June 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1031-1: moderate: update for libXcursor
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXcursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1031-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-2003 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXcursor fixes an integer overflow issue. - U_0001-signedness-bug-integer-overflow-in-_XcursorFileHeade. patch * signedness bug & integer overflow in _XcursorFileHeaderCreate() [CVE-2013-2003] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-502 - openSUSE 12.2: zypper in -t patch openSUSE-2013-502 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXcursor-debugsource-1.1.13-4.4.1 libXcursor-devel-1.1.13-4.4.1 libXcursor1-1.1.13-4.4.1 libXcursor1-debuginfo-1.1.13-4.4.1 - openSUSE 12.3 (x86_64): libXcursor-devel-32bit-1.1.13-4.4.1 libXcursor1-32bit-1.1.13-4.4.1 libXcursor1-debuginfo-32bit-1.1.13-4.4.1 - openSUSE 12.2 (i586 x86_64): libXcursor-debugsource-1.1.13-2.4.1 libXcursor-devel-1.1.13-2.4.1 libXcursor1-1.1.13-2.4.1 libXcursor1-debuginfo-1.1.13-2.4.1 - openSUSE 12.2 (x86_64): libXcursor-devel-32bit-1.1.13-2.4.1 libXcursor1-32bit-1.1.13-2.4.1 libXcursor1-debuginfo-32bit-1.1.13-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-2003.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1030-1: moderate: update for libXxf86dga
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXxf86dga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1030-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1991 CVE-2013-2000 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of libXxf86dga fixes several buffer and integer overflow issues. - U_0001-integer-overflow-in-XDGAQueryModes-CVE-2013-1991-1-2. patch, U_0002-integer-overflow-underflow-in-XDGASetMode-CVE-2013-1. patch * integer overflow in XDGAQueryModes(); integer overflow & underflow in XDGASetMode() [CVE-2013-1991] (bnc#821663, bnc#815451) - U_0001-buffer-overflow-in-XDGAQueryModes-CVE-2013-2000-1-2.p atch, U_0002-buffer-overflow-in-XDGASetMode-CVE-2013-2000-2-2.patc h * buffer overflow in XDGAQueryModes(), XDGASetMode() [CVE-2013-2000] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-509 - openSUSE 12.2: zypper in -t patch openSUSE-2013-509 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXxf86dga-debugsource-1.1.3-4.4.1 libXxf86dga-devel-1.1.3-4.4.1 libXxf86dga1-1.1.3-4.4.1 libXxf86dga1-debuginfo-1.1.3-4.4.1 - openSUSE 12.3 (x86_64): libXxf86dga-devel-32bit-1.1.3-4.4.1 libXxf86dga1-32bit-1.1.3-4.4.1 libXxf86dga1-debuginfo-32bit-1.1.3-4.4.1 - openSUSE 12.2 (i586 x86_64): libXxf86dga-debugsource-1.1.3-2.4.1 libXxf86dga-devel-1.1.3-2.4.1 libXxf86dga1-1.1.3-2.4.1 libXxf86dga1-debuginfo-1.1.3-2.4.1 - openSUSE 12.2 (x86_64): libXxf86dga-devel-32bit-1.1.3-2.4.1 libXxf86dga1-32bit-1.1.3-2.4.1 libXxf86dga1-debuginfo-32bit-1.1.3-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1991.html http://support.novell.com/security/cve/CVE-2013-2000.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1029-1: moderate: update for libdmx
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libdmx ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1029-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1992 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libdmx fixes several integer overflow issues. - U_0001-integer-overflow-in-DMXGetScreenAttributes-CVE-2013-. patch, U_0002-integer-overflow-in-DMXGetWindowAttributes-CVE-2013-. patch, U_0003-integer-overflow-in-DMXGetInputAttributes-CVE-2013-1. patch, * integer overflow in DMXGetScreenAttributes(), DMXGetWindowAttributes(), DMXGetInputAttributes() [CVE-2013-1992] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-510 - openSUSE 12.2: zypper in -t patch openSUSE-2013-510 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libdmx-debugsource-1.1.2-4.4.1 libdmx-devel-1.1.2-4.4.1 libdmx1-1.1.2-4.4.1 libdmx1-debuginfo-1.1.2-4.4.1 - openSUSE 12.3 (x86_64): libdmx-devel-32bit-1.1.2-4.4.1 libdmx1-32bit-1.1.2-4.4.1 libdmx1-debuginfo-32bit-1.1.2-4.4.1 - openSUSE 12.2 (i586 x86_64): libdmx-debugsource-1.1.2-2.4.1 libdmx-devel-1.1.2-2.4.1 libdmx1-1.1.2-2.4.1 libdmx1-debuginfo-1.1.2-2.4.1 - openSUSE 12.2 (x86_64): libdmx-devel-32bit-1.1.2-2.4.1 libdmx1-32bit-1.1.2-2.4.1 libdmx1-debuginfo-32bit-1.1.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1992.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1028-1: moderate: update for libXrandr
