April 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2014:0521-1: moderate: apache2: fix multiple issues with mod_dav and, by extension, Subversion
by maintenance＠opensuse.org 14 Apr '14

14 Apr '14

openSUSE Recommended Update: apache2: fix multiple issues with mod_dav and, by extension, Subversion ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0521-1 Rating: moderate References: #864308 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes multiple issues with mod_dav and, by extension, Subversion in Apache2 (bnc#864308) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-295 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-2.4.6-6.19.2 apache2-debuginfo-2.4.6-6.19.2 apache2-debugsource-2.4.6-6.19.2 apache2-devel-2.4.6-6.19.2 apache2-event-2.4.6-6.19.2 apache2-event-debuginfo-2.4.6-6.19.2 apache2-example-pages-2.4.6-6.19.2 apache2-prefork-2.4.6-6.19.2 apache2-prefork-debuginfo-2.4.6-6.19.2 apache2-utils-2.4.6-6.19.2 apache2-utils-debuginfo-2.4.6-6.19.2 apache2-worker-2.4.6-6.19.2 apache2-worker-debuginfo-2.4.6-6.19.2 - openSUSE 13.1 (noarch): apache2-doc-2.4.6-6.19.2 References: https://bugzilla.novell.com/864308

1 0

openSUSE-SU-2014:0520-1: moderate: update for flash-player
by opensuse-security＠opensuse.org 14 Apr '14

14 Apr '14

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0520-1 Rating: moderate References: #872692 Cross-References: CVE-2014-0506 CVE-2014-0507 CVE-2014-0508 CVE-2014-0509 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This flash-player update fixes several security issues: - bnc#872692: Security update to 11.2.202.350: * APSB14-09, CVE-2014-0506, CVE-2014-0507, CVE-2014-0508,CVE-2014-0509 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-46 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.350-103.1 flash-player-gnome-11.2.202.350-103.1 flash-player-kde4-11.2.202.350-103.1 References: http://support.novell.com/security/cve/CVE-2014-0506.html http://support.novell.com/security/cve/CVE-2014-0507.html http://support.novell.com/security/cve/CVE-2014-0508.html http://support.novell.com/security/cve/CVE-2014-0509.html https://bugzilla.novell.com/872692

1 0

openSUSE-SU-2014:0518-1: moderate: update for python
by opensuse-security＠opensuse.org 11 Apr '14

11 Apr '14

openSUSE Security Update: update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0518-1 Rating: moderate References: #863741 Cross-References: CVE-2014-1912 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python updated fixes the following security issue: - bnc#863741: Fixed potential buffer overflow in socket.recvfrom_into (CVE-2014-1912). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-289 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libpython2_7-1_0-2.7.3-10.12.1 libpython2_7-1_0-debuginfo-2.7.3-10.12.1 python-2.7.3-10.12.1 python-base-2.7.3-10.12.1 python-base-debuginfo-2.7.3-10.12.1 python-base-debugsource-2.7.3-10.12.1 python-curses-2.7.3-10.12.1 python-curses-debuginfo-2.7.3-10.12.1 python-debuginfo-2.7.3-10.12.1 python-debugsource-2.7.3-10.12.1 python-demo-2.7.3-10.12.1 python-devel-2.7.3-10.12.1 python-gdbm-2.7.3-10.12.1 python-gdbm-debuginfo-2.7.3-10.12.1 python-idle-2.7.3-10.12.1 python-tk-2.7.3-10.12.1 python-tk-debuginfo-2.7.3-10.12.1 python-xml-2.7.3-10.12.1 python-xml-debuginfo-2.7.3-10.12.1 - openSUSE 12.3 (x86_64): libpython2_7-1_0-32bit-2.7.3-10.12.1 libpython2_7-1_0-debuginfo-32bit-2.7.3-10.12.1 python-32bit-2.7.3-10.12.1 python-base-32bit-2.7.3-10.12.1 python-base-debuginfo-32bit-2.7.3-10.12.1 python-debuginfo-32bit-2.7.3-10.12.1 - openSUSE 12.3 (noarch): python-doc-2.7-10.12.1 python-doc-pdf-2.7-10.12.1 References: http://support.novell.com/security/cve/CVE-2014-1912.html https://bugzilla.novell.com/863741

