August 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1338-1: moderate: otrs: 3.1.18 update to fix security issues and bugs
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: otrs: 3.1.18 update to fix security issues and bugs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1338-1 Rating: moderate References: #828850 Cross-References: CVE-2013-2625 CVE-2013-2637 CVE-2013-3551 CVE-2013-4088 CVE-2013-4717 CVE-2013-4718 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: The ticket system OTRS was updated to 3.1.18 to fix various bugs and security issues. Update to 3.1.18: * OSA-2013-05, CVE-2013-4717, CVE-2013-4718 fixed. * Fixed bug#9561 - ACL restriction with CustomerID for DynamicFields at new Ticket screen not working. * Fixed bug#9425 - Wrong created date for queue view. * Fixed bug#9125 - AgentTicketSearch dialog does not expand when choosing more search criteria. * Fixed bug#8273 - Copying text in preview mode not possible. * Fixed bug#9557 - Cannot see quoted text in customer ticket zoom. * Fixed bug#9011 - GenericInterface: New value after value mapping can't be 0. * Improved parameter quoting in various places. * Fixed bug#9104 - Group permission for customer subset overwrites permissions for other customers. * Fixed bug#8719 - PasswordMin2Lower2UpperCharacters problem. - 3.1.17 * Fixed OSA-2013-04, CVE-2013-4088. * Improved permission checks in AgentTicketWatcher. * Fixed bug#9503 - no connection header in soap responses. * Added parameter "-t dbonly" to backup.pl to only backup the database * Fixed bug#9491 - GenericAgent job update with dynamic fields sends Uninitialized value error. * Fixed bug#9462 - Package Management page timeout due to HTTPS disabled on Proxy connections. - 3.1.16 * Fixed OSA-2013-03, CVE-2013-3551. * Updated Package Manager, that will ensure that packages to be installed meet the quality standards of OTRS Group. This is to guarantee that your package wasn’t modified, which may possibly harm your system or have an influence on the stability and performance of it. All independent package contributors will have to conduct a check of their Add-Ons by OTRS Group in order to take full advantage of the OTRS package verification. * Fixed bug#9387 - Error in a condition with dynamic fields in NotificationEvent. * Fixed bug#9286 - Ticket::ChangeOwnerToEveryone isn't functional, After a AJAX Load the setting is ignored. * Fixed bug#7518 - Escalation Notify by not working properly (follow-up fix). * Fixed bug#7478 - Got an external answer to an internal mail. * Improved permission checks in AgentTicketPhone. * Fixed bug#[9360](http://bugs.otrs.org/show_bug.cgi?id=9360) - DynamicField Names shown in CSV output. * Fixed bug#9384 - Problem with Method ServiceParentsGet of ServiceObject. * Fixed bug#9072 - Reply to email-internal includes customer users email in Cc. field. - 3.1.15 * Added Malay translation. * Fixed bug#8960 - AgentTicketSearch.pm SearchProfile problem. * Fixed bug#9182 - Customer Search Function -> If you go into a ticket and go back you got not the search results. * Fixed bug#9198 - Linked search with fulltext AND additional attributes. * Fixed bug#9295 - Article dynamic field is not searchable. * Fixed bug#9312 - LinkObject permission check problem. - 3.1.14 * Fixed for OSA-2013-01, CVE-2013-2625. * Fixed bug#9257 - No notifications to agents with out-of-office set but period not reached. * Improved permission checks in LinkObject. * Fixed bug#9191 - When ticket types are restricted, first available type is selected in AgentTicketActionCommon-based screens. * Updated Turkish translation, thanks to Sefer Şimşek / Network Group! * Fixed bug#9214 - IE10: impossible to open links from rich text articles. * Fixed bug#9218 - Cannot use special characters in TicketHook. * Fixed bug#9056 - Unused SysConfig option Ticket::Frontend::CustomerInfoQueueMaxSize. * Follow-up fix for bug#8533 apache will not start on Fedora. * Fixed bug#9172 - Generic Interface does not work on IIS 7.0. * Updated Czech language translation, thanks to Katerina Bubenickova! * Fixed bug#8865 - Additional empty data column in statistics CSV-Output. - update OTRS::ITSM to 3.1.10 (fix for OSA-2013-05, CVE-2013-4717, CVE-2013-4718) - update OTRS::ITSM to 3.1.9 (fix for OSA-2013-03, CVE-2013-3551) - update OTRS::ITSM to 3.1.8 (fix for OSA-2013-01, CVE-2013-2625) (fix for OSA-2013-02, CVE-2013-2637) - update to 3.1.13 - http://www.otrs.com/en/open-source/community-news/releases-n otes/ release-notes-otrs-help-desk-3113/ - http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.22 