July 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1187-1: important: 3.0.80 kernel update
by opensuse-security＠opensuse.org 12 Jul '13

12 Jul '13

openSUSE Security Update: 3.0.80 kernel update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1187-1 Rating: important References: #763968 #769685 #788590 #789359 #792584 #797175 #800907 #802642 #804609 #804656 #805804 #805945 #806238 #806980 #808358 #808647 #808827 #809122 #809895 #809902 #809903 #810473 #810580 #810624 #810722 #812281 #814719 #815356 #815444 #815745 #816443 #816451 #816586 #817010 #817339 #818053 #818327 #818371 #818514 #818516 #818798 #819295 #819519 #819655 #820434 #821930 #822431 #822722 Cross-References: CVE-2012-6548 CVE-2012-6549 CVE-2013-0160 CVE-2013-0268 CVE-2013-0311 CVE-2013-0914 CVE-2013-1772 CVE-2013-1792 CVE-2013-1796 CVE-2013-1797 CVE-2013-1798 CVE-2013-2634 CVE-2013-2635 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has 35 fixes is now available. Description: The kernel was updated to Linux kernel 3.0.80, fixing various bugs and security issues. Following security issues were fixed: CVE-2013-0160: Timing side channel on attacks were possible on /dev/ptmx that could allow local attackers to predict keypresses like e.g. passwords. This has been fixed again by updating accessed/modified time on the pty devices in resolution of 8 seconds, so that idle time detection can still work. CVE-2013-3222: The vcc_recvmsg function in net/atm/common.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. CVE-2013-3223: The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. CVE-2013-3224: The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel did not properly initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. CVE-2013-3225: The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. CVE-2013-3227: The caif_seqpkt_recvmsg function in net/caif/caif_socket.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. CVE-2013-3228: The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. CVE-2013-3229: The iucv_sock_recvmsg function in net/iucv/af_iucv.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. CVE-2013-3231: The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel did not initialize a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. CVE-2013-3232: The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. CVE-2013-3234: The rose_recvmsg function in net/rose/af_rose.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. CVE-2013-3235: net/tipc/socket.c in the Linux kernel did not initialize a certain data structure and a certain length variable, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call. CVE-2013-3076: The crypto API in the Linux kernel did not initialize certain length variables, which allowed local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c. CVE-2013-1979: The scm_set_cred function in include/net/scm.h in the Linux kernel used incorrect uid and gid values during credentials passing, which allowed local users to gain privileges via a crafted application. A kernel information leak via tkill/tgkill was fixed. Following bugs were fixed: - reiserfs: fix spurious multiple-fill in reiserfs_readdir_dentry (bnc#822722). - libfc: do not exch_done() on invalid sequence ptr (bnc#810722). - netfilter: ip6t_LOG: fix logging of packet mark (bnc#821930). - hyperv: use 3.4 as LIC version string (bnc#822431). - virtio_net: introduce VIRTIO_NET_HDR_F_DATA_VALID (bnc#819655). - xen/netback: do not disconnect frontend when seeing oversize packet. - xen/netfront: reduce gso_max_size to account for max TCP header. - xen/netfront: fix kABI after "reduce gso_max_size to account for max TCP header". - xfs: Fix kABI due to change in xfs_buf (bnc#815356). - xfs: fix race while discarding buffers [V4] (bnc#815356 (comment 36)). - xfs: Serialize file-extending direct IO (bnc#818371). - xhci: Do not switch webcams in some HP ProBooks to XHCI (bnc#805804). - bluetooth: Do not switch BT on HP ProBook 4340 (bnc#812281). - s390/ftrace: fix mcount adjustment (bnc#809895). - mm: memory_dev_init make sure nmi watchdog does not trigger while registering memory sections (bnc#804609, bnc#820434). - patches.fixes/xfs-backward-alloc-fix.diff: xfs: Avoid pathological backwards allocation (bnc#805945). - mm: compaction: Restart compaction from near where it left off - mm: compaction: cache if a pageblock was scanned and no pages were isolated - mm: compaction: clear PG_migrate_skip based on compaction and reclaim activity - mm: compaction: Scan PFN caching KABI workaround - mm: page_allocator: Remove first_pass guard - mm: vmscan: do not stall on writeback during memory compaction Cache compaction restart points for faster compaction cycles (bnc#816451) - qlge: fix dma map leak when the last chunk is not allocated (bnc#819519). - SUNRPC: Get rid of the redundant xprt->shutdown bit field (bnc#800907). - SUNRPC: Ensure that we grab the XPRT_LOCK before calling xprt_alloc_slot (bnc#800907). - SUNRPC: Fix a UDP transport regression (bnc#800907). - SUNRPC: Allow caller of rpc_sleep_on() to select priority levels (bnc#800907). - SUNRPC: Replace xprt->resend and xprt->sending with a priority queue (bnc#800907). - SUNRPC: Fix potential races in xprt_lock_write_next() (bnc#800907). - md: cannot re-add disks after recovery (bnc#808647). - fs/xattr.c:getxattr(): improve handling of allocation failures (bnc#818053). - fs/xattr.c:listxattr(): fall back to vmalloc() if kmalloc() failed (bnc#818053). - fs/xattr.c:setxattr(): improve handling of allocation failures (bnc#818053). - fs/xattr.c: suppress page allocation failure warnings from sys_listxattr() (bnc#818053). - virtio-blk: Call revalidate_disk() upon online disk resize (bnc#817339). - usb-storage: CY7C68300A chips do not support Cypress ATACB (bnc#819295). - patches.kernel.org/patch-3.0.60-61: Update references (add bnc#810580). - usb: Using correct way to clear usb3.0 devices remote wakeup feature (bnc#818516). - xhci: Fix TD size for isochronous URBs (bnc#818514). - ALSA: hda - fixup D3 pin and right channel mute on Haswell HDMI audio (bnc#818798). - ALSA: hda - Apply pin-enablement workaround to all Haswell HDMI codecs (bnc#818798). - xfs: fallback to vmalloc for large buffers in xfs_attrmulti_attr_get (bnc#818053). - xfs: fallback to vmalloc for large buffers in xfs_attrlist_by_handle (bnc#818053). - xfs: xfs: fallback to vmalloc for large buffers in xfs_compat_attrlist_by_handle (bnc#818053). - xHCI: store rings type. - xhci: Fix hang on back-to-back Set TR Deq Ptr commands. - xHCI: check enqueue pointer advance into dequeue seg. - xHCI: store rings last segment and segment numbers. - xHCI: Allocate 2 segments for transfer ring. - xHCI: count free TRBs on transfer ring. - xHCI: factor out segments allocation and free function. - xHCI: update sg tablesize. - xHCI: set cycle state when allocate rings. - xhci: Reserve one command for USB3 LPM disable. - xHCI: dynamic ring expansion. - xhci: Do not warn on empty ring for suspended devices. - md/raid1: Do not release reference to device while handling read error (bnc#809122, bnc#814719). - rpm/mkspec: Stop generating the get_release_number.sh file. - rpm/kernel-spec-macros: Properly handle