July 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1139-1: moderate: update for subversion
by opensuse-security＠opensuse.org 04 Jul '13

04 Jul '13

openSUSE Security Update: update for subversion ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1139-1 Rating: moderate References: #821505 Cross-References: CVE-2013-1968 CVE-2013-2088 CVE-2013-2112 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update of subversion includes several security fixes. - Server-side bugfixes: * fix FSFS repository corruption due to newline in filename * fix svnserve exiting when a client connection is aborted - Other tool improvements and bugfixes: * fix argument processing in contrib hook scripts Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-102 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.6.23-51.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.6.23-51.1 libsvn_auth_kwallet-1-0-1.6.23-51.1 libsvn_auth_kwallet-1-0-debuginfo-1.6.23-51.1 subversion-1.6.23-51.1 subversion-debuginfo-1.6.23-51.1 subversion-debugsource-1.6.23-51.1 subversion-devel-1.6.23-51.1 subversion-perl-1.6.23-51.1 subversion-perl-debuginfo-1.6.23-51.1 subversion-python-1.6.23-51.1 subversion-python-debuginfo-1.6.23-51.1 subversion-ruby-1.6.23-51.1 subversion-ruby-debuginfo-1.6.23-51.1 subversion-server-1.6.23-51.1 subversion-server-debuginfo-1.6.23-51.1 subversion-tools-1.6.23-51.1 subversion-tools-debuginfo-1.6.23-51.1 References: http://support.novell.com/security/cve/CVE-2013-1968.html http://support.novell.com/security/cve/CVE-2013-2088.html http://support.novell.com/security/cve/CVE-2013-2112.html https://bugzilla.novell.com/821505

1 0

openSUSE-RU-2013:1134-1: important: NetworkManager-strongswan: Fixed an issue where "program" in nm-strongswan-service.name points to a wrong binary
by maintenance＠opensuse.org 03 Jul '13

03 Jul '13

openSUSE Recommended Update: NetworkManager-strongswan: Fixed an issue where "program" in nm-strongswan-service.name points to a wrong binary ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1134-1 Rating: important References: #824079 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with NetworkManager-strongswan: - bnc#824079: Since strongwan 5.0.x, upstream developed a charon-nm daemon specific for NetworkManager. But in our /etc/NetworkManager/VPN/nm-strongswan-service.name, we're still using: program=/usr/lib/ipsec/charon it should be: program=/usr/lib/ipsec/charon-nm or there'll be a "vpn service 'strongswan' start timed out" aka "signal of type SIGTERM received. Shutting down" error. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-553 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): NetworkManager-strongswan-1.3.0-7.4.1 NetworkManager-strongswan-debugsource-1.3.0-7.4.1 NetworkManager-strongswan-gnome-1.3.0-7.4.1 NetworkManager-strongswan-gnome-debuginfo-1.3.0-7.4.1 - openSUSE 12.3 (noarch): NetworkManager-strongswan-lang-1.3.0-7.4.1 References: https://bugzilla.novell.com/824079

1 0

openSUSE-SU-2013:1133-1: moderate: update for curl
by opensuse-security＠opensuse.org 03 Jul '13

03 Jul '13

openSUSE Security Update: update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1133-1 Rating: moderate References: #824517 Cross-References: CVE-2013-2174 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a curl security vulnerability which may lead to heap corruption. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-100 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): curl-7.21.2-33.1 curl-debuginfo-7.21.2-33.1 libcurl-devel-7.21.2-33.1 libcurl4-7.21.2-33.1 - openSUSE 11.4 (x86_64): libcurl4-32bit-7.21.2-33.1 libcurl4-debuginfo-32bit-7.21.2-33.1 - openSUSE 11.4 (ia64): libcurl4-debuginfo-x86-7.21.2-33.1 libcurl4-x86-7.21.2-33.1 - openSUSE 11.4 (i586): libcurl4-debuginfo-7.21.2-33.1 References: http://support.novell.com/security/cve/CVE-2013-2174.html https://bugzilla.novell.com/824517

1 0

openSUSE-SU-2013:1132-1:
by opensuse-security＠opensuse.org 03 Jul '13

03 Jul '13

openSUSE Security Update: ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1132-1 Rating: low References: #824517 Cross-References: CVE-2013-2174 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: No description available. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-552 - openSUSE 12.2: zypper in -t patch openSUSE-2013-552 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): curl-7.28.1-4.17.1 curl-debuginfo-7.28.1-4.17.1 curl-debugsource-7.28.1-4.17.1 libcurl-devel-7.28.1-4.17.1 libcurl4-7.28.1-4.17.1 libcurl4-debuginfo-7.28.1-4.17.1 - openSUSE 12.3 (x86_64): libcurl4-32bit-7.28.1-4.17.1 libcurl4-debuginfo-32bit-7.28.1-4.17.1 - openSUSE 12.2 (i586 x86_64): curl-7.25.0-2.16.1 curl-debuginfo-7.25.0-2.16.1 curl-debugsource-7.25.0-2.16.1 libcurl-devel-7.25.0-2.16.1 libcurl4-7.25.0-2.16.1 libcurl4-debuginfo-7.25.0-2.16.1 - openSUSE 12.2 (x86_64): libcurl4-32bit-7.25.0-2.16.1 libcurl4-debuginfo-32bit-7.25.0-2.16.1 References: http://support.novell.com/security/cve/CVE-2013-2174.html https://bugzilla.novell.com/824517