60.2.206&view=markup * Fixed bug#9162 - Setting the start day of the week for the datepicker to Sunday does not work. * Fixed bug#9141 - Confused Columns in CustomerTicketSearch (ResultShort). * Fixed bug#9146 - Signed SMIME mails with altered content shows a not clear message. * Fixed bug#9145 - SMIME sign verification errors are not displayed in TicketZoom. * Fixed bug#9140 - Postmaster Filter for empty subjects does not work. * Fixed bug#9121 - Filenames with Unicode NFD are incorrectly reported as NFC by Main::DirectoryRead(). * Fixed bug#9108 - Check for opened/closed tickets not working with Ticket::SubjectFormat = Right. * Fixed bug#8839 - DateChecksum followup doesn't get correctly SystemID. * Updated Russian translation, thanks to Vadim Goncharov! * Fixed bug#9101 - Not possible to create dropdown with autocomplete attribute. * Fixed bug#9096 - All services list is shown instead of only default services. * Fixed bug#8470 - otrs.GenericAgent.pl reports: Can't open '/opt/otrs/otrs_vemco/var/tmp/CacheFileStorable/DynamicField /f3b7e10730fb6c9cab5ae0e7f7e034f3'. * Added new translation for Spanish (Colombia), thanks to John Edisson Ortiz Roman! * Fixed bug#9054 - Link Object deletes all links under certain conditions. * Fixed bug#8944 - do not backup the cache. * Fixed bug#9057 - Generating a PDF with bin/otrs.GenerateStats.pl produces lots of warnings. * Fixed bug#8929 - Fix problems with empty ticket search results while Ticket::Frontend::AgentTicketSearch###ExtendedSearchConditio n is inactive. * Fixed bug#9042 - Add X-Spam-Score to Ticket.xml. * Fixed bug#9047 - HistoryTicketGet caches info on disk directly. * Fixed bug#8923 - Alert message shown, if parent window is reloaded while bulk action popup is open. * Fixed bug#9030 - Wrong handling of Invalid YAML in Scheduler Tasks. * Updated CKEditor to version 3.6.6. * Updated Polish translation, thanks to Pawel @ ib.pl! * Follow-up fix for bug#8805 - Cron missing as RPM dependency on RHEL. Changed dependency on 'anacron' to 'vixie-cron' on RHEL5. * Fixed bug#9020 - Generic Ticket Connector does not support attachments with ContentType without charset. * Fixed bug#8545 - Attachment download not possible if pop up of another action is open. * Fixed bug#9009 - Empty Multiselect Dynamic Fields provokes an error. * Fixed bug#8589 - Bulk-Action not possible for single ticket. * Fixed bug#7198 - Broken repository selection width in Package Manager. * Fixed bug#8457 - Error if accessing AgentTicketSearch from AgentTicketPhone in IE8. * Fixed bug#8695 - Table head of Customer Ticket History does not resize on window resize. * Fixed bug#8533 - Apache will not start if you use mod_perl on Fedora 16 or 17. * Fixed bug#8974 - Event Based Notification does not populate REALNAME with Customer User data. - update to 3.1.12 * Fixed bug#8933 - ArticleStorageInit permission check problem. * Fixed bug#8763 - Please add charset conversion for customer companies. * Fixed bug#1970 - Email attachments of type .msg (Outlook-Message) are converted. * Fixed bug#8955 - Init script might fail on SUSE. * Fixed bug#8936 - Ticket close date is empty when ticket is created in closed state. * Fixed bug#8937 - "$" should be escaped in interpolated strings when javascript is meant. * Fixed bug#8919 - Customer interface search results: ticket can only be accessed via ticket number and subject. * Fixed bug#8850 - CustomerTicketOverview - MouseOver Age isn't always correct. * Fixed bug#8868 - Event Based Notification problem saving 'text' Dynamic Fields. * Fixed bug#8914 - Syntax error in hash loop in TicketGet operation. * Fixed bug#8749 - CustomerFrontend: missing dynamicfield in search results. * Fixed bug#8873 - Bad example of customization of "static" dynamic fields in AgentTicketOverviewSmall. * Fixed bug#8791 - IMAPTLS fails with some Microsoft Exchange servers. * Fixed bug#8841 - Search for Dynamic Fields shows all tickets (on "enter" key pressed). * Fixed bug#8861 - Ticket History overlaid calender choice function. * Fixed bug#8862 - GI debugger GUI does not show SOAP XML tags correctly. * Fixed bug#8566 - Cannot download attachment if filename has character #. * Fixed bug#8833 - Article table in TicketZoom does not scroll correctly. * Fixed bug#8673 - Richtext-Editor popups broken on Customer-Interface. * Fixed bug#8859 - Package upgrade does not work if an installed testpackage should be upgraded with a newer regular package. * Fixed bug#8678 - 'WidgetAction Toggle' is always shown as 'Expanded' when nesting elements * Fixed bug#8378 - Validation fails if the ID