February 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:0278-1: critical: flash-player: update to 11.2.202.341 security release
by opensuse-security＠opensuse.org 24 Feb '14

24 Feb '14

openSUSE Security Update: flash-player: update to 11.2.202.341 security release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0278-1 Rating: critical References: #865021 Cross-References: CVE-2014-0498 CVE-2014-0499 CVE-2014-0502 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.341: (bnc#865021) * APSB14-07, CVE-2014-0498 CVE-2014-0499 CVE-2014-0502 - Contents of flashplayer_11_sa.i386.tar.gz changed back: spec file updated, supplementary script (update.sh) updated. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-22 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.341-95.1 flash-player-gnome-11.2.202.341-95.1 flash-player-kde4-11.2.202.341-95.1 References: http://support.novell.com/security/cve/CVE-2014-0498.html http://support.novell.com/security/cve/CVE-2014-0499.html http://support.novell.com/security/cve/CVE-2014-0502.html https://bugzilla.novell.com/865021

1 0

openSUSE-SU-2014:0277-1: critical: flash-player: update to 11.2.202.341 security release
by opensuse-security＠opensuse.org 24 Feb '14

24 Feb '14

openSUSE Security Update: flash-player: update to 11.2.202.341 security release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0277-1 Rating: critical References: #865021 Cross-References: CVE-2014-0498 CVE-2014-0499 CVE-2014-0502 Affected Products: openSUSE 13.1:NonFree openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.341: (bnc#865021) * APSB14-07, CVE-2014-0498 CVE-2014-0499 CVE-2014-0502 - Contents of flashplayer_11_sa.i386.tar.gz changed back: spec file updated, supplementary script (update.sh) updated. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2014-157 - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2014-157 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.341-34.1 flash-player-gnome-11.2.202.341-34.1 flash-player-kde4-11.2.202.341-34.1 - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.341-2.60.1 flash-player-gnome-11.2.202.341-2.60.1 flash-player-kde4-11.2.202.341-2.60.1 References: http://support.novell.com/security/cve/CVE-2014-0498.html http://support.novell.com/security/cve/CVE-2014-0499.html http://support.novell.com/security/cve/CVE-2014-0502.html https://bugzilla.novell.com/865021

1 0

openSUSE-RU-2014:0276-1: systemd-presets-branding-openSUSE: Enable iscsi daemon socket and iscsi service
by maintenance＠opensuse.org 21 Feb '14

21 Feb '14

openSUSE Recommended Update: systemd-presets-branding-openSUSE: Enable iscsi daemon socket and iscsi service ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0276-1 Rating: low References: #853300 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This udpate fixes the following issue with systemd-presets-branding-openSUSE: - bnc#853300: Enable iscsi daemon socket and iscsi service as installed, so that iscsid.service can be socket-activated. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-155 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): systemd-presets-branding-openSUSE-0.3.0-3.4.1 References: https://bugzilla.novell.com/853300

1 0

openSUSE-RU-2014:0275-1: acpid: Correct pointer at further documentation in README
by maintenance＠opensuse.org 21 Feb '14

21 Feb '14

openSUSE Recommended Update: acpid: Correct pointer at further documentation in README ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0275-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for acpid corrects a pointer at further documentation in README Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-156 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): acpid-2.0.19-4.4.1 acpid-debuginfo-2.0.19-4.4.1 acpid-debugsource-2.0.19-4.4.1 References:

1 0

openSUSE-SU-2014:0274-1: moderate: update for curl
by opensuse-security＠opensuse.org 21 Feb '14

21 Feb '14

openSUSE Security Update: update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0274-1 Rating: moderate References: #858673 #862144 Cross-References: CVE-2014-0015 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update fixes the following security issues with curl: - bnc#858673: re-use of wrong HTTP NTLM connection (CVE-2014-0015) - bnc#862144: fix test failure because of an expired cookie Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-20 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): curl-7.21.2-41.1 curl-debuginfo-7.21.2-41.1 libcurl-devel-7.21.2-41.1 libcurl4-7.21.2-41.1 - openSUSE 11.4 (x86_64): libcurl4-32bit-7.21.2-41.1 libcurl4-debuginfo-32bit-7.21.2-41.1 - openSUSE 11.4 (ia64): libcurl4-debuginfo-x86-7.21.2-41.1 libcurl4-x86-7.21.2-41.1 - openSUSE 11.4 (i586): libcurl4-debuginfo-7.21.2-41.1 References: http://support.novell.com/security/cve/CVE-2014-0015.html https://bugzilla.novell.com/858673 https://bugzilla.novell.com/862144

