September 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1511-1: moderate: update for icedtea-web
by opensuse-security＠opensuse.org 30 Sep '13

30 Sep '13

openSUSE Security Update: update for icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1511-1 Rating: moderate References: #840572 Cross-References: CVE-2012-4540 CVE-2013-4349 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This icedtea-web update fixes several security issues. Changes in icedtea-web: - update to 1.4.1 (bnc#840572) * Improved and cleaned Temporary internet files panel * NetX - PR1465 - java.io.FileNotFoundException while trying to download a JAR file - PR1473 - javaws should not depend on name of local file * Plugin - PR854: Resizing an applet several times causes 100% CPU load * Security Updates - CVE-2013-4349, RH869040: Heap-based buffer overflow after triggering event attached to applet CVE-2012-4540 nit fixed in icedtea-web 1.4 * Misc - reproducers tests are enabled in dist-tarball - application context support for OpenJDK build 25 and higher - small patches into rhino support and - PR1533: Inherit jnlp.packEnabled and jnlp.versionEnabled like other properties - need jpackage-utils on older distros Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-142 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): icedtea-web-1.4.1-38.2 icedtea-web-debuginfo-1.4.1-38.2 icedtea-web-debugsource-1.4.1-38.2 - openSUSE 11.4 (noarch): icedtea-web-javadoc-1.4.1-38.2 References: http://support.novell.com/security/cve/CVE-2012-4540.html http://support.novell.com/security/cve/CVE-2013-4349.html https://bugzilla.novell.com/840572

1 0

openSUSE-SU-2013:1510-1: moderate: glibc: security and bugfix update
by opensuse-security＠opensuse.org 30 Sep '13

30 Sep '13

openSUSE Security Update: glibc: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1510-1 Rating: moderate References: #779320 #801246 #805054 #813121 #813306 #819383 #819524 #824046 #830257 #834594 #839870 Cross-References: CVE-2012-4412 CVE-2013-0242 CVE-2013-1914 CVE-2013-2207 CVE-2013-4237 CVE-2013-4332 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has 5 fixes is now available. Description: This update fixes the following issues in glibc: - CVE-2012-4412: glibc: buffer overflow in strcoll - CVE-2013-0242: glibc: DoS due to a buffer overrun in regexp matcher by processing multibyte characters - CVE-2013-1914: glibc: stack overflow in getaddrinfo() sorting - CVE-2013-2207: glibc: pt_chown tricked into granting access to another users pseudo-terminal - CVE-2013-4237: glibc: Buffer overwrite - NAME_MAX not enforced by readdir_r() - bnc#805054: man 1 locale mentions nonexistant file - bnc#813306: glibc 2.17 fprintf(stderr, ...) triggers write of undefined values if stderr is closed - bnc#819383: pldd a process multiple times can freeze the process - bnc#819524: nscd segfault - bnc#824046: glibc: blacklist code in bindresvport doesn't release lock, results in double-lock - bnc#839870: glibc: three integer overflows in memory allocator - ARM: Support loading unmarked objects from cache Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-723 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 i686 x86_64): glibc-2.17-4.7.1 glibc-debuginfo-2.17-4.7.1 glibc-debugsource-2.17-4.7.1 glibc-devel-2.17-4.7.1 glibc-devel-debuginfo-2.17-4.7.1 glibc-devel-static-2.17-4.7.1 glibc-extra-2.17-4.7.1 glibc-extra-debuginfo-2.17-4.7.1 glibc-locale-2.17-4.7.1 glibc-locale-debuginfo-2.17-4.7.1 glibc-profile-2.17-4.7.1 nscd-2.17-4.7.1 nscd-debuginfo-2.17-4.7.1 - openSUSE 12.3 (i586 x86_64): glibc-utils-2.17-4.7.1 glibc-utils-debuginfo-2.17-4.7.1 glibc-utils-debugsource-2.17-4.7.1 - openSUSE 12.3 (i586 i686): glibc-obsolete-2.17-4.7.1 glibc-obsolete-debuginfo-2.17-4.7.1 - openSUSE 12.3 (x86_64): glibc-32bit-2.17-4.7.1 glibc-debuginfo-32bit-2.17-4.7.1 glibc-devel-32bit-2.17-4.7.1 glibc-devel-debuginfo-32bit-2.17-4.7.1 glibc-devel-static-32bit-2.17-4.7.1 glibc-locale-32bit-2.17-4.7.1 glibc-locale-debuginfo-32bit-2.17-4.7.1 glibc-profile-32bit-2.17-4.7.1 glibc-utils-32bit-2.17-4.7.1 glibc-utils-debuginfo-32bit-2.17-4.7.1 - openSUSE 12.3 (noarch): glibc-html-2.17-4.7.1 glibc-i18ndata-2.17-4.7.1 glibc-info-2.17-4.7.1 References: http://support.novell.com/security/cve/CVE-2012-4412.html http://support.novell.com/security/cve/CVE-2013-0242.html http://support.novell.com/security/cve/CVE-2013-1914.html http://support.novell.com/security/cve/CVE-2013-2207.html http://support.novell.com/security/cve/CVE-2013-4237.html http://support.novell.com/security/cve/CVE-2013-4332.html https://bugzilla.novell.com/779320 https://bugzilla.novell.com/801246 https://bugzilla.novell.com/805054 https://bugzilla.novell.com/813121 https://bugzilla.novell.com/813306 https://bugzilla.novell.com/819383 https://bugzilla.novell.com/819524 https://bugzilla.novell.com/824046 https://bugzilla.novell.com/830257 https://bugzilla.novell.com/834594 https://bugzilla.novell.com/839870