of the element contains a dot (.) or a colon (:) * Fixed bug#8847 - Inline PGP message description routine does not add any info, thanks to IB Development Team. * Fixed bug#8848 - AgentTicketEmail does not preserve PGP Signatures set if attachment is added. * Fixed bug#8149 - Wrong handling of subject when SubjectFormat=right. * Updated Polish translation, thanks to Pawel! * Fixed bug#8820 - Service rcotrs restart fails because a race condition happens. * Fixed bug#8819 - Syntax error (stop crontab command) in SuSE rc script. * Removed auto cleanup of expired sessions in CreateSessionID() to improve the scalability of the hole system. * Fixed bug#8667 - TicketSplit does not use QueueID of old Ticket for ACL Checking. * Fixed bug#8780 - 508 Compliance: Text descriptions of "Responsible Tickets" and "Locked Tickets" links are insufficient for screen reader users. * Fixed bug#8812 - Encrypted email doesn't see properly in Outlook. * Fixed bug#8214 - OTRS Init script on Red Hat fails to check scheduler. * Fixed bug#8850 - Cron missing as RPM dependency on Red Hat Enterprise Linux. * Fixed bug#7274 - Ticket QueueView sorts by priority on first page but subsequent pages sort incorrectly by Age. * Fixed bug#8792 - TriggerEscalationStopEvents logs as loglevel 'error'. * Fixed bug#8743 - AgentTicketCompose.pm creates To, CC, BCC filelds without spaces after comma. * Fixed bug#8606 - Escalation notifications should not be sent to agents who are set out-of-office. * Fixed bug#8740 - backup.pl: insufficient handling of system() return values. * Fixed bug#8622 - Storing a new GI Invoker or Operation with an existing name doesn't complain anything. * Fixed bug#8770 - AJAX Removes Default Options (follow-up fix). * Improved caching for Services and Service Lists. - Update ITSM to 3.1.7 - News * In AgentTicketZoom the service and the sla are now shown as links to the service zoom / sla zoom screens. * Updated Polish translation, thanks to Pawel! * Added feature in bin/otrs.ITSMConfigItemDelete.pl script to delete config items by class together with the deployment state. * Added CustomerCompany field type that allows to link CI's with Customer Companies registered in OTRS. * Enhanced Import/Export screen to show a summary after importing. * Added new optional sysconfig option to check if config item names are unique. * Added attachment support for ITSM config items. This will replace the OTRS FeatureAddOn OTRSCIAttachment. Please uninstall this FeatureAddon BEFORE you upgrade to OTRS::ITSM 3.1.7 (no attachment data will be lost)! - Bug Fixes * Bug# 5928 - Print PDF: Newline not interpreted. * Bug# 8723 - Setting the planned start and planned end time to the same value causes an error. * Bug# 8785 - Poor performance of ServiceGet with many child services. * Bug# 8626 - AgentTicketAddtlITSMField, Ticket states set to first state after reload. * Bug# 8852 - No Impact and Criticality in CustomerTicketZoom. * Bug# 7786 - Search by "type" not displaying correct results from page 2 on. * Bug# 8804 - Reorder of workorders based on actual startime. * Bug# 8686 - CI-Search can not handle > 1000 CIs per class * Bug# 8863 - Problem with ChangeManagement DropDowns in Conditions Mask. * Bug# 8834 - Broken changes created from template when no time offset. * Bug# 8830 - CI version header should be clickable in all columns. * Bug# 8613 - Wrong date if a workorder has been created from a template. * Bug# 8881 - Searching for a config item number = 0 or a config item name = 0 (without wildcards) finds results where it should not. * Bug# 8882 - Error message from ToolBarMyCAB. * Bug# 8614 - Update agent notification doesn't contain agent name. * Bug# 8615 - Notification not sent for ChangeStateUpdate to pending PIR. * Bug# 7508 - Autocomplete uses milliseconds rather than seconds. - rebase perm patch - fix changes file Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-639 - openSUSE 12.2: zypper in -t patch openSUSE-2013-639 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): otrs-3.1.18-26.5.1 otrs-doc-3.1.18-26.5.1 otrs-itsm-3.1.10-26.5.1 - openSUSE 12.2 (noarch): otrs-3.1.18-20.17.1 otrs-doc-3.1.18-20.17.1 otrs-itsm-3.1.10-20.17.1 References: http://support.novell.com/security/cve/CVE-2013-2625.html http://support.novell.com/security/cve/CVE-2013-2637.html http://support.novell.com/security/cve/CVE-2013-3551.html http://support.novell.com/security/cve/CVE-2013-4088.html http://support.novell.com/security/cve/CVE-2013-4717.html http://support.novell.com/security/cve/CVE-2013-4718.html https://bugzilla.novell.com/828850