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXrandr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1028-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1986 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXrandr fixes several integer overflow issues. - U_0001-integer-overflow-in-XRRQueryOutputProperty-CVE-2013-. patch, U_0003-integer-overflow-in-XRRGetOutputProperty-CVE-2013-19. patch, * integer overflow in XRRQueryOutputProperty(), XRRGetProviderProperty() [CVE-2013-1986] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-505 - openSUSE 12.2: zypper in -t patch openSUSE-2013-505 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXrandr-debugsource-1.4.0-2.4.1 libXrandr-devel-1.4.0-2.4.1 libXrandr2-1.4.0-2.4.1 libXrandr2-debuginfo-1.4.0-2.4.1 - openSUSE 12.3 (x86_64): libXrandr-devel-32bit-1.4.0-2.4.1 libXrandr2-32bit-1.4.0-2.4.1 libXrandr2-debuginfo-32bit-1.4.0-2.4.1 - openSUSE 12.2 (i586 x86_64): libXrandr-debugsource-1.3.2-2.4.1 libXrandr-devel-1.3.2-2.4.1 libXrandr2-1.3.2-2.4.1 libXrandr2-debuginfo-1.3.2-2.4.1 - openSUSE 12.2 (x86_64): libXrandr-devel-32bit-1.3.2-2.4.1 libXrandr2-32bit-1.3.2-2.4.1 libXrandr2-debuginfo-32bit-1.3.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1986.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1027-1: moderate: update for libXres
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXres ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1027-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1988 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXres fixes several integer overflow issues. - U_0001-integer-overflow-in-XResQueryClients-CVE-2013-1988-1. patch, U_0002-integer-overflow-in-XResQueryClientResources-CVE-201. patch * integer overflow in XResQueryClients(), XResQueryClientResources() [CVE-2013-1988] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-506 - openSUSE 12.2: zypper in -t patch openSUSE-2013-506 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXRes1-1.0.6-4.4.1 libXRes1-debuginfo-1.0.6-4.4.1 libXres-debugsource-1.0.6-4.4.1 libXres-devel-1.0.6-4.4.1 - openSUSE 12.3 (x86_64): libXRes1-32bit-1.0.6-4.4.1 libXRes1-debuginfo-32bit-1.0.6-4.4.1 libXres-devel-32bit-1.0.6-4.4.1 - openSUSE 12.2 (i586 x86_64): libXRes1-1.0.6-2.4.1 libXRes1-debuginfo-1.0.6-2.4.1 libXres-debugsource-1.0.6-2.4.1 libXres-devel-1.0.6-2.4.1 - openSUSE 12.2 (x86_64): libXRes1-32bit-1.0.6-2.4.1 libXRes1-debuginfo-32bit-1.0.6-2.4.1 libXres-devel-32bit-1.0.6-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1988.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1026-1: moderate: update for libXinerama
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXinerama ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1026-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1985 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of libXinerama fixes an integer overflow issue. - U_0001-integer-overflow-in-XineramaQueryScreens-CVE-2013-19. patch * integer overflow in XineramaQueryScreens() [CVE-2013-1985] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-504 - openSUSE 12.2: zypper in -t patch openSUSE-2013-504 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXinerama-debugsource-1.1.2-4.4.1 libXinerama-devel-1.1.2-4.4.1 libXinerama1-1.1.2-4.4.1 libXinerama1-debuginfo-1.1.2-4.4.1 - openSUSE 12.3 (x86_64): libXinerama-devel-32bit-1.1.2-4.4.1 libXinerama1-32bit-1.1.2-4.4.1 libXinerama1-debuginfo-32bit-1.1.2-4.4.1 - openSUSE 12.2 (i586 x86_64): libXinerama-debugsource-1.1.2-2.4.1 libXinerama-devel-1.1.2-2.4.1 libXinerama1-1.1.2-2.4.1 libXinerama1-debuginfo-1.1.2-2.4.1 - openSUSE 12.2 (x86_64): libXinerama-devel-32bit-1.1.2-2.4.1 libXinerama1-32bit-1.1.2-2.4.1 libXinerama1-debuginfo-32bit-1.1.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1985.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-SU-2013:1025-1: moderate: update for libXvMC
by opensuse-security＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Security Update: update for libXvMC ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1025-1 Rating: moderate References: #815451 #821663 Cross-References: CVE-2013-1990 CVE-2013-1999 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of libXvMC fixes several integer overflow issues. - U_0001-integer-overflow-in-XvMCListSurfaceTypes-CVE-2013-19. patch, U_0002-integer-overflow-in-XvMCListSubpictureTypes-CVE-2013. patch * integer overflow in XvMCListSurfaceTypes(), XvMCListSubpictureTypes() [CVE-2013-1990] (bnc#821663, bnc#815451) - U_0001-Multiple-unvalidated-assumptions-in-XvMCGetDRInfo-CV. patch * Multiple unvalidated assumptions in XvMCGetDRInfo() [CVE-2013-1999] (bnc#821663, bnc#815451) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-508 - openSUSE 12.2: zypper in -t patch openSUSE-2013-508 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libXvMC-debugsource-1.0.7-4.4.1 libXvMC-devel-1.0.7-4.4.1 libXvMC1-1.0.7-4.4.1 libXvMC1-debuginfo-1.0.7-4.4.1 - openSUSE 12.3 (x86_64): libXvMC-devel-32bit-1.0.7-4.4.1 libXvMC1-32bit-1.0.7-4.4.1 libXvMC1-debuginfo-32bit-1.0.7-4.4.1 - openSUSE 12.2 (i586 x86_64): libXvMC-debugsource-1.0.7-2.4.1 libXvMC-devel-1.0.7-2.4.1 libXvMC1-1.0.7-2.4.1 libXvMC1-debuginfo-1.0.7-2.4.1 - openSUSE 12.2 (x86_64): libXvMC-devel-32bit-1.0.7-2.4.1 libXvMC1-32bit-1.0.7-2.4.1 libXvMC1-debuginfo-32bit-1.0.7-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-1990.html http://support.novell.com/security/cve/CVE-2013-1999.html https://bugzilla.novell.com/815451 https://bugzilla.novell.com/821663

