April 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2014:0507-1: pesign: Fixes restriction of -u option. Has no longer to be in the end of the command
by maintenance＠opensuse.org 10 Apr '14

10 Apr '14

openSUSE Recommended Update: pesign: Fixes restriction of -u option. Has no longer to be in the end of the command ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0507-1 Rating: low References: #871339 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This Update fixes the following issue with pesing: -bnc#871339: Fixes restriction of -u option. Has no longer to be in the end of the command Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-283 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): pesign-0.106-3.4.1 pesign-debuginfo-0.106-3.4.1 pesign-debugsource-0.106-3.4.1 References: https://bugzilla.novell.com/871339

1 0

openSUSE-RU-2014:0506-1: yast2-iscsi-client: Fixes yast2 refusing to use a non-standard iqn
by maintenance＠opensuse.org 10 Apr '14

10 Apr '14

openSUSE Recommended Update: yast2-iscsi-client: Fixes yast2 refusing to use a non-standard iqn ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0506-1 Rating: low References: #868220 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes following issue with yast2-iscsi-client: - bnc#868220: yast2 refuses to use a non-standard iqn Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-282 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): yast2-iscsi-client-3.0.1-2.4.1 References: https://bugzilla.novell.com/868220

1 0

openSUSE-RU-2014:0505-1: logrotate: Added return error when nomissingok is specified and the log path doesn't exist.
by maintenance＠opensuse.org 10 Apr '14

10 Apr '14

openSUSE Recommended Update: logrotate: Added return error when nomissingok is specified and the log path doesn't exist. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0505-1 Rating: low References: #871217 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes following issue with logrotate: - bnc#871217: Added return error when nomissingok is specified and the log path doesn't exist Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-286 - openSUSE 12.3: zypper in -t patch openSUSE-2014-286 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): logrotate-3.8.7-4.8.1 logrotate-debuginfo-3.8.7-4.8.1 logrotate-debugsource-3.8.7-4.8.1 - openSUSE 12.3 (i586 x86_64): logrotate-3.8.1-20.12.1 logrotate-debuginfo-3.8.1-20.12.1 logrotate-debugsource-3.8.1-20.12.1 References: https://bugzilla.novell.com/871217

1 0

openSUSE-RU-2014:0504-1: util-linux: Added Patch to identify partitions on which bcache is installed to allow bcache-tools to operate on boot
by maintenance＠opensuse.org 10 Apr '14

10 Apr '14

openSUSE Recommended Update: util-linux: Added Patch to identify partitions on which bcache is installed to allow bcache-tools to operate on boot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0504-1 Rating: low References: #871606 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes following issue with util-linux - bnc#871606: Added Patch to identify partitions on which bcache is installed to allow bcache-tools to operate on boot Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-284 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libblkid-devel-2.23.2-10.1 libblkid1-2.23.2-10.1 libblkid1-debuginfo-2.23.2-10.1 libmount-devel-2.23.2-10.1 libmount1-2.23.2-10.1 libmount1-debuginfo-2.23.2-10.1 libuuid-devel-2.23.2-10.1 libuuid1-2.23.2-10.1 libuuid1-debuginfo-2.23.2-10.1 util-linux-2.23.2-10.1 util-linux-debuginfo-2.23.2-10.1 util-linux-debugsource-2.23.2-10.1 uuidd-2.23.2-10.1 uuidd-debuginfo-2.23.2-10.1 - openSUSE 13.1 (x86_64): libblkid-devel-32bit-2.23.2-10.1 libblkid1-32bit-2.23.2-10.1 libblkid1-debuginfo-32bit-2.23.2-10.1 libmount-devel-32bit-2.23.2-10.1 libmount1-32bit-2.23.2-10.1 libmount1-debuginfo-32bit-2.23.2-10.1 libuuid-devel-32bit-2.23.2-10.1 libuuid1-32bit-2.23.2-10.1 libuuid1-debuginfo-32bit-2.23.2-10.1 - openSUSE 13.1 (noarch): util-linux-lang-2.23.2-10.1 References: https://bugzilla.novell.com/871606

1 0

openSUSE-SU-2014:0501-1: important: chromium to 33.0.1750.152 stable release
by opensuse-security＠opensuse.org 09 Apr '14

