December 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:1644-1: moderate: Security update for jasper
by opensuse-security＠opensuse.org 15 Dec '14

15 Dec '14

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1644-1 Rating: moderate References: #906364 Cross-References: CVE-2014-9029 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: jasper was updated to fix one security issue. This security issue was fixed: - Heap overflows in libjasper (CVE-2014-9029). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-781 - openSUSE 13.1: zypper in -t patch openSUSE-2014-781 - openSUSE 12.3: zypper in -t patch openSUSE-2014-781 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): jasper-1.900.1-163.5.1 jasper-debuginfo-1.900.1-163.5.1 jasper-debugsource-1.900.1-163.5.1 libjasper-devel-1.900.1-163.5.1 libjasper1-1.900.1-163.5.1 libjasper1-debuginfo-1.900.1-163.5.1 - openSUSE 13.2 (x86_64): libjasper1-32bit-1.900.1-163.5.1 libjasper1-debuginfo-32bit-1.900.1-163.5.1 - openSUSE 13.1 (i586 x86_64): jasper-1.900.1-160.5.1 jasper-debuginfo-1.900.1-160.5.1 jasper-debugsource-1.900.1-160.5.1 libjasper-devel-1.900.1-160.5.1 libjasper1-1.900.1-160.5.1 libjasper1-debuginfo-1.900.1-160.5.1 - openSUSE 13.1 (x86_64): libjasper1-32bit-1.900.1-160.5.1 libjasper1-debuginfo-32bit-1.900.1-160.5.1 - openSUSE 12.3 (i586 x86_64): jasper-1.900.1-156.5.1 jasper-debuginfo-1.900.1-156.5.1 jasper-debugsource-1.900.1-156.5.1 libjasper-devel-1.900.1-156.5.1 libjasper1-1.900.1-156.5.1 libjasper1-debuginfo-1.900.1-156.5.1 - openSUSE 12.3 (x86_64): libjasper1-32bit-1.900.1-156.5.1 libjasper1-debuginfo-32bit-1.900.1-156.5.1 References: http://support.novell.com/security/cve/CVE-2014-9029.html https://bugzilla.suse.com/show_bug.cgi?id=906364

1 0

openSUSE-SU-2014:1643-1: moderate: Security update for cpio
by opensuse-security＠opensuse.org 15 Dec '14

15 Dec '14

openSUSE Security Update: Security update for cpio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1643-1 Rating: moderate References: #907456 Cross-References: CVE-2014-9112 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This cpio update fixes the following secuirty issue: - fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-771 - openSUSE 13.1: zypper in -t patch openSUSE-2014-771 - openSUSE 12.3: zypper in -t patch openSUSE-2014-771 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): cpio-2.11-29.5.1 cpio-debuginfo-2.11-29.5.1 cpio-debugsource-2.11-29.5.1 - openSUSE 13.2 (noarch): cpio-lang-2.11-29.5.1 - openSUSE 13.1 (i586 x86_64): cpio-2.11-25.4.1 cpio-debuginfo-2.11-25.4.1 cpio-debugsource-2.11-25.4.1 - openSUSE 13.1 (noarch): cpio-lang-2.11-25.4.1 - openSUSE 12.3 (i586 x86_64): cpio-2.11-21.4.1 cpio-debuginfo-2.11-21.4.1 cpio-debugsource-2.11-21.4.1 - openSUSE 12.3 (noarch): cpio-lang-2.11-21.4.1 References: http://support.novell.com/security/cve/CVE-2014-9112.html https://bugzilla.suse.com/show_bug.cgi?id=907456

1 0

openSUSE-SU-2014:1642-1: important: Server crash caused by malformed network packet.
by opensuse-security＠opensuse.org 15 Dec '14

