January 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2014:0027-1: procps: Several fixes and improvements
by maintenance＠opensuse.org 07 Jan '14

07 Jan '14

openSUSE Recommended Update: procps: Several fixes and improvements ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0027-1 Rating: low References: #842340 #855861 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with procps: - bnc#855861: Use jiffies to calculate %CPU output - Be aware of new VmFlags entry in /proc/$pid/smaps - Enable legacy pmap - bnc#842340: Fix crash of legacy pmap - Show shared memory in 'free' again - Fixed possibility to enable selinux Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-23 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libprocps1-3.3.8-5.4.1 libprocps1-debuginfo-3.3.8-5.4.1 procps-3.3.8-5.4.1 procps-debuginfo-3.3.8-5.4.1 procps-debugsource-3.3.8-5.4.1 procps-devel-3.3.8-5.4.1 References: https://bugzilla.novell.com/842340 https://bugzilla.novell.com/855861

1 0

openSUSE-RU-2014:0026-1: Softwarestack update for openSUSE 12.2
by maintenance＠opensuse.org 07 Jan '14

07 Jan '14

openSUSE Recommended Update: Softwarestack update for openSUSE 12.2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0026-1 Rating: low References: #844373 #845619 #846565 #850907 #852943 #854784 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update fixes the following issues with the Softwarestack: - zypper: + bnc#854784: Fix groff .TP commands in manpage + bnc#844373: * Fix detection of multiversion packages in transaction summary * Improve prompt with more options hidden behind '?' + bnc#845619: Fix message typo + Updated translations - libzypp: + bnc#852943: Fix disk usage computation for single packages + bnc#850907: Filter control chars illegal in XML1.0 + bnc#846565: Always properly initialize pool storage + Updated translations Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2014-14 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libzypp-11.13.3-2.33.1 libzypp-debuginfo-11.13.3-2.33.1 libzypp-debugsource-11.13.3-2.33.1 libzypp-devel-11.13.3-2.33.1 zypper-1.7.16-1.28.1 zypper-debuginfo-1.7.16-1.28.1 zypper-debugsource-1.7.16-1.28.1 - openSUSE 12.2 (noarch): zypper-aptitude-1.7.16-1.28.1 zypper-log-1.7.16-1.28.1 References: https://bugzilla.novell.com/844373 https://bugzilla.novell.com/845619 https://bugzilla.novell.com/846565 https://bugzilla.novell.com/850907 https://bugzilla.novell.com/852943 https://bugzilla.novell.com/854784

1 0

openSUSE-SU-2014:0021-1: moderate: update for thttpd
by opensuse-security＠opensuse.org 03 Jan '14

03 Jan '14

openSUSE Security Update: update for thttpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0021-1 Rating: moderate References: #853381 Cross-References: CVE-2013-0348 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue with thttpd: - fix CVE-2013-0348 (bnc#853381) * don't create a world readable logfile Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-2 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): thttpd-2.25b-188.1 thttpd-debuginfo-2.25b-188.1 thttpd-debugsource-2.25b-188.1 References: http://support.novell.com/security/cve/CVE-2013-0348.html https://bugzilla.novell.com/853381

1 0

openSUSE-SU-2014:0020-1: moderate: update for wireshark
by opensuse-security＠opensuse.org 03 Jan '14

03 Jan '14

openSUSE Security Update: update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0020-1 Rating: moderate References: #855980 Cross-References: CVE-2013-7112 CVE-2013-7114 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: - update to 1.8.12 [bnc#855980] + vulnerabilities fixed: * The SIP dissector could go into an infinite loop. wnpa-sec-2013-66 CVE-2013-7112 * The NTLMSSP v2 dissector could crash. Discovered by Garming Sam. wnpa-sec-2013-68 CVE-2013-7114 + Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.8.12.htm l Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): wireshark-1.8.12-65.1 wireshark-debuginfo-1.8.12-65.1 wireshark-debugsource-1.8.12-65.1 wireshark-devel-1.8.12-65.1 References: http://support.novell.com/security/cve/CVE-2013-7112.html http://support.novell.com/security/cve/CVE-2013-7114.html https://bugzilla.novell.com/855980

