July 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1120-1: moderate: update for fail2ban
by opensuse-security＠opensuse.org 02 Jul '13

02 Jul '13

openSUSE Security Update: update for fail2ban ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1120-1 Rating: moderate References: #824710 Cross-References: CVE-2013-2178 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of fail2ban fixes a security vulnerability. Changes in fail2ban: - Fixes: Yaroslav Halchenko * [6ccd5781] filter.d/apache-{auth,nohome,noscript,overflows} - anchor failregex at the beginning (and where applicable at the end). Addresses a possible DoS. Closes gh#fail2ban/fail2ban#248, CVE-2013-2178, bnc#824710 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-544 - openSUSE 12.2: zypper in -t patch openSUSE-2013-544 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): fail2ban-0.8.8-2.8.1 - openSUSE 12.2 (noarch): fail2ban-0.8.6-2.9.1 References: http://support.novell.com/security/cve/CVE-2013-2178.html https://bugzilla.novell.com/824710

1 0

openSUSE-SU-2013:1119-1: moderate: Fix kpasswd UDP ping-pong
by opensuse-security＠opensuse.org 02 Jul '13

02 Jul '13

openSUSE Security Update: Fix kpasswd UDP ping-pong ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1119-1 Rating: moderate References: #825985 Cross-References: CVE-2002-2443 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a kpasswd UDP ping-pong security bug (CVE-2002-2443). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-546 - openSUSE 12.2: zypper in -t patch openSUSE-2013-546 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): krb5-1.10.2-10.17.1 krb5-client-1.10.2-10.17.1 krb5-client-debuginfo-1.10.2-10.17.1 krb5-debuginfo-1.10.2-10.17.1 krb5-debugsource-1.10.2-10.17.1 krb5-devel-1.10.2-10.17.1 krb5-mini-1.10.2-10.17.1 krb5-mini-debuginfo-1.10.2-10.17.1 krb5-mini-debugsource-1.10.2-10.17.1 krb5-mini-devel-1.10.2-10.17.1 krb5-plugin-kdb-ldap-1.10.2-10.17.1 krb5-plugin-kdb-ldap-debuginfo-1.10.2-10.17.1 krb5-plugin-preauth-pkinit-1.10.2-10.17.1 krb5-plugin-preauth-pkinit-debuginfo-1.10.2-10.17.1 krb5-server-1.10.2-10.17.1 krb5-server-debuginfo-1.10.2-10.17.1 - openSUSE 12.3 (x86_64): krb5-32bit-1.10.2-10.17.1 krb5-debuginfo-32bit-1.10.2-10.17.1 krb5-devel-32bit-1.10.2-10.17.1 - openSUSE 12.3 (noarch): krb5-doc-1.10.2-10.17.2 - openSUSE 12.2 (i586 x86_64): krb5-1.10.2-3.20.1 krb5-client-1.10.2-3.20.1 krb5-client-debuginfo-1.10.2-3.20.1 krb5-debuginfo-1.10.2-3.20.1 krb5-debugsource-1.10.2-3.20.1 krb5-devel-1.10.2-3.20.1 krb5-mini-1.10.2-3.20.1 krb5-mini-debuginfo-1.10.2-3.20.1 krb5-mini-debugsource-1.10.2-3.20.1 krb5-mini-devel-1.10.2-3.20.1 krb5-plugin-kdb-ldap-1.10.2-3.20.1 krb5-plugin-kdb-ldap-debuginfo-1.10.2-3.20.1 krb5-plugin-preauth-pkinit-1.10.2-3.20.1 krb5-plugin-preauth-pkinit-debuginfo-1.10.2-3.20.1 krb5-server-1.10.2-3.20.1 krb5-server-debuginfo-1.10.2-3.20.1 - openSUSE 12.2 (x86_64): krb5-32bit-1.10.2-3.20.1 krb5-debuginfo-32bit-1.10.2-3.20.1 krb5-devel-32bit-1.10.2-3.20.1 - openSUSE 12.2 (noarch): krb5-doc-1.10.2-3.20.2 References: http://support.novell.com/security/cve/CVE-2002-2443.html https://bugzilla.novell.com/825985

1 0

openSUSE-SU-2013:1118-1: moderate: update for dbus-1
by opensuse-security＠opensuse.org 02 Jul '13

02 Jul '13

openSUSE Security Update: update for dbus-1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1118-1 Rating: moderate References: #824607 Cross-References: CVE-2013-2168 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This dbus-1 update fixes a security vulnerability. - Added CVE-2013-2168.patch, fixes referenced vulnerability (bnc#824607) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-545 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): dbus-1-1.6.8-2.6.1 dbus-1-debuginfo-1.6.8-2.6.1 dbus-1-debugsource-1.6.8-2.6.1 dbus-1-devel-1.6.8-2.6.1 dbus-1-x11-1.6.8-2.6.1 dbus-1-x11-debuginfo-1.6.8-2.6.1 dbus-1-x11-debugsource-1.6.8-2.6.1 libdbus-1-3-1.6.8-2.6.1 libdbus-1-3-debuginfo-1.6.8-2.6.1 - openSUSE 12.3 (x86_64): dbus-1-32bit-1.6.8-2.6.1 dbus-1-debuginfo-32bit-1.6.8-2.6.1 dbus-1-devel-32bit-1.6.8-2.6.1 libdbus-1-3-32bit-1.6.8-2.6.1 libdbus-1-3-debuginfo-32bit-1.6.8-2.6.1 - openSUSE 12.3 (noarch): dbus-1-devel-doc-1.6.8-2.6.1 References: http://support.novell.com/security/cve/CVE-2013-2168.html https://bugzilla.novell.com/824607