15 Dec '14

openSUSE Security Update: Server crash caused by malformed network packet. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1642-1 Rating: important References: #908127 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Firebird server crashes when handling a malformed network packet. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-780 - openSUSE 13.1: zypper in -t patch openSUSE-2014-780 - openSUSE 12.3: zypper in -t patch openSUSE-2014-780 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): firebird-2.5.2.26539-14.4.1 firebird-classic-2.5.2.26539-14.4.1 firebird-classic-debuginfo-2.5.2.26539-14.4.1 firebird-classic-debugsource-2.5.2.26539-14.4.1 firebird-debuginfo-2.5.2.26539-14.4.1 firebird-debugsource-2.5.2.26539-14.4.1 firebird-devel-2.5.2.26539-14.4.1 firebird-superserver-2.5.2.26539-14.4.1 firebird-superserver-debuginfo-2.5.2.26539-14.4.1 libfbclient2-2.5.2.26539-14.4.1 libfbclient2-debuginfo-2.5.2.26539-14.4.1 libfbclient2-devel-2.5.2.26539-14.4.1 libfbembed-devel-2.5.2.26539-14.4.1 libfbembed2_5-2.5.2.26539-14.4.1 libfbembed2_5-debuginfo-2.5.2.26539-14.4.1 - openSUSE 13.2 (x86_64): firebird-32bit-2.5.2.26539-14.4.1 firebird-debuginfo-32bit-2.5.2.26539-14.4.1 libfbclient2-32bit-2.5.2.26539-14.4.1 libfbclient2-debuginfo-32bit-2.5.2.26539-14.4.1 - openSUSE 13.2 (noarch): firebird-doc-2.5.2.26539-14.4.1 - openSUSE 13.1 (i586 x86_64): firebird-2.5.2.26539-8.4.1 firebird-classic-2.5.2.26539-8.4.1 firebird-classic-debuginfo-2.5.2.26539-8.4.1 firebird-classic-debugsource-2.5.2.26539-8.4.1 firebird-debuginfo-2.5.2.26539-8.4.1 firebird-debugsource-2.5.2.26539-8.4.1 firebird-devel-2.5.2.26539-8.4.1 firebird-superserver-2.5.2.26539-8.4.1 firebird-superserver-debuginfo-2.5.2.26539-8.4.1 libfbclient2-2.5.2.26539-8.4.1 libfbclient2-debuginfo-2.5.2.26539-8.4.1 libfbclient2-devel-2.5.2.26539-8.4.1 libfbembed-devel-2.5.2.26539-8.4.1 libfbembed2_5-2.5.2.26539-8.4.1 libfbembed2_5-debuginfo-2.5.2.26539-8.4.1 - openSUSE 13.1 (x86_64): firebird-32bit-2.5.2.26539-8.4.1 firebird-debuginfo-32bit-2.5.2.26539-8.4.1 libfbclient2-32bit-2.5.2.26539-8.4.1 libfbclient2-debuginfo-32bit-2.5.2.26539-8.4.1 - openSUSE 13.1 (noarch): firebird-doc-2.5.2.26539-8.4.1 - openSUSE 12.3 (i586 x86_64): firebird-2.5.2.26539-2.9.1 firebird-classic-2.5.2.26539-2.9.1 firebird-classic-debuginfo-2.5.2.26539-2.9.1 firebird-classic-debugsource-2.5.2.26539-2.9.1 firebird-debuginfo-2.5.2.26539-2.9.1 firebird-debugsource-2.5.2.26539-2.9.1 firebird-devel-2.5.2.26539-2.9.1 firebird-superserver-2.5.2.26539-2.9.1 firebird-superserver-debuginfo-2.5.2.26539-2.9.1 libfbclient2-2.5.2.26539-2.9.1 libfbclient2-debuginfo-2.5.2.26539-2.9.1 libfbclient2-devel-2.5.2.26539-2.9.1 libfbembed-devel-2.5.2.26539-2.9.1 libfbembed2_5-2.5.2.26539-2.9.1 libfbembed2_5-debuginfo-2.5.2.26539-2.9.1 - openSUSE 12.3 (x86_64): firebird-32bit-2.5.2.26539-2.9.1 firebird-debuginfo-32bit-2.5.2.26539-2.9.1 libfbclient2-32bit-2.5.2.26539-2.9.1 libfbclient2-debuginfo-32bit-2.5.2.26539-2.9.1 - openSUSE 12.3 (noarch): firebird-doc-2.5.2.26539-2.9.1 References: https://bugzilla.suse.com/show_bug.cgi?id=908127

1 0

openSUSE-RU-2014:1641-1: tigervnc
by maintenance＠opensuse.org 15 Dec '14

15 Dec '14

openSUSE Recommended Update: tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1641-1 Rating: low References: #901752 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for tigervnc fixes the following issues: - bnc#901752: Added several patches to add support for view only passwords. (bnc#901752) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-782 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tigervnc-1.3.1-6.14.1 tigervnc-debuginfo-1.3.1-6.14.1 tigervnc-debugsource-1.3.1-6.14.1 xorg-x11-Xvnc-1.3.1-6.14.1 xorg-x11-Xvnc-debuginfo-1.3.1-6.14.1 References: https://bugzilla.suse.com/show_bug.cgi?id=901752

1 0

openSUSE-RU-2014:1640-1: moderate: Recommended update for privoxy
by maintenance＠opensuse.org 15 Dec '14