1 0

openSUSE-SU-2013:1509-1: moderate: update for icedtea-web
by opensuse-security＠opensuse.org 30 Sep '13

30 Sep '13

openSUSE Security Update: update for icedtea-web ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1509-1 Rating: moderate References: #840572 Cross-References: CVE-2012-4540 CVE-2013-4349 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This icedtea-web update fixes several security issues. Changes in icedtea-web: - update to 1.4.1 (bnc#840572) * Improved and cleaned Temporary internet files panel * NetX - PR1465 - java.io.FileNotFoundException while trying to download a JAR file - PR1473 - javaws should not depend on name of local file * Plugin - PR854: Resizing an applet several times causes 100% CPU load * Security Updates - CVE-2013-4349, RH869040: Heap-based buffer overflow after triggering event attached to applet CVE-2012-4540 nit fixed in icedtea-web 1.4 * Misc - reproducers tests are enabled in dist-tarball - application context support for OpenJDK build 25 and higher - small patches into rhino support and - PR1533: Inherit jnlp.packEnabled and jnlp.versionEnabled like other properties - need jpackage-utils on older distros - run more tests in %check - drop icedtea-web-AppContext.patch, already upstream - add javapackages-tools to build requires Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-733 - openSUSE 12.2: zypper in -t patch openSUSE-2013-733 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): icedtea-web-1.4.1-4.22.1 icedtea-web-debuginfo-1.4.1-4.22.1 icedtea-web-debugsource-1.4.1-4.22.1 - openSUSE 12.3 (noarch): icedtea-web-javadoc-1.4.1-4.22.1 - openSUSE 12.2 (i586 x86_64): icedtea-web-1.4.1-1.25.1 icedtea-web-debuginfo-1.4.1-1.25.1 icedtea-web-debugsource-1.4.1-1.25.1 - openSUSE 12.2 (noarch): icedtea-web-javadoc-1.4.1-1.25.1 References: http://support.novell.com/security/cve/CVE-2012-4540.html http://support.novell.com/security/cve/CVE-2013-4349.html https://bugzilla.novell.com/840572

1 0

openSUSE-RU-2013:1508-1: mysql-community-server: Update to 5.5.33
by maintenance＠opensuse.org 30 Sep '13

