November 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:1376-1: moderate: update for pidgin
by opensuse-security＠opensuse.org 10 Nov '14

10 Nov '14

openSUSE Security Update: update for pidgin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1376-1 Rating: moderate References: #853038 #874606 #902408 #902409 #902410 #902495 Cross-References: CVE-2014-3694 CVE-2014-3695 CVE-2014-3696 CVE-2014-3697 CVE-2014-3698 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: The following issues were fixed in this update: + General: - Check the basic constraints extension when validating SSL/TLS certificates. This fixes a security hole that allowed a malicious man-in-the-middle to impersonate an IM server or any other https endpoint. This affected both the NSS and GnuTLS plugins (CVE-2014-3694, boo#902495). - Allow and prefer TLS 1.2 and 1.1 when using the NSS plugin for SSL (im#15909). + libpurple3 compatibility: - Encrypted account passwords are preserved until the new one is set. - Fix loading Google Talk and Facebook XMPP accounts. + Groupwise: Fix potential remote crash parsing server message that indicates that a large amount of memory should be allocated (CVE-2014-3696, boo#902410). + IRC: Fix a possible leak of unencrypted data when using /me command with OTR (im#15750). + MXit: Fix potential remote crash parsing a malformed emoticon response (CVE-2014-3695, boo#902409). + XMPP: - Fix potential information leak where a malicious XMPP server and possibly even a malicious remote user could create a carefully crafted XMPP message that causes libpurple to send an XMPP message containing arbitrary memory (CVE-2014-3698, boo#902408). + Yahoo: Fix login when using the GnuTLS library for TLS connections (im#16172, boo#874606). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-635 - openSUSE 12.3: zypper in -t patch openSUSE-2014-635 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): finch-2.10.10-4.22.1 finch-debuginfo-2.10.10-4.22.1 finch-devel-2.10.10-4.22.1 libpurple-2.10.10-4.22.1 libpurple-debuginfo-2.10.10-4.22.1 libpurple-devel-2.10.10-4.22.1 libpurple-meanwhile-2.10.10-4.22.1 libpurple-meanwhile-debuginfo-2.10.10-4.22.1 libpurple-tcl-2.10.10-4.22.1 libpurple-tcl-debuginfo-2.10.10-4.22.1 pidgin-2.10.10-4.22.1 pidgin-debuginfo-2.10.10-4.22.1 pidgin-debugsource-2.10.10-4.22.1 pidgin-devel-2.10.10-4.22.1 pidgin-otr-4.0.0-4.7.1 pidgin-otr-debuginfo-4.0.0-4.7.1 pidgin-otr-debugsource-4.0.0-4.7.1 - openSUSE 13.1 (noarch): libpurple-branding-openSUSE-13.1-2.17.1 libpurple-branding-upstream-2.10.10-4.22.1 libpurple-lang-2.10.10-4.22.1 - openSUSE 12.3 (i586 x86_64): finch-2.10.10-4.16.1 finch-debuginfo-2.10.10-4.16.1 finch-devel-2.10.10-4.16.1 libpurple-2.10.10-4.16.1 libpurple-debuginfo-2.10.10-4.16.1 libpurple-devel-2.10.10-4.16.1 libpurple-meanwhile-2.10.10-4.16.1 libpurple-meanwhile-debuginfo-2.10.10-4.16.1 libpurple-tcl-2.10.10-4.16.1 libpurple-tcl-debuginfo-2.10.10-4.16.1 pidgin-2.10.10-4.16.1 pidgin-debuginfo-2.10.10-4.16.1 pidgin-debugsource-2.10.10-4.16.1 pidgin-devel-2.10.10-4.16.1 pidgin-otr-4.0.0-2.11.1 pidgin-otr-debuginfo-4.0.0-2.11.1 pidgin-otr-debugsource-4.0.0-2.11.1 - openSUSE 12.3 (noarch): libpurple-branding-openSUSE-12.2-4.21.1 libpurple-branding-upstream-2.10.10-4.16.1 libpurple-lang-2.10.10-4.16.1 References: http://support.novell.com/security/cve/CVE-2014-3694.html http://support.novell.com/security/cve/CVE-2014-3695.html http://support.novell.com/security/cve/CVE-2014-3696.html http://support.novell.com/security/cve/CVE-2014-3697.html http://support.novell.com/security/cve/CVE-2014-3698.html https://bugzilla.suse.com/show_bug.cgi?id=853038 https://bugzilla.suse.com/show_bug.cgi?id=874606 https://bugzilla.suse.com/show_bug.cgi?id=902408 https://bugzilla.suse.com/show_bug.cgi?id=902409 https://bugzilla.suse.com/show_bug.cgi?id=902410 https://bugzilla.suse.com/show_bug.cgi?id=902495

