February 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2014:0311-1: boinc-client: Fix an building-issue
by maintenance＠opensuse.org 28 Feb '14

28 Feb '14

openSUSE Recommended Update: boinc-client: Fix an building-issue ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0311-1 Rating: low References: Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issue with boinc-client: - Add libX11 and libgtk-x11-2.0 to the libraries boincmgr to fix an build-issue Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-177 - openSUSE 12.3: zypper in -t patch openSUSE-2014-177 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): boinc-client-6.12.43-6.8.1 boinc-client-debuginfo-6.12.43-6.8.1 boinc-client-debugsource-6.12.43-6.8.1 boinc-client-devel-6.12.43-6.8.1 boinc-manager-6.12.43-6.8.1 boinc-manager-debuginfo-6.12.43-6.8.1 libboinc6-6.12.43-6.8.1 libboinc6-debuginfo-6.12.43-6.8.1 - openSUSE 13.1 (noarch): boinc-client-doc-6.12.43-6.8.1 boinc-client-lang-6.12.43-6.8.1 boinc-manager-lang-6.12.43-6.8.1 - openSUSE 12.3 (i586 x86_64): boinc-client-6.12.43-3.4.2 boinc-client-debuginfo-6.12.43-3.4.2 boinc-client-debugsource-6.12.43-3.4.2 boinc-client-devel-6.12.43-3.4.2 boinc-manager-6.12.43-3.4.2 boinc-manager-debuginfo-6.12.43-3.4.2 libboinc6-6.12.43-3.4.2 libboinc6-debuginfo-6.12.43-3.4.2 - openSUSE 12.3 (noarch): boinc-client-doc-6.12.43-3.4.2 boinc-client-lang-6.12.43-3.4.2 boinc-manager-lang-6.12.43-3.4.2 References:

1 0

openSUSE-SU-2014:0310-1: moderate: icedtea-web: 1.4.2 bugfix update
by opensuse-security＠opensuse.org 28 Feb '14

28 Feb '14

openSUSE Security Update: icedtea-web: 1.4.2 bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0310-1 Rating: moderate References: #864364 Cross-References: CVE-2013-6493 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: icedtea-web was updated to version 1.4.2 (bnc#864364), fixing various bugs and a security issues: * Dialogs center on screen before becoming visible * Support for u45 new manifest attributes (Application-Name) * Custom applet permission policies panel in itweb-settings control panel * Plugin - PR1271: icedtea-web does not handle 'javascript:'-protocol URLs - RH976833: Multiple applets on one page cause deadlock - Enabled javaconsole * Security Updates - CVE-2013-6493/RH1010958: insecure temporary file use flaw in LiveConnect implementation * Except above also: - Christmas splashscreen extension - fixed classloading deadlocks - cleaned code from warnings - pipes moved to XDG runtime dir * Patches changes: * rebased icedtea-web-1.1-moonlight-symbol-clash.patch * add icedtea-web-1.4.2-mkdir.patch * add icedtea-web-1.4.2-softkiller-link.patch * build with rhino support * use fdupes * run make run-netx-dist-tests in %check on openSUSE > 13.1 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-176 - openSUSE 12.3: zypper in -t patch openSUSE-2014-176 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): icedtea-web-1.4.2-4.1 icedtea-web-debuginfo-1.4.2-4.1 icedtea-web-debugsource-1.4.2-4.1 - openSUSE 13.1 (noarch): icedtea-web-javadoc-1.4.2-4.1 - openSUSE 12.3 (i586 x86_64): icedtea-web-1.4.2-4.26.1 icedtea-web-debuginfo-1.4.2-4.26.1 icedtea-web-debugsource-1.4.2-4.26.1 - openSUSE 12.3 (noarch): icedtea-web-javadoc-1.4.2-4.26.1 References: http://support.novell.com/security/cve/CVE-2013-6493.html https://bugzilla.novell.com/864364

1 0

openSUSE-SU-2014:0309-1: moderate: mupdf: fixed security problem
by opensuse-security＠opensuse.org 28 Feb '14

28 Feb '14

openSUSE Security Update: mupdf: fixed security problem ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0309-1 Rating: moderate References: #863975 Cross-References: CVE-2014-2013 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: mupdf received a security updated to fix a stack based array overflow in xps_parse_color() (bnc#863975, CVE-2014-2013) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-172 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): mupdf-1.2-5.4.1 mupdf-debuginfo-1.2-5.4.1 mupdf-debugsource-1.2-5.4.1 mupdf-devel-static-1.2-5.4.1 References: http://support.novell.com/security/cve/CVE-2014-2013.html https://bugzilla.novell.com/863975

1 0

openSUSE-RU-2014:0308-1: moderate: ca-certificates-mozilla: Updated to 1.96 (February 2014) state
by maintenance＠opensuse.org 28 Feb '14

