November 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:1516-1: moderate: Security update for file
by opensuse-security＠opensuse.org 27 Nov '14

27 Nov '14

openSUSE Security Update: Security update for file ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1516-1 Rating: moderate References: #902367 Cross-References: CVE-2014-3710 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: file was updated to fix one security issue. This security issue was fixed: - Out-of-bounds read in elf note headers (CVE-2014-3710). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-723 - openSUSE 13.1: zypper in -t patch openSUSE-2014-723 - openSUSE 12.3: zypper in -t patch openSUSE-2014-723 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): file-5.19-3.4.1 file-debuginfo-5.19-3.4.1 file-debugsource-5.19-3.4.1 file-devel-5.19-3.4.1 file-magic-5.19-3.4.1 libmagic1-5.19-3.4.1 libmagic1-debuginfo-5.19-3.4.1 python-magic-5.19-3.4.1 - openSUSE 13.2 (x86_64): libmagic1-32bit-5.19-3.4.1 libmagic1-debuginfo-32bit-5.19-3.4.1 - openSUSE 13.1 (i586 x86_64): file-5.15-4.24.1 file-debuginfo-5.15-4.24.1 file-debugsource-5.15-4.24.1 file-devel-5.15-4.24.1 file-magic-5.15-4.24.1 libmagic1-5.15-4.24.1 libmagic1-debuginfo-5.15-4.24.1 python-magic-5.15-4.24.1 - openSUSE 13.1 (x86_64): libmagic1-32bit-5.15-4.24.1 libmagic1-debuginfo-32bit-5.15-4.24.1 - openSUSE 12.3 (i586 x86_64): file-5.11-12.27.1 file-debuginfo-5.11-12.27.1 file-debugsource-5.11-12.27.1 file-devel-5.11-12.27.1 libmagic-data-5.11-12.27.1 libmagic1-5.11-12.27.1 libmagic1-debuginfo-5.11-12.27.1 python-magic-5.11-12.27.1 - openSUSE 12.3 (x86_64): libmagic1-32bit-5.11-12.27.1 libmagic1-debuginfo-32bit-5.11-12.27.1 References: http://support.novell.com/security/cve/CVE-2014-3710.html https://bugzilla.suse.com/show_bug.cgi?id=902367

1 0

openSUSE-SU-2014:1515-1: moderate: Security update for rubygem-actionpack-3_2
by opensuse-security＠opensuse.org 27 Nov '14

27 Nov '14

openSUSE Security Update: Security update for rubygem-actionpack-3_2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1515-1 Rating: moderate References: #903662 #905727 Cross-References: CVE-2014-7818 CVE-2014-7829 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: rubygem-actionpack-3_2 was updated to fix two security issues. These security issues were fixed: - Arbitrary file existence disclosure (CVE-2014-7829). - Arbitrary file existence disclosure (CVE-2014-7818). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-724 - openSUSE 13.1: zypper in -t patch openSUSE-2014-724 - openSUSE 12.3: zypper in -t patch openSUSE-2014-724 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rubygem-actionpack-3_2-3.2.17-3.4.1 rubygem-actionpack-3_2-doc-3.2.17-3.4.1 - openSUSE 13.1 (i586 x86_64): rubygem-actionpack-3_2-3.2.13-2.28.1 rubygem-actionpack-3_2-doc-3.2.13-2.28.1 - openSUSE 12.3 (i586 x86_64): rubygem-actionpack-3_2-3.2.12-1.32.1 rubygem-actionpack-3_2-doc-3.2.12-1.32.1 References: http://support.novell.com/security/cve/CVE-2014-7818.html http://support.novell.com/security/cve/CVE-2014-7829.html https://bugzilla.suse.com/show_bug.cgi?id=903662 https://bugzilla.suse.com/show_bug.cgi?id=905727

1 0

openSUSE-SU-2014:1514-1: moderate: Security update for rubygem-sprockets
by opensuse-security＠opensuse.org 27 Nov '14

27 Nov '14

openSUSE Security Update: Security update for rubygem-sprockets ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1514-1 Rating: moderate References: #903658 Cross-References: CVE-2014-7819 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rubygem-sprockets was updated to fix one security issue. This security issue was fixed: - Arbitrary file existence disclosure (CVE-2014-7819). To enable this update rubygem-tilt-1_4 was added to openSUSE and installed with the update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-722 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rubygem-sprockets-2.12.1-2.4.1 rubygem-sprockets-doc-2.12.1-2.4.1 rubygem-tilt-1_4-1.4.1-2.1 rubygem-tilt-1_4-doc-1.4.1-2.1 rubygem-tilt-1_4-testsuite-1.4.1-2.1 References: http://support.novell.com/security/cve/CVE-2014-7819.html https://bugzilla.suse.com/show_bug.cgi?id=903658