1 0

openSUSE-SU-2014:0019-1: moderate: update for rubygem-actionpack-2_3
by opensuse-security＠opensuse.org 03 Jan '14

03 Jan '14

openSUSE Security Update: update for rubygem-actionpack-2_3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0019-1 Rating: moderate References: #809935 #809940 #853632 Cross-References: CVE-2013-1855 CVE-2013-1857 CVE-2013-6415 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Update consists of 3 fixes: -fix CVE-2013-6415: number_to_currency XSS (bnc#853632). -fix CVE-2013-1855: rubygem-actionpack*: XSS vulnerability insanitize_css in Action Pack (bnc#809935) -fix CVE-2013-1857: rubygem-actionpack*: XSS Vulnerability in the sanitize` helper of Ruby on Rails (bnc#809940) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-3 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): rubygem-actionpack-2_3-2.3.17-39.1 rubygem-actionpack-2_3-doc-2.3.17-39.1 rubygem-actionpack-2_3-testsuite-2.3.17-39.1 References: http://support.novell.com/security/cve/CVE-2013-1855.html http://support.novell.com/security/cve/CVE-2013-1857.html http://support.novell.com/security/cve/CVE-2013-6415.html https://bugzilla.novell.com/809935 https://bugzilla.novell.com/809940 https://bugzilla.novell.com/853632

1 0

openSUSE-SU-2014:0018-1: moderate: update for openssl
by opensuse-security＠opensuse.org 03 Jan '14

03 Jan '14

openSUSE Security Update: update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0018-1 Rating: moderate References: #849377 #856687 Cross-References: CVE-2013-6449 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: - Fixed bnc#856687, openssl: crash when using TLS 1.2 Add file: CVE-2013-6449.patch - compression_methods_switch.patch: setenv might not be successful if a surrounding library or application filters it, like e.g. sudo. As setenv() does not seem to be useful anyway, remove it. bnc#849377 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2014-11 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libopenssl-devel-1.0.1e-2.16.1 libopenssl1_0_0-1.0.1e-2.16.1 libopenssl1_0_0-debuginfo-1.0.1e-2.16.1 openssl-1.0.1e-2.16.1 openssl-debuginfo-1.0.1e-2.16.1 openssl-debugsource-1.0.1e-2.16.1 - openSUSE 12.2 (x86_64): libopenssl-devel-32bit-1.0.1e-2.16.1 libopenssl1_0_0-32bit-1.0.1e-2.16.1 libopenssl1_0_0-debuginfo-32bit-1.0.1e-2.16.1 - openSUSE 12.2 (noarch): openssl-doc-1.0.1e-2.16.1 References: http://support.novell.com/security/cve/CVE-2013-6449.html https://bugzilla.novell.com/849377 https://bugzilla.novell.com/856687

1 0

openSUSE-SU-2014:0017-1: moderate: update for wireshark
by opensuse-security＠opensuse.org 03 Jan '14

03 Jan '14

openSUSE Security Update: update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0017-1 Rating: moderate References: #855980 Cross-References: CVE-2013-7112 CVE-2013-7113 CVE-2013-7114 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: - update to 1.10.5 + bugs fixed: * Wireshark stops showing new packets but dumpcap keeps writing them to the temp file. * Wireshark 1.10.4 shuts down when promiscuous mode is unchecked. * Homeplug dissector bug: STATUS_ACCESS_VIOLATION: dissector accessed an invalid memory address. - update to 1.10.4 [bnc#855980] + vulnerabilities fixed: * The SIP dissector could go into an infinite loop. wnpa-sec-2013-66 CVE-2013-7112 * The BSSGP dissector could crash. wnpa-sec-2013-67 CVE-2013-7113 * The NTLMSSP v2 dissector could crash. Discovered by Garming Sam. wnpa-sec-2013-68 CVE-2013-7114 + Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.10.4.htm l Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-9 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): wireshark-1.10.5-4.1 wireshark-debuginfo-1.10.5-4.1 wireshark-debugsource-1.10.5-4.1 wireshark-devel-1.10.5-4.1 References: http://support.novell.com/security/cve/CVE-2013-7112.html http://support.novell.com/security/cve/CVE-2013-7113.html http://support.novell.com/security/cve/CVE-2013-7114.html https://bugzilla.novell.com/855980