09 Apr '14

openSUSE Security Update: chromium to 33.0.1750.152 stable release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0501-1 Rating: important References: #866959 Cross-References: CVE-2014-1700 CVE-2014-1701 CVE-2014-1702 CVE-2014-1703 CVE-2014-1704 CVE-2014-1705 CVE-2014-1713 CVE-2014-1714 CVE-2014-1715 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Chromium was updated to the 33.0.1750.152 stable channel uodate: - Security fixes: * CVE-2014-1713: Use-after-free in Blink bindings * CVE-2014-1714: Windows clipboard vulnerability * CVE-2014-1705: Memory corruption in V8 * CVE-2014-1715: Directory traversal issue Previous stable channel update 33.0.1750.149: - Security fixes: * CVE-2014-1700: Use-after-free in speech * CVE-2014-1701: UXSS in events * CVE-2014-1702: Use-after-free in web database * CVE-2014-1703: Potential sandbox escape due to a use-after-free in web sockets * CVE-2014-1704: Multiple vulnerabilities in V8 fixed in version 3.23.17.18 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-280 - openSUSE 12.3: zypper in -t patch openSUSE-2014-280 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-33.0.1750.152-25.2 chromedriver-debuginfo-33.0.1750.152-25.2 chromium-33.0.1750.152-25.2 chromium-debuginfo-33.0.1750.152-25.2 chromium-debugsource-33.0.1750.152-25.2 chromium-desktop-gnome-33.0.1750.152-25.2 chromium-desktop-kde-33.0.1750.152-25.2 chromium-ffmpegsumo-33.0.1750.152-25.2 chromium-ffmpegsumo-debuginfo-33.0.1750.152-25.2 chromium-suid-helper-33.0.1750.152-25.2 chromium-suid-helper-debuginfo-33.0.1750.152-25.2 - openSUSE 12.3 (i586 x86_64): chromedriver-33.0.1750.152-1.33.2 chromedriver-debuginfo-33.0.1750.152-1.33.2 chromium-33.0.1750.152-1.33.2 chromium-debuginfo-33.0.1750.152-1.33.2 chromium-debugsource-33.0.1750.152-1.33.2 chromium-desktop-gnome-33.0.1750.152-1.33.2 chromium-desktop-kde-33.0.1750.152-1.33.2 chromium-ffmpegsumo-33.0.1750.152-1.33.2 chromium-ffmpegsumo-debuginfo-33.0.1750.152-1.33.2 chromium-suid-helper-33.0.1750.152-1.33.2 chromium-suid-helper-debuginfo-33.0.1750.152-1.33.2 References: http://support.novell.com/security/cve/CVE-2014-1700.html http://support.novell.com/security/cve/CVE-2014-1701.html http://support.novell.com/security/cve/CVE-2014-1702.html http://support.novell.com/security/cve/CVE-2014-1703.html http://support.novell.com/security/cve/CVE-2014-1704.html http://support.novell.com/security/cve/CVE-2014-1705.html http://support.novell.com/security/cve/CVE-2014-1713.html http://support.novell.com/security/cve/CVE-2014-1714.html http://support.novell.com/security/cve/CVE-2014-1715.html https://bugzilla.novell.com/866959

1 0

openSUSE-SU-2014:0500-1: moderate: libyaml: fixed heap overflow
by opensuse-security＠opensuse.org 09 Apr '14

09 Apr '14

openSUSE Security Update: libyaml: fixed heap overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0500-1 Rating: moderate References: #868944 Cross-References: CVE-2014-2525 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libyaml was updated to fix a heap overflow during parsing. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-281 - openSUSE 12.3: zypper in -t patch openSUSE-2014-281 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libyaml-0-2-0.1.4-2.12.1 libyaml-0-2-debuginfo-0.1.4-2.12.1 libyaml-debugsource-0.1.4-2.12.1 libyaml-devel-0.1.4-2.12.1 - openSUSE 12.3 (i586 x86_64): libyaml-0-2-0.1.3-11.12.1 libyaml-0-2-debuginfo-0.1.3-11.12.1 libyaml-debugsource-0.1.3-11.12.1 libyaml-devel-0.1.3-11.12.1 References: http://support.novell.com/security/cve/CVE-2014-2525.html https://bugzilla.novell.com/868944