1 0

openSUSE-SU-2013:1337-1: moderate: update for apache2
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1337-1 Rating: moderate References: #829056 #829057 Cross-References: CVE-2013-1862 CVE-2013-1896 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: - httpd-2.2.x-bnc829056-CVE-2013-1896-pr1482522-mod_dav.diff C VE-2013-1896: Sending a MERGE request against a URI handled by mod_dav_svn with the source href (sent as part of the request body as XML) pointing to a URI that is not configured for DAV will trigger a segfault. [bnc#829056] - httpd-2.2.x-bnc829057-CVE-2013-1862-mod_rewrite_terminal_esc ape_sequences.diff CVE-2013-1862: client data written to the RewriteLog must have terminal escape sequences escaped. [bnc#829057] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-637 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): apache2-2.2.22-4.18.1 apache2-debuginfo-2.2.22-4.18.1 apache2-debugsource-2.2.22-4.18.1 apache2-devel-2.2.22-4.18.1 apache2-event-2.2.22-4.18.1 apache2-event-debuginfo-2.2.22-4.18.1 apache2-example-pages-2.2.22-4.18.1 apache2-itk-2.2.22-4.18.1 apache2-itk-debuginfo-2.2.22-4.18.1 apache2-prefork-2.2.22-4.18.1 apache2-prefork-debuginfo-2.2.22-4.18.1 apache2-utils-2.2.22-4.18.1 apache2-utils-debuginfo-2.2.22-4.18.1 apache2-worker-2.2.22-4.18.1 apache2-worker-debuginfo-2.2.22-4.18.1 - openSUSE 12.2 (noarch): apache2-doc-2.2.22-4.18.1 References: http://support.novell.com/security/cve/CVE-2013-1862.html http://support.novell.com/security/cve/CVE-2013-1896.html https://bugzilla.novell.com/829056 https://bugzilla.novell.com/829057

1 0

openSUSE-SU-2013:1336-1: moderate: update for apache2-mod_security2
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: update for apache2-mod_security2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1336-1 Rating: moderate References: #768293 #789393 #813190 #822664 Cross-References: CVE-2009-5031 CVE-2012-2751 CVE-2012-4528 CVE-2013-1915 CVE-2013-2765 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: - complete overhaul of this package, with update to 2.7.5. - ruleset update to 2.2.8-0-g0f07cbb. - new configuration framework private to mod_security2: /etc/apache2/conf.d/mod_security2.conf loads /usr/share/apache2-mod_security2/rules/modsecurity_crs_10_se tup.conf, then /etc/apache2/mod_security2.d/*.conf , as set up based on advice in /etc/apache2/conf.d/mod_security2.conf Your configuration starting point is /etc/apache2/conf.d/mod_security2.conf - !!! Please note that mod_unique_id is needed for mod_security2 to run! - modsecurity-apache_2.7.5-build_fix_pcre.diff changes erroneaous linker parameter, preventing rpath in shared object. - fixes contained for the following bugs: * CVE-2009-5031, CVE-2012-2751 [bnc#768293] request parameter handling * [bnc#768293] multi-part bypass, minor threat * CVE-2013-1915 [bnc#813190] XML external entity vulnerability * CVE-2012-4528 [bnc#789393] rule bypass * CVE-2013-2765 [bnc#822664] null pointer dereference crash - new from 2.5.9 to 2.7.5, only major changes: * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * new directive SecXmlExternalEntity, default off * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual * wrong time calculation when logging for some timezones fixed. * replaced time-measuring mechanism with finer granularity for measured request/answer phases. (Stopwatch remains for compat.) * cookie parser memory leak fix * parsing of quoted strings in multipart Content-Disposition headers fixed. * SDBM deadlock fix * @rsub memory leak fix * cookie separator code improvements * build failure fixes * compile time option --enable-htaccess-config (set) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-640 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): apache2-mod_security2-2.7.5-14.4.1 apache2-mod_security2-debuginfo-2.7.5-14.4.1 apache2-mod_security2-debugsource-2.7.5-14.4.1 References: http://support.novell.com/security/cve/CVE-2009-5031.html http://support.novell.com/security/cve/CVE-2012-2751.html http://support.novell.com/security/cve/CVE-2012-4528.html http://support.novell.com/security/cve/CVE-2013-1915.html http://support.novell.com/security/cve/CVE-2013-2765.html https://bugzilla.novell.com/768293 https://bugzilla.novell.com/789393 https://bugzilla.novell.com/813190 https://bugzilla.novell.com/822664