15 Dec '14

openSUSE Recommended Update: Recommended update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1640-1 Rating: moderate References: #849923 #852941 #862339 #878788 #907675 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This privoxy update fixes the following security and non security issues: - Privoxy 3.0.22 [boo#907675] - Bug fixes: - Fixed a memory leak when rejecting client connections - Fixed an immediate-use-after-free bug and two additional unconfirmed use-after-free complaints - Actually show the FORCE_PREFIX value on the show-status page. - Properly deal with Keep-Alive headers with timeout= parameters - Not using any filter files no longer results in warning messages unless an action file is referencing header taggers or filters. - Fixed a bug that prevented Privoxy from reusing some reusable connections. - General improvements: - Introduced NO-REQUEST-TAG and NO-RESPONSE-TAG. - Add support for the 'PATCH' method as defined in RFC5789. - Reject requests with unsupported Expect header values. - Normalize the HTTP-version in forwarded requests and responses. - Server 'Keep-Alive' headers are no longer forwarded. - Change declared template file encoding to UTF-8. - Do not pass rejected keep-alive timeouts to the server. - CGI templates no longer enforce new windows for some links. - Documentation improvements - Build system improvements - Action file improvements: - The pattern 'promotions.' is no longer being blocked. - Various updated filter rules and exceptions. - Filter file improvements & bug fixes: - Decrease the chances that js-annoyances creates invalid JavaScript. - Let the msn filter hide 'related' ads again. - Prevent img-reorder from messing up img tags with empty src attributes. - add source URL - fix self-obsoletion - clean up spec file - fix bashisms in pre script - added config file for SuSEfirewall2 - update logrotate config file after switch to systemd (bnc#878788) - added "reload" capability which was lost during switch from sysvinit to systemd - privoxy-3.0.16-networkmanager.systemd.patch: update Networkmanager dispatcher to reload config of privoxy with systemd (bnc#862339) - Add proper sysv to service migration - Readd rc link - Remove reference to nonexisting dns6 nss module (bnc#849923) - Fixed unsuccessful start of privoxy with systemd: - Privoxy isn't chrooted properly, added option --chroot to privoxy.service (see bnc#849923) - After fixing bnc#849923 there is no DNS resolution due to missing population of chroot env, added ExecStartPre commands to privoxy.service (see bnc#852941) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-777 - openSUSE 13.1: zypper in -t patch openSUSE-2014-777 - openSUSE 12.3: zypper in -t patch openSUSE-2014-777 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): privoxy-3.0.22-8.4.1 privoxy-debuginfo-3.0.22-8.4.1 privoxy-debugsource-3.0.22-8.4.1 privoxy-doc-3.0.22-8.4.1 - openSUSE 13.1 (i586 x86_64): privoxy-3.0.22-2.16.1 privoxy-debuginfo-3.0.22-2.16.1 privoxy-debugsource-3.0.22-2.16.1 privoxy-doc-3.0.22-2.16.1 - openSUSE 12.3 (i586 x86_64): privoxy-3.0.22-2.8.1 privoxy-debuginfo-3.0.22-2.8.1 privoxy-debugsource-3.0.22-2.8.1 privoxy-doc-3.0.22-2.8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=849923 https://bugzilla.suse.com/show_bug.cgi?id=852941 https://bugzilla.suse.com/show_bug.cgi?id=862339 https://bugzilla.suse.com/show_bug.cgi?id=878788 https://bugzilla.suse.com/show_bug.cgi?id=907675

1 0

openSUSE-SU-2014:1639-1: moderate: Security update for perl-Plack
by opensuse-security＠opensuse.org 15 Dec '14

15 Dec '14

openSUSE Security Update: Security update for perl-Plack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1639-1 Rating: moderate References: #892328 Cross-References: CVE-2014-5269 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This perl-Plack update fixes the following security issue: - bnc#892328: trailing slashes removed leading to source code disclosure (CVE-2014-5269) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-775 - openSUSE 13.1: zypper in -t patch openSUSE-2014-775 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): perl-Plack-1.0031-4.1 - openSUSE 13.1 (noarch): perl-Plack-1.0028-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-5269.html https://bugzilla.suse.com/show_bug.cgi?id=892328

1 0

openSUSE-SU-2014:1638-1: moderate: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 15 Dec '14