28 Feb '14

openSUSE Recommended Update: ca-certificates-mozilla: Updated to 1.96 (February 2014) state ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0308-1 Rating: moderate References: #865080 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The mozilla ca certificates was updated to the state released with Mozilla NSS 3.15.4, internal version 1.96. Following changes were done: * New: ACCVRAIZ1.pem (Spain) (all trusts) * New: SG_TRUST_SERVICES_RACINE.pem (Singapore) (email signing only) * New: TWCA_Global_Root_CA.pem (Taiwanese) (all trusts) * Removed: Wells_Fargo_Root_CA.pem Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-174 - openSUSE 12.3: zypper in -t patch openSUSE-2014-174 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): ca-certificates-mozilla-1.96-3.8.1 - openSUSE 12.3 (noarch): ca-certificates-mozilla-1.96-3.8.1 References: https://bugzilla.novell.com/865080

1 0

openSUSE-SU-2014:0307-1: moderate: subversion: 1.8.8 security and bugfix update
by opensuse-security＠opensuse.org 28 Feb '14

28 Feb '14

openSUSE Security Update: subversion: 1.8.8 security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0307-1 Rating: moderate References: #862459 Cross-References: CVE-2014-0032 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Apache Subversion was updated to version 1.8.8: It fix a remotely triggerable segfault in mod_dav_svn when svn is handling the server root and SVNListParentPath is on [bnc#862459] CVE-2014-0032 - Client-side bugfixes: * fix automatic relocate for wcs not at repository root * wc: improve performance when used with SQLite 3.8 * copy: fix some scenarios that broke the working copy * move: fix errors when moving files between an external and the parent working copy * log: resolve performance regression in certain scenarios * merge: decrease work to detect differences between 3 files * commit: don't change file permissions inappropriately * commit: fix assertion due to invalid pool lifetime * version: don't cut off the distribution version on Linux * flush stdout before exiting to avoid information being lost * status: fix missing sentinel value on warning codes * update/switch: improve some WC db queries that may return incorrect results depending on how SQLite is built - Server-side bugfixes: * reduce memory usage during checkout and export * fsfs: create rep-cache.db with proper permissions * mod_dav_svn: prevent crashes with SVNListParentPath on [bnc#862459] CVE-2014-0032 * mod_dav_svn: fix SVNAllowBulkUpdates directive merging * mod_dav_svn: include requested property changes in reports * svnserve: correct default cache size in help text * svnadmin dump: reduce size of dump files with '--deltas' * resolve integer underflow that resulted in infinite loops - developer visible changes: * fix ocassional failure of check_tests.py 12 * fix failure with SQLite 3.8.1-3.8.3 when built with SQLITE_ENABLE_STAT3/4 due to bug in SQLite * specify SQLite defaults that can be changed when SQLite is built to avoid unexpected behavior with Subversion * numerous documentation fixes * svn_client_commit_item3_dup() fix pool lifetime issues * ra_serf: properly ask multiple certificate validation providers for acceptance of certificate failures * release internal fs objects when closing commit editor * svn_client_proplist4() don't call the callback multiple times for the same path in order to deliver inherited properties - Bindings: * swig-pl: fix with --enable-sqlite-compatibility-version * swig: fix building from tarball with an out-of-tree build - removed patches: * subversion-1.8.x-fix-ppc-tests.patch, committed upstream - packaging changes: * only require and build with junit when building with java and running regression tests - 1.8.6 and 1.8.7 were not released Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-173 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.8.8-2.21.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.8-2.21.1 libsvn_auth_kwallet-1-0-1.8.8-2.21.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.8-2.21.1 subversion-1.8.8-2.21.1 subversion-debuginfo-1.8.8-2.21.1 subversion-debugsource-1.8.8-2.21.1 subversion-devel-1.8.8-2.21.1 subversion-perl-1.8.8-2.21.1 subversion-perl-debuginfo-1.8.8-2.21.1 subversion-python-1.8.8-2.21.1 subversion-python-debuginfo-1.8.8-2.21.1 subversion-ruby-1.8.8-2.21.1 subversion-ruby-debuginfo-1.8.8-2.21.1 subversion-server-1.8.8-2.21.1 subversion-server-debuginfo-1.8.8-2.21.1 subversion-tools-1.8.8-2.21.1 subversion-tools-debuginfo-1.8.8-2.21.1 - openSUSE 13.1 (noarch): subversion-bash-completion-1.8.8-2.21.1 References: http://support.novell.com/security/cve/CVE-2014-0032.html https://bugzilla.novell.com/862459

1 0

openSUSE-SU-2014:0306-1: moderate: python-logilab-common: fixed multiple temp file problems
by opensuse-security＠opensuse.org 28 Feb '14

28 Feb '14

openSUSE Security Update: python-logilab-common: fixed multiple temp file problems ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0306-1 Rating: moderate References: #861822 Cross-References: CVE-2014-1838 CVE-2014-1839 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The Python logilab-common module was updated to fix several temporary file problems, one in the PDF generator (CVE-2014-1838) and one in the shellutils helper (CVE-2014-1839). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-175 - openSUSE 12.3: zypper in -t patch openSUSE-2014-175 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): python-logilab-common-0.58.0-7.4.1 - openSUSE 12.3 (noarch): python-logilab-common-0.58.0-4.4.1 python3-logilab-common-0.58.0-4.4.1 References: http://support.novell.com/security/cve/CVE-2014-1838.html http://support.novell.com/security/cve/CVE-2014-1839.html https://bugzilla.novell.com/861822