1 0

openSUSE-SU-2014:1513-1: moderate: Security update for rubygem-sprockets
by opensuse-security＠opensuse.org 27 Nov '14

27 Nov '14

openSUSE Security Update: Security update for rubygem-sprockets ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1513-1 Rating: moderate References: #903658 Cross-References: CVE-2014-7819 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rubygem-sprockets was updated to fix one security issue. This security issue was fixed: - Arbitrary file existence disclosure (CVE-2014-7819). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-721 - openSUSE 12.3: zypper in -t patch openSUSE-2014-721 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): rubygem-sprockets-2.10.0-2.4.1 rubygem-sprockets-doc-2.10.0-2.4.1 - openSUSE 12.3 (i586 x86_64): rubygem-sprockets-2.8.2-2.4.1 rubygem-sprockets-doc-2.8.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-7819.html https://bugzilla.suse.com/show_bug.cgi?id=903658

1 0

openSUSE-RU-2014:1509-1: moderate: xfdesktop
by maintenance＠opensuse.org 27 Nov '14

27 Nov '14

openSUSE Recommended Update: xfdesktop ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1509-1 Rating: moderate References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for xfdesktop fixes the following issues: - fix the default application lookup with gio >= 2.41 (bxo#11306) - update to version 4.10.3 + fix for extra blank lines in backdrop list + remember the window size of the settings dialog + filter out changed events for special icons + lower update delay of icon size spinbutton + fix missing thumbnail on xfdesktop when thumbler fails to create it + check for thumbnails in the new location + don't set ESETROOT + speed up template sub-menu loading code + fix template sub-menu loading code for 4.10 + always move files from the trash + use the Path key of desktop files if a path is not set + fix for trash always showing empty on system startup + unselect the desktop icon after activating it + fix HTTP URL performance issue / wrong action proposed + decide on move/copy action before items have been dropped + translation updates Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-720 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xfdesktop-4.10.3-5.4.1 xfdesktop-debuginfo-4.10.3-5.4.1 xfdesktop-debugsource-4.10.3-5.4.1 - openSUSE 13.2 (noarch): xfdesktop-branding-upstream-4.10.3-5.4.1 xfdesktop-lang-4.10.3-5.4.1 References:

1 0

openSUSE-SU-2014:1508-1: critical: Security update for flashplayer to version 11.2.202.424
by opensuse-security＠opensuse.org 27 Nov '14

27 Nov '14

openSUSE Security Update: Security update for flashplayer to version 11.2.202.424 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1508-1 Rating: critical References: Cross-References: CVE-2014-8439 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Flash player was updated to latest version 11.2.202.424 which provide additional hardening against CVE-2014-8439. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2014-91 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.424-131.1 flash-player-gnome-11.2.202.424-131.1 flash-player-kde4-11.2.202.424-131.1 References: http://support.novell.com/security/cve/CVE-2014-8439.html

1 0

openSUSE-RU-2014:1506-1: icecast
by maintenance＠opensuse.org 26 Nov '14

26 Nov '14

openSUSE Recommended Update: icecast ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1506-1 Rating: low References: #905468 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for icecast fixes the following issues: - produce valid json status (boo#905468) - fix bashisms in pre script Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-718 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): icecast-2.4.0-2.4.1 icecast-debuginfo-2.4.0-2.4.1 icecast-debugsource-2.4.0-2.4.1 icecast-doc-2.4.0-2.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=905468

1 0

openSUSE-RU-2014:1505-1: git
by maintenance＠opensuse.org 26 Nov '14

26 Nov '14

openSUSE Recommended Update: git ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1505-1 Rating: low References: #905707 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended udpate for git fixes the following issue: - Allow snapshot generation in apparmor profile (bnc#905707) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-719 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): git-2.1.2-5.1 git-arch-2.1.2-5.1 git-core-2.1.2-5.1 git-core-debuginfo-2.1.2-5.1 git-cvs-2.1.2-5.1 git-daemon-2.1.2-5.1 git-daemon-debuginfo-2.1.2-5.1 git-debugsource-2.1.2-5.1 git-email-2.1.2-5.1 git-gui-2.1.2-5.1 git-svn-2.1.2-5.1 git-svn-debuginfo-2.1.2-5.1 git-web-2.1.2-5.1 gitk-2.1.2-5.1 - openSUSE 13.2 (noarch): git-doc-2.1.2-5.1 References: https://bugzilla.suse.com/show_bug.cgi?id=905707