KOTD release numbers with .g<commit> suffix. - rpm/kernel-spec-macros: Drop the %release_num macro We no longer put the -rcX tag into the release string. - rpm/kernel-*.spec.in, rpm/mkspec: Do not force the "<RELEASE>" string in specfiles. - mm/mmap: check for RLIMIT_AS before unmapping (bnc#818327). - mm: Fix add_page_wait_queue() to work for PG_Locked bit waiters (bnc#792584). - mm: Fix add_page_wait_queue() to work for PG_Locked bit waiters (bnc#792584). - bonding: only use primary address for ARP (bnc#815444). - bonding: remove entries for master_ip and vlan_ip and query devices instead (bnc#815444). - mm: speedup in __early_pfn_to_nid (bnc#810624). - TTY: fix atime/mtime regression (bnc#815745). - sd_dif: problem with verify of type 1 protection information (PI) (bnc#817010). - sched: harden rq rt usage accounting (bnc#769685, bnc#788590). - rcu: Avoid spurious RCU CPU stall warnings (bnc#816586). - rcu: Dump local stack if cannot dump all CPUs stacks (bnc#816586). - rcu: Fix detection of abruptly-ending stall (bnc#816586). - rcu: Suppress NMI backtraces when stall ends before dump (bnc#816586). - Update Xen patches to 3.0.74. - btrfs: do not re-enter when allocating a chunk. - btrfs: save us a read_lock. - btrfs: Check CAP_DAC_READ_SEARCH for BTRFS_IOC_INO_PATHS. - btrfs: remove unused fs_info from btrfs_decode_error(). - btrfs: handle null fs_info in btrfs_panic(). - btrfs: fix varargs in __btrfs_std_error. - btrfs: fix the race between bio and btrfs_stop_workers. - btrfs: fix NULL pointer after aborting a transaction. - btrfs: fix infinite loop when we abort on mount. - xfs: Do not allocate new buffers on every call to _xfs_buf_find (bnc#763968). - xfs: fix buffer lookup race on allocation failure (bnc#763968). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-109 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): kernel-debug-3.0.80-52.1 kernel-debug-base-3.0.80-52.1 kernel-debug-base-debuginfo-3.0.80-52.1 kernel-debug-debuginfo-3.0.80-52.1 kernel-debug-debugsource-3.0.80-52.1 kernel-debug-devel-3.0.80-52.1 kernel-debug-devel-debuginfo-3.0.80-52.1 kernel-debug-hmac-3.0.80-52.1 kernel-default-3.0.80-52.1 kernel-default-base-3.0.80-52.1 kernel-default-base-debuginfo-3.0.80-52.1 kernel-default-debuginfo-3.0.80-52.1 kernel-default-debugsource-3.0.80-52.1 kernel-default-devel-3.0.80-52.1 kernel-default-devel-debuginfo-3.0.80-52.1 kernel-default-hmac-3.0.80-52.1 kernel-desktop-3.0.80-52.1 kernel-desktop-base-3.0.80-52.1 kernel-desktop-base-debuginfo-3.0.80-52.1 kernel-desktop-debuginfo-3.0.80-52.1 kernel-desktop-debugsource-3.0.80-52.1 kernel-desktop-devel-3.0.80-52.1 kernel-desktop-devel-debuginfo-3.0.80-52.1 kernel-desktop-hmac-3.0.80-52.1 kernel-ec2-3.0.80-52.1 kernel-ec2-base-3.0.80-52.1 kernel-ec2-base-debuginfo-3.0.80-52.1 kernel-ec2-debuginfo-3.0.80-52.1 kernel-ec2-debugsource-3.0.80-52.1 kernel-ec2-devel-3.0.80-52.1 kernel-ec2-devel-debuginfo-3.0.80-52.1 kernel-ec2-extra-3.0.80-52.1 kernel-ec2-extra-debuginfo-3.0.80-52.1 kernel-ec2-hmac-3.0.80-52.1 kernel-source-3.0.80-52.1 kernel-source-vanilla-3.0.80-52.1 kernel-syms-3.0.80-52.1 kernel-trace-3.0.80-52.1 kernel-trace-base-3.0.80-52.1 kernel-trace-base-debuginfo-3.0.80-52.1 kernel-trace-debuginfo-3.0.80-52.1 kernel-trace-debugsource-3.0.80-52.1 kernel-trace-devel-3.0.80-52.1 kernel-trace-devel-debuginfo-3.0.80-52.1 kernel-trace-hmac-3.0.80-52.1 kernel-vanilla-3.0.80-52.1 kernel-vanilla-base-3.0.80-52.1 kernel-vanilla-base-debuginfo-3.0.80-52.1 kernel-vanilla-debuginfo-3.0.80-52.1 kernel-vanilla-debugsource-3.0.80-52.1 kernel-vanilla-devel-3.0.80-52.1 