March 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:0361-1: moderate: percona-toolkit: fixed version check security issue
by opensuse-security＠opensuse.org 13 Mar '14

13 Mar '14

openSUSE Security Update: percona-toolkit: fixed version check security issue ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0361-1 Rating: moderate References: #864194 Cross-References: CVE-2014-2029 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: percona-toolkit was updated to 2.1.11 [bnc#864194] CVE-2014-2029 This improves sanitisation of input and output for commands run when performing a version check. This option is not the default. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-205 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): percona-toolkit-2.1.11-2.12.1 References: http://support.novell.com/security/cve/CVE-2014-2029.html https://bugzilla.novell.com/864194

1 0

openSUSE-SU-2014:0360-1: moderate: otrs: security and bugfix update to 3.1.20/3.2.15
by opensuse-security＠opensuse.org 13 Mar '14

13 Mar '14

openSUSE Security Update: otrs: security and bugfix update to 3.1.20/3.2.15 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0360-1 Rating: moderate References: #866476 Cross-References: CVE-2014-1695 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The OTRS ticket system was updated to 3.1.20 / 3.2.15: On openSUSE 12.3 it was updated to 3.1.20: (fix for OSA-2014-03, CVE-2014-1695) * Improved HTML filter. - 3.1.19 2014-01-28 * Fixed bug#10158 - Missing quoting in State::StateGetStatesByType(). * Fixed bug#10099 - Missing challenge token checks on customer interface. * Fixed bug#8489 - setting Tickets per page resets AgentTicketQueue. * Fixed bug#9661 - Useless code in DynamicField backend. * Fixed bug#9622 - Actions in Small ticket overview don't work when cookies are turned off. * Fixed bug#9541 - Package manager cannot use https proxy. * Fixed bug#9594 - No auto-reply sent with multiple From addresses in AgentTicketPhone on PostgreSQL and Oracle. * Fixed bug#3434 - Validity of search time frame not checked by OTRS. * Fixed bug#9596 - On merge and bounce screens is confusing when fill or not 'To', 'Subject' and 'Body' fields. * Fixed bug#9595 - Incomplete page reload handling in merge and bounce. * Fixed bug#3007 - CheckMXRecord and CheckEmailAddresses have no effect on AgentTicketBounce. * Fixed bug#9512 - Database error for invalid date in AgentTicketSearch. * Fixed bug#8835 - No article found for TicketID <TICKET ID> when showing group tickets * Fixed bug#9583 - Dynamic Fields of type Date have timestamp in notifications. * Fixed bug#9579 - SOAP Serializer used in Kernel/GenericInterface/Transport/ HTTP/SOAP.pm does not correctly set namespace. * Fixed bug#7359 - Setting pending states via generic agent does not set pending time. * Fixed bug#8380 - Middle name not displayed in AdminCustomerUser. * Fixed bug#9576 - GI TicketSearch Date and Date/Time dynamic fields are ignored. * Changed Dynamic Field SearchFieldParameterBuild() API, LayoutObject is now optional. * Fixed bug#9573 - Date and DateTime dynamic fields not considered in GenericAgent Jobs. On openSUSE 13.1 it was updated to 3.2.15: (fix for OSA-2014-03, CVE-2014-1695) * Improved HTML filter. * Fixed bug#10207 - DynamicField Search-Function in CustomerFrontend is not working. * Followup for bug#9011 - New value after value mapping can't be 0. * Fixed bug#10214 - Value "0" for DynamicsFields prevents TicketCreation. * Fixed bug#9616 - Too long activities and transitions are not displayed correctly. * Fixed bug#10212 - My tickets & Company tickets in 3.3.4. * Fixed bug#10205 - GenericInterface: Mandatory TimeUnits can't be 0. * Fixed bug#10196 - Ticket merge action does not notify the owner of the existing ticket. * Fixed bug#9692 - On PhoneOutbound articles, the FROM field shows Customer ID instead Agent ID. * Fixed bug#10189 - ProcessManagement: Use article subject if no ticket title is set. * Fixed bug#9654 - TicketUpdate operation doesn't work when authenticated as a customer. * Fixed bug#10137 - Generic interface TicketCreate operation doesn't work when authenticated as a customer. - 3.2.14 * Fixed bug#10172 - Can't create process tickets with disabled richtext. * Fixed bug#10121 - QQMails break in OTRS. * Fixed bug#10158 - Missing quoting in State::StateGetStatesByType(). * Fixed bug#8969 - FAQ module Language files installation fails (Kernel/Language permissions). * Fixed bug#9959 - & breaks ExpandCustomerName. * Fixed bug#10099 - Missing challenge token checks on customer interface. * Fixed bug#10103 - ArticleTypeID is always undef in AgentTicketCompose. * Added functionality to disable access to tickets of other customers with the same customer company in customer interface. * Fixed bug#9650 - Special character in customer id breaks Open Tickets in AgentTicketZoom. * Fixed bug#9723 - TicketAccountedTime stat does not run on Oracle with many tickets * Fixed bug#10077 - regular expressions in postmaster filter return 1 if no regex match. * Fixed bug#10070 - Wrong error message if Transition contains no transition actions. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-202 - openSUSE 12.3: zypper in -t patch openSUSE-2014-202 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): otrs-3.2.15-31.5.1 otrs-doc-3.2.15-31.5.1 otrs-itsm-3.2.9-31.5.1 - openSUSE 12.3 (noarch): otrs-3.1.20-26.9.1 otrs-doc-3.1.20-26.9.1 otrs-itsm-3.1.10-26.9.1 References: http://support.novell.com/security/cve/CVE-2014-1695.html https://bugzilla.novell.com/866476