1 0

openSUSE-RU-2014:1375-1: ktp-* Update to 0.9 Final
by maintenance＠opensuse.org 10 Nov '14

10 Nov '14

openSUSE Recommended Update: ktp-* Update to 0.9 Final ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1375-1 Rating: low References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issue with 11 ktp-Packages: - Update to 0.9 Final * Bugfixes since beta release, no upstream changelog Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-629 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ktp-accounts-kcm-0.9.0-4.1 ktp-accounts-kcm-debuginfo-0.9.0-4.1 ktp-accounts-kcm-debugsource-0.9.0-4.1 ktp-approver-0.9.0-2.1 ktp-approver-debuginfo-0.9.0-2.1 ktp-approver-debugsource-0.9.0-2.1 ktp-auth-handler-0.9.0-2.1 ktp-auth-handler-debuginfo-0.9.0-2.1 ktp-auth-handler-debugsource-0.9.0-2.1 ktp-common-internals-0.9.0-2.1 ktp-common-internals-debuginfo-0.9.0-2.1 ktp-common-internals-debugsource-0.9.0-2.1 ktp-common-internals-devel-0.9.0-2.1 ktp-contact-list-0.9.0-2.1 ktp-contact-list-debuginfo-0.9.0-2.1 ktp-contact-list-debugsource-0.9.0-2.1 ktp-contact-runner-0.9.0-2.1 ktp-contact-runner-debuginfo-0.9.0-2.1 ktp-contact-runner-debugsource-0.9.0-2.1 ktp-desktop-applets-0.9.0-2.1 ktp-desktop-applets-debuginfo-0.9.0-2.1 ktp-desktop-applets-debugsource-0.9.0-2.1 ktp-filetransfer-handler-0.9.0-2.1 ktp-filetransfer-handler-debuginfo-0.9.0-2.1 ktp-filetransfer-handler-debugsource-0.9.0-2.1 ktp-icons-0.9.0-2.1 ktp-kded-module-0.9.0-2.1 ktp-kded-module-debuginfo-0.9.0-2.1 ktp-kded-module-debugsource-0.9.0-2.1 ktp-kpeople-0.9.0-2.1 ktp-kpeople-debuginfo-0.9.0-2.1 ktp-send-file-0.9.0-2.1 ktp-send-file-debuginfo-0.9.0-2.1 ktp-send-file-debugsource-0.9.0-2.1 ktp-text-ui-0.9.0-2.1 ktp-text-ui-debuginfo-0.9.0-2.1 ktp-text-ui-debugsource-0.9.0-2.1 libktpaccountskcminternal4-0.9.0-4.1 libktpaccountskcminternal4-debuginfo-0.9.0-4.1 - openSUSE 13.2 (noarch): ktp-accounts-kcm-lang-0.9.0-4.1 ktp-approver-lang-0.9.0-2.1 ktp-auth-handler-lang-0.9.0-2.1 ktp-common-internals-lang-0.9.0-2.1 ktp-contact-list-lang-0.9.0-2.1 ktp-contact-runner-lang-0.9.0-2.1 ktp-desktop-applets-lang-0.9.0-2.1 ktp-filetransfer-handler-lang-0.9.0-2.1 ktp-kded-module-lang-0.9.0-2.1 ktp-send-file-lang-0.9.0-2.1 ktp-text-ui-lang-0.9.0-2.1 References:

1 0

openSUSE-RU-2014:1374-1: telnet: added patch that fixes generation of an infinite loop
by maintenance＠opensuse.org 10 Nov '14

10 Nov '14

openSUSE Recommended Update: telnet: added patch that fixes generation of an infinite loop ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1374-1 Rating: low References: #898481 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with telnet: -bnc#898481: added patch that fixes generating an infinite loop Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-627 - openSUSE 12.3: zypper in -t patch openSUSE-2014-627 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): telnet-1.2-164.4.1 telnet-debuginfo-1.2-164.4.1 telnet-debugsource-1.2-164.4.1 telnet-server-1.2-164.4.1 telnet-server-debuginfo-1.2-164.4.1 - openSUSE 12.3 (i586 x86_64): telnet-1.2-161.4.1 telnet-debuginfo-1.2-161.4.1 telnet-debugsource-1.2-161.4.1 telnet-server-1.2-161.4.1 telnet-server-debuginfo-1.2-161.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=898481

1 0

openSUSE-RU-2014:1373-1: moderate: aws-cli to 1.5.3
by maintenance＠opensuse.org 10 Nov '14

10 Nov '14

openSUSE Recommended Update: aws-cli to 1.5.3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1373-1 Rating: moderate References: #902598 #902648 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: The Amazon Web Services packages were updated to the version 1.5.3, fixing bugs, bringing features include the new amazon eu-central region. python-boto was updated to version 2.34.0 (bnc#902648) python-botocore was updated to version 0.67.0. and python-jmespath was updated to version 0.4.1. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-633 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): python-boto-doc-2.34.0-4.2 - openSUSE 13.2 (noarch): aws-cli-1.5.3-2.4.1 python-boto-2.34.0-4.1 python-botocore-0.67.0-2.4.1 python-jmespath-0.4.1-2.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=902598 https://bugzilla.suse.com/show_bug.cgi?id=902648

1 0

openSUSE-RU-2014:1372-1: moderate: update for telnet
by maintenance＠opensuse.org 10 Nov '14

10 Nov '14

openSUSE Recommended Update: update for telnet ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1372-1 Rating: moderate References: #898481 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This updates fixes and infinite loop possibility in telnet. (bnc#898481) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-628 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): telnet-1.2-166.4.1 telnet-debuginfo-1.2-166.4.1 telnet-debugsource-1.2-166.4.1 telnet-server-1.2-166.4.1 telnet-server-debuginfo-1.2-166.4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=898481

1 0

openSUSE-RU-2014:1371-1: virt-manager: Prepare online-update, dependencies were incomplete
by maintenance＠opensuse.org 10 Nov '14

10 Nov '14

openSUSE Recommended Update: virt-manager: Prepare online-update, dependencies were incomplete ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1371-1 Rating: low References: #901869 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with virt-manager: - boo#901869: Specify the requirement of Gtk 3.0 typelibs Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-630 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): virt-install-1.0.1-14.7.1 virt-manager-1.0.1-14.7.1 virt-manager-common-1.0.1-14.7.1 References: https://bugzilla.suse.com/show_bug.cgi?id=901869

1 0

openSUSE-RU-2014:1370-1: moderate: plasma-addons: disable impanel to allow working with ibus-ui-gtk3
by maintenance＠opensuse.org 10 Nov '14