1 0

openSUSE-SU-2013:1335-1: moderate: update for mariadb, mysql-community-server
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: update for mariadb, mysql-community-server ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1335-1 Rating: moderate References: #747811 #768832 #780019 #789263 #791863 #803040 #830086 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This version upgrade of mariadb fixed the following issues: - get rid of info which is not info (bnc#747811) - minor polishing of spec/installation - avoiding file conflicts with mytop - better fix for hardcoded libdir issue - making mysqldump work with MySQL 5.0 (bnc#768832) - fixed log rights (bnc#789263 and bnc#803040) - binlog disabled in default configuration (bnc#791863) - fixed dependencies for client package (bnc#780019) Additionally, it includes multiple security fixes. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-642 - openSUSE 12.2: zypper in -t patch openSUSE-2013-642 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libmysql55client18-5.5.32-1.4.2 libmysql55client18-debuginfo-5.5.32-1.4.2 libmysql55client_r18-5.5.32-1.4.2 libmysqlclient-devel-5.5.32-1.4.2 libmysqlclient18-5.5.32-1.4.2 libmysqlclient18-debuginfo-5.5.32-1.4.2 libmysqlclient_r18-5.5.32-1.4.2 libmysqld-devel-5.5.32-1.4.2 libmysqld18-5.5.32-1.4.2 libmysqld18-debuginfo-5.5.32-1.4.2 mariadb-5.5.32-1.4.2 mariadb-bench-5.5.32-1.4.2 mariadb-bench-debuginfo-5.5.32-1.4.2 mariadb-client-5.5.32-1.4.2 mariadb-client-debuginfo-5.5.32-1.4.2 mariadb-debug-version-5.5.32-1.4.2 mariadb-debug-version-debuginfo-5.5.32-1.4.2 mariadb-debuginfo-5.5.32-1.4.2 mariadb-debugsource-5.5.32-1.4.2 mariadb-errormessages-5.5.32-1.4.2 mariadb-test-5.5.32-1.4.2 mariadb-test-debuginfo-5.5.32-1.4.2 mariadb-tools-5.5.32-1.4.2 mariadb-tools-debuginfo-5.5.32-1.4.2 mysql-community-server-5.5.32-1.4.2 mysql-community-server-bench-5.5.32-1.4.2 mysql-community-server-bench-debuginfo-5.5.32-1.4.2 mysql-community-server-client-5.5.32-1.4.2 mysql-community-server-client-debuginfo-5.5.32-1.4.2 mysql-community-server-debug-version-5.5.32-1.4.2 mysql-community-server-debug-version-debuginfo-5.5.32-1.4.2 mysql-community-server-debuginfo-5.5.32-1.4.2 mysql-community-server-debugsource-5.5.32-1.4.2 mysql-community-server-errormessages-5.5.32-1.4.2 mysql-community-server-test-5.5.32-1.4.2 mysql-community-server-test-debuginfo-5.5.32-1.4.2 mysql-community-server-tools-5.5.32-1.4.2 mysql-community-server-tools-debuginfo-5.5.32-1.4.2 - openSUSE 12.3 (x86_64): libmysql55client18-32bit-5.5.32-1.4.2 libmysql55client18-debuginfo-32bit-5.5.32-1.4.2 libmysql55client_r18-32bit-5.5.32-1.4.2 libmysqlclient18-32bit-5.5.32-1.4.2 libmysqlclient18-debuginfo-32bit-5.5.32-1.4.2 libmysqlclient_r18-32bit-5.5.32-1.4.2 - openSUSE 12.2 (i586 x86_64): libmariadbclient18-5.5.32-1.8.2 libmariadbclient18-debuginfo-5.5.32-1.8.2 libmariadbclient_r18-5.5.32-1.8.2 libmysqlclient-devel-5.5.32-1.8.2 libmysqlclient18-5.5.32-1.8.2 libmysqlclient18-debuginfo-5.5.32-1.8.2 libmysqlclient_r18-5.5.32-1.8.2 libmysqld-devel-5.5.32-1.8.2 libmysqld18-5.5.32-1.8.2 libmysqld18-debuginfo-5.5.32-1.8.2 mariadb-5.5.32-1.8.2 mariadb-bench-5.5.32-1.8.2 mariadb-bench-debuginfo-5.5.32-1.8.2 mariadb-client-5.5.32-1.8.2 mariadb-client-debuginfo-5.5.32-1.8.2 mariadb-debug-version-5.5.32-1.8.2 mariadb-debug-version-debuginfo-5.5.32-1.8.2 mariadb-debuginfo-5.5.32-1.8.2 mariadb-debugsource-5.5.32-1.8.2 mariadb-errormessages-5.5.32-1.8.2 mariadb-test-5.5.32-1.8.2 mariadb-test-debuginfo-5.5.32-1.8.2 mariadb-tools-5.5.32-1.8.2 mariadb-tools-debuginfo-5.5.32-1.8.2 mysql-community-server-5.5.32-1.8.2 mysql-community-server-bench-5.5.32-1.8.2 mysql-community-server-bench-debuginfo-5.5.32-1.8.2 mysql-community-server-client-5.5.32-1.8.2 mysql-community-server-client-debuginfo-5.5.32-1.8.2 mysql-community-server-debug-version-5.5.32-1.8.2 mysql-community-server-debug-version-debuginfo-5.5.32-1.8.2 mysql-community-server-debuginfo-5.5.32-1.8.2 mysql-community-server-debugsource-5.5.32-1.8.2 mysql-community-server-errormessages-5.5.32-1.8.2 mysql-community-server-test-5.5.32-1.8.2 mysql-community-server-test-debuginfo-5.5.32-1.8.2 mysql-community-server-tools-5.5.32-1.8.2 mysql-community-server-tools-debuginfo-5.5.32-1.8.2 - openSUSE 12.2 (x86_64): libmariadbclient18-32bit-5.5.32-1.8.2 libmariadbclient18-debuginfo-32bit-5.5.32-1.8.2 libmariadbclient_r18-32bit-5.5.32-1.8.2 libmysqlclient18-32bit-5.5.32-1.8.2 libmysqlclient18-debuginfo-32bit-5.5.32-1.8.2 libmysqlclient_r18-32bit-5.5.32-1.8.2 References: https://bugzilla.novell.com/747811 https://bugzilla.novell.com/768832 https://bugzilla.novell.com/780019 https://bugzilla.novell.com/789263 https://bugzilla.novell.com/791863 https://bugzilla.novell.com/803040 https://bugzilla.novell.com/830086