1 0

openSUSE-SU-2014:0358-1: moderate: libpng16: fixed endless loop in png reader
by opensuse-security＠opensuse.org 12 Mar '14

12 Mar '14

openSUSE Security Update: libpng16: fixed endless loop in png reader ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0358-1 Rating: moderate References: #866298 Cross-References: CVE-2014-0333 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libpng16 was updated to fix a endless loop denial of service in the png reader code. (CVE-2014-0333 [bnc#866298]) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-201 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libpng16-16-1.6.6-12.1 libpng16-16-debuginfo-1.6.6-12.1 libpng16-compat-devel-1.6.6-12.1 libpng16-debugsource-1.6.6-12.1 libpng16-devel-1.6.6-12.1 libpng16-tools-1.6.6-12.1 libpng16-tools-debuginfo-1.6.6-12.1 - openSUSE 13.1 (x86_64): libpng16-16-32bit-1.6.6-12.1 libpng16-16-debuginfo-32bit-1.6.6-12.1 libpng16-compat-devel-32bit-1.6.6-12.1 libpng16-devel-32bit-1.6.6-12.1 References: http://support.novell.com/security/cve/CVE-2014-0333.html https://bugzilla.novell.com/866298

1 0

openSUSE-RU-2014:0357-1: moderate: yast2: Two recommended fixes
by maintenance＠opensuse.org 12 Mar '14

12 Mar '14

openSUSE Recommended Update: yast2: Two recommended fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0357-1 Rating: moderate References: #853300 #864934 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with yast2: - bnc#853300: Add systemd socket support - bnc#864934: Do not check for existence of systemd unit files in Service module Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-200 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): yast2-3.0.13-13.1 yast2-devel-doc-3.0.13-13.1 References: https://bugzilla.novell.com/853300 https://bugzilla.novell.com/864934

1 0

openSUSE-RU-2014:0354-1: moderate: cups: restore correct on-demand startup and listening behaviour
by maintenance＠opensuse.org 11 Mar '14

11 Mar '14

openSUSE Recommended Update: cups: restore correct on-demand startup and listening behaviour ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0354-1 Rating: moderate References: #857372 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The CUPS systemd setup received a change of setup. The state after this update as intended: The CUPS Server is not default started, but is started on-demand on first access by any printer tool like "lp" or "kprinter" or any UI print dialog. The "network browsing" for network printers however will only start once the server runs, so it will take a bit after the on-demand startup for auto discovered printers to show up. If you want to enable the CUPS server on system start, as "root" user run once: systemctl enable cups.service Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-199 - openSUSE 12.3: zypper in -t patch openSUSE-2014-199 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): cups-1.5.4-12.13.1 cups-client-1.5.4-12.13.1 cups-client-debuginfo-1.5.4-12.13.1 cups-ddk-1.5.4-12.13.1 cups-ddk-debuginfo-1.5.4-12.13.1 cups-debuginfo-1.5.4-12.13.1 cups-debugsource-1.5.4-12.13.1 cups-devel-1.5.4-12.13.1 cups-libs-1.5.4-12.13.1 cups-libs-debuginfo-1.5.4-12.13.1 - openSUSE 13.1 (x86_64): cups-libs-32bit-1.5.4-12.13.1 cups-libs-debuginfo-32bit-1.5.4-12.13.1 - openSUSE 12.3 (i586 x86_64): cups-1.5.4-5.11.1 cups-client-1.5.4-5.11.1 cups-client-debuginfo-1.5.4-5.11.1 cups-ddk-1.5.4-5.11.1 cups-ddk-debuginfo-1.5.4-5.11.1 cups-debuginfo-1.5.4-5.11.1 cups-debugsource-1.5.4-5.11.1 cups-devel-1.5.4-5.11.1 cups-libs-1.5.4-5.11.1 cups-libs-debuginfo-1.5.4-5.11.1 - openSUSE 12.3 (x86_64): cups-libs-32bit-1.5.4-5.11.1 cups-libs-debuginfo-32bit-1.5.4-5.11.1 References: https://bugzilla.novell.com/857372

