February 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2014:0240-1: kdebase4-workspace: Update to 4.11.6
by maintenance＠opensuse.org 17 Feb '14

17 Feb '14

openSUSE Recommended Update: kdebase4-workspace: Update to 4.11.6 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0240-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provides the bugfix release 4.11.6 of kdebase4-workspace. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-134 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): kde4-kgreeter-plugins-4.11.6-107.1 kde4-kgreeter-plugins-debuginfo-4.11.6-107.1 kdebase4-workspace-4.11.6-107.1 kdebase4-workspace-branding-upstream-4.11.6-107.1 kdebase4-workspace-debuginfo-4.11.6-107.1 kdebase4-workspace-debugsource-4.11.6-107.1 kdebase4-workspace-devel-4.11.6-107.1 kdebase4-workspace-devel-debuginfo-4.11.6-107.1 kdebase4-workspace-ksysguardd-4.11.6-107.1 kdebase4-workspace-ksysguardd-debuginfo-4.11.6-107.1 kdebase4-workspace-liboxygenstyle-4.11.6-107.1 kdebase4-workspace-liboxygenstyle-debuginfo-4.11.6-107.1 kdebase4-workspace-plasma-calendar-4.11.6-107.1 kdebase4-workspace-plasma-calendar-debuginfo-4.11.6-107.1 kdm-4.11.6-107.1 kdm-branding-upstream-4.11.6-107.1 kdm-debuginfo-4.11.6-107.1 krandr-4.11.6-107.1 krandr-debuginfo-4.11.6-107.1 kwin-4.11.6-107.1 kwin-debuginfo-4.11.6-107.1 python-kdebase4-4.11.6-107.1 - openSUSE 13.1 (x86_64): kdebase4-workspace-liboxygenstyle-32bit-4.11.6-107.1 kdebase4-workspace-liboxygenstyle-debuginfo-32bit-4.11.6-107.1 References:

1 0

openSUSE-SU-2014:0239-1: moderate: update for pidgin, pidgin-branding-openSUSE
by opensuse-security＠opensuse.org 15 Feb '14