1 0

openSUSE-SU-2013:1334-1: important: Mozilla updates August 2013
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: Mozilla updates August 2013 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1334-1 Rating: important References: #833389 Cross-References: CVE-2013-1701 CVE-2013-1702 CVE-2013-1704 CVE-2013-1705 CVE-2013-1708 CVE-2013-1709 CVE-2013-1710 CVE-2013-1711 CVE-2013-1713 CVE-2013-1714 CVE-2013-1717 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This patch contains updates for - Firefox to 23.0 - xulrunner to 17.0.8esr - Thunderbird to 17.0.8 - mozilla-nspr to 4.10 - mozilla-nss to 3.15,1 * MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous memory safety hazards * MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free mutating DOM during SetBody * MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests * MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV audio file decoding * MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading * MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks * MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of XrayWrappers using XBL Scopes * MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some Javascript components * MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest * MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-122 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-23.0-83.1 MozillaFirefox-branding-upstream-23.0-83.1 MozillaFirefox-buildsymbols-23.0-83.1 MozillaFirefox-debuginfo-23.0-83.1 MozillaFirefox-debugsource-23.0-83.1 MozillaFirefox-devel-23.0-83.1 MozillaFirefox-translations-common-23.0-83.1 MozillaFirefox-translations-other-23.0-83.1 MozillaThunderbird-17.0.8-69.2 MozillaThunderbird-buildsymbols-17.0.8-69.2 MozillaThunderbird-debuginfo-17.0.8-69.2 MozillaThunderbird-debugsource-17.0.8-69.2 MozillaThunderbird-devel-17.0.8-69.2 MozillaThunderbird-devel-debuginfo-17.0.8-69.2 MozillaThunderbird-translations-common-17.0.8-69.2 MozillaThunderbird-translations-other-17.0.8-69.2 enigmail-1.5.2+17.0.8-69.2 enigmail-debuginfo-1.5.2+17.0.8-69.2 libfreebl3-3.15.1-62.1 libfreebl3-debuginfo-3.15.1-62.1 libsoftokn3-3.15.1-62.1 libsoftokn3-debuginfo-3.15.1-62.1 mozilla-nspr-4.10-28.1 mozilla-nspr-debuginfo-4.10-28.1 mozilla-nspr-debugsource-4.10-28.1 mozilla-nspr-devel-4.10-28.1 mozilla-nss-3.15.1-62.1 mozilla-nss-certs-3.15.1-62.1 mozilla-nss-certs-debuginfo-3.15.1-62.1 mozilla-nss-debuginfo-3.15.1-62.1 mozilla-nss-debugsource-3.15.1-62.1 mozilla-nss-devel-3.15.1-62.1 mozilla-nss-sysinit-3.15.1-62.1 mozilla-nss-sysinit-debuginfo-3.15.1-62.1 mozilla-nss-tools-3.15.1-62.1 mozilla-nss-tools-debuginfo-3.15.1-62.1 seamonkey-2.20-73.1 seamonkey-debuginfo-2.20-73.1 seamonkey-debugsource-2.20-73.1 seamonkey-dom-inspector-2.20-73.1 seamonkey-irc-2.20-73.1 seamonkey-translations-common-2.20-73.1 seamonkey-translations-other-2.20-73.1 seamonkey-venkman-2.20-73.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.15.1-62.1 libfreebl3-debuginfo-32bit-3.15.1-62.1 libsoftokn3-32bit-3.15.1-62.1 libsoftokn3-debuginfo-32bit-3.15.1-62.1 mozilla-nspr-32bit-4.10-28.1 mozilla-nspr-debuginfo-32bit-4.10-28.1 mozilla-nss-32bit-3.15.1-62.1 mozilla-nss-certs-32bit-3.15.1-62.1 mozilla-nss-certs-debuginfo-32bit-3.15.1-62.1 mozilla-nss-debuginfo-32bit-3.15.1-62.1 mozilla-nss-sysinit-32bit-3.15.1-62.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.1-62.1 - openSUSE 11.4 (ia64): libfreebl3-debuginfo-x86-3.15.1-62.1 libfreebl3-x86-3.15.1-62.1 libsoftokn3-debuginfo-x86-3.15.1-62.1 libsoftokn3-x86-3.15.1-62.1 mozilla-nspr-debuginfo-x86-4.10-28.1 mozilla-nspr-x86-4.10-28.1 mozilla-nss-certs-debuginfo-x86-3.15.1-62.1 mozilla-nss-certs-x86-3.15.1-62.1 mozilla-nss-debuginfo-x86-3.15.1-62.1 mozilla-nss-sysinit-debuginfo-x86-3.15.1-62.1 mozilla-nss-sysinit-x86-3.15.1-62.1 mozilla-nss-x86-3.15.1-62.1 References: http://support.novell.com/security/cve/CVE-2013-1701.html http://support.novell.com/security/cve/CVE-2013-1702.html http://support.novell.com/security/cve/CVE-2013-1704.html http://support.novell.com/security/cve/CVE-2013-1705.html http://support.novell.com/security/cve/CVE-2013-1708.html http://support.novell.com/security/cve/CVE-2013-1709.html http://support.novell.com/security/cve/CVE-2013-1710.html http://support.novell.com/security/cve/CVE-2013-1711.html http://support.novell.com/security/cve/CVE-2013-1713.html http://support.novell.com/security/cve/CVE-2013-1714.html http://support.novell.com/security/cve/CVE-2013-1717.html https://bugzilla.novell.com/833389