kernel-vanilla-devel-debuginfo-3.0.80-52.1 kernel-vanilla-hmac-3.0.80-52.1 kernel-xen-3.0.80-52.1 kernel-xen-base-3.0.80-52.1 kernel-xen-base-debuginfo-3.0.80-52.1 kernel-xen-debuginfo-3.0.80-52.1 kernel-xen-debugsource-3.0.80-52.1 kernel-xen-devel-3.0.80-52.1 kernel-xen-devel-debuginfo-3.0.80-52.1 kernel-xen-hmac-3.0.80-52.1 preload-1.2-6.35.1 preload-debuginfo-1.2-6.35.1 preload-debugsource-1.2-6.35.1 preload-kmp-default-1.2_3.0.80_52-6.35.1 preload-kmp-default-debuginfo-1.2_3.0.80_52-6.35.1 preload-kmp-desktop-1.2_3.0.80_52-6.35.1 preload-kmp-desktop-debuginfo-1.2_3.0.80_52-6.35.1 - openSUSE 11.4 (noarch): kernel-docs-3.0.80-52.2 - openSUSE 11.4 (i586): kernel-pae-3.0.80-52.1 kernel-pae-base-3.0.80-52.1 kernel-pae-base-debuginfo-3.0.80-52.1 kernel-pae-debuginfo-3.0.80-52.1 kernel-pae-debugsource-3.0.80-52.1 kernel-pae-devel-3.0.80-52.1 kernel-pae-devel-debuginfo-3.0.80-52.1 kernel-pae-hmac-3.0.80-52.1 kernel-vmi-3.0.80-52.1 kernel-vmi-base-3.0.80-52.1 kernel-vmi-base-debuginfo-3.0.80-52.1 kernel-vmi-debuginfo-3.0.80-52.1 kernel-vmi-debugsource-3.0.80-52.1 kernel-vmi-devel-3.0.80-52.1 kernel-vmi-devel-debuginfo-3.0.80-52.1 kernel-vmi-hmac-3.0.80-52.1 References: http://support.novell.com/security/cve/CVE-2012-6548.html http://support.novell.com/security/cve/CVE-2012-6549.html http://support.novell.com/security/cve/CVE-2013-0160.html http://support.novell.com/security/cve/CVE-2013-0268.html http://support.novell.com/security/cve/CVE-2013-0311.html http://support.novell.com/security/cve/CVE-2013-0914.html http://support.novell.com/security/cve/CVE-2013-1772.html http://support.novell.com/security/cve/CVE-2013-1792.html http://support.novell.com/security/cve/CVE-2013-1796.html http://support.novell.com/security/cve/CVE-2013-1797.html http://support.novell.com/security/cve/CVE-2013-1798.html http://support.novell.com/security/cve/CVE-2013-2634.html http://support.novell.com/security/cve/CVE-2013-2635.html https://bugzilla.novell.com/763968 https://bugzilla.novell.com/769685 https://bugzilla.novell.com/788590 https://bugzilla.novell.com/789359 https://bugzilla.novell.com/792584 https://bugzilla.novell.com/797175 https://bugzilla.novell.com/800907 https://bugzilla.novell.com/802642 https://bugzilla.novell.com/804609 https://bugzilla.novell.com/804656 https://bugzilla.novell.com/805804 https://bugzilla.novell.com/805945 https://bugzilla.novell.com/806238 https://bugzilla.novell.com/806980 https://bugzilla.novell.com/808358 https://bugzilla.novell.com/808647 https://bugzilla.novell.com/808827 https://bugzilla.novell.com/809122 https://bugzilla.novell.com/809895 https://bugzilla.novell.com/809902 https://bugzilla.novell.com/809903 https://bugzilla.novell.com/810473 https://bugzilla.novell.com/810580 https://bugzilla.novell.com/810624 https://bugzilla.novell.com/810722 https://bugzilla.novell.com/812281 https://bugzilla.novell.com/814719 https://bugzilla.novell.com/815356 https://bugzilla.novell.com/815444 https://bugzilla.novell.com/815745 https://bugzilla.novell.com/816443 https://bugzilla.novell.com/816451 https://bugzilla.novell.com/816586 https://bugzilla.novell.com/817010 https://bugzilla.novell.com/817339 https://bugzilla.novell.com/818053 https://bugzilla.novell.com/818327 https://bugzilla.novell.com/818371 https://bugzilla.novell.com/818514 https://bugzilla.novell.com/818516 https://bugzilla.novell.com/818798 https://bugzilla.novell.com/819295 https://bugzilla.novell.com/819519 https://bugzilla.novell.com/819655 https://bugzilla.novell.com/820434 https://bugzilla.novell.com/821930 https://bugzilla.novell.com/822431 https://bugzilla.novell.com/822722