1 0

openSUSE-SU-2014:0517-1: moderate: xinetd for tcpmux service
by opensuse-security＠opensuse.org 11 Apr '14

11 Apr '14

openSUSE Security Update: xinetd for tcpmux service ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0517-1 Rating: moderate References: #762294 #844230 #855685 Cross-References: CVE-2012-0862 CVE-2013-4342 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: xinetd was updated to receive security fixes and a bug fix. Security issues fixed: * CVE-2013-4342 (bnc#844230) - xinetd ignored user and group directives for tcpmux services * CVE-2012-0862 (bnc#762294) - xinetd enabled all services when tcp multiplexing is used Also added support for setting maximum number of open files (bnc#855685). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-292 - openSUSE 12.3: zypper in -t patch openSUSE-2014-292 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): xinetd-2.3.15-2.8.1 xinetd-debuginfo-2.3.15-2.8.1 xinetd-debugsource-2.3.15-2.8.1 - openSUSE 12.3 (i586 x86_64): xinetd-2.3.14-163.4.1 xinetd-debuginfo-2.3.14-163.4.1 xinetd-debugsource-2.3.14-163.4.1 References: http://support.novell.com/security/cve/CVE-2012-0862.html http://support.novell.com/security/cve/CVE-2013-4342.html https://bugzilla.novell.com/762294 https://bugzilla.novell.com/844230 https://bugzilla.novell.com/855685

1 0

openSUSE-SU-2014:0516-1: moderate: nagios: fixed a buffer overflow
by opensuse-security＠opensuse.org 11 Apr '14

11 Apr '14

openSUSE Security Update: nagios: fixed a buffer overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0516-1 Rating: moderate References: #864843 Cross-References: CVE-2014-1878 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Nagios was updated to fix a stack-based buffer overflow in the cmd_submitf function in the CGI handler. (CVE-2014-1878) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-291 - openSUSE 12.3: zypper in -t patch openSUSE-2014-291 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): nagios-3.5.1-3.9.1 nagios-debugsource-3.5.1-3.9.1 nagios-devel-3.5.1-3.9.1 nagios-www-3.5.1-3.9.1 nagios-www-dch-3.5.1-3.9.1 nagios-www-debuginfo-3.5.1-3.9.1 - openSUSE 12.3 (i586 x86_64): nagios-3.5.0-2.18.1 nagios-debuginfo-3.5.0-2.18.1 nagios-debugsource-3.5.0-2.18.1 nagios-devel-3.5.0-2.18.1 nagios-www-3.5.0-2.18.1 nagios-www-dch-3.5.0-2.18.1 nagios-www-debuginfo-3.5.0-2.18.1 References: http://support.novell.com/security/cve/CVE-2014-1878.html https://bugzilla.novell.com/864843

1 0

openSUSE-SU-2014:0515-1: moderate: update for rubygem-rack-ssl
by opensuse-security＠opensuse.org 11 Apr '14

11 Apr '14

openSUSE Security Update: update for rubygem-rack-ssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0515-1 Rating: moderate References: #869162 Cross-References: CVE-2014-2538 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This rubygem-rack-ssl updated fixes the following security issue: - bnc#869162: Fixed XSS in error page (CVE-2014-2538). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-293 - openSUSE 12.3: zypper in -t patch openSUSE-2014-293 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): rubygem-rack-ssl-1.3.3-2.4.1 rubygem-rack-ssl-doc-1.3.3-2.4.1 - openSUSE 12.3 (i586 x86_64): rubygem-rack-ssl-1.3.2-6.4.1 rubygem-rack-ssl-doc-1.3.2-6.4.1 References: http://support.novell.com/security/cve/CVE-2014-2538.html https://bugzilla.novell.com/869162