1 0

openSUSE-SU-2014:0016-1: moderate: nagios: fixed a denial of service in CGI executables
by opensuse-security＠opensuse.org 03 Jan '14

03 Jan '14

openSUSE Security Update: nagios: fixed a denial of service in CGI executables ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0016-1 Rating: moderate References: #856837 Cross-References: CVE-2013-7108 Affected Products: openSUSE 13.1 openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: nagios was updated to fix a possible denial of service in CGI executables. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-13 - openSUSE 12.3: zypper in -t patch openSUSE-2014-13 - openSUSE 12.2: zypper in -t patch openSUSE-2014-13 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): nagios-3.5.1-3.5.1 nagios-debugsource-3.5.1-3.5.1 nagios-devel-3.5.1-3.5.1 nagios-www-3.5.1-3.5.1 nagios-www-dch-3.5.1-3.5.1 nagios-www-debuginfo-3.5.1-3.5.1 - openSUSE 12.3 (i586 x86_64): nagios-3.5.0-2.14.1 nagios-debuginfo-3.5.0-2.14.1 nagios-debugsource-3.5.0-2.14.1 nagios-devel-3.5.0-2.14.1 nagios-www-3.5.0-2.14.1 nagios-www-dch-3.5.0-2.14.1 nagios-www-debuginfo-3.5.0-2.14.1 - openSUSE 12.2 (i586 x86_64): nagios-3.5.0-2.23.1 nagios-debuginfo-3.5.0-2.23.1 nagios-debugsource-3.5.0-2.23.1 nagios-devel-3.5.0-2.23.1 nagios-www-3.5.0-2.23.1 nagios-www-dch-3.5.0-2.23.1 nagios-www-debuginfo-3.5.0-2.23.1 References: http://support.novell.com/security/cve/CVE-2013-7108.html https://bugzilla.novell.com/856837

1 0

openSUSE-SU-2014:0015-1: moderate: update for openssl
by opensuse-security＠opensuse.org 03 Jan '14

03 Jan '14

openSUSE Security Update: update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0015-1 Rating: moderate References: #856687 Cross-References: CVE-2013-6449 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Fixed bnc#856687, openssl: crash when using TLS 1.2 Add file: CVE-2013-6449.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-4 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1e-11.10.1 libopenssl1_0_0-1.0.1e-11.10.1 libopenssl1_0_0-debuginfo-1.0.1e-11.10.1 openssl-1.0.1e-11.10.1 openssl-debuginfo-1.0.1e-11.10.1 openssl-debugsource-1.0.1e-11.10.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1e-11.10.1 libopenssl1_0_0-32bit-1.0.1e-11.10.1 libopenssl1_0_0-debuginfo-32bit-1.0.1e-11.10.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1e-11.10.1 References: http://support.novell.com/security/cve/CVE-2013-6449.html https://bugzilla.novell.com/856687

1 0

openSUSE-SU-2014:0014-1: moderate: update for pixman
by opensuse-security＠opensuse.org 03 Jan '14

03 Jan '14

openSUSE Security Update: update for pixman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0014-1 Rating: moderate References: #853824 Cross-References: CVE-2013-6425 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Added pixman-bnc853824-bfo67484-CVE-2013-6425-fix-underflow.patch for bnc#853824. Fixes an integer underflow bug which can cause a crash. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-7 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libpixman-1-0-0.30.2-2.5.1 libpixman-1-0-debuginfo-0.30.2-2.5.1 libpixman-1-0-devel-0.30.2-2.5.1 pixman-debugsource-0.30.2-2.5.1 - openSUSE 13.1 (x86_64): libpixman-1-0-32bit-0.30.2-2.5.1 libpixman-1-0-debuginfo-32bit-0.30.2-2.5.1 References: http://support.novell.com/security/cve/CVE-2013-6425.html https://bugzilla.novell.com/853824

1 0