1 0

openSUSE-SU-2013:1186-1: moderate: ruby19
by opensuse-security＠opensuse.org 12 Jul '13

12 Jul '13

openSUSE Security Update: ruby19 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1186-1 Rating: moderate References: #827265 Cross-References: CVE-2013-4073 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: was updated to fix SSL hostname certification (CVE-2013-4073) (bnc#827265). https://github.com/ruby/ruby/commit/2669b84d407ab431e965145c 827db66c91158f89 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-107 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): ruby-1.8.7.p357-0.36.1 ruby-debuginfo-1.8.7.p357-0.36.1 ruby-debugsource-1.8.7.p357-0.36.1 ruby-devel-1.8.7.p357-0.36.1 ruby-examples-1.8.7.p357-0.36.1 ruby-test-suite-1.8.7.p357-0.36.1 ruby-tk-1.8.7.p357-0.36.1 ruby-tk-debuginfo-1.8.7.p357-0.36.1 - openSUSE 11.4 (noarch): ruby-doc-html-1.8.7.p357-0.36.1 ruby-doc-ri-1.8.7.p357-0.36.1 References: http://support.novell.com/security/cve/CVE-2013-4073.html https://bugzilla.novell.com/827265

1 0

openSUSE-SU-2013:1185-1: moderate: perl-Module-Signature
by opensuse-security＠opensuse.org 12 Jul '13

12 Jul '13

openSUSE Security Update: perl-Module-Signature ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1185-1 Rating: moderate References: #828010 Cross-References: CVE-2013-2145 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: perl-Module-Signature was updated to 0.73, fixing bugs and security issues: Security fix for code execution in signature checking: * fix for bnc#828010 (CVE-2013-2145) * Properly redo the previous fix using File::Spec->file_name_is_absolute. - [Changes for 0.72 - Wed Jun 5 23:19:02 CST 2013] * Only allow loading Digest::* from absolute paths in @INC, by ensuring they begin with \ or / characters. Contributed by: Florian Weimer (CVE-2013-2145) - [Changes for 0.71 - Tue Jun 4 18:24:10 CST 2013] * Constrain the user-specified digest name to /^\w+\d+$/. * Avoid loading Digest::* from relative paths in @INC. Contributed by: Florian Weimer (CVE-2013-2145) - [Changes for 0.70 - Thu Nov 29 01:45:54 CST 2012] * Don't check gpg version if gpg does not exist. This avoids unnecessary warnings during installation when gpg executable is not installed. Contributed by: Kenichi Ishigaki - [Changes for 0.69 - Fri Nov 2 23:04:19 CST 2012] * Support for gpg under these alternate names: gpg gpg2 gnupg gnupg2 Contributed by: Michael Schwern - [Changes for 0.68 - Wed Dec 14 12:14:47 UTC 2011] * Fix breakage introduced by 0.67 (Andreas König). * Better handling of \r (Andreas König, Zefram) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-108 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): perl-Module-Signature-0.73-9.1 References: http://support.novell.com/security/cve/CVE-2013-2145.html https://bugzilla.novell.com/828010

1 0

openSUSE-SU-2013:1181-1: moderate: update for ruby19
by opensuse-security＠opensuse.org 11 Jul '13

11 Jul '13

openSUSE Security Update: update for ruby19 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1181-1 Rating: moderate References: #827265 Cross-References: CVE-2013-4073 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - fix cve-2013-4073 (bnc#827265) The fix_cve-2013-4073.patch contains the patch for cve-2013-4073 (bnc#827265) adapted from https://github.com/ruby/ruby/commit/2669b84d407ab431e965145c 827db66c91158f89 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-575 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): ruby19-1.9.3.p392-1.9.1 ruby19-debuginfo-1.9.3.p392-1.9.1 ruby19-debugsource-1.9.3.p392-1.9.1 ruby19-devel-1.9.3.p392-1.9.1 ruby19-devel-extra-1.9.3.p392-1.9.1 ruby19-tk-1.9.3.p392-1.9.1 ruby19-tk-debuginfo-1.9.3.p392-1.9.1 - openSUSE 12.3 (noarch): ruby19-doc-ri-1.9.3.p392-1.9.1 References: http://support.novell.com/security/cve/CVE-2013-4073.html https://bugzilla.novell.com/827265

1 0

openSUSE-SU-2013:1180-1: moderate: seamonkey: 2.19
by opensuse-security＠opensuse.org 11 Jul '13