15 Feb '14

openSUSE Security Update: update for pidgin, pidgin-branding-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0239-1 Rating: moderate References: #861019 Cross-References: CVE-2012-6152 CVE-2013-6477 CVE-2013-6478 CVE-2013-6479 CVE-2013-6481 CVE-2013-6482 CVE-2013-6483 CVE-2013-6484 CVE-2013-6485 CVE-2013-6486 CVE-2013-6487 CVE-2014-0020 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: - Update to version 2.10.8 (bnc#861019): + General: Python build scripts and example plugins are now compatible with Python 3 (pidgin.im#15624). + libpurple: - Fix potential crash if libpurple gets an error attempting to read a reply from a STUN server (CVE-2013-6484). - Fix potential crash parsing a malformed HTTP response (CVE-2013-6479). - Fix buffer overflow when parsing a malformed HTTP response with chunked Transfer-Encoding (CVE-2013-6485). - Better handling of HTTP proxy responses with negative Content-Lengths. - Fix handling of SSL certificates without subjects when using libnss. - Fix handling of SSL certificates with timestamps in the distant future when using libnss (pidgin.im#15586). - Impose maximum download size for all HTTP fetches. + Pidgin: - Fix crash displaying tooltip of long URLs (CVE-2013-6478). - Better handling of URLs longer than 1000 letters. - Fix handling of multibyte UTF-8 characters in smiley themes (pidgin.im#15756). + AIM: Fix untrusted certificate error. + AIM and ICQ: Fix a possible crash when receiving a malformed message in a Direct IM session. + Gadu-Gadu: - Fix buffer overflow with remote code execution potential. Only triggerable by a Gadu-Gadu server or a man-in-the-middle (CVE-2013-6487). - Disabled buddy list import/export from/to server. - Disabled new account registration and password change options. + IRC: - Fix bug where a malicious server or man-in-the-middle could trigger a crash by not sending enough arguments with various messages (CVE-2014-0020). - Fix bug where initial IRC status would not be set correctly. - Fix bug where IRC wasn't available when libpurple was compiled with Cyrus SASL support (pidgin.im#15517). + MSN: - Fix NULL pointer dereference parsing headers in MSN (CVE-2013-6482). - Fix NULL pointer dereference parsing OIM data in MSN (CVE-2013-6482). - Fix NULL pointer dereference parsing SOAP data in MSN (CVE-2013-6482). - Fix possible crash when sending very long messages. Not remotely-triggerable. + MXit: - Fix buffer overflow with remote code execution potential (CVE-2013-6487). - Fix sporadic crashes that can happen after user is disconnected. - Fix crash when attempting to add a contact via search results. - Show error message if file transfer fails. - Fix compiling with InstantBird. - Fix display of some custom emoticons. + SILC: Correctly set whiteboard dimensions in whiteboard sessions. + SIMPLE: Fix buffer overflow with remote code execution potential (CVE-2013-6487). + XMPP: - Prevent spoofing of iq replies by verifying that the 'from' address matches the 'to' address of the iq request (CVE-2013-6483). - Fix crash on some systems when receiving fake delay timestamps with extreme values (CVE-2013-6477). - Fix possible crash or other erratic behavior when selecting a very small file for your own buddy icon. - Fix crash if the user tries to initiate a voice/video session with a resourceless JID. - Fix login errors when the first two available auth mechanisms fail but a subsequent mechanism would otherwise work when using Cyrus SASL (pidgin.im#15524). - Fix dropping incoming stanzas on BOSH connections when we receive multiple HTTP responses at once (pidgin.im#15684). + Yahoo!: - Fix possible crashes handling incoming strings that are not UTF-8 (CVE-2012-6152). - Fix a bug reading a peer to peer message where a remote user could trigger a crash (CVE-2013-6481). + Plugins: - Fix crash in contact availability plugin. - Fix perl function Purple::Network::ip_atoi. - Add Unity integration plugin. + Windows specific fixes: (CVE-2013-6486, pidgin.im#15520, pidgin.im#15521, bgo#668154). - Drop pidgin-irc-sasl.patch, fixed upstream. - Obsolete pidgin-facebookchat: the package is no longer maintained and pidgin as built-in support for Facebook Chat. - Protect buildrequires for mono-devel with with_mono macro. - Add pidgin-gstreamer1.patch: Port to GStreamer 1.0. Only enabled on openSUSE 13.1 and newer. - On openSUSE 13.1 and newer, use gstreamer-devel and gstreamer-plugins-base-devel BuildRequires. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-132 - openSUSE 12.3: zypper in -t patch openSUSE-2014-132 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): finch-2.10.9-4.6.1 finch-debuginfo-2.10.9-4.6.1 finch-devel-2.10.9-4.6.1 libpurple-2.10.9-4.6.1 libpurple-debuginfo-2.10.9-4.6.1 libpurple-devel-2.10.9-4.6.1 libpurple-meanwhile-2.10.9-4.6.1 libpurple-meanwhile-debuginfo-2.10.9-4.6.1 libpurple-tcl-2.10.9-4.6.1 libpurple-tcl-debuginfo-2.10.9-4.6.1 pidgin-2.10.9-4.6.1 pidgin-debuginfo-2.10.9-4.6.1 pidgin-debugsource-2.10.9-4.6.1 pidgin-devel-2.10.9-4.6.1 - openSUSE 13.1 (noarch): libpurple-branding-openSUSE-13.1-2.6.1 libpurple-branding-upstream-2.10.9-4.6.1 libpurple-lang-2.10.9-4.6.1 - openSUSE 12.3 (i586 x86_64): finch-2.10.9-4.10.1 finch-debuginfo-2.10.9-4.10.1 finch-devel-2.10.9-4.10.1 libpurple-2.10.9-4.10.1 libpurple-debuginfo-2.10.9-4.10.1 libpurple-devel-2.10.9-4.10.1 libpurple-meanwhile-2.10.9-4.10.1 libpurple-meanwhile-debuginfo-2.10.9-4.10.1 libpurple-tcl-2.10.9-4.10.1 libpurple-tcl-debuginfo-2.10.9-4.10.1 pidgin-2.10.9-4.10.1 pidgin-debuginfo-2.10.9-4.10.1 pidgin-debugsource-2.10.9-4.10.1 pidgin-devel-2.10.9-4.10.1 - openSUSE 12.3 (noarch): libpurple-branding-openSUSE-12.2-4.10.1 libpurple-branding-upstream-2.10.9-4.10.1 libpurple-lang-2.10.9-4.10.1 References: http://support.novell.com/security/cve/CVE-2012-6152.html http://support.novell.com/security/cve/CVE-2013-6477.html http://support.novell.com/security/cve/CVE-2013-6478.html http://support.novell.com/security/cve/CVE-2013-6479.html http://support.novell.com/security/cve/CVE-2013-6481.html http://support.novell.com/security/cve/CVE-2013-6482.html http://support.novell.com/security/cve/CVE-2013-6483.html http://support.novell.com/security/cve/CVE-2013-6484.html http://support.novell.com/security/cve/CVE-2013-6485.html http://support.novell.com/security/cve/CVE-2013-6486.html http://support.novell.com/security/cve/CVE-2013-6487.html http://support.novell.com/security/cve/CVE-2014-0020.html https://bugzilla.novell.com/861019