30 Sep '13

openSUSE Recommended Update: mysql-community-server: Update to 5.5.33 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1508-1 Rating: low References: Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues with mysql-community-server: - fixed commenting out unsupported options - workaround to mark datadir version - updated to 5.5.33 + http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-33.h tml - added back info page - better README.SuSE Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-725 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libmysql55client18-5.5.33-1.13.1 libmysql55client18-debuginfo-5.5.33-1.13.1 libmysql55client_r18-5.5.33-1.13.1 mysql-community-server-5.5.33-1.13.1 mysql-community-server-bench-5.5.33-1.13.1 mysql-community-server-bench-debuginfo-5.5.33-1.13.1 mysql-community-server-client-5.5.33-1.13.1 mysql-community-server-client-debuginfo-5.5.33-1.13.1 mysql-community-server-debug-version-5.5.33-1.13.1 mysql-community-server-debug-version-debuginfo-5.5.33-1.13.1 mysql-community-server-debuginfo-5.5.33-1.13.1 mysql-community-server-debugsource-5.5.33-1.13.1 mysql-community-server-errormessages-5.5.33-1.13.1 mysql-community-server-test-5.5.33-1.13.1 mysql-community-server-test-debuginfo-5.5.33-1.13.1 mysql-community-server-tools-5.5.33-1.13.1 mysql-community-server-tools-debuginfo-5.5.33-1.13.1 - openSUSE 12.3 (x86_64): libmysql55client18-32bit-5.5.33-1.13.1 libmysql55client18-debuginfo-32bit-5.5.33-1.13.1 libmysql55client_r18-32bit-5.5.33-1.13.1 References:

1 0

openSUSE-RU-2013:1507-1: iptraf: update to 1.1.4 and fixed floating point exception
by maintenance＠opensuse.org 30 Sep '13

30 Sep '13

openSUSE Recommended Update: iptraf: update to 1.1.4 and fixed floating point exception ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1507-1 Rating: low References: #841156 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with iptraf: - bnc#841156: fix "Floating point exception" in tcplog_flowrate_msg() - Update to new upstream release 1.1.4: * update all rates not only the visible ones * add 802.1ad / 802.1ah / QinQ ethertypes Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-730 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): iptraf-debugsource-1.1.4-5.8.1 iptraf-ng-1.1.4-5.8.1 iptraf-ng-debuginfo-1.1.4-5.8.1 References: https://bugzilla.novell.com/841156

1 0

openSUSE-RU-2013:1506-1: mysql-community-server: Update to 5.5.33 and droped relinking of libraries
by maintenance＠opensuse.org 30 Sep '13

30 Sep '13

openSUSE Recommended Update: mysql-community-server: Update to 5.5.33 and droped relinking of libraries ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1506-1 Rating: low References: Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues with mysql-community-server: - fixed commenting out incompatible options - workaround to mark datadir version - updated to 5.5.33 + changelog: http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-33.h tml - added back info page - droped relinking of libraries to fix builds of dependencies - better README.SuSE Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-724 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libmysqlclient-devel-5.5.33-1.17.1 libmysqlclient18-5.5.33-1.17.1 libmysqlclient18-debuginfo-5.5.33-1.17.1 libmysqlclient_r18-5.5.33-1.17.1 libmysqld-devel-5.5.33-1.17.1 libmysqld18-5.5.33-1.17.1 libmysqld18-debuginfo-5.5.33-1.17.1 mysql-community-server-5.5.33-1.17.1 mysql-community-server-bench-5.5.33-1.17.1 mysql-community-server-bench-debuginfo-5.5.33-1.17.1 mysql-community-server-client-5.5.33-1.17.1 mysql-community-server-client-debuginfo-5.5.33-1.17.1 mysql-community-server-debug-version-5.5.33-1.17.1 mysql-community-server-debug-version-debuginfo-5.5.33-1.17.1 mysql-community-server-debuginfo-5.5.33-1.17.1 mysql-community-server-debugsource-5.5.33-1.17.1 mysql-community-server-errormessages-5.5.33-1.17.1 mysql-community-server-test-5.5.33-1.17.1 mysql-community-server-test-debuginfo-5.5.33-1.17.1 mysql-community-server-tools-5.5.33-1.17.1 mysql-community-server-tools-debuginfo-5.5.33-1.17.1 - openSUSE 12.2 (x86_64): libmysqlclient18-32bit-5.5.33-1.17.1 libmysqlclient18-debuginfo-32bit-5.5.33-1.17.1 libmysqlclient_r18-32bit-5.5.33-1.17.1 References:

1 0

openSUSE-RU-2013:1505-1: OpenLP: update to 2.0.3
by maintenance＠opensuse.org 30 Sep '13