1 0

openSUSE-RU-2014:0514-1: moderate: curl
by maintenance＠opensuse.org 11 Apr '14

11 Apr '14

openSUSE Recommended Update: curl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0514-1 Rating: moderate References: #868627 #868629 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: curl was updated to fix two security issues: * CVE-2014-0138: wrong re-use of connections * CVE-2014-0139: IP address wildcard certificate validation Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-290 - openSUSE 12.3: zypper in -t patch openSUSE-2014-290 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): curl-7.32.0-2.16.1 curl-debuginfo-7.32.0-2.16.1 curl-debugsource-7.32.0-2.16.1 libcurl-devel-7.32.0-2.16.1 libcurl4-7.32.0-2.16.1 libcurl4-debuginfo-7.32.0-2.16.1 - openSUSE 13.1 (x86_64): libcurl4-32bit-7.32.0-2.16.1 libcurl4-debuginfo-32bit-7.32.0-2.16.1 - openSUSE 12.3 (i586 x86_64): curl-7.28.1-4.33.1 curl-debuginfo-7.28.1-4.33.1 curl-debugsource-7.28.1-4.33.1 libcurl-devel-7.28.1-4.33.1 libcurl4-7.28.1-4.33.1 libcurl4-debuginfo-7.28.1-4.33.1 - openSUSE 12.3 (x86_64): libcurl4-32bit-7.28.1-4.33.1 libcurl4-debuginfo-32bit-7.28.1-4.33.1 References: http://support.novell.com/security/cve/CVE-2014-0138.html http://support.novell.com/security/cve/CVE-2014-0139.html https://bugzilla.novell.com/868627 https://bugzilla.novell.com/868629

1 0

openSUSE-SU-2014:0513-1: CVE-2014-0128: squid can crash when SSLBump is used in combination with range requests.
by opensuse-security＠opensuse.org 11 Apr '14

11 Apr '14

openSUSE Security Update: CVE-2014-0128: squid can crash when SSLBump is used in combination with range requests. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0513-1 Rating: low References: #867533 Cross-References: CVE-2014-0128 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The SSLBump feature acts as TLS/SSL termination for clients. If this feature is enabled, squid can crash with range requests, leading to a potential Denial of Service condition. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch openSUSE-2014-288 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): squid3-3.1.23-23.1 squid3-debuginfo-3.1.23-23.1 squid3-debugsource-3.1.23-23.1 References: http://support.novell.com/security/cve/CVE-2014-0128.html https://bugzilla.novell.com/867533

1 0

openSUSE-RU-2014:0509-1: important: rubygem-activesupport-3_2: Fixes conflict with the last update
by maintenance＠opensuse.org 10 Apr '14

10 Apr '14

openSUSE Recommended Update: rubygem-activesupport-3_2: Fixes conflict with the last update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0509-1 Rating: important References: #871017 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with rubygem-activesupport-3_2: -bnc#871017: fixes that openSUSE-2014-185 cannot be installed due to wrong dependency on rubygem-activesupport-3_2-3.2.13-3.10.1.x86_64 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-287 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): rubygem-activesupport-3_2-3.2.13-3.14.1 rubygem-activesupport-3_2-doc-3.2.13-3.14.1 References: https://bugzilla.novell.com/871017

1 0

openSUSE-RU-2014:0508-1: vim: Re-enabled X clipboard support
by maintenance＠opensuse.org 10 Apr '14

10 Apr '14

openSUSE Recommended Update: vim: Re-enabled X clipboard support ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0508-1 Rating: low References: #853072 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This Update fixes following issue for vim: -bnc#853072: Re-enabled X clipboard support Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-285 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): gvim-7.4.052-4.1 gvim-debuginfo-7.4.052-4.1 vim-7.4.052-4.1 vim-debuginfo-7.4.052-4.1 vim-debugsource-7.4.052-4.1 - openSUSE 13.1 (noarch): vim-data-7.4.052-4.1 References: https://bugzilla.novell.com/853072

1 0