15 Dec '14

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1638-1 Rating: moderate References: #887530 Cross-References: CVE-2013-6629 CVE-2013-6954 CVE-2014-0429 CVE-2014-0446 CVE-2014-0451 CVE-2014-0452 CVE-2014-0453 CVE-2014-0454 CVE-2014-0455 CVE-2014-0456 CVE-2014-0457 CVE-2014-0458 CVE-2014-0459 CVE-2014-0460 CVE-2014-0461 CVE-2014-1876 CVE-2014-2397 CVE-2014-2398 CVE-2014-2402 CVE-2014-2403 CVE-2014-2412 CVE-2014-2413 CVE-2014-2414 CVE-2014-2421 CVE-2014-2423 CVE-2014-2427 CVE-2014-2483 CVE-2014-2490 CVE-2014-4209 CVE-2014-4216 CVE-2014-4218 CVE-2014-4219 CVE-2014-4221 CVE-2014-4223 CVE-2014-4244 CVE-2014-4252 CVE-2014-4262 CVE-2014-4263 CVE-2014-4264 CVE-2014-4266 CVE-2014-4268 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 41 vulnerabilities is now available. Description: This openjdk update fixes the following security and non security issues: - Upgrade to 2.4.8 (bnc#887530) * Changed back from gzipped tarball to xz * Changed the keyring file to add Andrew John Hughes that signed the icedtea package * Change ZERO to AARCH64 tarball - Removed patches: * gstackbounds.patch * java-1.7.0-openjdk-ppc-zero-jdk.patch * java-1.7.0-openjdk-ppc-zero-hotspot.patch - Integrated in upstream icedtea * java-1.7.0-openjdk-makefiles-zero.patch - Does not apply on the AARCH64 tarball, since the change from DEFAULT and ZERO tarball to DEFAULT and AARCH64 - Upstream changes since 2.4.4: * Security fixes - S8029755, CVE-2014-4209: Enhance subject class - S8030763: Validate global memory allocation - S8031340, CVE-2014-4264: Better TLS/EC management - S8031346, CVE-2014-4244: Enhance RSA key handling - S8031540: Introduce document horizon - S8032536: JVM resolves wrong method in some unusual cases - S8033055: Issues in 2d - S8033301, CVE-2014-4266: Build more informative InfoBuilder - S8034267: Probabilistic native crash - S8034272: Do not cram data into CRAM arrays - S8034985, CVE-2014-2483: Better form for Lambda Forms - S8035004, CVE-2014-4252: Provider provides less service - S8035009, CVE-2014-4218: Make Proxy representations consistent - S8035119, CVE-2014-4219: Fix exceptions to bytecode verification - S8035699, CVE-2014-4268: File choosers should be choosier - S8035788. CVE-2014-4221: Provide more consistency for lookups - S8035793, CVE-2014-4223: Maximum arity maxed out - S8036571: (process) Process process arguments carefully - S8036800: Attribute OOM to correct part of code - S8037046: Validate libraries to be loaded - S8037076, CVE-2014-2490: Check constant pool constants - S8037157: Verify <init> call - S8037162, CVE-2014-4263: More robust DH exchanges - S8037167, CVE-2014-4216: Better method signature resolution - S8039520, CVE-2014-4262: More atomicity of atomic updates - S8023046: Enhance splashscreen support - S8025005: Enhance CORBA initializations - S8025010, CVE-2014-2412: Enhance AWT contexts - S8025030, CVE-2014-2414: Enhance stream handling - S8025152, CVE-2014-0458: Enhance activation set up - S8026067: Enhance signed jar verification - S8026163, CVE-2014-2427: Enhance media provisioning - S8026188, CVE-2014-2423: Enhance envelope factory - S8026200: Enhance RowSet Factory - S8026716, CVE-2014-2402: (aio) Enhance asynchronous channel handling - S8026736, CVE-2014-2398: Enhance Javadoc pages - S8026797, CVE-2014-0451: Enhance data transfers - S8026801, CVE-2014-0452: Enhance endpoint addressing - S8027766, CVE-2014-0453: Enhance RSA processing - S8027775: Enhance ICU code. - S8027841, CVE-2014-0429: Enhance pixel manipulations - S8028385: Enhance RowSet Factory - S8029282, CVE-2014-2403: Enhance CharInfo set up - S8029286: Enhance subject delegation - S8029699: Update Poller demo - S8029730: Improve audio device additions - S8029735: Enhance service mgmt natives - S8029740, CVE-2014-0446: Enhance handling of loggers - S8029745, CVE-2014-0454: Enhance algorithm checking - S8029750: Enhance LCMS color processing (in-tree LCMS) - S8029760, CVE-2013-6629: Enhance AWT image libraries (in-tree libjpeg) - S8029844, CVE-2014-0455: Enhance argument validation - S8029854, CVE-2014-2421: Enhance JPEG decodings - S8029858, CVE-2014-0456: Enhance array copies - S8030731, CVE-2014-0460: Improve name service robustness - S8031330: Refactor ObjectFactory - S8031335, CVE-2014-0459: Better color profiling (in-tree LCMS) - S8031352, CVE-2013-6954: Enhance PNG handling (in-tree libpng) - S8031394, CVE-2014-0457: (sl) Fix exception handling in ServiceLoader - S8031395: Enhance LDAP processing - S8032686, CVE-2014-2413: Issues with method invoke - S8033618, CVE-2014-1876: Correct logging output - S8034926, CVE-2014-2397: Attribute classes properly - S8036794, CVE-2014-0461: Manage JavaScript instances * Backports - S5049299: (process) Use posix_spawn, not fork, on S10 to avoid swap exhaustion - S6571600: JNI use results in UnsatisfiedLinkError looking for libmawt.so - S7131153: GetDC called way too many times - causes bad performance. - S7190349: [macosx] Text (Label) is incorrectly drawn with a rotated g2d - S8001108: an attempt to use "<init>" as a method name should elicit NoSuchMethodException - S8001109: arity mismatch on a call to spreader method handle should elicit IllegalArgumentException - S8008118: (process) Possible null pointer dereference in jdk/src/solaris/native/java/lang/UNIXProcess_md.c - S8013611: Modal dialog fails to obtain keyboard focus - S8013809: deadlock in SSLSocketImpl between between write and close - S8013836: getFirstDayOfWeek reports wrong day for pt-BR locale - S8014460: Need to check for non-empty EXT_LIBS_PATH before using it - S8019853: Break logging and AWT circular dependency - S8019990: IM candidate window appears on the South-East corner of the display. - S8020191: System.getProperty("os.name") returns "Windows NT (unknown)" on Windows 8.1 - S8022452: Hotspot needs to know about Windows 8.1 and Windows Server 2012 R2 - S8023990: Regression: postscript size increase from 6u18 - S8024283: 10 nashorn tests fail with similar stack trace InternalError with cause being NoClassDefFoundError - S8024616: JSR292: lazily initialize core NamedFunctions used for bootstrapping - S8024648: 7141246 & 8016131 break Zero port (AArch64 only) - S8024830: SEGV in org.apache.lucene.codecs.compressing.CompressingTermVectorsReader.get - S8025588: [macosx] Frozen AppKit thread in 7u40 - S8026404: Logging in Applet can trigger ACE: access denied ("java.lang.RuntimePermission" "modifyThreadGroup") - S8026705: [TEST_BUG] java/beans/Introspector/TestTypeResolver.java failed - S8027196: Increment minor version of HSx for 7u55 and initialize the build number - S8027212: java/nio/channels/Selector/SelectAfterRead.java fails intermittently - S8028285: RMI Thread can no longer call out to AWT - S8029177: [Parfait] warnings from b117 for jdk.src.share.native.com.sun.java.util.jar: JNI exception pending - S8030655: Regression: 