.0.4-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1996.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1033-1: moderate: update for libXi
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1033-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1984 CVE-2013-1995 CVE-2013-1998 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update of libXi fixes several integer overflow issues. - U_0001-integer-overflow-in-XGetDeviceControl-CVE-2013-1984-. patch, U_0002-integer-overflow-in-XGetFeedbackControl-CVE-2013-198. patch, U_0003-integer-overflow-in-XGetDeviceDontPropagateList-CVE-. patch, U_0004-integer-overflow-in-XGetDeviceMotionEvents-CVE-2013-. patch, U_0005-integer-overflow-in-XIGetProperty-CVE-2013-1984-5-8.p atch, U_0006-integer-overflow-in-XIGetSelectedEvents-CVE-2013-198. patch, U_0007-Avoid-integer-overflow-in-XGetDeviceProperties-CVE-2. patch, U_0008-Avoid-integer-overflow-in-XListInputDevices-CVE-2013. patch * integer overflow in various functions [CVE-2013-1984] (bnc#821663, bnc#815451) - U_0001-sign-extension-issue-in-XListInputDevices-CVE-2013-1. patch * sign extension issue in XListInputDevices() [CVE-2013-1995] (bnc#821663, bnc#815451) - U_0001-Stack-buffer-overflow-in-XGetDeviceButtonMapping-CVE. patch, U_0002-memory-corruption-in-_XIPassiveGrabDevice-CVE-2013-1. patch, U_0003-unvalidated-lengths-in-XQueryDeviceState-CVE-2013-19. patch * Stack buffer overflow in XGetDeviceButtonMapping(), memory corruption in _XIPassiveGrabDevice(), unvalidated lengths in XQueryDeviceState() [CVE-2013-1998] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-503 - openSUSE 12.2: zypper in -t patch openSUSE-2013-503 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXi-debugsource-1.6.1-4.4.1 libXi-devel-1.6.1-4.4.1 libXi6-1.6.1-4.4.1 libXi6-debuginfo-1.6.1-4.4.1 - openSUSE 12.3 (x86_64): libXi-devel-32bit-1.6.1-4.4.1 libXi6-32bit-1.6.1-4.4.1 libXi6-debuginfo-32bit-1.6.1-4.4.1 - openSUSE 12.2 (i586 x86_64): libXi-debugsource-1.6.1-2.4.1 libXi-devel-1.6.1-2.4.1 libXi6-1.6.1-2.4.1 libXi6-debuginfo-1.6.1-2.4.1 - openSUSE 12.2 (x86_64): libXi-devel-32bit-1.6.1-2.4.1 libXi6-32bit-1.6.1-2.4.1 libXi6-debuginfo-32bit-1.6.1-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1984.html http://support.novell.com/security/cve/CVE-2013-1995.html http://support.novell.com/security/cve/CVE-2013-1998.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1032-1: moderate: update for libXtst
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXtst ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1032-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-2063 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXtst fixes an integer overflow issue. - U_0001-integer-overflow-in-XRecordGetContext-CVE-2013-2063.p atch * integer overflow in XRecordGetContext() [CVE-2013-2063] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-507 - openSUSE 12.2: zypper in -t patch openSUSE-2013-507 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXtst-debugsource-1.2.1-4.4.1 libXtst-devel-1.2.1-4.4.1 libXtst6-1.2.1-4.4.1 libXtst6-debuginfo-1.2.1-4.4.1 - openSUSE 12.3 (x86_64): libXtst-devel-32bit-1.2.1-4.4.1 libXtst6-32bit-1.2.1-4.4.1 libXtst6-debuginfo-32bit-1.2.1-4.4.1 - openSUSE 12.2 (i586 x86_64): libXtst-debugsource-1.2.1-2.4.1 libXtst-devel-1.2.1-2.4.1 libXtst6-1.2.1-2.4.1 libXtst6-debuginfo-1.2.1-2.4.1 - openSUSE 12.2 (x86_64): libXtst-devel-32bit-1.2.1-2.4.1 libXtst6-32bit-1.2.1-2.4.1 libXtst6-debuginfo-32bit-1.2.1-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-2063.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0