1 0

openSUSE-SU-2014:0273-1: moderate: update for libyaml
by opensuse-security＠opensuse.org 21 Feb '14

21 Feb '14

openSUSE Security Update: update for libyaml ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0273-1 Rating: moderate References: #860617 Cross-References: CVE-2013-6393 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue with libyaml: - bnc#860617: Fixed heap based buffer overflow due to integer misuse (CVE-2013-6393) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-21 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libyaml-0-2-0.1.3-6.1 libyaml-0-2-debuginfo-0.1.3-6.1 libyaml-debugsource-0.1.3-6.1 libyaml-devel-0.1.3-6.1 References: http://support.novell.com/security/cve/CVE-2013-6393.html https://bugzilla.novell.com/860617

1 0

openSUSE-SU-2014:0272-1: moderate: update for libyaml
by opensuse-security＠opensuse.org 21 Feb '14

21 Feb '14

openSUSE Security Update: update for libyaml ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0272-1 Rating: moderate References: #860617 Cross-References: CVE-2013-6393 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue with libyaml: - bnc#860617: Fixed heap based buffer overflow due to integer misuse (CVE-2013-6393) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-150 - openSUSE 12.3: zypper in -t patch openSUSE-2014-150 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libyaml-0-2-0.1.4-2.4.1 libyaml-0-2-debuginfo-0.1.4-2.4.1 libyaml-debugsource-0.1.4-2.4.1 libyaml-devel-0.1.4-2.4.1 - openSUSE 12.3 (i586 x86_64): libyaml-0-2-0.1.3-11.4.1 libyaml-0-2-debuginfo-0.1.3-11.4.1 libyaml-debugsource-0.1.3-11.4.1 libyaml-devel-0.1.3-11.4.1 References: http://support.novell.com/security/cve/CVE-2013-6393.html https://bugzilla.novell.com/860617

1 0

openSUSE-SU-2014:0271-1: moderate: update for mumble
by opensuse-security＠opensuse.org 21 Feb '14

21 Feb '14

openSUSE Security Update: update for mumble ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0271-1 Rating: moderate References: #855478 #862527 Cross-References: CVE-2014-0044 CVE-2014-0045 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes two security issues with mumble: - bnc#862527: updated to version 1.2.5 to address two Denial of Service security issues (CVE-2014-0044, CVE-2014-0045). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-152 - openSUSE 12.3: zypper in -t patch openSUSE-2014-152 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): mumble-1.2.5-2.8.2 mumble-debuginfo-1.2.5-2.8.2 mumble-debugsource-1.2.5-2.8.2 mumble-server-1.2.5-2.8.2 mumble-server-debuginfo-1.2.5-2.8.2 - openSUSE 13.1 (x86_64): mumble-32bit-1.2.5-2.8.2 mumble-debuginfo-32bit-1.2.5-2.8.2 - openSUSE 12.3 (i586 x86_64): mumble-1.2.5-21.4.1 mumble-debuginfo-1.2.5-21.4.1 mumble-debugsource-1.2.5-21.4.1 mumble-server-1.2.5-21.4.1 mumble-server-debuginfo-1.2.5-21.4.1 - openSUSE 12.3 (x86_64): mumble-32bit-1.2.5-21.4.1 mumble-debuginfo-32bit-1.2.5-21.4.1 References: http://support.novell.com/security/cve/CVE-2014-0044.html http://support.novell.com/security/cve/CVE-2014-0045.html https://bugzilla.novell.com/855478 https://bugzilla.novell.com/862527