1 0

openSUSE-RU-2014:0235-1: choqok: Two fixes
by maintenance＠opensuse.org 14 Feb '14

14 Feb '14

openSUSE Recommended Update: choqok: Two fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0235-1 Rating: low References: #862467 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with choqok: - bnc#862467: Show tweets marked as favorite in the Favorit Folder - kde#265219: fix yourls shortener plugin Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-130 - openSUSE 12.3: zypper in -t patch openSUSE-2014-130 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): choqok-1.4-2.4.1 choqok-debuginfo-1.4-2.4.1 choqok-debugsource-1.4-2.4.1 choqok-devel-1.4-2.4.1 - openSUSE 12.3 (i586 x86_64): choqok-1.4-4.10.1 choqok-debuginfo-1.4-4.10.1 choqok-debugsource-1.4-4.10.1 choqok-devel-1.4-4.10.1 References: https://bugzilla.novell.com/862467

1 0

openSUSE-RU-2014:0234-1: kvm: Reload rules in post script to process ones just installed
by maintenance＠opensuse.org 14 Feb '14

14 Feb '14

openSUSE Recommended Update: kvm: Reload rules in post script to process ones just installed ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0234-1 Rating: low References: #860275 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with kvm: - bnc#860275: Reload rules in post script to process ones just installed Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-131 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): kvm-1.6.0-3.4.1 References: https://bugzilla.novell.com/860275

1 0

openSUSE-RU-2014:0232-1: gnutls: fixed to small internal buffer for inflate
by maintenance＠opensuse.org 13 Feb '14

13 Feb '14

openSUSE Recommended Update: gnutls: fixed to small internal buffer for inflate ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0232-1 Rating: low References: #861907 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with gnutls: - bnc#861907: fixed broken COMP-DEFLATE because of a too small internal buffer for inflate Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-129 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): gnutls-3.2.4-2.9.1 gnutls-debuginfo-3.2.4-2.9.1 gnutls-debugsource-3.2.4-2.9.1 libgnutls-devel-3.2.4-2.9.1 libgnutls-openssl-devel-3.2.4-2.9.1 libgnutls-openssl27-3.2.4-2.9.1 libgnutls-openssl27-debuginfo-3.2.4-2.9.1 libgnutls28-3.2.4-2.9.1 libgnutls28-debuginfo-3.2.4-2.9.1 libgnutlsxx-devel-3.2.4-2.9.1 libgnutlsxx28-3.2.4-2.9.1 libgnutlsxx28-debuginfo-3.2.4-2.9.1 - openSUSE 13.1 (x86_64): libgnutls-devel-32bit-3.2.4-2.9.1 libgnutls28-32bit-3.2.4-2.9.1 libgnutls28-debuginfo-32bit-3.2.4-2.9.1 References: https://bugzilla.novell.com/861907

1 0

openSUSE-RU-2014:0231-1: moderate: yast2-storage: include only devices know to libstorage in target-map
by maintenance＠opensuse.org 13 Feb '14