1 0

openSUSE-RU-2014:0304-1: moderate: tar: fixed creating archives with large UIDs
by maintenance＠opensuse.org 27 Feb '14

27 Feb '14

openSUSE Recommended Update: tar: fixed creating archives with large UIDs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0304-1 Rating: moderate References: #864302 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: GNU Tar was updated to fix creating archive with large uids and posix (default) format (bnc#864302). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-170 - openSUSE 12.3: zypper in -t patch openSUSE-2014-170 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): tar-1.26-19.4.1 tar-backup-scripts-1.26-19.4.1 tar-debuginfo-1.26-19.4.1 tar-debugsource-1.26-19.4.1 - openSUSE 13.1 (noarch): tar-lang-1.26-19.4.1 - openSUSE 12.3 (i586 x86_64): tar-1.26-14.4.1 tar-backup-scripts-1.26-14.4.1 tar-debuginfo-1.26-14.4.1 tar-debugsource-1.26-14.4.1 - openSUSE 12.3 (noarch): tar-lang-1.26-14.4.1 References: https://bugzilla.novell.com/864302

1 0

openSUSE-RU-2014:0303-1: moderate: clamav: 0.98.1 version update
by maintenance＠opensuse.org 27 Feb '14

27 Feb '14

openSUSE Recommended Update: clamav: 0.98.1 version update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0303-1 Rating: moderate References: #841815 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: clamav was updated to version 0.98.1 (bnc#841815): * remove copy of wxWidgets (halves the size of the tarball). * Decompression and scanning of files in "Xz" compression format. * Extraction, decompression, and scanning of files within Apple Disk Image (DMG) format. * Extraction, decompression, and scanning of files within Extensible Archive (XAR) format. XAR format is commonly used for software packaging, such as PKG and RPM, as well as general archival. * Improvements and fixes to extraction and scanning of ole formats. * Option to force all scanned data to disk. * Various improvements to ClamAV configuration, support of third party libraries, and unit tests. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-171 - openSUSE 12.3: zypper in -t patch openSUSE-2014-171 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): clamav-0.98.1-6.2 clamav-debuginfo-0.98.1-6.2 clamav-debugsource-0.98.1-6.2 - openSUSE 12.3 (i586 x86_64): clamav-0.98.1-5.14.1 clamav-debuginfo-0.98.1-5.14.1 clamav-debugsource-0.98.1-5.14.1 References: https://bugzilla.novell.com/841815

1 0

openSUSE-RU-2014:0296-1: moderate: openssl: fixed crashes when using WebRTC in FreeSwitch
by maintenance＠opensuse.org 26 Feb '14

26 Feb '14

openSUSE Recommended Update: openssl: fixed crashes when using WebRTC in FreeSwitch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0296-1 Rating: moderate References: #861384 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The last openssl security fix could cause crashes using WebRTC functionality in FreeSWITCH, this update fixes this problem. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-169 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libopenssl-devel-1.0.1e-1.36.1 libopenssl1_0_0-1.0.1e-1.36.1 libopenssl1_0_0-debuginfo-1.0.1e-1.36.1 openssl-1.0.1e-1.36.1 openssl-debuginfo-1.0.1e-1.36.1 openssl-debugsource-1.0.1e-1.36.1 - openSUSE 12.3 (x86_64): libopenssl-devel-32bit-1.0.1e-1.36.1 libopenssl1_0_0-32bit-1.0.1e-1.36.1 libopenssl1_0_0-debuginfo-32bit-1.0.1e-1.36.1 - openSUSE 12.3 (noarch): openssl-doc-1.0.1e-1.36.1 References: https://bugzilla.novell.com/861384

1 0

openSUSE-SU-2014:0295-1: moderate: rubygem-actionpack-3_2: fixed two security issues
by opensuse-security＠opensuse.org 26 Feb '14

26 Feb '14

openSUSE Security Update: rubygem-actionpack-3_2: fixed two security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0295-1 Rating: moderate References: #864431 #864433 Cross-References: CVE-2014-0081 CVE-2014-0082 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: rubygem-actionpack-3_2 was updated to fix security issues: - fix CVE-2014-0081: XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human (bnc#864433) - fix CVE-2014-0082: Denial of Service Vulnerability in Action View when using render :text (bnc#864431) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-166 - openSUSE 12.3: zypper in -t patch openSUSE-2014-166 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): rubygem-actionpack-3_2-3.2.13-2.15.1 rubygem-actionpack-3_2-doc-3.2.13-2.15.1 - openSUSE 12.3 (i586 x86_64): rubygem-actionpack-3_2-3.2.12-1.19.1 rubygem-actionpack-3_2-doc-3.2.12-1.19.1 References: http://support.novell.com/security/cve/CVE-2014-0081.html http://support.novell.com/security/cve/CVE-2014-0082.html https://bugzilla.novell.com/864431 https://bugzilla.novell.com/864433

1 0