January 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:0145-1: moderate: update for pixman
by opensuse-security＠opensuse.org 28 Jan '14

28 Jan '14

openSUSE Security Update: update for pixman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0145-1 Rating: moderate References: #853824 Cross-References: CVE-2013-6425 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Added pixman-bnc853824-bfo67484-CVE-2013-6425-fix-underflow.patch for bnc#853824. Fixes an integer underflow bug which can cause a crash. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-12 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libpixman-1-0-0.20.0-6.1 libpixman-1-0-debuginfo-0.20.0-6.1 libpixman-1-0-devel-0.20.0-6.1 pixman-debugsource-0.20.0-6.1 - openSUSE 11.4 (x86_64): libpixman-1-0-32bit-0.20.0-6.1 libpixman-1-0-debuginfo-32bit-0.20.0-6.1 - openSUSE 11.4 (ia64): libpixman-1-0-debuginfo-x86-0.20.0-6.1 libpixman-1-0-x86-0.20.0-6.1 References: http://support.novell.com/security/cve/CVE-2013-6425.html https://bugzilla.novell.com/853824

1 0

openSUSE-SU-2014:0144-1: moderate: update clamav to 0.98
by opensuse-security＠opensuse.org 28 Jan '14

28 Jan '14

openSUSE Security Update: update clamav to 0.98 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0144-1 Rating: moderate References: #841815 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Code quality fixes in libclamav, clamd, sigtool, clamav-milter, clamconf, and clamdtop. Code quality fixes in libclamav, libclamunrar and freshclam. Valgrind suppression rules for dl_catch_error complaints. bb #8385: a PDF ASCII85Decode zero-length fix. libclamav: SCAN_ALL mode fixes. bb #7436: elf64 header early exit. iso9660: iso_scan_file rewrite. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-11 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): clamav-0.98-25.1 clamav-debuginfo-0.98-25.1 clamav-debugsource-0.98-25.1 - openSUSE 11.4 (noarch): clamav-db-0.98-25.1 References: https://bugzilla.novell.com/841815

1 0

openSUSE-SU-2014:0143-1: moderate: update for tor
by opensuse-security＠opensuse.org 28 Jan '14

28 Jan '14

openSUSE Security Update: update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0143-1 Rating: moderate References: #859421 Cross-References: CVE-2013-7295 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - fixes potentially poor random number generation for users who 1) use OpenSSL 1.0.0 or later, 2) set "HardwareAccel 1" in their torrc file, 3) have "Sandy Bridge" or "Ivy Bridge" Intel processors and 4) have no state file in their DataDirectory (as would happen on first start). Users who generated relay or hidden service identity keys in such a situation should discard them and generate new ones. No 2 is not the default configuration for openSUSE. [bnc#859421] [CVE-2013-7295] - added patches: * tor-0.2.3.x-CVE-2013-7295.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-86 - openSUSE 12.3: zypper in -t patch openSUSE-2014-86 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): tor-0.2.3.25-5.4.1 tor-debuginfo-0.2.3.25-5.4.1 tor-debugsource-0.2.3.25-5.4.1 - openSUSE 12.3 (i586 x86_64): tor-0.2.3.25-2.4.1 tor-debuginfo-0.2.3.25-2.4.1 tor-debugsource-0.2.3.25-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-7295.html https://bugzilla.novell.com/859421

1 0

openSUSE-SU-2014:0142-1: moderate: update for ack
by opensuse-security＠opensuse.org 28 Jan '14

28 Jan '14

openSUSE Security Update: update for ack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0142-1 Rating: moderate References: #855340 Cross-References: CVE-2013-7069 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - update to ack 2.12: fixes potential remote code execution via per-project .ackrc files [bnc#855340] [CVE-2013-7069] * prevents the --pager, --regex and --output options from being used from project-level ackrc files, preventing possible code execution when using ack through malicious files * --pager, --regex and --output options may still be used from the global /etc/ackrc, your own private ~/.ackrc, the ACK_OPTIONS environment variable, and of course from the command line. * Now ignores Eclipse .metadata directory. - includes changes form 2.11_02: * upstream source mispackaging fix - includes changes from 2.11_01 * Fixed a race condition in t/file-permission.t that was causing failures if tests were run in parallel. - includes changes from 2.10: * Add --perltest for *.t files * Added Matlab support * More compatibility fixes for Perl 5.8.8. - includes changes from 2.08 * ack now ignores CMake's build/cache directories by default * Add shebang matching for --lua files * Add documentation for --ackrc * Add Elixir filetype * Add --cathy option * Add some helpful debugging tips when an invalid option is found * Ignore PDF files by default, because Perl will detect them as text * Ignore .gif, .jpg, .jpeg and .png files. They won't normally be selected, but this is an optimization so that ack doesn't have to open them to know * Ack's colorizing of output would get confused with multiple sets of parentheses * Ack would get confused when trying to colorize the output in DOS-format files - includes changes from 2.05_01 * We now ignore the node_modules directories created by npm * --pager without an argument implies --pager=$PAGER * --perl now recognizes Plack-style .psgi files * Added filetypes for Coffescript, JSON, LESS, and Sass. * Command-line options now override options set in ackrc files * ACK_PAGER and ACK_PAGER_COLOR now work as advertised. * Fix a bug resulting in uninitialized variable warnings when more than one capture group was specified in the search pattern * Make sure ack is happy to build and test under cron and other console-less environments. - packaging changes: * run more rests with IO::Pty * refresh ack-ignore-osc.patch for upstream changes * update project URL - port changes from devel:languages:perl ack by daxim(a)cpan.org: * correct metadata: licence, CPAN download, homepage * unset forced prefix - let Perl configuration and toolchain determine the prefix/install_base which will DTRT * bash completion is gone, remove dead code - modified patches: * ack-ignore-osc.patch adjust for upstream source changes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-87 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): ack-2.12-3.4.1 perl-App-Ack-2.12-3.4.1 References: http://support.novell.com/security/cve/CVE-2013-7069.html https://bugzilla.novell.com/855340