14_01 Security fix 8024306 causes test failures - S8030813: Signed applet fails to load when CRLs are stored in an LDAP directory - S8030822: (tz) Support tzdata2013i - S8031050: (thread) Change Thread initialization so that thread name is set before invoking SecurityManager - S8031075: [Regression] focus disappears with shift+tab on dialog having one focus component - S8031462: Fonts with morx tables are broken with latest ICU fixes - S8032585: JSR292: IllegalAccessError when attempting to invoke protected method from different package - S8032740: Need to create SE Embedded Source Bundles in 7 Release - S8033278: Missed access checks for Lookup.unreflect* after 8032585 - S8034772: JDK-8028795 brought a specification change to 7u55 release and caused JCK7 signature test failure - S8035283: Second phase of branch shortening doesn't account for loop alignment - S8035613: With active Securitymanager JAXBContext.newInstance fails - S8035618: Four api/org_omg/CORBA TCK tests fail under plugin only - S8036147: Increment hsx 24.55 build to b02 for 7u55-b11 - S8036786: Update jdk7 testlibrary to match jdk8 - S8036837: Increment hsx 24.55 build to b03 for 7u55-b12 - S8037012: (tz) Support tzdata2014a - S8038306: (tz) Support tzdata2014b - S8038392: Generating prelink cache breaks JAVA 'jinfo' utility normal behavior - S8042264: 7u65 l10n resource file translation update 1 - S8042582: Test java/awt/KeyboardFocusmanager/ChangeKFMTest/ChangeKFMTest.html fails on Windows x64 - S8042590: Running form URL throws NPE - S8042789: org.omg.CORBA.ORBSingletonClass loading no longer uses context class loader - S8043012: (tz) Support tzdata2014c - S8004145: New improved hgforest.sh, ctrl-c now properly terminates mercurial processes. - S8007625: race with nested repos in /common/bin/hgforest.sh - S8011178: improve common/bin/hgforest.sh python detection (MacOS) - S8011342: hgforest.sh : 'python --version' not supported on older python - S8011350: hgforest.sh uses non-POSIX sh features that may fail with some shells - S8024200: handle hg wrapper with space after #! - S8025796: hgforest.sh could trigger unbuffered output from hg without complicated machinations - S8028388: 9 jaxws tests failed in nightly build with java.lang.ClassCastException - S8031477: [macosx] Loading AWT native library fails - S8032370: No "Truncated file" warning from IIOReadWarningListener on JPEGImageReader - S8035834: InetAddress.getLocalHost() can hang after JDK-8030731 was fixed - S8009062: poor performance of JNI AttachCurrentThread after fix for 7017193 - S8035893: JVM_GetVersionInfo fails to zero structure - Re-enable the 'gamma' test at the end of the HotSpot build, but only for HotSpot based bootstrap JDKs. - S8015976: OpenJDK part of bug JDK-8015812 [TEST_BUG] Tests have conflicting test descriptions - S8022698: javax/script/GetInterfaceTest.java fails since 7u45 b04 with -agentvm option - S8022868: missing codepage Cp290 at java runtime - S8023310: Thread contention in the method Beans.IsDesignTime() - S8024461: [macosx] Java crashed on mac10.9 for swing and 2d function manual test - S8025679: Increment minor version of HSx for 7u51 and initialize the build number - S8026037: [TESTBUG] sun/security/tools/jarsigner/warnings.sh test fails on Solaris - S8026304: jarsigner output bad grammar - S8026772: test/sun/util/resources/TimeZone/Bug6317929.java failing - S8026887: Make issues due to failed large pages allocations easier to debug - S8027204: Revise the update of 8026204 and 8025758 - S8027224: test regression - ClassNotFoundException - S8027370: Support tzdata2013h - S8027378: Two closed/javax/xml/8005432 fails with jdk7u51b04 - S8027787: 7u51 l10n resource file translation update 1 - S8027837: JDK-8021257 causes CORBA build failure on emdedded platforms - S8027943: serial version of com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl changed in 7u45 - S8027944: Increment hsx 24.51 build to b02 for 7u51-b07 - S8028057: Modify jarsigner man page documentation to document CCC 8024302: Clarify jar verifications - S8028090: reverting change - changeset pushed with incorrect commit message, linked to wrong issue - S8028111: XML readers share the same entity expansion counter - S8028215: ORB.init fails with SecurityException if properties select the JDK default ORB - S8028293: Check local configuration for actual ephemeral port range - S8028382: Two javax/xml/8005433 tests still fail after the fix JDK-8028147 - S8028453: AsynchronousSocketChannel.connect() requires SocketPermission due to bind to local address (win) - S8028823: java/net/Makefile tabs converted to spaces - S8029038: Revise fix for XML readers share the same entity expansion counter - S8029842: Increment hsx 24.51 build to b03 for 7u51-b11 * Bug fixes - Fix accidental reversion of PR1188 for armel - PR1781: NSS PKCS11 provider fails to handle multipart AES encryption - PR1830: Drop version requirement for LCMS 2 - PR1833, RH1022017: Report elliptic curves supported by NSS, not the SunEC library - RH905128: [CRASH] OpenJDK-1.7.0 while using NSS security provider and kerberos - PR1393: JPEG support in build is broken on non-system-libjpeg builds - PR1726: configure fails looking for ecj.jar before even trying to find javac - Red Hat local: Fix for repo with path statting with / . - Remove unused hgforest script - PR1101: Undefined symbols on GNU/Linux SPARC - PR1659: OpenJDK 7 returns incorrect TrueType font metrics when bold style is set - PR1677, G498288: Update PaX support to detect running PaX kernel and use newer tools - PR1679: Allow OpenJDK to build on PaX-enabled kernels - PR1684: Build fails with empty PAX_COMMAND - RH1015432: java-1.7.0-openjdk: Fails on PPC with StackOverflowError (revised fix) - Link against $(LIBDL) if SYSTEM_CUPS is not true - Perform configure checks using ecj.jar when --with-gcj (native ecj build) is enabled. - Fix broken bootstrap build by updating ecj-multicatch.patch - PR1653: Support ppc64le via Zero - PR1654: ppc32 needs a larger ThreadStackSize to build - RH1015432: java-1.7.0-openjdk: Fails on PPC with StackOverflowError - RH910107: fail to load PC/SC library * ARM32 port - Add arm_port from IcedTea 6 - Add patches/arm.patch from IcedTea 6 - Add patches/arm-debug.patch from IcedTea 6 - Add patches/arm-hsdis.patch from IcedTea 6 - added jvmti event generation for dynamic_generate and compiled_method_load events to ARM JIT compiler - Adjust saved SP when safepointing. - First cut of invokedynamic - Fix trashed thread ptr after recursive re-entry from asm JIT. - JIT-compilation of ldc methodHandle - Rename a bunch of misleadingly-named functions - Changes for HSX22 - Rename a bunch of misleadingly-named functions - Patched method handle adapter code to deal with failures in TCK - Phase 1 - Phase 2 - RTC Thumb2 JIT enhancements. - Zero fails to build in hsx22+, fix for hsx22 