1 0

openSUSE-SU-2014:0353-1: backport of SSLCompression directive, SSLCipherSuite update in template
by opensuse-security＠opensuse.org 10 Mar '14

10 Mar '14

openSUSE Security Update: backport of SSLCompression directive, SSLCipherSuite update in template ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0353-1 Rating: low References: Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This low-profile update introduces a backport of the SSLCompression directive (added to /etc/apache2/ssl-global.conf) that helps mitigating the CRIME attack if set to off (default). Also added to /etc/apache2/ssl-global.conf: "SSLHonorCipherOrder on". /etc/apache2/vhosts.d/vhost-ssl.template now contains a new SSLCipherSuite string. Even though GCM mode of AES is not supported in openssl-1.0.0l, the string works well and may be useful elsewhere, too. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-28 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-2.2.17-76.2 apache2-debuginfo-2.2.17-76.2 apache2-debugsource-2.2.17-76.2 apache2-devel-2.2.17-76.2 apache2-event-2.2.17-76.2 apache2-event-debuginfo-2.2.17-76.2 apache2-example-certificates-2.2.17-76.2 apache2-example-pages-2.2.17-76.2 apache2-itk-2.2.17-76.2 apache2-itk-debuginfo-2.2.17-76.2 apache2-prefork-2.2.17-76.2 apache2-prefork-debuginfo-2.2.17-76.2 apache2-utils-2.2.17-76.2 apache2-utils-debuginfo-2.2.17-76.2 apache2-worker-2.2.17-76.2 apache2-worker-debuginfo-2.2.17-76.2 - openSUSE 11.4 (noarch): apache2-doc-2.2.17-76.2 References:

1 0

openSUSE-RU-2014:0352-1: moderate: youtube-dl: Update to new upstream release 2014.02.28
by maintenance＠opensuse.org 10 Mar '14

10 Mar '14

openSUSE Recommended Update: youtube-dl: Update to new upstream release 2014.02.28 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0352-1 Rating: moderate References: #866153 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with youtube-dl: - Update to new upstream release 2014.02.28 + bnc#866153: miscellaneous fixes to make YT downloading work again + support for ComedyCentral clips + corrected Vimeo description fetching + --verbose now shows more environment information + --no-post-overwrites now takes an argument + New engines: NBA, JustinTV, FunnyOrDie, TweetReel, Steam, Ustream Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-197 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): youtube-dl-2014.02.28-2.4.1 References: https://bugzilla.novell.com/866153

1 0

openSUSE-RU-2014:0351-1: moderate: update for privoxy
by maintenance＠opensuse.org 10 Mar '14

10 Mar '14

openSUSE Recommended Update: update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0351-1 Rating: moderate References: #849923 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following non-security issues with privoxy: - Add proper sysv to service migration - Readd rc link - Remove reference to nonexisting dns6 nss module (bnc#849923) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-195 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): privoxy-3.0.21-2.8.1 privoxy-debuginfo-3.0.21-2.8.1 privoxy-debugsource-3.0.21-2.8.1 privoxy-doc-3.0.21-2.8.1 References: https://bugzilla.novell.com/849923

1 0

openSUSE-RU-2014:0350-1: apache2: Fixed AuthnProviderAlias
by maintenance＠opensuse.org 10 Mar '14