11 Jul '13

openSUSE Security Update: seamonkey: 2.19 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1180-1 Rating: moderate References: #813026 #814101 #825935 Cross-References: CVE-2013-0788 CVE-2013-0789 CVE-2013-0792 CVE-2013-0793 CVE-2013-0794 CVE-2013-0795 CVE-2013-0796 CVE-2013-0800 CVE-2013-1682 CVE-2013-1683 CVE-2013-1684 CVE-2013-1685 CVE-2013-1686 CVE-2013-1687 CVE-2013-1688 CVE-2013-1690 CVE-2013-1692 CVE-2013-1693 CVE-2013-1694 CVE-2013-1695 CVE-2013-1696 CVE-2013-1697 CVE-2013-1698 CVE-2013-1699 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: seamonkey was updated to 2.19 (bnc#825935) to fix bugs and security issues. Security issues fixed: * MFSA 2013-49/CVE-2013-1682/CVE-2013-1683 Miscellaneous memory safety hazards * MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer * MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL * MFSA 2013-52/CVE-2013-1688 (bmo#873966) Arbitrary code execution within Profiler * MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event * MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks * MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure * MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior * MFSA 2013-57/CVE-2013-1695 (bmo#849791) Sandbox restrictions not applied to nested frame elements * MFSA 2013-58/CVE-2013-1696 (bmo#761667) X-Frame-Options ignored when using server push with multi-part responses * MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context * MFSA 2013-60/CVE-2013-1698 (bmo#876044) getUserMedia permission dialog incorrectly displays location * MFSA 2013-61/CVE-2013-1699 (bmo#840882) Homograph domain spoofing in .com, .net and .name Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-574 - openSUSE 12.2: zypper in -t patch openSUSE-2013-574 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): seamonkey-2.19-1.12.1 seamonkey-debuginfo-2.19-1.12.1 seamonkey-debugsource-2.19-1.12.1 seamonkey-dom-inspector-2.19-1.12.1 seamonkey-irc-2.19-1.12.1 seamonkey-translations-common-2.19-1.12.1 seamonkey-translations-other-2.19-1.12.1 seamonkey-venkman-2.19-1.12.1 - openSUSE 12.2 (i586 x86_64): seamonkey-2.19-2.42.1 seamonkey-debuginfo-2.19-2.42.1 seamonkey-debugsource-2.19-2.42.1 seamonkey-dom-inspector-2.19-2.42.1 seamonkey-irc-2.19-2.42.1 seamonkey-translations-common-2.19-2.42.1 seamonkey-translations-other-2.19-2.42.1 seamonkey-venkman-2.19-2.42.1 References: http://support.novell.com/security/cve/CVE-2013-0788.html http://support.novell.com/security/cve/CVE-2013-0789.html http://support.novell.com/security/cve/CVE-2013-0792.html http://support.novell.com/security/cve/CVE-2013-0793.html http://support.novell.com/security/cve/CVE-2013-0794.html http://support.novell.com/security/cve/CVE-2013-0795.html http://support.novell.com/security/cve/CVE-2013-0796.html http://support.novell.com/security/cve/CVE-2013-0800.html http://support.novell.com/security/cve/CVE-2013-1682.html http://support.novell.com/security/cve/CVE-2013-1683.html http://support.novell.com/security/cve/CVE-2013-1684.html http://support.novell.com/security/cve/CVE-2013-1685.html http://support.novell.com/security/cve/CVE-2013-1686.html http://support.novell.com/security/cve/CVE-2013-1687.html http://support.novell.com/security/cve/CVE-2013-1688.html http://support.novell.com/security/cve/CVE-2013-1690.html http://support.novell.com/security/cve/CVE-2013-1692.html http://support.novell.com/security/cve/CVE-2013-1693.html http://support.novell.com/security/cve/CVE-2013-1694.html http://support.novell.com/security/cve/CVE-2013-1695.html http://support.novell.com/security/cve/CVE-2013-1696.html http://support.novell.com/security/cve/CVE-2013-1697.html http://support.novell.com/security/cve/CVE-2013-1698.html http://support.novell.com/security/cve/CVE-2013-1699.html https://bugzilla.novell.com/813026 https://bugzilla.novell.com/814101 https://bugzilla.novell.com/825935

1 0

openSUSE-SU-2013:1179-1: moderate: ruby19
by opensuse-security＠opensuse.org 11 Jul '13

11 Jul '13

openSUSE Security Update: ruby19 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1179-1 Rating: moderate References: #827265 Cross-References: CVE-2013-4073 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: was updated to fix SSL hostname certification (CVE-2013-4073) (bnc#827265). https://github.com/ruby/ruby/commit/2669b84d407ab431e965145c 827db66c91158f89 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-572 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): ruby19-1.9.3.p392-3.26.1 ruby19-debuginfo-1.9.3.p392-3.26.1 ruby19-debugsource-1.9.3.p392-3.26.1 ruby19-devel-1.9.3.p392-3.26.1 ruby19-devel-extra-1.9.3.p392-3.26.1 ruby19-tk-1.9.3.p392-3.26.1 ruby19-tk-debuginfo-1.9.3.p392-3.26.1 - openSUSE 12.2 (noarch): ruby19-doc-ri-1.9.3.p392-3.26.1 References: http://support.novell.com/security/cve/CVE-2013-4073.html https://bugzilla.novell.com/827265

1 0

openSUSE-SU-2013:1178-1: moderate: perl-Module-Signature
by opensuse-security＠opensuse.org 11 Jul '13