13 Feb '14

openSUSE Recommended Update: yast2-storage: include only devices know to libstorage in target-map ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0231-1 Rating: moderate References: #861301 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with yast2-storage: - bnc#861301: include only devices know to libstorage in target-map Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-128 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libstorage-debugsource-2.24.8-3.1 libstorage-devel-2.24.8-3.1 libstorage-python-2.24.8-3.1 libstorage-python-debuginfo-2.24.8-3.1 libstorage-ruby-2.24.8-3.1 libstorage-ruby-debuginfo-2.24.8-3.1 libstorage-testsuite-2.24.8-3.1 libstorage-testsuite-debuginfo-2.24.8-3.1 libstorage4-2.24.8-3.1 libstorage4-debuginfo-2.24.8-3.1 yast2-storage-3.0.9-4.2 yast2-storage-debuginfo-3.0.9-4.2 yast2-storage-debugsource-3.0.9-4.2 yast2-storage-devel-3.0.9-4.2 References: https://bugzilla.novell.com/861301

1 0

openSUSE-RU-2014:0228-1: moderate: update for openssl
by maintenance＠opensuse.org 12 Feb '14

12 Feb '14

openSUSE Recommended Update: update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0228-1 Rating: moderate References: #861384 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following non-security issues with openssl: - Update to openssl-1.0.1e-11.14.1 broke WebRTC functionality in FreeSWITCH (bnc#861384). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-123 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1e-11.24.1 libopenssl1_0_0-1.0.1e-11.24.1 libopenssl1_0_0-debuginfo-1.0.1e-11.24.1 openssl-1.0.1e-11.24.1 openssl-debuginfo-1.0.1e-11.24.1 openssl-debugsource-1.0.1e-11.24.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1e-11.24.1 libopenssl1_0_0-32bit-1.0.1e-11.24.1 libopenssl1_0_0-debuginfo-32bit-1.0.1e-11.24.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1e-11.24.1 References: https://bugzilla.novell.com/861384

1 0

openSUSE-RU-2014:0227-1: moderate: update for nfs-utils
by maintenance＠opensuse.org 12 Feb '14

12 Feb '14

openSUSE Recommended Update: update for nfs-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0227-1 Rating: moderate References: #849387 #849476 #859221 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update fixes the following non-security issues with nfs-utils: - nfsserver.init: another typo in --nfs-version 4. (bnc#849476) - nfs-utils.spec: Require keyutils for proper idmap lookup. - nfs.init, nfsserver.init: mkdir /run/nfs before trying to create a file in there (bnc#859221) - nfs.init, nfsserver.init: add X-Systemd-RemainAfterExit: true to ensure services aren't shutdown if sm-notify reports an error (bnc#849387) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-126 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): nfs-client-1.2.8-4.9.1 nfs-client-debuginfo-1.2.8-4.9.1 nfs-doc-1.2.8-4.9.1 nfs-kernel-server-1.2.8-4.9.1 nfs-kernel-server-debuginfo-1.2.8-4.9.1 nfs-utils-debugsource-1.2.8-4.9.1 References: https://bugzilla.novell.com/849387 https://bugzilla.novell.com/849476 https://bugzilla.novell.com/859221

1 0

openSUSE-RU-2014:0226-1: moderate: brise: Update to 0.30
by maintenance＠opensuse.org 12 Feb '14

12 Feb '14

openSUSE Recommended Update: brise: Update to 0.30 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0226-1 Rating: moderate References: #862135 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with brise: - bnc#862135: update version 0.30 + default.yaml, symbols.yaml: prefer middle dot U+00B7 to U+30FB. + bopomofo_tw: bopomofo, output in Taiwan standard. + jyutping: include more characters. + luna_pinyin_simp: enable hotkey Control+Shift+4 to toggle simplified/traditional Chinese mode. + essay.txt, luna_pinyin, terra_pinyin: lots of improvements. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-127 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): brise-0.30-7.4.1 References: https://bugzilla.novell.com/862135

1 0

openSUSE-RU-2014:0225-1: moderate: update for yast2-add-on-creator
by maintenance＠opensuse.org 12 Feb '14

12 Feb '14

openSUSE Recommended Update: update for yast2-add-on-creator ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0225-1 Rating: moderate References: #485825 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following non-security issues with yast2-add-on-creator: - fix expect script used for signing rpm's - generate MD5SUM files after signing packages (bnc#485825) - 3.0.2 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-125 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): yast2-add-on-creator-3.0.2-5.1 References: https://bugzilla.novell.com/485825

1 0