10 Mar '14

openSUSE Recommended Update: apache2: Fixed AuthnProviderAlias ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0350-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issue with apache2: - Fixed AuthnProviderAlias (https://issues.apache.org/bugzilla/show_bug.cgi?id=55622) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-198 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-2.4.6-6.15.1 apache2-debuginfo-2.4.6-6.15.1 apache2-debugsource-2.4.6-6.15.1 apache2-devel-2.4.6-6.15.1 apache2-event-2.4.6-6.15.1 apache2-event-debuginfo-2.4.6-6.15.1 apache2-example-pages-2.4.6-6.15.1 apache2-prefork-2.4.6-6.15.1 apache2-prefork-debuginfo-2.4.6-6.15.1 apache2-utils-2.4.6-6.15.1 apache2-utils-debuginfo-2.4.6-6.15.1 apache2-worker-2.4.6-6.15.1 apache2-worker-debuginfo-2.4.6-6.15.1 - openSUSE 13.1 (noarch): apache2-doc-2.4.6-6.15.1 References:

1 0

openSUSE-RU-2014:0349-1: avahi: do not start unconditionally / by default under sysconfig
by maintenance＠opensuse.org 10 Mar '14

10 Mar '14

openSUSE Recommended Update: avahi: do not start unconditionally / by default under sysconfig ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0349-1 Rating: low References: #851953 #853845 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issue with avahi: - bnc#853845, bnc#851953: do not start unconditionally / by default under sysconfig as it breaks vlan,bridge,bonding setups Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-196 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): avahi-0.6.31-16.6.1 avahi-autoipd-0.6.31-16.6.1 avahi-autoipd-debuginfo-0.6.31-16.6.1 avahi-compat-howl-devel-0.6.31-16.6.1 avahi-compat-mDNSResponder-devel-0.6.31-16.6.1 avahi-debuginfo-0.6.31-16.6.1 avahi-debugsource-0.6.31-16.6.1 avahi-glib2-debugsource-0.6.31-16.6.1 avahi-mono-0.6.31-16.6.1 avahi-qt4-debugsource-0.6.31-16.6.1 avahi-utils-0.6.31-16.6.1 avahi-utils-debuginfo-0.6.31-16.6.1 avahi-utils-gtk-0.6.31-16.6.1 avahi-utils-gtk-debuginfo-0.6.31-16.6.1 libavahi-client3-0.6.31-16.6.1 libavahi-client3-debuginfo-0.6.31-16.6.1 libavahi-common3-0.6.31-16.6.1 libavahi-common3-debuginfo-0.6.31-16.6.1 libavahi-core7-0.6.31-16.6.1 libavahi-core7-debuginfo-0.6.31-16.6.1 libavahi-devel-0.6.31-16.6.1 libavahi-glib-devel-0.6.31-16.6.1 libavahi-glib1-0.6.31-16.6.1 libavahi-glib1-debuginfo-0.6.31-16.6.1 libavahi-gobject-devel-0.6.31-16.6.1 libavahi-gobject0-0.6.31-16.6.1 libavahi-gobject0-debuginfo-0.6.31-16.6.1 libavahi-qt4-1-0.6.31-16.6.1 libavahi-qt4-1-debuginfo-0.6.31-16.6.1 libavahi-qt4-devel-0.6.31-16.6.1 libavahi-ui-gtk3-0-0.6.31-16.6.1 libavahi-ui-gtk3-0-debuginfo-0.6.31-16.6.1 libavahi-ui0-0.6.31-16.6.1 libavahi-ui0-debuginfo-0.6.31-16.6.1 libdns_sd-0.6.31-16.6.1 libdns_sd-debuginfo-0.6.31-16.6.1 libhowl0-0.6.31-16.6.1 libhowl0-debuginfo-0.6.31-16.6.1 python-avahi-0.6.31-16.6.1 python-avahi-gtk-0.6.31-16.6.1 typelib-1_0-Avahi-0_6-0.6.31-16.6.1 - openSUSE 13.1 (x86_64): avahi-debuginfo-32bit-0.6.31-16.6.1 libavahi-client3-32bit-0.6.31-16.6.1 libavahi-client3-debuginfo-32bit-0.6.31-16.6.1 libavahi-common3-32bit-0.6.31-16.6.1 libavahi-common3-debuginfo-32bit-0.6.31-16.6.1 libavahi-glib1-32bit-0.6.31-16.6.1 libavahi-glib1-debuginfo-32bit-0.6.31-16.6.1 libdns_sd-32bit-0.6.31-16.6.1 libdns_sd-debuginfo-32bit-0.6.31-16.6.1 - openSUSE 13.1 (noarch): avahi-lang-0.6.31-16.6.1 References: https://bugzilla.novell.com/851953 https://bugzilla.novell.com/853845

1 0