September 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1484-1: moderate: update for tiff
by opensuse-security＠opensuse.org 24 Sep '13

24 Sep '13

openSUSE Security Update: update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1484-1 Rating: moderate References: #834477 #834779 #834788 Cross-References: CVE-2013-4231 CVE-2013-4232 CVE-2013-4243 CVE-2013-4244 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This tiff security update fixes several buffer overflow issues and a out-of-bounds wirte problem. * tiff: buffer overflows/use after free problem [CVE-2013-4231][CVE-2013-4232][bnc#834477] * libtiff (gif2tiff): OOB Write in LZW decompressor [CVE-2013-4244][bnc#834788] * libtiff (gif2tiff): heap-based buffer overflow in readgifimage() [CVE-2013-4243][bnc#834779] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-139 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libtiff-devel-3.9.4-42.1 libtiff3-3.9.4-42.1 libtiff3-debuginfo-3.9.4-42.1 tiff-3.9.4-42.1 tiff-debuginfo-3.9.4-42.1 tiff-debugsource-3.9.4-42.1 - openSUSE 11.4 (x86_64): libtiff-devel-32bit-3.9.4-42.1 libtiff3-32bit-3.9.4-42.1 libtiff3-debuginfo-32bit-3.9.4-42.1 - openSUSE 11.4 (ia64): libtiff3-debuginfo-x86-3.9.4-42.1 libtiff3-x86-3.9.4-42.1 References: http://support.novell.com/security/cve/CVE-2013-4231.html http://support.novell.com/security/cve/CVE-2013-4232.html http://support.novell.com/security/cve/CVE-2013-4243.html http://support.novell.com/security/cve/CVE-2013-4244.html https://bugzilla.novell.com/834477 https://bugzilla.novell.com/834779 https://bugzilla.novell.com/834788

1 0

openSUSE-SU-2013:1483-1: moderate: update for wireshark
by opensuse-security＠opensuse.org 24 Sep '13

24 Sep '13

openSUSE Security Update: update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1483-1 Rating: moderate References: #839607 Cross-References: CVE-2013-5718 CVE-2013-5719 CVE-2013-5720 CVE-2013-5721 CVE-2013-5722 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This wireshark update to 1.8.10 fixes several security and non security bugs. [bnc#839607] + vulnerabilities fixed: * The NBAP dissector could crash. wnpa-sec-2013-55 CVE-2013-5718 * The ASSA R3 dissector could go into an infinite loop. wnpa-sec-2013-56 CVE-2013-5719 * The RTPS dissector could overflow a buffer. wnpa-sec-2013-57 CVE-2013-5720 * The MQ dissector could crash. wnpa-sec-2013-58 CVE-2013-5721 * The LDAP dissector could crash. wnpa-sec-2013-59 CVE-2013-5722 * The Netmon file parser could crash. wnpa-sec-2013-60 + Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.8.10.htm l Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-138 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): wireshark-1.8.10-57.1 wireshark-debuginfo-1.8.10-57.1 wireshark-debugsource-1.8.10-57.1 wireshark-devel-1.8.10-57.1 References: http://support.novell.com/security/cve/CVE-2013-5718.html http://support.novell.com/security/cve/CVE-2013-5719.html http://support.novell.com/security/cve/CVE-2013-5720.html http://support.novell.com/security/cve/CVE-2013-5721.html http://support.novell.com/security/cve/CVE-2013-5722.html https://bugzilla.novell.com/839607

1 0

openSUSE-SU-2013:1482-1: moderate: update for tiff
by opensuse-security＠opensuse.org 24 Sep '13

