January 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:0127-1: moderate: update for hplip
by opensuse-security＠opensuse.org 24 Jan '14

24 Jan '14

openSUSE Security Update: update for hplip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0127-1 Rating: moderate References: #852368 #853405 Cross-References: CVE-2013-6402 CVE-2013-6427 Affected Products: openSUSE 13.1 openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: - fix-CVE-2013-6402.dif fixes hardcoded file name /tmp/hp-pkservice.log in pkit.py (bnc#852368). - disable_hp-upgrade.patch disables hp-upgrade/upgrade.py for security reasons (bnc#853405). To upgrade HPLIP an openSUSE software package manager like YaST or zypper should be used. (CVE-2013-6427) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-80 - openSUSE 12.3: zypper in -t patch openSUSE-2014-80 - openSUSE 12.2: zypper in -t patch openSUSE-2014-80 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): hplip-3.13.10-4.2 hplip-debuginfo-3.13.10-4.2 hplip-debugsource-3.13.10-4.2 hplip-hpijs-3.13.10-4.2 hplip-hpijs-debuginfo-3.13.10-4.2 hplip-sane-3.13.10-4.2 hplip-sane-debuginfo-3.13.10-4.2 - openSUSE 12.3 (i586 x86_64): hplip-3.12.11-2.9.2 hplip-debuginfo-3.12.11-2.9.2 hplip-debugsource-3.12.11-2.9.2 hplip-hpijs-3.12.11-2.9.2 hplip-hpijs-debuginfo-3.12.11-2.9.2 hplip-sane-3.12.11-2.9.2 hplip-sane-debuginfo-3.12.11-2.9.2 - openSUSE 12.2 (i586 x86_64): hplip-3.12.4-3.10.1 hplip-debuginfo-3.12.4-3.10.1 hplip-debugsource-3.12.4-3.10.1 hplip-hpijs-3.12.4-3.10.1 hplip-hpijs-debuginfo-3.12.4-3.10.1 hplip-sane-3.12.4-3.10.1 hplip-sane-debuginfo-3.12.4-3.10.1 References: http://support.novell.com/security/cve/CVE-2013-6402.html http://support.novell.com/security/cve/CVE-2013-6427.html https://bugzilla.novell.com/852368 https://bugzilla.novell.com/853405

1 0

openSUSE-SU-2014:0126-1:
by opensuse-security＠opensuse.org 24 Jan '14

24 Jan '14

openSUSE Security Update: ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0126-1 Rating: low References: #858822 Cross-References: CVE-2014-0491 CVE-2014-0492 Affected Products: openSUSE 13.1:NonFree openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: No description available. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2014-78 - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2014-78 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.335-26.1 flash-player-gnome-11.2.202.335-26.1 flash-player-kde4-11.2.202.335-26.1 - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.335-2.52.1 flash-player-gnome-11.2.202.335-2.52.1 flash-player-kde4-11.2.202.335-2.52.1 References: http://support.novell.com/security/cve/CVE-2014-0491.html http://support.novell.com/security/cve/CVE-2014-0492.html https://bugzilla.novell.com/858822

1 0

openSUSE-SU-2014:0125-1: moderate: update for libqt4
by opensuse-security＠opensuse.org 24 Jan '14