11 Jul '13

openSUSE Security Update: perl-Module-Signature ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1178-1 Rating: moderate References: #828010 Cross-References: CVE-2013-2145 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: perl-Module-Signature was updated to 0.73, fixing bugs and security issues: Security fix for code execution in signature checking: * fix for bnc#828010 (CVE-2013-2145) * Properly redo the previous fix using File::Spec->file_name_is_absolute. - [Changes for 0.72 - Wed Jun 5 23:19:02 CST 2013] * Only allow loading Digest::* from absolute paths in @INC, by ensuring they begin with \ or / characters. Contributed by: Florian Weimer (CVE-2013-2145) - [Changes for 0.71 - Tue Jun 4 18:24:10 CST 2013] * Constrain the user-specified digest name to /^\w+\d+$/. * Avoid loading Digest::* from relative paths in @INC. Contributed by: Florian Weimer (CVE-2013-2145) - [Changes for 0.70 - Thu Nov 29 01:45:54 CST 2012] * Don't check gpg version if gpg does not exist. This avoids unnecessary warnings during installation when gpg executable is not installed. Contributed by: Kenichi Ishigaki - [Changes for 0.69 - Fri Nov 2 23:04:19 CST 2012] * Support for gpg under these alternate names: gpg gpg2 gnupg gnupg2 Contributed by: Michael Schwern Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-573 - openSUSE 12.2: zypper in -t patch openSUSE-2013-573 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): perl-Module-Signature-0.73-4.4.1 - openSUSE 12.2 (noarch): perl-Module-Signature-0.73-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-2145.html https://bugzilla.novell.com/828010

1 0

openSUSE-SU-2013:1177-1: moderate: update for xorg-x11-server
by opensuse-security＠opensuse.org 11 Jul '13

11 Jul '13

openSUSE Security Update: update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1177-1 Rating: moderate References: #815583 #823410 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This xorg-x11-server update fixes a DoS vulnerability and adds randr support. - U_os-Reset-input-buffer-s-ignoreBytes-field.patch * If a client sends a request larger than maxBigRequestSize, the server is supposed to ignore it. Before commit cf88363d, the server would simply disconnect the client. After that commit, it attempts to gracefully ignore the request by remembering how long the client specified the request to be, and ignoring that many bytes. However, if a client sends a BigReq header with a large size and disconnects before actually sending the rest of the specified request, the server will reuse the ConnectionInput buffer without resetting the ignoreBytes field. This makes the server ignore new X clients' requests. This fixes that behavior by resetting the ignoreBytes field when putting the ConnectionInput buffer back on the FreeInputs list. (bnc#815583) - u_xserver_xvfb-randr.patch * Add randr support to Xvfb (bnc#823410) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-106 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): xorg-x11-Xvnc-7.6_1.9.3-15.40.1 xorg-x11-Xvnc-debuginfo-7.6_1.9.3-15.40.1 xorg-x11-server-7.6_1.9.3-15.40.1 xorg-x11-server-debuginfo-7.6_1.9.3-15.40.1 xorg-x11-server-debugsource-7.6_1.9.3-15.40.1 xorg-x11-server-extra-7.6_1.9.3-15.40.1 xorg-x11-server-extra-debuginfo-7.6_1.9.3-15.40.1 xorg-x11-server-sdk-7.6_1.9.3-15.40.1 References: https://bugzilla.novell.com/815583 https://bugzilla.novell.com/823410

1 0

openSUSE-SU-2013:1176-1: important: update to SeaMonkey 2.19
by opensuse-security＠opensuse.org 11 Jul '13