24 Sep '13

openSUSE Security Update: update for tiff ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1482-1 Rating: moderate References: #834477 #834779 #834788 Cross-References: CVE-2013-4231 CVE-2013-4232 CVE-2013-4243 CVE-2013-4244 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This tiff security update fixes several buffer overflow issues and a out-of-bounds wirte problem. * tiff: buffer overflows/use after free problem [CVE-2013-4231][CVE-2013-4232][bnc#834477] * libtiff (gif2tiff): OOB Write in LZW decompressor [CVE-2013-4244][bnc#834788] * libtiff (gif2tiff): heap-based buffer overflow in readgifimage() [CVE-2013-4243][bnc#834779] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-715 - openSUSE 12.2: zypper in -t patch openSUSE-2013-715 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libtiff-devel-4.0.3-2.8.1 libtiff5-4.0.3-2.8.1 libtiff5-debuginfo-4.0.3-2.8.1 tiff-4.0.3-2.8.1 tiff-debuginfo-4.0.3-2.8.1 tiff-debugsource-4.0.3-2.8.1 - openSUSE 12.3 (x86_64): libtiff-devel-32bit-4.0.3-2.8.1 libtiff5-32bit-4.0.3-2.8.1 libtiff5-debuginfo-32bit-4.0.3-2.8.1 - openSUSE 12.2 (i586 x86_64): libtiff-devel-4.0.2-1.20.1 libtiff5-4.0.2-1.20.1 libtiff5-debuginfo-4.0.2-1.20.1 tiff-4.0.2-1.20.1 tiff-debuginfo-4.0.2-1.20.1 tiff-debugsource-4.0.2-1.20.1 - openSUSE 12.2 (x86_64): libtiff-devel-32bit-4.0.2-1.20.1 libtiff5-32bit-4.0.2-1.20.1 libtiff5-debuginfo-32bit-4.0.2-1.20.1 References: http://support.novell.com/security/cve/CVE-2013-4231.html http://support.novell.com/security/cve/CVE-2013-4232.html http://support.novell.com/security/cve/CVE-2013-4243.html http://support.novell.com/security/cve/CVE-2013-4244.html https://bugzilla.novell.com/834477 https://bugzilla.novell.com/834779 https://bugzilla.novell.com/834788

1 0

openSUSE-SU-2013:1481-1: moderate: update for wireshark
by opensuse-security＠opensuse.org 24 Sep '13

24 Sep '13

openSUSE Security Update: update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1481-1 Rating: moderate References: #839607 Cross-References: CVE-2013-5718 CVE-2013-5719 CVE-2013-5720 CVE-2013-5721 CVE-2013-5722 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This wireshark update to 1.8.10 fixes several security and non security bugs. [bnc#839607] + vulnerabilities fixed: * The NBAP dissector could crash. wnpa-sec-2013-55 CVE-2013-5718 * The ASSA R3 dissector could go into an infinite loop. wnpa-sec-2013-56 CVE-2013-5719 * The RTPS dissector could overflow a buffer. wnpa-sec-2013-57 CVE-2013-5720 * The MQ dissector could crash. wnpa-sec-2013-58 CVE-2013-5721 * The LDAP dissector could crash. wnpa-sec-2013-59 CVE-2013-5722 * The Netmon file parser could crash. wnpa-sec-2013-60 + Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.8.10.htm l Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-714 - openSUSE 12.2: zypper in -t patch openSUSE-2013-714 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): wireshark-1.8.10-1.20.1 wireshark-debuginfo-1.8.10-1.20.1 wireshark-debugsource-1.8.10-1.20.1 wireshark-devel-1.8.10-1.20.1 - openSUSE 12.2 (i586 x86_64): wireshark-1.8.10-1.39.1 wireshark-debuginfo-1.8.10-1.39.1 wireshark-debugsource-1.8.10-1.39.1 wireshark-devel-1.8.10-1.39.1 References: http://support.novell.com/security/cve/CVE-2013-5718.html http://support.novell.com/security/cve/CVE-2013-5719.html http://support.novell.com/security/cve/CVE-2013-5720.html http://support.novell.com/security/cve/CVE-2013-5721.html http://support.novell.com/security/cve/CVE-2013-5722.html https://bugzilla.novell.com/839607

1 0

openSUSE-RU-2013:1480-1: moderate: choqok: Update to 1.4
by maintenance＠opensuse.org 23 Sep '13