1 0

openSUSE-SU-2013:1117-1: moderate: xdm: fixed NULL pointer crash
by opensuse-security＠opensuse.org 02 Jul '13

02 Jul '13

openSUSE Security Update: xdm: fixed NULL pointer crash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1117-1 Rating: moderate References: #824884 Cross-References: CVE-2013-2179 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: xdm was updated on crypt() NULL pointer crashes: * Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL (w/ NULL return) if the salt violates specifications. Additionally, on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords passed to crypt() fail with EPERM (w/ NULL return). If using glibc's crypt(), check return value to avoid a possible NULL pointer dereference. (bnc#824884) (CVE-2013-2179) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-547 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): xdm-1.1.10-14.10.1 xdm-debuginfo-1.1.10-14.10.1 xdm-debugsource-1.1.10-14.10.1 References: http://support.novell.com/security/cve/CVE-2013-2179.html https://bugzilla.novell.com/824884

1 0

openSUSE-RU-2013:1109-1: moderate: gnome-games: Fixes several crashes at start
by maintenance＠opensuse.org 01 Jul '13

01 Jul '13

openSUSE Recommended Update: gnome-games: Fixes several crashes at start ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1109-1 Rating: moderate References: #825469 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with gnome-games: - bnc#825469: + bgo#701601: Always undo from the most recent move. (bnc#825469, bgo#701601) + bgo#578130: Fix massive CPU usage after starting a new game. + bgo#701705: Stop the chess clock when ChessGame is freed. + prepare the preview surfaces before the board is shown. Without this, the game crashes upon starting most notably on 32-bit machines. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-542 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): glchess-3.6.1-2.8.1 glchess-debuginfo-3.6.1-2.8.1 glines-3.6.1-2.8.1 glines-debuginfo-3.6.1-2.8.1 gnect-3.6.1-2.8.1 gnect-debuginfo-3.6.1-2.8.1 gnibbles-3.6.1-2.8.1 gnibbles-debuginfo-3.6.1-2.8.1 gnobots2-3.6.1-2.8.1 gnobots2-debuginfo-3.6.1-2.8.1 gnome-games-3.6.1-2.8.1 gnome-games-debugsource-3.6.1-2.8.1 gnome-games-recommended-3.6.1-2.8.1 gnome-games-support-3.6.1-2.8.1 gnome-mahjongg-3.6.1-2.8.1 gnome-mahjongg-debuginfo-3.6.1-2.8.1 gnome-sudoku-3.6.1-2.8.1 gnomine-3.6.1-2.8.1 gnomine-debuginfo-3.6.1-2.8.1 gnotravex-3.6.1-2.8.1 gnotravex-debuginfo-3.6.1-2.8.1 gnotski-3.6.1-2.8.1 gnotski-debuginfo-3.6.1-2.8.1 gtali-3.6.1-2.8.1 gtali-debuginfo-3.6.1-2.8.1 iagno-3.6.1-2.8.1 iagno-debuginfo-3.6.1-2.8.1 lightsoff-3.6.1-2.8.1 lightsoff-debuginfo-3.6.1-2.8.1 quadrapassel-3.6.1-2.8.1 quadrapassel-debuginfo-3.6.1-2.8.1 swell-foop-3.6.1-2.8.1 swell-foop-debuginfo-3.6.1-2.8.1 - openSUSE 12.3 (noarch): glchess-lang-3.6.1-2.8.1 glines-lang-3.6.1-2.8.1 gnect-lang-3.6.1-2.8.1 gnibbles-lang-3.6.1-2.8.1 gnobots2-lang-3.6.1-2.8.1 gnome-games-support-lang-3.6.1-2.8.1 gnome-mahjongg-lang-3.6.1-2.8.1 gnome-sudoku-lang-3.6.1-2.8.1 gnomine-lang-3.6.1-2.8.1 gnotravex-lang-3.6.1-2.8.1 gnotski-lang-3.6.1-2.8.1 gtali-lang-3.6.1-2.8.1 iagno-lang-3.6.1-2.8.1 lightsoff-lang-3.6.1-2.8.1 quadrapassel-lang-3.6.1-2.8.1 swell-foop-lang-3.6.1-2.8.1 References: https://bugzilla.novell.com/825469

1 0

openSUSE-RU-2013:1108-1: pesign-obs-integration: Put debuginfo packages to %_topdir/OTHER
by maintenance＠opensuse.org 01 Jul '13

01 Jul '13

openSUSE Recommended Update: pesign-obs-integration: Put debuginfo packages to %_topdir/OTHER ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1108-1 Rating: low References: #824971 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with pesign-obs-integration: - bnc#824971: Put debuginfo packages to %_topdir/OTHER Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-543 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): pesign-obs-integration-9.0-0.1.26.1 References: https://bugzilla.novell.com/824971

1 0