24 Jan '14

openSUSE Security Update: update for libqt4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0125-1 Rating: moderate References: #856832 Cross-References: CVE-2013-4549 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Fixes XML Entity Expansion Denial of Service (bnc#856832, CVE-2013-4549) * add backported patch libqt4-disallow-deep-or-widely-nested-entity-references.patc h * add backported patch libqt4-fully-expand-all-entities.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-79 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libqt4-4.8.5-5.9.2 libqt4-debuginfo-4.8.5-5.9.2 libqt4-debugsource-4.8.5-5.9.2 libqt4-devel-4.8.5-5.9.2 libqt4-devel-debuginfo-4.8.5-5.9.2 libqt4-devel-doc-4.8.5-5.9.5 libqt4-devel-doc-debuginfo-4.8.5-5.9.5 libqt4-devel-doc-debugsource-4.8.5-5.9.5 libqt4-linguist-4.8.5-5.9.2 libqt4-linguist-debuginfo-4.8.5-5.9.2 libqt4-private-headers-devel-4.8.5-5.9.2 libqt4-qt3support-4.8.5-5.9.2 libqt4-qt3support-debuginfo-4.8.5-5.9.2 libqt4-sql-4.8.5-5.9.2 libqt4-sql-debuginfo-4.8.5-5.9.2 libqt4-sql-mysql-4.8.5-5.9.2 libqt4-sql-mysql-debuginfo-4.8.5-5.9.2 libqt4-sql-plugins-debugsource-4.8.5-5.9.2 libqt4-sql-postgresql-4.8.5-5.9.2 libqt4-sql-postgresql-debuginfo-4.8.5-5.9.2 libqt4-sql-sqlite-4.8.5-5.9.2 libqt4-sql-sqlite-debuginfo-4.8.5-5.9.2 libqt4-sql-unixODBC-4.8.5-5.9.2 libqt4-sql-unixODBC-debuginfo-4.8.5-5.9.2 libqt4-x11-4.8.5-5.9.2 libqt4-x11-debuginfo-4.8.5-5.9.2 qt4-x11-tools-4.8.5-5.9.5 qt4-x11-tools-debuginfo-4.8.5-5.9.5 - openSUSE 13.1 (x86_64): libqt4-32bit-4.8.5-5.9.2 libqt4-debuginfo-32bit-4.8.5-5.9.2 libqt4-qt3support-32bit-4.8.5-5.9.2 libqt4-qt3support-debuginfo-32bit-4.8.5-5.9.2 libqt4-sql-32bit-4.8.5-5.9.2 libqt4-sql-debuginfo-32bit-4.8.5-5.9.2 libqt4-sql-mysql-32bit-4.8.5-5.9.2 libqt4-sql-mysql-debuginfo-32bit-4.8.5-5.9.2 libqt4-sql-postgresql-32bit-4.8.5-5.9.2 libqt4-sql-postgresql-debuginfo-32bit-4.8.5-5.9.2 libqt4-sql-sqlite-32bit-4.8.5-5.9.2 libqt4-sql-sqlite-debuginfo-32bit-4.8.5-5.9.2 libqt4-sql-unixODBC-32bit-4.8.5-5.9.2 libqt4-sql-unixODBC-debuginfo-32bit-4.8.5-5.9.2 libqt4-x11-32bit-4.8.5-5.9.2 libqt4-x11-debuginfo-32bit-4.8.5-5.9.2 - openSUSE 13.1 (noarch): libqt4-devel-doc-data-4.8.5-5.9.5 References: http://support.novell.com/security/cve/CVE-2013-4549.html https://bugzilla.novell.com/856832

1 0

openSUSE-RU-2014:0123-1: mumble: remove syslog.target, since it no longer exists in recent systemd versions
by maintenance＠opensuse.org 24 Jan '14

24 Jan '14

openSUSE Recommended Update: mumble: remove syslog.target, since it no longer exists in recent systemd versions ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0123-1 Rating: low References: #855478 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with mumble: - bnc#855478: remove syslog.target, since it no longer exists in recent systemd versions (>202) and causes the service to fail to start Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-77 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): mumble-1.2.4-2.4.1 mumble-debuginfo-1.2.4-2.4.1 mumble-debugsource-1.2.4-2.4.1 mumble-server-1.2.4-2.4.1 mumble-server-debuginfo-1.2.4-2.4.1 - openSUSE 13.1 (x86_64): mumble-32bit-1.2.4-2.4.1 mumble-debuginfo-32bit-1.2.4-2.4.1 References: https://bugzilla.novell.com/855478

1 0

openSUSE-RU-2014:0122-1: moderate: aaa_base: make rcfoo usable for not enabled services
by maintenance＠opensuse.org 24 Jan '14