23 Sep '13

openSUSE Recommended Update: choqok: Update to 1.4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1480-1 Rating: moderate References: Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues with choqok: - Update to 1.4: * Support for Twitter API v1.1. (kde#264091) * "Mark timeline as read" menu item added to tabs context menu. * Show "In reply to" in twitter search timelines. * Identi.ca support removed from StatusNet plugin. * And some other minor fixes Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-711 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): choqok-1.4-4.5.1 choqok-debuginfo-1.4-4.5.1 choqok-debugsource-1.4-4.5.1 choqok-devel-1.4-4.5.1 References:

1 0

openSUSE-RU-2013:1479-1: pam_mount: Update to new upstream release 2.14
by maintenance＠opensuse.org 23 Sep '13

23 Sep '13

openSUSE Recommended Update: pam_mount: Update to new upstream release 2.14 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1479-1 Rating: low References: #811119 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with pam_mount: - Update to new upstream release 2.14 * Bugfix: pam_mount printed "ehd_logctl: feature 1 is already zero" at each login (bnc#811119) * pmt-ehd: avoid miscalculating blockdev size obtained from BLKGETSIZE64 * correctly mkdir mountpoint if requested, and only remove mountpoint if actually created * restore DOMAIN_USER and DOMAIN_NAME expansion in mount options * add an "allow_discard" option for volumes to enable trim support on the block device without enabling it for the filesystem. * config: regexes can now be used for the user and group configuration options - Suppress useless debug output on using pam_mount - Avoid running fdupes on /etc - Depend on gpg-offline only for openSUSE >= 12.3 - Do require ofl and fd0ssh now, as they are now separate installables starting with 12.3 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-709 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libcryptmount-devel-2.14-5.4.1 libcryptmount0-2.14-5.4.1 libcryptmount0-debuginfo-2.14-5.4.1 pam_mount-2.14-5.4.1 pam_mount-debuginfo-2.14-5.4.1 pam_mount-debugsource-2.14-5.4.1 - openSUSE 12.3 (x86_64): libcryptmount0-32bit-2.14-5.4.1 libcryptmount0-debuginfo-32bit-2.14-5.4.1 pam_mount-32bit-2.14-5.4.1 pam_mount-debuginfo-32bit-2.14-5.4.1 References: https://bugzilla.novell.com/811119

1 0

openSUSE-RU-2013:1478-1: net-snmp: fix segmentation fault
by maintenance＠opensuse.org 23 Sep '13

23 Sep '13

openSUSE Recommended Update: net-snmp: fix segmentation fault ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1478-1 Rating: low References: #812867 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with net-snmp: - bnc#812867: fix a segmentation fault when reading disk directives after the daemon was reloaded by SIGHUP. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-713 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libsnmp30-5.7.1-9.5.1 libsnmp30-debuginfo-5.7.1-9.5.1 net-snmp-5.7.1-9.5.1 net-snmp-debuginfo-5.7.1-9.5.1 net-snmp-debugsource-5.7.1-9.5.1 net-snmp-devel-5.7.1-9.5.1 perl-SNMP-5.7.1-9.5.1 perl-SNMP-debuginfo-5.7.1-9.5.1 snmp-mibs-5.7.1-9.5.1 - openSUSE 12.2 (x86_64): libsnmp30-32bit-5.7.1-9.5.1 libsnmp30-debuginfo-32bit-5.7.1-9.5.1 net-snmp-devel-32bit-5.7.1-9.5.1 References: https://bugzilla.novell.com/812867

1 0

openSUSE-RU-2013:1477-1: libWebKit: Fix GtkAdjustmentWatcher idle source handling
by maintenance＠opensuse.org 23 Sep '13