10 Nov '14

openSUSE Recommended Update: plasma-addons: disable impanel to allow working with ibus-ui-gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1370-1 Rating: moderate References: #903556 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This plasma-addons fixes a problem with the ibus-ui-gtk3 interaction, by removing the impanel from the autostart list. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-631 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): plasma-addons-4.14.2-4.1 plasma-addons-akonadi-4.14.2-4.1 plasma-addons-akonadi-debuginfo-4.14.2-4.1 plasma-addons-debuginfo-4.14.2-4.1 plasma-addons-debugsource-4.14.2-4.1 plasma-addons-devel-4.14.2-4.1 plasma-addons-lancelot-4.14.2-4.1 plasma-addons-lancelot-debuginfo-4.14.2-4.1 plasma-addons-marble-4.14.2-4.1 plasma-addons-marble-debuginfo-4.14.2-4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=903556

1 0

openSUSE-RU-2014:1369-1: moderate: timezone: update to version 2014i
by maintenance＠opensuse.org 10 Nov '14

10 Nov '14

openSUSE Recommended Update: timezone: update to version 2014i ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1369-1 Rating: moderate References: #902276 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: timezone was updated to 2014i [bsc#902276]: * Pacific/Fiji will observe DST from 2014-11-02 02:00 to 2015-01-18 03:00. * A new Zone Pacific/Bougainville, for the part of Papua New Guinea that plans to switch from UTC+10 to UTC+11 on 2014-12-28 at 02:00. * Some changes in time zone abbreviations and affecting past time stamps. * Some fixes for minor bugs. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-632 - openSUSE 13.1: zypper in -t patch openSUSE-2014-632 - openSUSE 12.3: zypper in -t patch openSUSE-2014-632 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): timezone-2014i-4.1 timezone-debuginfo-2014i-4.1 timezone-debugsource-2014i-4.1 - openSUSE 13.2 (noarch): timezone-java-2014i-4.1 - openSUSE 13.1 (i586 x86_64): timezone-2014i-8.1 timezone-debuginfo-2014i-8.1 timezone-debugsource-2014i-8.1 - openSUSE 13.1 (noarch): timezone-java-2014i-8.1 - openSUSE 12.3 (i586 x86_64): timezone-2014i-2.41.1 timezone-debuginfo-2014i-2.41.1 timezone-debugsource-2014i-2.41.1 - openSUSE 12.3 (noarch): timezone-java-2014i-2.41.1 References: https://bugzilla.suse.com/show_bug.cgi?id=902276

1 0

openSUSE-RU-2014:1368-1: apache2-mod_nss: Added patch to compare CN and VS hostname
by maintenance＠opensuse.org 07 Nov '14

07 Nov '14

openSUSE Recommended Update: apache2-mod_nss: Added patch to compare CN and VS hostname ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1368-1 Rating: low References: #897712 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with apache2-mod_nss: -bnc#897712: added patch that compare CN and VS hostname (use NSS library). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-626 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-mod_nss-1.0.8-6.17.2 apache2-mod_nss-debuginfo-1.0.8-6.17.2 apache2-mod_nss-debugsource-1.0.8-6.17.2 References: https://bugzilla.suse.com/show_bug.cgi?id=897712

1 0

openSUSE-RU-2014:1363-1: system-config-printer: fixes crash when printing a traceback
by maintenance＠opensuse.org 06 Nov '14

06 Nov '14

openSUSE Recommended Update: system-config-printer: fixes crash when printing a traceback ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1363-1 Rating: low References: #902407 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with system-config-printer: - boo#902407: fixes crash when printing a traceback. As we disable openprinting, our status is always 403 and the noise of a traceback not welcome Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-624 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): system-config-printer-1.4.5-2.5.1 system-config-printer-debugsource-1.4.5-2.5.1 udev-configure-printer-1.4.5-2.5.1 udev-configure-printer-debuginfo-1.4.5-2.5.1 - openSUSE 13.2 (noarch): python-cupshelpers-1.4.5-2.5.1 system-config-printer-applet-1.4.5-2.5.1 system-config-printer-common-1.4.5-2.5.1 system-config-printer-common-lang-1.4.5-2.5.1 system-config-printer-dbus-service-1.4.5-2.5.1 References: https://bugzilla.suse.com/show_bug.cgi?id=902407

1 0