1 0

openSUSE-SU-2013:1333-1: moderate: update for strongswan
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1333-1 Rating: moderate References: #833278 Cross-References: CVE-2013-5018 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of strongswan fixed a denial-of-service vulnerability, that could be triggered by special XAuth usernames and EAP identities. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-645 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): strongswan-5.0.1-4.8.1 strongswan-debugsource-5.0.1-4.8.1 strongswan-ipsec-5.0.1-4.8.1 strongswan-ipsec-debuginfo-5.0.1-4.8.1 strongswan-libs0-5.0.1-4.8.1 strongswan-libs0-debuginfo-5.0.1-4.8.1 strongswan-mysql-5.0.1-4.8.1 strongswan-mysql-debuginfo-5.0.1-4.8.1 strongswan-nm-5.0.1-4.8.1 strongswan-nm-debuginfo-5.0.1-4.8.1 strongswan-sqlite-5.0.1-4.8.1 strongswan-sqlite-debuginfo-5.0.1-4.8.1 - openSUSE 12.3 (noarch): strongswan-doc-5.0.1-4.8.1 References: http://support.novell.com/security/cve/CVE-2013-5018.html https://bugzilla.novell.com/833278

1 0

openSUSE-SU-2013:1332-1: moderate: update for strongswan
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1332-1 Rating: moderate References: #833278 Cross-References: CVE-2013-5018 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of strongswan fixed a denial-of-service vulnerability, that could be triggered by special XAuth usernames and EAP identities. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-643 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): strongswan-4.6.4-2.12.1 strongswan-debugsource-4.6.4-2.12.1 strongswan-ikev1-4.6.4-2.12.1 strongswan-ikev1-debuginfo-4.6.4-2.12.1 strongswan-ikev2-4.6.4-2.12.1 strongswan-ikev2-debuginfo-4.6.4-2.12.1 strongswan-ipsec-4.6.4-2.12.1 strongswan-ipsec-debuginfo-4.6.4-2.12.1 strongswan-libs0-4.6.4-2.12.1 strongswan-libs0-debuginfo-4.6.4-2.12.1 strongswan-mysql-4.6.4-2.12.1 strongswan-mysql-debuginfo-4.6.4-2.12.1 strongswan-nm-4.6.4-2.12.1 strongswan-nm-debuginfo-4.6.4-2.12.1 strongswan-sqlite-4.6.4-2.12.1 strongswan-sqlite-debuginfo-4.6.4-2.12.1 - openSUSE 12.2 (noarch): strongswan-doc-4.6.4-2.12.1 References: http://support.novell.com/security/cve/CVE-2013-5018.html https://bugzilla.novell.com/833278

