openSUSE Security Update: ruby: configure https usage for rubygems.org
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1393-1
Rating: moderate
References:
Affected Products:
openSUSE 12.3
openSUSE 12.2
______________________________________________________________________________
An update that contains security fixes can now be installed.
Description:
The ruby gemrc configured the gem installation source as
http source, allowing man in the middle attacks (if someone
could provide a different address for rubygems.org).
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-668
- openSUSE 12.2:
zypper in -t patch openSUSE-2013-668
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (i586 x86_64):
ruby-1.9.3-15.6.1
ruby-devel-1.9.3-15.6.1
- openSUSE 12.2 (i586 x86_64):
ruby-1.9.3-2.8.1
ruby-common-1.9.3-2.8.1
ruby-devel-1.9.3-2.8.1
References:
openSUSE Recommended Update: release-notes-openSUSE: added note on sysvinit
______________________________________________________________________________
Announcement ID: openSUSE-RU-2013:1391-1
Rating: moderate
References: #830979
Affected Products:
openSUSE 12.3
______________________________________________________________________________
An update that has one recommended fix can now be installed.
Description:
Releases Notes were updated to mention:
* New entries: Sysvinit Support No Longer Available
(bnc#830979).
Patch Instructions:
To install this openSUSE Recommended Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-667
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (noarch):
release-notes-openSUSE-12.3.11-1.26.1
References:
https://bugzilla.novell.com/830979
openSUSE Recommended Update: permission: fixed PERMISSION_FSCAPS typo
______________________________________________________________________________
Announcement ID: openSUSE-RU-2013:1388-1
Rating: low
References: #834790
Affected Products:
openSUSE 12.3
______________________________________________________________________________
An update that has one recommended fix can now be installed.
Description:
The /etc/sysconfig/security uses "PERMISSION_FSCAPS" as
variable, while chkstat queried PERMISSIONS_FSCAPS... The
chkstat binary was adjusted the correct PERMISSION_FSCAPS
name.
Patch Instructions:
To install this openSUSE Recommended Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-666
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (i586 x86_64):
permissions-2013.01.29.1841-1.5.1
permissions-debuginfo-2013.01.29.1841-1.5.1
permissions-debugsource-2013.01.29.1841-1.5.1
References:
https://bugzilla.novell.com/834790
openSUSE Security Update: cacti: security and bugfix update to 0.8.8b
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1377-1
Rating: moderate
References: #834464
Cross-References: CVE-2013-1434 CVE-2013-1435
Affected Products:
openSUSE 12.3
openSUSE 12.2
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
cacti was updated to version 0.8.8b to fix security issues
and bugs.
- Fixes CVE-2013-1434 CVE-2013-1435
- security: SQL injection and shell escaping issues
- bug: Fixed issue with custom data source information
being lost when saved from edit
- bug: Repopulate the poller cache on new installations
- bug: Fix issue with poller not escaping the script query
path correctly
- bug: Allow snmpv3 priv proto none
- bug: Fix issue where host activate may flush the entire
poller item cache
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-664
- openSUSE 12.2:
zypper in -t patch openSUSE-2013-664
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (noarch):
cacti-0.8.8b-5.4.1
- openSUSE 12.2 (noarch):
cacti-0.8.8b-2.4.1
References:
http://support.novell.com/security/cve/CVE-2013-1434.htmlhttp://support.novell.com/security/cve/CVE-2013-1435.htmlhttps://bugzilla.novell.com/834464
openSUSE Recommended Update: ecryptfs-utils: fixed pam-config usage during update
______________________________________________________________________________
Announcement ID: openSUSE-RU-2013:1375-1
Rating: moderate
References: #814098 #834993
Affected Products:
openSUSE 12.3
______________________________________________________________________________
An update that has two recommended fixes can now be
installed.
Description:
ecryptfs-utils was updated so that package updating does
not remove the PAM snippets.