after runs gamma OK, hsx23 still nogo. - Use ldrexd for atomic reads on ARMv7. - Use unified syntax for thumb code. - Corrected call from fast_method_handle_entry to CppInterpreter::method_handle_entry so that thread is loaded into r2 - Don't save locals at a return. - Fix call to handle_special_method(). Fix compareAndSwapLong. - Fix JIT bug that miscompiles org.eclipse.ui.internal.contexts.ContextAuthority.sourceChanged - invokedynamic and aldc for JIT - Modified safepoint check to rely on memory protect signal instead of polling - Minor review cleanups. - PR1188: ASM Interpreter and Thumb2 JIT javac miscompile modulo reminder on armel - PR1363: Fedora 19 / rawhide FTBFS SIGILL - Changes for HSX23 - Remove fragment from method that has been removed - Remove C++ flags from CC_COMPILE and fix usage in zeroshark.make. - Use $(CC) to compile mkbc instead of $(CC_COMPILE) to avoid C++-only flags - Add note about use of $(CFLAGS)/$(CXXFLAGS)/$(CPPFLAGS) at present. - Override automatic detection of source language for bytecodes_arm.def - Include $(CFLAGS) in assembler stage - PR1626: ARM32 assembler update for hsx24. Use ARM32JIT to turn it on/off. - Replace literal offsets for METHOD_SIZEOFPARAMETERS and ISTATE_NEXT_FRAME with correct symbolic names. - Turn ARM32 JIT on by default * AArch64 port - AArch64 C2 instruct for smull - Add a constructor as a conversion from Register - RegSet. Use it. - Add RegSet::operator+=. - Add support for a few simple intrinsics - Add support for builtin crc32 instructions - Add support for CRC32 intrinsic - Add support for Neon implementation of CRC32 - All address constants are 48 bits in size. - C1: Fix offset overflow when profiling. - Common frame handling for C1/C2 which correctly handle all frame sizes - Correct costs for operations with shifts. - Correct OptoAssembly for prologs and epilogs. - Delete useless instruction. - Don't use any form of _call_VM_leaf when we're calling a stub. - Fast string comparison - Fast String.equals() - Fix a tonne of bogus comments. - Fix biased locking and enable as default - Fix instruction size from 8 to 4 - Fix opto assembly for shifts. - Fix register misuse in verify_method_data_pointer - Fix register usage in generate_verify_oop(). - Implement various locked memory operations. - Improve C1 performance improvements in ic_cache checks - Improve code generation for pop(), as suggested by Edward Nevill. - Improvements to safepoint polling - Make code entry alignment 64 for C2 - Minor optimisation for divide by 2 - New cost model for instruction selection. - Offsets in lookupswitch instructions should be signed. - Optimise addressing of card table byte map base - Optimise C2 entry point verification - Optimise long divide by 2 - Performance improvement and ease of use changes pulled from upstream - Preserve callee save FP registers around call to java code - Remove obsolete C1 patching code. - Remove special-case handling of division arguments. AArch64 doesn't need it. - Remove unnecessary memory barriers around CAS operations - Restore sp from sender sp, r13 in crc32 code - Restrict default ReservedCodeCacheSize to 128M - Rewrite CAS operations to be more conservative - Save intermediate state before removing C1 patching code. - Tidy up register usage in push/pop instructions. - Tidy up stack frame handling. - Use 2- and 3-instruction immediate form of movoop and mov_metadata in C2-generated code. - Use an explicit set of registers rather than a bitmap for psh and pop operations. - Use explicit barrier instructions in C1. - Use gcc __clear_cache instead of doing it ourselves - PR1713: Support AArch64 Port * Shark - Add Shark definitions from 8003868 - Drop compile_method argument removed in 7083786 from sharkCompiler.cpp Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-773 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.55-24.17.1 java-1_7_0-openjdk-accessibility-1.7.0.55-24.17.1 java-1_7_0-openjdk-debuginfo-1.7.0.55-24.17.1 java-1_7_0-openjdk-debugsource-1.7.0.55-24.17.1 java-1_7_0-openjdk-demo-1.7.0.55-24.17.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.55-24.17.1 java-1_7_0-openjdk-devel-1.7.0.55-24.17.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.55-24.17.1 java-1_7_0-openjdk-headless-1.7.0.55-24.17.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.55-24.17.1 java-1_7_0-openjdk-javadoc-1.7.0.55-24.17.1 java-1_7_0-openjdk-src-1.7.0.55-24.17.1 References: http://support.novell.com/security/cve/CVE-2013-6629.html http://support.novell.com/security/cve/CVE-2013-6954.html http://support.novell.com/security/cve/CVE-2014-0429.html http://support.novell.com/security/cve/CVE-2014-0446.html http://support.novell.com/security/cve/CVE-2014-0451.html http://support.novell.com/security/cve/CVE-2014-0452.html http://support.novell.com/security/cve/CVE-2014-0453.html http://support.novell.com/security/cve/CVE-2014-0454.html http://support.novell.com/security/cve/CVE-2014-0455.html http://support.novell.com/security/cve/CVE-2014-0456.html http://support.novell.com/security/cve/CVE-2014-0457.html http://support.novell.com/security/cve/CVE-2014-0458.html http://support.novell.com/security/cve/CVE-2014-0459.html http://support.novell.com/security/cve/CVE-2014-0460.html http://support.novell.com/security/cve/CVE-2014-0461.html http://support.novell.com/security/cve/CVE-2014-1876.html http://support.novell.com/security/cve/CVE-2014-2397.html http://support.novell.com/security/cve/CVE-2014-2398.html http://support.novell.com/security/cve/CVE-2014-2402.html http://support.novell.com/security/cve/CVE-2014-2403.html http://support.novell.com/security/cve/CVE-2014-2412.html http://support.novell.com/security/cve/CVE-2014-2413.html http://support.novell.com/security/cve/CVE-2014-2414.html http://support.novell.com/security/cve/CVE-2014-2421.html http://support.novell.com/security/cve/CVE-2014-2423.html http://support.novell.com/security/cve/CVE-2014-2427.html http://support.novell.com/security/cve/CVE-2014-2483.html http://support.novell.com/security/cve/CVE-2014-2490.html http://support.novell.com/security/cve/CVE-2014-4209.html http://support.novell.com/security/cve/CVE-2014-4216.html http://support.novell.com/security/cve/CVE-2014-4218.html http://support.novell.com/security/cve/CVE-2014-4219.html http://support.novell.com/security/cve/CVE-2014-4221.html http://support.novell.com/security/cve/CVE-2014-4223.html http://support.novell.com/security/cve/CVE-2014-4244.html http://support.novell.com/security/cve/CVE-2014-4252.html http://support.novell.com/security/cve/CVE-2014-4262.html http://support.novell.com/security/cve/CVE-2014-4263.html http://support.novell.com/security/cve/CVE-2014-4264.html http://support.novell.com/security/cve/CVE-2014-4266.html http://support.novell.com/security/cve/CVE-2014-4268.html https://bugzilla.suse.com/show_bug.cgi?id=887530