1 0

openSUSE-SU-2014:0499-1: moderate: a2ps: fixed commandinjection in fixps
by opensuse-security＠opensuse.org 09 Apr '14

09 Apr '14

openSUSE Security Update: a2ps: fixed commandinjection in fixps ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0499-1 Rating: moderate References: #871097 Cross-References: CVE-2014-0466 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: a2ps was updated to fix a security issue: fixps called ghostscript without -dSAFER, enabling postscript files processed by fixps to execute code on the system. (CVE-2014-0466) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-279 - openSUSE 12.3: zypper in -t patch openSUSE-2014-279 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): a2ps-4.13-1356.4.1 a2ps-debuginfo-4.13-1356.4.1 a2ps-debugsource-4.13-1356.4.1 a2ps-devel-4.13-1356.4.1 - openSUSE 12.3 (i586 x86_64): a2ps-4.13-1353.4.1 a2ps-debuginfo-4.13-1353.4.1 a2ps-debugsource-4.13-1353.4.1 a2ps-devel-4.13-1353.4.1 References: http://support.novell.com/security/cve/CVE-2014-0466.html https://bugzilla.novell.com/871097

1 0

openSUSE-SU-2014:0498-1: moderate: python3: security and bugfix update to 3.3.5
by opensuse-security＠opensuse.org 09 Apr '14

09 Apr '14

openSUSE Security Update: python3: security and bugfix update to 3.3.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0498-1 Rating: moderate References: #856835 #856836 #863741 #869222 Cross-References: CVE-2013-1752 CVE-2013-1753 CVE-2013-4238 CVE-2013-7338 CVE-2014-1912 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: Python was updated to 3.3.5 fixing bugs and security issues: * bugfix-only release, closes several security bugs * CVE-2013-1752 (bnc#856836) - DoS flaws with unbounded reads from network * disable SSLv2 by default * DoS on maliciously crafted zip files (CVE-2013-7338, bnc#869222) * CGIHttpRequestHandler directory traversal * gzip decompression bomb in xmlrpc client (CVE-2013-1753, bnc#856835) xmlrpc_gzip_33.patch * potential buffer overflow in recvfrom_into (CVE-2014-1912, bnc#863741) * hundreds of non-security-related bugfixes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-278 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libpython3_3m1_0-3.3.5-5.4.1 libpython3_3m1_0-debuginfo-3.3.5-5.4.1 python3-3.3.5-5.4.1 python3-base-3.3.5-5.4.1 python3-base-debuginfo-3.3.5-5.4.1 python3-base-debugsource-3.3.5-5.4.1 python3-curses-3.3.5-5.4.1 python3-curses-debuginfo-3.3.5-5.4.1 python3-dbm-3.3.5-5.4.1 python3-dbm-debuginfo-3.3.5-5.4.1 python3-debuginfo-3.3.5-5.4.1 python3-debugsource-3.3.5-5.4.1 python3-devel-3.3.5-5.4.1 python3-devel-debuginfo-3.3.5-5.4.1 python3-idle-3.3.5-5.4.1 python3-testsuite-3.3.5-5.4.1 python3-testsuite-debuginfo-3.3.5-5.4.1 python3-tk-3.3.5-5.4.1 python3-tk-debuginfo-3.3.5-5.4.1 python3-tools-3.3.5-5.4.1 - openSUSE 13.1 (x86_64): libpython3_3m1_0-32bit-3.3.5-5.4.1 libpython3_3m1_0-debuginfo-32bit-3.3.5-5.4.1 python3-32bit-3.3.5-5.4.1 python3-base-32bit-3.3.5-5.4.1 python3-base-debuginfo-32bit-3.3.5-5.4.1 python3-debuginfo-32bit-3.3.5-5.4.1 - openSUSE 13.1 (noarch): python3-doc-3.3.5-5.4.1 python3-doc-pdf-3.3.5-5.4.1 References: http://support.novell.com/security/cve/CVE-2013-1752.html http://support.novell.com/security/cve/CVE-2013-1753.html http://support.novell.com/security/cve/CVE-2013-4238.html http://support.novell.com/security/cve/CVE-2013-7338.html http://support.novell.com/security/cve/CVE-2014-1912.html https://bugzilla.novell.com/856835 https://bugzilla.novell.com/856836 https://bugzilla.novell.com/863741 https://bugzilla.novell.com/869222