1 0

openSUSE-RU-2013:1024-1: cairo: fix memory leak
by maintenance＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Recommended Update: cairo: fix memory leak ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1024-1 Rating: low References: #824538 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with cairo: - bnc#824538: Add cairo-xlib-memleak.patch to fix a memory leak Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-499 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): cairo-debugsource-1.12.8-2.4.1 cairo-devel-1.12.8-2.4.1 cairo-tools-1.12.8-2.4.1 cairo-tools-debuginfo-1.12.8-2.4.1 libcairo-gobject2-1.12.8-2.4.1 libcairo-gobject2-debuginfo-1.12.8-2.4.1 libcairo-script-interpreter2-1.12.8-2.4.1 libcairo-script-interpreter2-debuginfo-1.12.8-2.4.1 libcairo2-1.12.8-2.4.1 libcairo2-debuginfo-1.12.8-2.4.1 - openSUSE 12.3 (x86_64): cairo-devel-32bit-1.12.8-2.4.1 libcairo-gobject2-32bit-1.12.8-2.4.1 libcairo-gobject2-debuginfo-32bit-1.12.8-2.4.1 libcairo-script-interpreter2-32bit-1.12.8-2.4.1 libcairo-script-interpreter2-debuginfo-32bit-1.12.8-2.4.1 libcairo2-32bit-1.12.8-2.4.1 libcairo2-debuginfo-32bit-1.12.8-2.4.1 References: https://bugzilla.novell.com/824538