24 Jan '14

openSUSE Recommended Update: aaa_base: make rcfoo usable for not enabled services ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0122-1 Rating: moderate References: #856986 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with aaa_base: - bnc#856986: make rcfoo usable for not enabled services Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-76 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): aaa_base-13.1-16.30.1 aaa_base-debuginfo-13.1-16.30.1 aaa_base-debugsource-13.1-16.30.1 aaa_base-extras-13.1-16.30.1 aaa_base-malloccheck-13.1-16.30.1 References: https://bugzilla.novell.com/856986

1 0

openSUSE-RU-2014:0120-1: liferea: Update to 1.10.4
by maintenance＠opensuse.org 23 Jan '14

23 Jan '14

openSUSE Recommended Update: liferea: Update to 1.10.4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0120-1 Rating: low References: #858588 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with liferea: - bnc#858588: Update to version 1.10.4 + sf#1123: Mistakenly claims "TinyTinyRSS source is not self-updating". + sf#1119: Crash on font resize at startup. + sf#1117: Selecting last unread item in reduced feed list jumps to next feed. + Updated translations. - Update to version 1.10.3: + Ask for credentials again if TinyTinyRSS login fails. + Ask for TinyTinyRSS credentials only 3 times. + Check whether TinyTinyRSS base URL is lost. + Added warning on TinyTinyRSS login when source is not self-updating. + "--debug-net --debug-verbose" now traces POST data. + Add GNOME AppData XML. + Updated the default feed lists. + Updated translations. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-75 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): liferea-1.10.4-2.4.1 liferea-debuginfo-1.10.4-2.4.1 liferea-debugsource-1.10.4-2.4.1 - openSUSE 13.1 (noarch): liferea-lang-1.10.4-2.4.1 References: https://bugzilla.novell.com/858588

1 0

openSUSE-SU-2014:0119-1: moderate: update for cups
by opensuse-security＠opensuse.org 22 Jan '14

22 Jan '14

openSUSE Security Update: update for cups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0119-1 Rating: moderate References: #857372 Affected Products: openSUSE 13.1 openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Hardening: - cups-0002-systemd-listen-only-on-localhost-for-socket-activa tion.patch fixes the systemd cups.socket file so that systemd listens only on localhost (bnc#857372). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-73 - openSUSE 12.3: zypper in -t patch openSUSE-2014-73 - openSUSE 12.2: zypper in -t patch openSUSE-2014-73 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): cups-1.5.4-12.4.1 cups-client-1.5.4-12.4.1 cups-client-debuginfo-1.5.4-12.4.1 cups-ddk-1.5.4-12.4.1 cups-ddk-debuginfo-1.5.4-12.4.1 cups-debuginfo-1.5.4-12.4.1 cups-debugsource-1.5.4-12.4.1 cups-devel-1.5.4-12.4.1 cups-libs-1.5.4-12.4.1 cups-libs-debuginfo-1.5.4-12.4.1 - openSUSE 13.1 (x86_64): cups-libs-32bit-1.5.4-12.4.1 cups-libs-debuginfo-32bit-1.5.4-12.4.1 - openSUSE 12.3 (i586 x86_64): cups-1.5.4-5.5.1 cups-client-1.5.4-5.5.1 cups-client-debuginfo-1.5.4-5.5.1 cups-ddk-1.5.4-5.5.1 cups-ddk-debuginfo-1.5.4-5.5.1 cups-debuginfo-1.5.4-5.5.1 cups-debugsource-1.5.4-5.5.1 cups-devel-1.5.4-5.5.1 cups-libs-1.5.4-5.5.1 cups-libs-debuginfo-1.5.4-5.5.1 - openSUSE 12.3 (x86_64): cups-libs-32bit-1.5.4-5.5.1 cups-libs-debuginfo-32bit-1.5.4-5.5.1 - openSUSE 12.2 (i586 x86_64): cups-1.5.3-2.8.1 cups-client-1.5.3-2.8.1 cups-client-debuginfo-1.5.3-2.8.1 cups-ddk-1.5.3-2.8.1 cups-ddk-debuginfo-1.5.3-2.8.1 cups-debuginfo-1.5.3-2.8.1 cups-debugsource-1.5.3-2.8.1 cups-devel-1.5.3-2.8.1 cups-libs-1.5.3-2.8.1 cups-libs-debuginfo-1.5.3-2.8.1 - openSUSE 12.2 (x86_64): cups-libs-32bit-1.5.3-2.8.1 cups-libs-debuginfo-32bit-1.5.3-2.8.1 References: https://bugzilla.novell.com/857372