1 0

openSUSE-SU-2014:0496-1: important: lighttpd to 1.4.35
by opensuse-security＠opensuse.org 08 Apr '14

08 Apr '14

openSUSE Security Update: lighttpd to 1.4.35 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0496-1 Rating: important References: #867350 Cross-References: CVE-2014-2323 CVE-2014-2324 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: lighttpd was updated to version 1.4.35, fixing bugs and security issues: CVE-2014-2323: SQL injection vulnerability in mod_mysql_vhost.c in lighttpd allowed remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname. CVE-2014-2323: Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd allowed remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname. More information can be found on the lighttpd advisory page: http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2 014_01.txt Other changes: * [network/ssl] fix build error if TLSEXT is disabled * [mod_fastcgi] fix use after free (only triggered if fastcgi debug is active) * [mod_rrdtool] fix invalid read (string not null terminated) * [mod_dirlisting] fix memory leak if pcre fails * [mod_fastcgi,mod_scgi] fix resource leaks on spawning backends * [mod_magnet] fix memory leak * add comments for switch fall throughs * remove logical dead code * [buffer] fix length check in buffer_is_equal_right_len * fix resource leaks in error cases on config parsing and other initializations * add force_assert() to enforce assertions as simple assert()s are disabled by -DNDEBUG (fixes #2546) * [mod_cml_lua] fix null pointer dereference * force assertion: setting FD_CLOEXEC must work (if available) * [network] check return value of lseek() * fix unchecked return values from stream_open/stat_cache_get_entry * [mod_webdav] fix logic error in handling file creation error * check length of unix domain socket filenames * fix SQL injection / host name validation (thx Jann Horn)for all the changes see /usr/share/doc/packages/lighttpd/NEWS Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-44 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): lighttpd-1.4.35-41.1 lighttpd-debuginfo-1.4.35-41.1 lighttpd-debugsource-1.4.35-41.1 lighttpd-mod_cml-1.4.35-41.1 lighttpd-mod_cml-debuginfo-1.4.35-41.1 lighttpd-mod_geoip-1.4.35-41.1 lighttpd-mod_geoip-debuginfo-1.4.35-41.1 lighttpd-mod_magnet-1.4.35-41.1 lighttpd-mod_magnet-debuginfo-1.4.35-41.1 lighttpd-mod_mysql_vhost-1.4.35-41.1 lighttpd-mod_mysql_vhost-debuginfo-1.4.35-41.1 lighttpd-mod_rrdtool-1.4.35-41.1 lighttpd-mod_rrdtool-debuginfo-1.4.35-41.1 lighttpd-mod_trigger_b4_dl-1.4.35-41.1 lighttpd-mod_trigger_b4_dl-debuginfo-1.4.35-41.1 lighttpd-mod_webdav-1.4.35-41.1 lighttpd-mod_webdav-debuginfo-1.4.35-41.1 References: http://support.novell.com/security/cve/CVE-2014-2323.html http://support.novell.com/security/cve/CVE-2014-2324.html https://bugzilla.novell.com/867350

1 0

openSUSE-SU-2014:0495-1: moderate: file: fixed off-by-one errors
by opensuse-security＠opensuse.org 08 Apr '14

08 Apr '14

openSUSE Security Update: file: fixed off-by-one errors ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0495-1 Rating: moderate References: #866750 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The file magic scanning tool/library was updated to fix a off-by-one error in the last security fixes. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-45 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): file-5.04-20.1 file-debuginfo-5.04-20.1 file-debugsource-5.04-20.1 file-devel-5.04-20.1 python-magic-5.04-20.1 python-magic-debuginfo-5.04-20.1 python-magic-debugsource-5.04-20.1 - openSUSE 11.4 (x86_64): file-32bit-5.04-20.1 file-debuginfo-32bit-5.04-20.1 - openSUSE 11.4 (ia64): file-debuginfo-x86-5.04-20.1 file-x86-5.04-20.1 References: https://bugzilla.novell.com/866750

1 0