1 0

openSUSE-SU-2013:1331-1: moderate: update for apache2-mod_security2
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: update for apache2-mod_security2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1331-1 Rating: moderate References: #768293 #789393 #813190 #822664 Cross-References: CVE-2009-5031 CVE-2012-2751 CVE-2012-4528 CVE-2013-1915 CVE-2013-2765 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: - complete overhaul of this package, with update to 2.7.5. - ruleset update to 2.2.8-0-g0f07cbb. - new configuration framework private to mod_security2: /etc/apache2/conf.d/mod_security2.conf loads /usr/share/apache2-mod_security2/rules/modsecurity_crs_10_se tup.conf, then /etc/apache2/mod_security2.d/*.conf , as set up based on advice in /etc/apache2/conf.d/mod_security2.conf Your configuration starting point is /etc/apache2/conf.d/mod_security2.conf - !!! Please note that mod_unique_id is needed for mod_security2 to run! - modsecurity-apache_2.7.5-build_fix_pcre.diff changes erroneaous linker parameter, preventing rpath in shared object. - fixes contained for the following bugs: * CVE-2009-5031, CVE-2012-2751 [bnc#768293] request parameter handling * [bnc#768293] multi-part bypass, minor threat * CVE-2013-1915 [bnc#813190] XML external entity vulnerability * CVE-2012-4528 [bnc#789393] rule bypass * CVE-2013-2765 [bnc#822664] null pointer dereference crash - new from 2.5.9 to 2.7.5, only major changes: * GPLv2 replaced by Apache License v2 * rules are not part of the source tarball any longer, but maintaned upstream externally, and included in this package. * documentation was externalized to a wiki. Package contains the FAQ and the reference manual in html form. * renamed the term "Encryption" in directives that actually refer to hashes. See CHANGES file for more details. * new directive SecXmlExternalEntity, default off * byte conversion issues on s390x when logging fixed. * many small issues fixed that were discovered by a Coverity scanner * updated reference manual * wrong time calculation when logging for some timezones fixed. * replaced time-measuring mechanism with finer granularity for measured request/answer phases. (Stopwatch remains for compat.) * cookie parser memory leak fix * parsing of quoted strings in multipart Content-Disposition headers fixed. * SDBM deadlock fix * @rsub memory leak fix * cookie separator code improvements * build failure fixes * compile time option --enable-htaccess-config (set) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-641 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): apache2-mod_security2-2.7.5-2.4.1 apache2-mod_security2-debuginfo-2.7.5-2.4.1 apache2-mod_security2-debugsource-2.7.5-2.4.1 References: http://support.novell.com/security/cve/CVE-2009-5031.html http://support.novell.com/security/cve/CVE-2012-2751.html http://support.novell.com/security/cve/CVE-2012-4528.html http://support.novell.com/security/cve/CVE-2013-1915.html http://support.novell.com/security/cve/CVE-2013-2765.html https://bugzilla.novell.com/768293 https://bugzilla.novell.com/789393 https://bugzilla.novell.com/813190 https://bugzilla.novell.com/822664

1 0

openSUSE-SU-2013:1330-1: moderate: update for python-glanceclient
by opensuse-security＠opensuse.org 14 Aug '13

14 Aug '13

openSUSE Security Update: update for python-glanceclient ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1330-1 Rating: moderate References: #831947 Cross-References: CVE-2013-4111 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of python-glanceclient fixed SSL certificate CNAME checking. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-646 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): python-glanceclient-0.6.0.14.gc057fe4+git.1355912586.c057fe4-2.4.1 python-glanceclient-test-0.6.0.14.gc057fe4+git.1355912586.c057fe4-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-4111.html https://bugzilla.novell.com/831947

1 0

openSUSE-SU-2013:1319-1: moderate: opera was updated to 12.16
by opensuse-security＠opensuse.org 12 Aug '13

12 Aug '13

openSUSE Security Update: opera was updated to 12.16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1319-1 Rating: moderate References: #832559 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Opera Software recently experienced an attack on the internal infrastructure. Following best practices, Opera Software is replacing signing certificates in Opera with newly issued certificates. Certificates in Opera include the code signing certificate for desktop binaries and the signing certificate for automatic updates to browser.js. Opera's rootstore was not affected by the attack and certificates used for accessing HTTPS websites are unchanged by this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-121 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): opera-12.16-56.1 opera-gtk-12.16-56.1 opera-kde4-12.16-56.1 References: https://bugzilla.novell.com/832559

1 0