1 0

openSUSE-SU-2014:1504-1: moderate: Security update for rubygem-sprockets-2_2
by opensuse-security＠opensuse.org 26 Nov '14

26 Nov '14

openSUSE Security Update: Security update for rubygem-sprockets-2_2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1504-1 Rating: moderate References: #903658 Cross-References: CVE-2014-7819 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rubygem-sprockets-2_2 was updated to fix one security issue. This security issue was fixed: - Arbitrary file existence disclosure (CVE-2014-7819). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-715 - openSUSE 13.1: zypper in -t patch openSUSE-2014-715 - openSUSE 12.3: zypper in -t patch openSUSE-2014-715 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): rubygem-sprockets-2_2-2.2.2-8.4.1 rubygem-sprockets-2_2-doc-2.2.2-8.4.1 - openSUSE 13.1 (i586 x86_64): rubygem-sprockets-2_2-2.2.2-5.4.1 rubygem-sprockets-2_2-doc-2.2.2-5.4.1 - openSUSE 12.3 (i586 x86_64): rubygem-sprockets-2_2-2.2.2-2.4.1 rubygem-sprockets-2_2-doc-2.2.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-7819.html https://bugzilla.suse.com/show_bug.cgi?id=903658

1 0

openSUSE-SU-2014:1503-1: moderate: update for wireshark
by opensuse-security＠opensuse.org 26 Nov '14

26 Nov '14

openSUSE Security Update: update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1503-1 Rating: moderate References: #905245 #905246 #905247 #905248 Cross-References: CVE-2014-8710 CVE-2014-8711 CVE-2014-8712 CVE-2014-8713 CVE-2014-8714 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: wireshark was updated to fix five security issues. These security issues were fixed: - SigComp UDVM buffer overflow (CVE-2014-8710). - AMQP crash (CVE-2014-8711). - NCP crashes (CVE-2014-8712, CVE-2014-8713). - TN5250 infinite loops (CVE-2014-8714). For openSUSE 12.3 and 13.1 further bug fixes and updated protocol support are described in: https://www.wireshark.org/docs/relnotes/wireshark-1.10.11.html For openSUSE 13.2 further bug fixes and updated protocol support are described in: https://www.wireshark.org/docs/relnotes/wireshark-1.12.2.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-717 - openSUSE 13.1: zypper in -t patch openSUSE-2014-717 - openSUSE 12.3: zypper in -t patch openSUSE-2014-717 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): wireshark-1.12.2-4.1 wireshark-debuginfo-1.12.2-4.1 wireshark-debugsource-1.12.2-4.1 wireshark-devel-1.12.2-4.1 wireshark-ui-gtk-1.12.2-4.1 wireshark-ui-gtk-debuginfo-1.12.2-4.1 wireshark-ui-qt-1.12.2-4.1 wireshark-ui-qt-debuginfo-1.12.2-4.1 - openSUSE 13.1 (i586 x86_64): wireshark-1.10.11-28.1 wireshark-debuginfo-1.10.11-28.1 wireshark-debugsource-1.10.11-28.1 wireshark-devel-1.10.11-28.1 - openSUSE 12.3 (i586 x86_64): wireshark-1.10.11-1.48.1 wireshark-debuginfo-1.10.11-1.48.1 wireshark-debugsource-1.10.11-1.48.1 wireshark-devel-1.10.11-1.48.1 References: http://support.novell.com/security/cve/CVE-2014-8710.html http://support.novell.com/security/cve/CVE-2014-8711.html http://support.novell.com/security/cve/CVE-2014-8712.html http://support.novell.com/security/cve/CVE-2014-8713.html http://support.novell.com/security/cve/CVE-2014-8714.html https://bugzilla.suse.com/show_bug.cgi?id=905245 https://bugzilla.suse.com/show_bug.cgi?id=905246 https://bugzilla.suse.com/show_bug.cgi?id=905247 https://bugzilla.suse.com/show_bug.cgi?id=905248

1 0