1 0

openSUSE-SU-2014:1637-1: moderate: Security update for libjpeg-turbo, libjpeg62-turbo
by opensuse-security＠opensuse.org 15 Dec '14

15 Dec '14

openSUSE Security Update: Security update for libjpeg-turbo, libjpeg62-turbo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1637-1 Rating: moderate References: #771791 #807183 #906761 Cross-References: CVE-2014-9092 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This libjpeg update fixes several security and non security issues: - bnc#906761: Passing special crafted jpeg file smashes stack (CVE-2014-9092) - bnc#771791: Fixed heap overflow Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-774 - openSUSE 13.1: zypper in -t patch openSUSE-2014-774 - openSUSE 12.3: zypper in -t patch openSUSE-2014-774 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libjpeg-turbo-1.3.1-30.5.1 libjpeg-turbo-debuginfo-1.3.1-30.5.1 libjpeg-turbo-debugsource-1.3.1-30.5.1 libjpeg62-62.1.0-30.5.1 libjpeg62-debuginfo-62.1.0-30.5.1 libjpeg62-devel-62.1.0-30.5.1 libjpeg62-turbo-1.3.1-30.5.1 libjpeg62-turbo-debugsource-1.3.1-30.5.1 libjpeg8-8.0.2-30.5.1 libjpeg8-debuginfo-8.0.2-30.5.1 libjpeg8-devel-8.0.2-30.5.1 libturbojpeg0-8.0.2-30.5.1 libturbojpeg0-debuginfo-8.0.2-30.5.1 - openSUSE 13.2 (x86_64): libjpeg62-32bit-62.1.0-30.5.1 libjpeg62-debuginfo-32bit-62.1.0-30.5.1 libjpeg62-devel-32bit-62.1.0-30.5.1 libjpeg8-32bit-8.0.2-30.5.1 libjpeg8-debuginfo-32bit-8.0.2-30.5.1 libjpeg8-devel-32bit-8.0.2-30.5.1 libturbojpeg0-32bit-8.0.2-30.5.1 libturbojpeg0-debuginfo-32bit-8.0.2-30.5.1 - openSUSE 13.1 (i586 x86_64): libjpeg-turbo-1.2.1-24.4.1 libjpeg-turbo-debuginfo-1.2.1-24.4.1 libjpeg-turbo-debugsource-1.2.1-24.4.1 libjpeg62-62.0.0-24.4.1 libjpeg62-debuginfo-62.0.0-24.4.1 libjpeg62-devel-62.0.0-24.4.1 libjpeg62-turbo-1.2.1-24.4.1 libjpeg62-turbo-debugsource-1.2.1-24.4.1 libjpeg8-8.0.2-24.4.1 libjpeg8-debuginfo-8.0.2-24.4.1 libjpeg8-devel-8.0.2-24.4.1 - openSUSE 13.1 (x86_64): libjpeg62-32bit-62.0.0-24.4.1 libjpeg62-debuginfo-32bit-62.0.0-24.4.1 libjpeg62-devel-32bit-62.0.0-24.4.1 libjpeg8-32bit-8.0.2-24.4.1 libjpeg8-debuginfo-32bit-8.0.2-24.4.1 libjpeg8-devel-32bit-8.0.2-24.4.1 - openSUSE 12.3 (i586 x86_64): libjpeg-turbo-1.2.1-19.20.1 libjpeg-turbo-debuginfo-1.2.1-19.20.1 libjpeg-turbo-debugsource-1.2.1-19.20.1 libjpeg62-62.0.0-19.20.1 libjpeg62-debuginfo-62.0.0-19.20.1 libjpeg62-devel-62.0.0-19.20.1 libjpeg62-turbo-1.2.1-19.20.1 libjpeg62-turbo-debugsource-1.2.1-19.20.1 libjpeg8-8.0.2-19.20.1 libjpeg8-debuginfo-8.0.2-19.20.1 libjpeg8-devel-8.0.2-19.20.1 - openSUSE 12.3 (x86_64): libjpeg62-32bit-62.0.0-19.20.1 libjpeg62-debuginfo-32bit-62.0.0-19.20.1 libjpeg62-devel-32bit-62.0.0-19.20.1 libjpeg8-32bit-8.0.2-19.20.1 libjpeg8-debuginfo-32bit-8.0.2-19.20.1 libjpeg8-devel-32bit-8.0.2-19.20.1 References: http://support.novell.com/security/cve/CVE-2014-9092.html https://bugzilla.suse.com/show_bug.cgi?id=771791 https://bugzilla.suse.com/show_bug.cgi?id=807183 https://bugzilla.suse.com/show_bug.cgi?id=906761