1 0

openSUSE-RU-2014:0139-1: release-notes-openSUSE: End of maintenance announcement
by maintenance＠opensuse.org 27 Jan '14

27 Jan '14

openSUSE Recommended Update: release-notes-openSUSE: End of maintenance announcement ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0139-1 Rating: low References: Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This last update marks the end of maintenance for openSUSE 12.2. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2014-85 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (noarch): release-notes-openSUSE-12.2.9-1.16.3 References:

1 0

openSUSE-SU-2014:0138-1: moderate: update for gnumeric
by opensuse-security＠opensuse.org 27 Jan '14

27 Jan '14

openSUSE Security Update: update for gnumeric ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0138-1 Rating: moderate References: #856254 Cross-References: CVE-2013-6836 CVE-2013-6838 Affected Products: openSUSE 13.1 openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: - Add gnumeric-CVE-2013-6836.patch: fix Heap-buffer-overflow in ms_escher_get_data on a fuzzed xls file (bnc#856254, bgo#712772, CVE-2013-6838). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-84 - openSUSE 12.3: zypper in -t patch openSUSE-2014-84 - openSUSE 12.2: zypper in -t patch openSUSE-2014-84 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): gnumeric-1.12.7-2.5.3 gnumeric-debuginfo-1.12.7-2.5.3 gnumeric-debugsource-1.12.7-2.5.3 gnumeric-devel-1.12.7-2.5.3 - openSUSE 13.1 (noarch): gnumeric-lang-1.12.7-2.5.3 - openSUSE 12.3 (i586 x86_64): gnumeric-1.12.0-2.4.3 gnumeric-debuginfo-1.12.0-2.4.3 gnumeric-debugsource-1.12.0-2.4.3 gnumeric-devel-1.12.0-2.4.3 - openSUSE 12.3 (noarch): gnumeric-lang-1.12.0-2.4.3 - openSUSE 12.2 (i586 x86_64): gnumeric-1.11.3-2.5.2 gnumeric-debuginfo-1.11.3-2.5.2 gnumeric-debugsource-1.11.3-2.5.2 gnumeric-devel-1.11.3-2.5.2 - openSUSE 12.2 (noarch): gnumeric-lang-1.11.3-2.5.2 References: http://support.novell.com/security/cve/CVE-2013-6836.html http://support.novell.com/security/cve/CVE-2013-6838.html https://bugzilla.novell.com/856254

1 0

openSUSE-RU-2014:0136-1: important: qtcurve-gtk2: Removed patch from previous update which caused problems
by maintenance＠opensuse.org 27 Jan '14

27 Jan '14

openSUSE Recommended Update: qtcurve-gtk2: Removed patch from previous update which caused problems ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0136-1 Rating: important References: #859469 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with qtcurve-gtk2: - bnc#859469: Removed patch from previous update after this caused problems with SIGCHILD handler Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-82 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): qtcurve-gtk2-1.8.16-2.8.1 qtcurve-gtk2-debuginfo-1.8.16-2.8.1 - openSUSE 13.1 (x86_64): qtcurve-gtk2-32bit-1.8.16-2.8.1 qtcurve-gtk2-debuginfo-32bit-1.8.16-2.8.1 References: https://bugzilla.novell.com/859469

1 0

openSUSE-RU-2014:0135-1: important: nodejs: use own libv8 instead of requiring it
by maintenance＠opensuse.org 27 Jan '14

27 Jan '14

openSUSE Recommended Update: nodejs: use own libv8 instead of requiring it ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0135-1 Rating: important References: #858747 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with nodejs: - bnc#858747: Use included libv8 engine Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-83 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): nodejs-0.8.12-3.11.1 nodejs-debuginfo-0.8.12-3.11.1 nodejs-debugsource-0.8.12-3.11.1 nodejs-devel-0.8.12-3.11.1 References: https://bugzilla.novell.com/858747

1 0

openSUSE-RU-2014:0134-1: moderate: yast2-add-on: Fix autoyast config file
by maintenance＠opensuse.org 27 Jan '14

27 Jan '14

openSUSE Recommended Update: yast2-add-on: Fix autoyast config file ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0134-1 Rating: moderate References: #846011 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with yast2-add-on: - bnc#846011: Fix autoyast config file Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-81 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): yast2-add-on-3.0.3-4.1 yast2-add-on-devel-doc-3.0.3-4.1 References: https://bugzilla.novell.com/846011

1 0

openSUSE-SU-2014:0128-1: important: flash-player to 11.2.202.335
by opensuse-security＠opensuse.org 24 Jan '14

24 Jan '14

openSUSE Security Update: flash-player to 11.2.202.335 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0128-1 Rating: important References: #858822 Cross-References: CVE-2014-0491 CVE-2014-0492 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Adobe Flash Player was updated to version 11.2.202.335: (bnc#858822) * APSB14-02, CVE-2014-0491, CVE-2014-0492 More information can be found on: http://helpx.adobe.com/security/products/flash-player/apsb14 -02.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-9 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.335-87.1 flash-player-gnome-11.2.202.335-87.1 flash-player-kde4-11.2.202.335-87.1 References: http://support.novell.com/security/cve/CVE-2014-0491.html http://support.novell.com/security/cve/CVE-2014-0492.html https://bugzilla.novell.com/858822

1 0