1 0

openSUSE-RU-2013:1023-1: plymouth: Several fixes
by maintenance＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Recommended Update: plymouth: Several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1023-1 Rating: low References: #811185 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with plymouth: - do not try to close negative fd. - bnc#811185: + do not leak fd when stopping redirection of /dev/console + redirect plymouth standard io to /dev/null - Add plymouth-exit-code.patch: ignore exit code in ExecStartPost. - Add plymouth-terminal-session-close.patch: do no try to close terminal session fd if already closed. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-500 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libply-boot-client2-0.8.8_git201211022126-4.6.1 libply-boot-client2-debuginfo-0.8.8_git201211022126-4.6.1 libply-splash-core2-0.8.8_git201211022126-4.6.1 libply-splash-core2-debuginfo-0.8.8_git201211022126-4.6.1 libply-splash-graphics2-0.8.8_git201211022126-4.6.1 libply-splash-graphics2-debuginfo-0.8.8_git201211022126-4.6.1 libply2-0.8.8_git201211022126-4.6.1 libply2-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-0.8.8_git201211022126-4.6.1 plymouth-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-debugsource-0.8.8_git201211022126-4.6.1 plymouth-devel-0.8.8_git201211022126-4.6.1 plymouth-dracut-0.8.8_git201211022126-4.6.1 plymouth-plugin-fade-throbber-0.8.8_git201211022126-4.6.1 plymouth-plugin-fade-throbber-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-plugin-label-0.8.8_git201211022126-4.6.1 plymouth-plugin-label-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-plugin-script-0.8.8_git201211022126-4.6.1 plymouth-plugin-script-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-plugin-space-flares-0.8.8_git201211022126-4.6.1 plymouth-plugin-space-flares-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-plugin-throbgress-0.8.8_git201211022126-4.6.1 plymouth-plugin-throbgress-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-plugin-two-step-0.8.8_git201211022126-4.6.1 plymouth-plugin-two-step-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-scripts-0.8.8_git201211022126-4.6.1 plymouth-utils-0.8.8_git201211022126-4.6.1 plymouth-utils-debuginfo-0.8.8_git201211022126-4.6.1 plymouth-x11-renderer-0.8.8_git201211022126-4.6.1 plymouth-x11-renderer-debuginfo-0.8.8_git201211022126-4.6.1 - openSUSE 12.3 (noarch): plymouth-theme-fade-in-0.8.8_git201211022126-4.6.1 plymouth-theme-script-0.8.8_git201211022126-4.6.1 plymouth-theme-solar-0.8.8_git201211022126-4.6.1 plymouth-theme-spinfinity-0.8.8_git201211022126-4.6.1 plymouth-theme-spinner-0.8.8_git201211022126-4.6.1 References: https://bugzilla.novell.com/811185

1 0

openSUSE-RU-2013:1021-1: pam_ssh: restore credentials before exiting from pam sm open session
by maintenance＠opensuse.org 17 Jun '13

17 Jun '13

openSUSE Recommended Update: pam_ssh: restore credentials before exiting from pam sm open session ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1021-1 Rating: low References: #823484 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This udpate fixes the following issue with pam_ssh: - bnc#823484: restore credentials before exiting from pam sm open session Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-498 - openSUSE 12.2: zypper in -t patch openSUSE-2013-498 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): pam_ssh-1.97-23.4.1 pam_ssh-debuginfo-1.97-23.4.1 pam_ssh-debugsource-1.97-23.4.1 - openSUSE 12.3 (x86_64): pam_ssh-32bit-1.97-23.4.1 pam_ssh-debuginfo-32bit-1.97-23.4.1 - openSUSE 12.2 (i586 x86_64): pam_ssh-1.97-20.4.1 pam_ssh-debuginfo-1.97-20.4.1 pam_ssh-debugsource-1.97-20.4.1 - openSUSE 12.2 (x86_64): pam_ssh-32bit-1.97-20.4.1 pam_ssh-debuginfo-32bit-1.97-20.4.1 References: https://bugzilla.novell.com/823484

1 0