30 Sep '13

openSUSE Recommended Update: OpenLP: update to 2.0.3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1505-1 Rating: low References: #841394 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with OpenLP: - bnc#841394, lp#1216785: Updated OpenLP from version 2.0.2 to version 2.0.3 + Fixes regression introduced in 2.0.2 that prevents saving service files with notes in them Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-732 - openSUSE 12.2: zypper in -t patch openSUSE-2013-732 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): OpenLP-2.0.3-2.8.1 - openSUSE 12.2 (noarch): OpenLP-2.0.3-1.27.1 References: https://bugzilla.novell.com/841394

1 0

openSUSE-RU-2013:1504-1: Shotwell: update to 0.14.1 and several fixes
by maintenance＠opensuse.org 30 Sep '13

30 Sep '13

openSUSE Recommended Update: Shotwell: update to 0.14.1 and several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1504-1 Rating: low References: #835758 #841716 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with shotwell: - bnc#835758: fix crash on importing AVI files with "Mon Mar 3 09:44:56 2008" date format - Fix build with Vala 0.21.1. - fix build with LibRaw-0.15. - bnc#841716: Update to version 0.14.1 + Fixes a critical issue where Shotwell could close unexpectedly when working with RAW photos in direct-edit mode. + The Facebook Connector now recovers smoothly from type 7 errors. + EXIF-oriented photos uploaded to Facebook now appear in their correct orientation, even when the strip metadata option is turned on in the Facebook Connector. + Fixes an issue where incorrect view filter settings were applied on tag and event pages. + The Camera Developer is now disabled for RAW images that lack a suitable paired or embedded JPEG. + Assorted smaller bug fixes. + Updated translations. - Update to version 0.14.0: + A folder tree in the sidebar provides a directory-hierarchy view of your Shotwell library. + Dramatically improved user experience for RAW photographers. + Comprehensive logging of photo and video import. + The Facebook Connector now uses the Facebook Graph API. + The Shotwell video subsystem now relies on GStreamer 1.0. + New slideshow effects. + Improved Piwigo support. + Ability to show and hide the main Shotwell sidebar. + Numerous bug fixes. + Updated translations. - Replace BuildRequires for port to GStreamer 1.0 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-731 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): shotwell-0.14.1-2.4.1 shotwell-debuginfo-0.14.1-2.4.1 shotwell-debugsource-0.14.1-2.4.1 - openSUSE 12.3 (noarch): shotwell-lang-0.14.1-2.4.1 References: https://bugzilla.novell.com/835758 https://bugzilla.novell.com/841716

1 0

openSUSE-RU-2013:1503-1: augeas to fix error when editing /etc/sysconfig/kernel and /etc/sysconfig/bootloader.
by maintenance＠opensuse.org 30 Sep '13

30 Sep '13

openSUSE Recommended Update: augeas to fix error when editing /etc/sysconfig/kernel and /etc/sysconfig/bootloader. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1503-1 Rating: low References: #841331 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following error when attempting to use augeas to edit /etc/sysconfig/bootloader and /etc/sysconfig/kernel: "Lenses @Shellvars and @Shellvars_list could be used to load this file" Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-728 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): augeas-0.10.0-7.5.1 augeas-debuginfo-0.10.0-7.5.1 augeas-debugsource-0.10.0-7.5.1 augeas-devel-0.10.0-7.5.1 augeas-lense-tests-0.10.0-7.5.1 augeas-lenses-0.10.0-7.5.1 libaugeas0-0.10.0-7.5.1 libaugeas0-debuginfo-0.10.0-7.5.1 - openSUSE 12.3 (x86_64): augeas-devel-32bit-0.10.0-7.5.1 libaugeas0-32bit-0.10.0-7.5.1 libaugeas0-debuginfo-32bit-0.10.0-7.5.1 References: https://bugzilla.novell.com/841331

1 0

openSUSE-RU-2013:1502-1: os-prober: Fix detection of Windows 8 on legacy BIOS platform
by maintenance＠opensuse.org 30 Sep '13

30 Sep '13

openSUSE Recommended Update: os-prober: Fix detection of Windows 8 on legacy BIOS platform ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1502-1 Rating: low References: #822526 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with os-prober: - bnc#822526: Fix detection of Windows 8 on legacy BIOS platform Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-729 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): os-prober-1.49-7.15.1 os-prober-debuginfo-1.49-7.15.1 os-prober-debugsource-1.49-7.15.1 References: https://bugzilla.novell.com/822526

1 0