1 0

openSUSE-SU-2014:1636-1: moderate: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 15 Dec '14

15 Dec '14

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1636-1 Rating: moderate References: #908363 #908364 Cross-References: CVE-2014-9218 CVE-2014-9219 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: phpMyAdmin on openSUSE 12.3 and 13.1 was updated to 4.1.14.8. This update fixes one vulnerability. - Security fixes: * PMASA-2014-17 (CVE-2014-9218, CWE-661 CWE-400) [boo#908363] http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php - sf#4611 [security] DOS attack with long passwords phpMyAdmin on openSUSE 13.2 was updated to 4.2.13.1 (2014-12-03) - Security fixes: * PMASA-2014-18 (CVE-2014-9219, CWE-661 CWE-79) [boo#908364] http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php - sf#4612 [security] XSS vulnerability in redirection mechanism * PMASA-2014-17 (CVE-2014-9218, CWE-661 CWE-400) [boo#908363] http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php - sf#4611 [security] DOS attack with long passwords - Bugfixes: - sf#4604 Query history not being deleted - sf#4057 db/table query string parameters no longer work - sf#4605 Unseen messages in tracking - sf#4606 Tracking report export as SQL dump does not work - sf#4607 Syntax error during db_copy operation - sf#4608 SELECT permission issues with relations and restricted access Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-776 - openSUSE 13.1: zypper in -t patch openSUSE-2014-776 - openSUSE 12.3: zypper in -t patch openSUSE-2014-776 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): phpMyAdmin-4.2.13.1-8.1 - openSUSE 13.1 (noarch): phpMyAdmin-4.1.14.8-28.1 - openSUSE 12.3 (noarch): phpMyAdmin-4.1.14.8-1.38.1 References: http://support.novell.com/security/cve/CVE-2014-9218.html http://support.novell.com/security/cve/CVE-2014-9219.html https://bugzilla.suse.com/show_bug.cgi?id=908363 https://bugzilla.suse.com/show_bug.cgi?id=908364

1 0

openSUSE-SU-2014:1635-1: moderate: Security update for mutt
by opensuse-security＠opensuse.org 15 Dec '14

15 Dec '14

openSUSE Security Update: Security update for mutt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1635-1 Rating: moderate References: #907453 Cross-References: CVE-2014-9116 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: mutt was updated to fix a security issue with a heap-based buffer overflow in mutt_substrdup() (CVE-2014-9116). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-779 - openSUSE 13.1: zypper in -t patch openSUSE-2014-779 - openSUSE 12.3: zypper in -t patch openSUSE-2014-779 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): mutt-1.5.21-44.4.1 mutt-debuginfo-1.5.21-44.4.1 mutt-debugsource-1.5.21-44.4.1 - openSUSE 13.1 (i586 x86_64): mutt-1.5.21-41.8.1 mutt-debuginfo-1.5.21-41.8.1 mutt-debugsource-1.5.21-41.8.1 - openSUSE 12.3 (i586 x86_64): mutt-1.5.21-36.20.1 mutt-debuginfo-1.5.21-36.20.1 mutt-debugsource-1.5.21-36.20.1 References: http://support.novell.com/security/cve/CVE-2014-9116.html https://bugzilla.suse.com/show_bug.cgi?id=907453

1 0