1 0

openSUSE-SU-2014:0270-1: moderate: update for libvirt
by opensuse-security＠opensuse.org 21 Feb '14

21 Feb '14

openSUSE Security Update: update for libvirt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0270-1 Rating: moderate References: #857492 #858817 Cross-References: CVE-2013-6458 CVE-2014-1447 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes the following security issues with libvirt: - bnc#857492: Fix libvirtd crash when hot-plugging disks for qemu domains (CVE-2013-6458) - bnc#858817: Don't crash if a connection closes early (CVE-2014-1447) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-151 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libvirt-1.0.2-1.14.1 libvirt-client-1.0.2-1.14.1 libvirt-client-debuginfo-1.0.2-1.14.1 libvirt-debuginfo-1.0.2-1.14.1 libvirt-debugsource-1.0.2-1.14.1 libvirt-devel-1.0.2-1.14.1 libvirt-doc-1.0.2-1.14.1 libvirt-lock-sanlock-1.0.2-1.14.1 libvirt-lock-sanlock-debuginfo-1.0.2-1.14.1 libvirt-python-1.0.2-1.14.1 libvirt-python-debuginfo-1.0.2-1.14.1 - openSUSE 12.3 (x86_64): libvirt-client-32bit-1.0.2-1.14.1 libvirt-client-debuginfo-32bit-1.0.2-1.14.1 libvirt-devel-32bit-1.0.2-1.14.1 References: http://support.novell.com/security/cve/CVE-2013-6458.html http://support.novell.com/security/cve/CVE-2014-1447.html https://bugzilla.novell.com/857492 https://bugzilla.novell.com/858817

1 0

openSUSE-SU-2014:0269-1: moderate: update for icinga
by opensuse-security＠opensuse.org 21 Feb '14

21 Feb '14

openSUSE Security Update: update for icinga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0269-1 Rating: moderate References: #859424 Cross-References: CVE-2013-7107 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue with icinga: - bnc#859424: Fixed vulnerability against CSRF attacks (CVE-2013-7107). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-153 - openSUSE 12.3: zypper in -t patch openSUSE-2014-153 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): icinga-1.10.2-4.10.2 icinga-debuginfo-1.10.2-4.10.2 icinga-debugsource-1.10.2-4.10.2 icinga-devel-1.10.2-4.10.2 icinga-doc-1.10.2-4.10.2 icinga-idoutils-1.10.2-4.10.2 icinga-idoutils-debuginfo-1.10.2-4.10.2 icinga-idoutils-mysql-1.10.2-4.10.2 icinga-idoutils-oracle-1.10.2-4.10.2 icinga-idoutils-pgsql-1.10.2-4.10.2 icinga-plugins-downtimes-1.10.2-4.10.2 icinga-plugins-eventhandlers-1.10.2-4.10.2 icinga-www-1.10.2-4.10.2 icinga-www-debuginfo-1.10.2-4.10.2 monitoring-tools-1.10.2-4.10.2 monitoring-tools-debuginfo-1.10.2-4.10.2 - openSUSE 12.3 (i586 x86_64): icinga-1.10.2-2.8.1 icinga-debuginfo-1.10.2-2.8.1 icinga-debugsource-1.10.2-2.8.1 icinga-devel-1.10.2-2.8.1 icinga-doc-1.10.2-2.8.1 icinga-idoutils-1.10.2-2.8.1 icinga-idoutils-debuginfo-1.10.2-2.8.1 icinga-idoutils-mysql-1.10.2-2.8.1 icinga-idoutils-oracle-1.10.2-2.8.1 icinga-idoutils-pgsql-1.10.2-2.8.1 icinga-plugins-downtimes-1.10.2-2.8.1 icinga-plugins-eventhandlers-1.10.2-2.8.1 icinga-www-1.10.2-2.8.1 icinga-www-debuginfo-1.10.2-2.8.1 monitoring-tools-1.10.2-2.8.1 monitoring-tools-debuginfo-1.10.2-2.8.1 References: http://support.novell.com/security/cve/CVE-2013-7107.html https://bugzilla.novell.com/859424

1 0