1 0

openSUSE-RU-2013:1129-1: taglib: Added check if file is open before attempting to read tags
by maintenance＠opensuse.org 03 Jul '13

03 Jul '13

openSUSE Recommended Update: taglib: Added check if file is open before attempting to read tags ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1129-1 Rating: low References: #826228 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This udpate fixes the following issue with libtag: - bnc#826228: added check if file is open before attempting to read tags Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-549 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libtag-devel-1.8-3.13.1 libtag1-1.8-3.13.1 libtag1-debuginfo-1.8-3.13.1 libtag_c0-1.8-3.13.1 libtag_c0-debuginfo-1.8-3.13.1 taglib-1.8-3.13.1 taglib-debuginfo-1.8-3.13.1 taglib-debugsource-1.8-3.13.1 - openSUSE 12.3 (x86_64): libtag1-32bit-1.8-3.13.1 libtag1-debuginfo-32bit-1.8-3.13.1 libtag_c0-32bit-1.8-3.13.1 libtag_c0-debuginfo-32bit-1.8-3.13.1 References: https://bugzilla.novell.com/826228

1 0

openSUSE-RU-2013:1128-1: important: librcc: fix chinese charset with unzip
by maintenance＠opensuse.org 03 Jul '13

03 Jul '13

openSUSE Recommended Update: librcc: fix chinese charset with unzip ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1128-1 Rating: important References: #821877 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with librcc: - bnc#821877: rcc-runtime contains dynamic charset detection engines for librcc0 library. Thus it should be required by librcc0 instead of librcc main package, which doesn't exist at all. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-551 - openSUSE 12.2: zypper in -t patch openSUSE-2013-551 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): librcc-debugsource-0.2.10-2.4.1 librcc-devel-0.2.10-2.4.1 librcc0-0.2.10-2.4.1 librcc0-debuginfo-0.2.10-2.4.1 rcc-runtime-0.2.10-2.4.1 rcc-runtime-debuginfo-0.2.10-2.4.1 - openSUSE 12.3 (x86_64): librcc0-32bit-0.2.10-2.4.1 librcc0-debuginfo-32bit-0.2.10-2.4.1 - openSUSE 12.2 (i586 x86_64): librcc-debugsource-0.2.9-2.4.1 librcc-devel-0.2.9-2.4.1 librcc0-0.2.9-2.4.1 librcc0-debuginfo-0.2.9-2.4.1 rcc-runtime-0.2.9-2.4.1 rcc-runtime-debuginfo-0.2.9-2.4.1 - openSUSE 12.2 (x86_64): librcc0-32bit-0.2.9-2.4.1 librcc0-debuginfo-32bit-0.2.9-2.4.1 References: https://bugzilla.novell.com/821877

1 0

openSUSE-RU-2013:1127-1: projectM: Fixed error in standard configuration File
by maintenance＠opensuse.org 03 Jul '13

03 Jul '13

openSUSE Recommended Update: projectM: Fixed error in standard configuration File ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1127-1 Rating: low References: #825162 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with projectM: - bnc#825162: The default projectM-data contains an error in /usr/share/projectM/config.inp Instead of Title Font = /usr/share/fonts/truetype/DejaVuSans.ttf Title Font = /usr/share/fonts/truetype/DejaVuSansMono.ttf The last two lines are: Title Font = /usr/share/fonts/truetype/DejaVuSans.ttf Menu Font = /usr/share/fonts/truetype/DejaVuSansMono.ttf This error would not allow projectM to start, if it is used as a configuration file. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-550 - openSUSE 12.2: zypper in -t patch openSUSE-2013-550 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libprojectM-libvisual-2.1.0-4.4.1 libprojectM-libvisual-debuginfo-2.1.0-4.4.1 libprojectM-qt1-2.1.0-4.4.1 libprojectM-qt1-debuginfo-2.1.0-4.4.1 libprojectM2-2.1.0-4.4.1 libprojectM2-debuginfo-2.1.0-4.4.1 projectM-2.1.0-4.4.1 projectM-data-2.1.0-4.4.1 projectM-debuginfo-2.1.0-4.4.1 projectM-devel-2.1.0-4.4.1 - openSUSE 12.2 (i586 x86_64): libprojectM-libvisual-2.1.0-2.4.1 libprojectM-qt1-2.1.0-2.4.1 libprojectM2-2.1.0-2.4.1 libprojectM2-debuginfo-2.1.0-2.4.1 projectM-2.1.0-2.4.1 projectM-data-2.1.0-2.4.1 projectM-debuginfo-2.1.0-2.4.1 projectM-devel-2.1.0-2.4.1 References: https://bugzilla.novell.com/825162