23 Sep '13

openSUSE Recommended Update: libWebKit: Fix GtkAdjustmentWatcher idle source handling ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1477-1 Rating: low References: #840654 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with libWebKit: - bnc#840654, webkit#119003: Fix GtkAdjustmentWatcher idle source handling. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-712 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libjavascriptcoregtk-1_0-0-1.10.2-3.5.1 libjavascriptcoregtk-1_0-0-debuginfo-1.10.2-3.5.1 libjavascriptcoregtk-3_0-0-1.10.2-3.5.1 libjavascriptcoregtk-3_0-0-debuginfo-1.10.2-3.5.1 libwebkit2gtk-3_0-18-1.10.2-3.5.1 libwebkit2gtk-3_0-18-debuginfo-1.10.2-3.5.1 libwebkitgtk-1_0-0-1.10.2-3.5.1 libwebkitgtk-1_0-0-debuginfo-1.10.2-3.5.1 libwebkitgtk-3_0-0-1.10.2-3.5.1 libwebkitgtk-3_0-0-debuginfo-1.10.2-3.5.1 libwebkitgtk-devel-1.10.2-3.5.1 libwebkitgtk3-devel-1.10.2-3.5.1 typelib-1_0-JSCore-1_0-1.10.2-3.5.1 typelib-1_0-JSCore-3_0-1.10.2-3.5.1 typelib-1_0-WebKit-1_0-1.10.2-3.5.1 typelib-1_0-WebKit-3_0-1.10.2-3.5.1 typelib-1_0-WebKit2-3_0-1.10.2-3.5.1 webkit-jsc-1-1.10.2-3.5.1 webkit-jsc-1-debuginfo-1.10.2-3.5.1 webkit-jsc-3-1.10.2-3.5.1 webkit-jsc-3-debuginfo-1.10.2-3.5.1 - openSUSE 12.3 (x86_64): libjavascriptcoregtk-1_0-0-32bit-1.10.2-3.5.1 libjavascriptcoregtk-1_0-0-debuginfo-32bit-1.10.2-3.5.1 libjavascriptcoregtk-3_0-0-32bit-1.10.2-3.5.1 libjavascriptcoregtk-3_0-0-debuginfo-32bit-1.10.2-3.5.1 libwebkitgtk-1_0-0-32bit-1.10.2-3.5.1 libwebkitgtk-1_0-0-debuginfo-32bit-1.10.2-3.5.1 libwebkitgtk-3_0-0-32bit-1.10.2-3.5.1 libwebkitgtk-3_0-0-debuginfo-32bit-1.10.2-3.5.1 - openSUSE 12.3 (noarch): libwebkitgtk2-lang-1.10.2-3.5.1 libwebkitgtk3-lang-1.10.2-3.5.1 References: https://bugzilla.novell.com/840654

1 0

openSUSE-RU-2013:1476-1: vino: fixed possible infinit loop
by maintenance＠opensuse.org 23 Sep '13

23 Sep '13

openSUSE Recommended Update: vino: fixed possible infinit loop ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1476-1 Rating: low References: Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issue with vino: - bgo#641811: Fix possible infinit loop Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-710 - openSUSE 12.2: zypper in -t patch openSUSE-2013-710 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): vino-3.6.2-2.4.1 vino-debuginfo-3.6.2-2.4.1 vino-debugsource-3.6.2-2.4.1 - openSUSE 12.3 (noarch): vino-lang-3.6.2-2.4.1 - openSUSE 12.2 (i586 x86_64): vino-3.4.2-3.4.1 vino-debuginfo-3.4.2-3.4.1 vino-debugsource-3.4.2-3.4.1 - openSUSE 12.2 (noarch): vino-lang-3.4.2-3.4.1 References:

1 0

openSUSE-RU-2013:1475-1: nagios-plugins-mem: Initial update
by maintenance＠opensuse.org 23 Sep '13

23 Sep '13

openSUSE Recommended Update: nagios-plugins-mem: Initial update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:1475-1 Rating: low References: Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update introduces nagios-plugins-mem to openSUSE 12.3: - follow /usr move for cat and uname in apparmor profile - as we provide a symlink for check_mem => check_mem.pl, also provide an adapted apparmor profile - fix missing array definition for $def[] in pnp4nagios template - update to 20120618 (commit e3b162e6bb0cd7c6601933eeb0185f02d109739e): + count SReclaimable as cache + Added PNP config + added AIX support + switched from GPL to MIT license - specfile cleanup - use nagios-rpm-macros - package the check without extension, but provide symlink for upgraders - added rpmlintrc for PNP template (%%config) - added apparmor profile - initial version from 2002-02-28 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-87 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): nagios-plugins-mem-20120618-2.2 References:

1 0