11 Jul '13

openSUSE Security Update: update to SeaMonkey 2.19 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1176-1 Rating: important References: #825935 Cross-References: CVE-2013-1682 CVE-2013-1683 CVE-2013-1684 CVE-2013-1685 CVE-2013-1686 CVE-2013-1687 CVE-2013-1688 CVE-2013-1690 CVE-2013-1692 CVE-2013-1693 CVE-2013-1694 CVE-2013-1695 CVE-2013-1696 CVE-2013-1697 CVE-2013-1698 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: Seamonkey was updated to version 2.19 * MFSA 2013-49/CVE-2013-1682/CVE-2013-1683 Miscellaneous memory safety hazards * MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer * MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL * MFSA 2013-52/CVE-2013-1688 (bmo#873966) Arbitrary code execution within Profiler * MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event * MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks * MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure * MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior * MFSA 2013-57/CVE-2013-1695 (bmo#849791) Sandbox restrictions not applied to nested frame elements * MFSA 2013-58/CVE-2013-1696 (bmo#761667) X-Frame-Options ignored when using server push with multi-part responses * MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context * MFSA 2013-60/CVE-2013-1698 (bmo#876044) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-105 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): seamonkey-2.19-69.1 seamonkey-debuginfo-2.19-69.1 seamonkey-debugsource-2.19-69.1 seamonkey-dom-inspector-2.19-69.1 seamonkey-irc-2.19-69.1 seamonkey-translations-common-2.19-69.1 seamonkey-translations-other-2.19-69.1 seamonkey-venkman-2.19-69.1 References: http://support.novell.com/security/cve/CVE-2013-1682.html http://support.novell.com/security/cve/CVE-2013-1683.html http://support.novell.com/security/cve/CVE-2013-1684.html http://support.novell.com/security/cve/CVE-2013-1685.html http://support.novell.com/security/cve/CVE-2013-1686.html http://support.novell.com/security/cve/CVE-2013-1687.html http://support.novell.com/security/cve/CVE-2013-1688.html http://support.novell.com/security/cve/CVE-2013-1690.html http://support.novell.com/security/cve/CVE-2013-1692.html http://support.novell.com/security/cve/CVE-2013-1693.html http://support.novell.com/security/cve/CVE-2013-1694.html http://support.novell.com/security/cve/CVE-2013-1695.html http://support.novell.com/security/cve/CVE-2013-1696.html http://support.novell.com/security/cve/CVE-2013-1697.html http://support.novell.com/security/cve/CVE-2013-1698.html https://bugzilla.novell.com/825935

1 0

openSUSE-RU-2013:1172-1: Update openSUSE open-iscsi to SLES 11 SP3
by maintenance＠opensuse.org 10 Jul '13

10 Jul '13

openSUSE Recommended Update: Update openSUSE open-iscsi to SLES 11 SP3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1172-1 Rating: low References: #435689 #455995 #466846 #471475 #514273 #519402 #528711 #541882 #541892 #561596 #562030 #565116 #576601 #581259 #589064 #590531 #595629 #596627 #603382 #608224 #617883 #687392 #708261 #711953 #713975 #715071 #718014 #722268 #726708 #727415 #728095 #730157 #731216 #732634 #732798 #738040 #742430 #742570 #751056 #769125 #807936 #810208 #818517 #820881 #821695 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has 45 recommended fixes can now be installed. Description: Update openSUSE open-iscsi to SLES 11 SP3 version. See open-iscsi.changes for details. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-570 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): open-iscsi-2.0.873-47.14.1 open-iscsi-debuginfo-2.0.873-47.14.1 open-iscsi-debugsource-2.0.873-47.14.1 References: https://bugzilla.novell.com/435689 https://bugzilla.novell.com/455995 https://bugzilla.novell.com/466846 https://bugzilla.novell.com/471475 https://bugzilla.novell.com/514273 https://bugzilla.novell.com/519402 https://bugzilla.novell.com/528711 https://bugzilla.novell.com/541882 https://bugzilla.novell.com/541892 https://bugzilla.novell.com/561596 https://bugzilla.novell.com/562030 https://bugzilla.novell.com/565116 https://bugzilla.novell.com/576601 https://bugzilla.novell.com/581259 https://bugzilla.novell.com/589064 https://bugzilla.novell.com/590531 https://bugzilla.novell.com/595629 https://bugzilla.novell.com/596627 https://bugzilla.novell.com/603382 https://bugzilla.novell.com/608224 https://bugzilla.novell.com/617883 https://bugzilla.novell.com/687392 https://bugzilla.novell.com/708261 https://bugzilla.novell.com/711953 https://bugzilla.novell.com/713975 https://bugzilla.novell.com/715071 https://bugzilla.novell.com/718014 https://bugzilla.novell.com/722268 https://bugzilla.novell.com/726708 https://bugzilla.novell.com/727415 https://bugzilla.novell.com/728095 https://bugzilla.novell.com/730157 https://bugzilla.novell.com/731216 https://bugzilla.novell.com/732634 https://bugzilla.novell.com/732798 https://bugzilla.novell.com/738040 https://bugzilla.novell.com/742430 https://bugzilla.novell.com/742570 https://bugzilla.novell.com/751056 https://bugzilla.novell.com/769125 https://bugzilla.novell.com/807936 https://bugzilla.novell.com/810208 https://bugzilla.novell.com/818517 https://bugzilla.novell.com/820881 https://bugzilla.novell.com/821695

1 0