1 0

openSUSE-RU-2013:1123-1: moderate: syslog-ng: update to 3.4.2 and a additional fix
by maintenance＠opensuse.org 02 Jul '13

02 Jul '13

openSUSE Recommended Update: syslog-ng: update to 3.4.2 and a additional fix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1123-1 Rating: moderate References: #805309 #815746 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This udpate fixes the following issues with syslog-ng: - update to 3.4.2, which fixes bnc#815746 and many other bugfixes, including flags(final) + loggen will bail out earily if using Unix sockets without a path specified. + Using the same filter for multiple destinations does not trigger a crash anymore. + An issue with log branch propagation has been fixed, restoring compatibility with the 3.3 branch (this mostly affected flags(final) use cases). + The systemd unit file now specified Restart=on-failure. + Support for empty blocks in the configuration were restored, syslog-ng does not crash anymore when encountering one. + An assertion was fixed in patterndb, that prevented one from overriding built-in values, such as HOST. + The persist state file (syslog-ng.persist) is now marked close-on-exec, so it does not leak through to forked subprocesses. + The system() source now treats /proc/kmsg as optional: if it is not readable to the user running syslog-ng, it will not be included. + Proper escape handling in backtick insertion has been implemented, so string arguments to block parameters are - again - treated correctly + A rare race condition in the SQL, MongoDB, SMTP and AMQP destinations have been fixed. + A possible deadlock was fixed within the suppress() handling code. - Fix systemd unit to do only what is required by http://www.freedesktop.org/wiki/Software/systemd/syslog. In particular it should not mess with the ordering of syslog.target - bnc#805309: Fixed to use program() instead of message() to match by program names. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-548 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): syslog-ng-3.4.2-1.5.1 syslog-ng-debuginfo-3.4.2-1.5.1 syslog-ng-debugsource-3.4.2-1.5.1 syslog-ng-geoip-3.4.2-1.5.1 syslog-ng-geoip-debuginfo-3.4.2-1.5.1 syslog-ng-json-3.4.2-1.5.1 syslog-ng-json-debuginfo-3.4.2-1.5.1 syslog-ng-smtp-3.4.2-1.5.1 syslog-ng-smtp-debuginfo-3.4.2-1.5.1 syslog-ng-sql-3.4.2-1.5.1 syslog-ng-sql-debuginfo-3.4.2-1.5.1 References: https://bugzilla.novell.com/805309 https://bugzilla.novell.com/815746

1 0

openSUSE-SU-2013:1122-1: moderate: update for krb5
by opensuse-security＠opensuse.org 02 Jul '13

02 Jul '13

openSUSE Security Update: update for krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1122-1 Rating: moderate References: Cross-References: CVE-2002-2443 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a kpasswd UDP ping-pong security bug (CVE-2002-2443) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-99 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): krb5-1.8.3-63.1 krb5-client-1.8.3-63.1 krb5-client-debuginfo-1.8.3-63.1 krb5-debuginfo-1.8.3-63.1 krb5-debugsource-1.8.3-63.1 krb5-devel-1.8.3-63.1 krb5-plugin-kdb-ldap-1.8.3-63.1 krb5-plugin-kdb-ldap-debuginfo-1.8.3-63.1 krb5-plugin-preauth-pkinit-1.8.3-63.1 krb5-plugin-preauth-pkinit-debuginfo-1.8.3-63.1 krb5-server-1.8.3-63.1 krb5-server-debuginfo-1.8.3-63.1 - openSUSE 11.4 (x86_64): krb5-32bit-1.8.3-63.1 krb5-debuginfo-32bit-1.8.3-63.1 krb5-devel-32bit-1.8.3-63.1 - openSUSE 11.4 (ia64): krb5-debuginfo-x86-1.8.3-63.1 krb5-x86-1.8.3-63.1 References: http://support.novell.com/security/cve/CVE-2002-2443.html

1 0

openSUSE-SU-2013:1121-1: moderate: update for fail2ban
by opensuse-security＠opensuse.org 02 Jul '13

02 Jul '13

openSUSE Security Update: update for fail2ban ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1121-1 Rating: moderate References: #824710 Cross-References: CVE-2013-2178 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of fail2ban fixes a security vulnerability. Changes in fail2ban: - Fixes: Yaroslav Halchenko * [6ccd5781] filter.d/apache-{auth,nohome,noscript,overflows} - anchor failregex at the beginning (and where applicable at the end). Addresses a possible DoS. Closes gh#fail2ban/fail2ban#248, CVE-2013-2178, bnc#824710 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-98 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): fail2ban-0.8.4-22.1 References: http://support.novell.com/security/cve/CVE-2013-2178.html https://bugzilla.novell.com/824710

1 0