- fix %postun to not run pam-config on update (bnc#814098,
bnc#834993)
Patch Instructions:
To install this openSUSE Recommended Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-663
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (i586 x86_64):
ecryptfs-utils-103-7.9.1
ecryptfs-utils-debuginfo-103-7.9.1
ecryptfs-utils-debugsource-103-7.9.1
- openSUSE 12.3 (x86_64):
ecryptfs-utils-32bit-103-7.9.1
ecryptfs-utils-debuginfo-32bit-103-7.9.1
References:
https://bugzilla.novell.com/814098https://bugzilla.novell.com/834993
openSUSE Security Update: update for strongswan
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1372-1
Rating: moderate
References: #833278
Cross-References: CVE-2013-5018
Affected Products:
openSUSE 11.4
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update of strongswan fixed a denial-of-service
vulnerability, that could be triggered by special XAuth
usernames and EAP identities.
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 11.4:
zypper in -t patch 2013-128
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 11.4 (i586 x86_64):
strongswan-4.5.0-6.56.1
strongswan-debugsource-4.5.0-6.56.1
strongswan-doc-4.5.0-6.56.1
strongswan-ikev1-4.5.0-6.56.1
strongswan-ikev1-debuginfo-4.5.0-6.56.1
strongswan-ikev2-4.5.0-6.56.1
strongswan-ikev2-debuginfo-4.5.0-6.56.1
strongswan-ipsec-4.5.0-6.56.1
strongswan-ipsec-debuginfo-4.5.0-6.56.1
strongswan-libs0-4.5.0-6.56.1
strongswan-libs0-debuginfo-4.5.0-6.56.1
strongswan-mysql-4.5.0-6.56.1
strongswan-mysql-debuginfo-4.5.0-6.56.1
strongswan-nm-4.5.0-6.56.1
strongswan-nm-debuginfo-4.5.0-6.56.1
strongswan-sqlite-4.5.0-6.56.1
strongswan-sqlite-debuginfo-4.5.0-6.56.1
References:
http://support.novell.com/security/cve/CVE-2013-5018.htmlhttps://bugzilla.novell.com/833278
openSUSE Security Update: poppler: fixed terminal escape sequence security issue
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1371-1
Rating: moderate
References: #795582 #834476
Cross-References: CVE-2012-2142
Affected Products:
openSUSE 12.2
______________________________________________________________________________
An update that solves one vulnerability and has one errata
is now available.
Description:
poppler was updated to fix a security problem. PDF files
could emit messages with terminal escape sequences which
could be used to inject shell code if the user ran a PDF
viewer from a terminal shell (CVE-2012-2142).
Also a bug was fixed to avoid division by zero when using
origpagesizes option (bnc#795582)
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.2:
zypper in -t patch openSUSE-2013-662
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.2 (i586 x86_64):
libpoppler-cpp0-0.20.0-2.13.1
libpoppler-cpp0-debuginfo-0.20.0-2.13.1
libpoppler-devel-0.20.0-2.13.1
libpoppler-glib-devel-0.20.0-2.13.1
libpoppler-glib8-0.20.0-2.13.1
libpoppler-glib8-debuginfo-0.20.0-2.13.1
libpoppler-qt4-4-0.20.0-2.13.1
libpoppler-qt4-4-debuginfo-0.20.0-2.13.1
libpoppler-qt4-devel-0.20.0-2.13.1
libpoppler25-0.20.0-2.13.1
libpoppler25-debuginfo-0.20.0-2.13.1
poppler-debugsource-0.20.0-2.13.1
poppler-qt-debugsource-0.20.0-2.13.1
poppler-tools-0.20.0-2.13.1
poppler-tools-debuginfo-0.20.0-2.13.1
typelib-1_0-Poppler-0_18-0.20.0-2.13.1
References:
http://support.novell.com/security/cve/CVE-2012-2142.htmlhttps://bugzilla.novell.com/795582https://bugzilla.novell.com/834476
openSUSE Security Update: puppet: security fix for YAML support
______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1370-1
Rating: critical
References: #825878
Cross-References: CVE-2013-3567
Affected Products:
openSUSE 12.3
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
A potential remote code execution via YAML was fixed in
puppet. (CVE-2013-3567)
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-661
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 12.3 (i586 x86_64):
puppet-3.0.2-2.9.1
puppet-server-3.0.2-2.9.1
References:
http://support.novell.com/security/cve/CVE-2013-3567.htmlhttps://bugzilla.novell.com/825878