1 0

openSUSE-SU-2014:0118-1: moderate: update for almanah
by opensuse-security＠opensuse.org 22 Jan '14

22 Jan '14

openSUSE Security Update: update for almanah ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0118-1 Rating: moderate References: #809140 Cross-References: CVE-2013-1853 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Update to version 0.9.1: + Almanah doesn't encrypt the database when the application close (bgo#695117, bnc#809140, CVE-2013-1853). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2014-74 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): almanah-0.9.1-3.4.1 almanah-debuginfo-0.9.1-3.4.1 almanah-debugsource-0.9.1-3.4.1 - openSUSE 12.2 (noarch): almanah-lang-0.9.1-3.4.1 References: http://support.novell.com/security/cve/CVE-2013-1853.html https://bugzilla.novell.com/809140

1 0

openSUSE-RU-2014:0117-1: bash: Two fixes
by maintenance＠opensuse.org 22 Jan '14

22 Jan '14

openSUSE Recommended Update: bash: Two fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0117-1 Rating: low References: #820149 #828877 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with bash: - Reintroduce patch bash-4.2-winch.dif to solve bnc#828877 - bnc#820149: Do not restart the sighandler after a trap is reset Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-72 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): bash-4.2-61.4.1 bash-debuginfo-4.2-61.4.1 bash-debugsource-4.2-61.4.1 bash-devel-4.2-61.4.1 bash-loadables-4.2-61.4.1 bash-loadables-debuginfo-4.2-61.4.1 libreadline6-6.2-61.4.1 libreadline6-debuginfo-6.2-61.4.1 readline-devel-6.2-61.4.1 - openSUSE 12.3 (x86_64): bash-debuginfo-32bit-4.2-61.4.1 libreadline6-32bit-6.2-61.4.1 libreadline6-debuginfo-32bit-6.2-61.4.1 readline-devel-32bit-6.2-61.4.1 - openSUSE 12.3 (noarch): bash-doc-4.2-61.4.1 bash-lang-4.2-61.4.1 readline-doc-6.2-61.4.1 References: https://bugzilla.novell.com/820149 https://bugzilla.novell.com/828877

1 0

openSUSE-SU-2014:0114-1: moderate: update for quassel
by opensuse-security＠opensuse.org 21 Jan '14

21 Jan '14

openSUSE Security Update: update for quassel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0114-1 Rating: moderate References: #849850 Cross-References: CVE-2013-6404 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Add back /etc/sysconfig/quasselcore (bnc#849850) - Drop fix-CVE-2013-6404.diff: Merged upstream - Update to 0.9.2 * Don't crash if /topic contains newlines. * Fix SSL-related issues. * Fix Phonon notifications not playing sound. * Pingout if connection drops during SASL auth phase. * Prevent messages from being sent to status buffers. * Make sure manipulated/buggy clients cannot access backlog of other core users. * Fix context menu issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-71 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): quassel-base-0.9.2-12.1 quassel-client-0.9.2-12.1 quassel-client-debuginfo-0.9.2-12.1 quassel-core-0.9.2-12.1 quassel-core-debuginfo-0.9.2-12.1 quassel-debugsource-0.9.2-12.1 quassel-mono-0.9.2-12.1 quassel-mono-debuginfo-0.9.2-12.1 References: http://support.novell.com/security/cve/CVE-2013-6404.html https://bugzilla.novell.com/849850

1 0