April 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:0494-1: moderate: xinetd for tcpmux service
by opensuse-security＠opensuse.org 08 Apr '14

08 Apr '14

openSUSE Security Update: xinetd for tcpmux service ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0494-1 Rating: moderate References: #726737 #762294 #844230 #855685 Cross-References: CVE-2012-0862 CVE-2013-4342 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: xinetd was updated to receive security fixes and a bug fix. Security issues fixed: * CVE-2013-4342 (bnc#844230) - xinetd ignored user and group directives for tcpmux services * CVE-2012-0862 (bnc#762294) - xinetd enabled all services when tcp multiplexing is used Also added support for setting maximum number of open files (bnc#855685). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-43 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): xinetd-2.3.14-155.1 xinetd-debuginfo-2.3.14-155.1 xinetd-debugsource-2.3.14-155.1 References: http://support.novell.com/security/cve/CVE-2012-0862.html http://support.novell.com/security/cve/CVE-2013-4342.html https://bugzilla.novell.com/726737 https://bugzilla.novell.com/762294 https://bugzilla.novell.com/844230 https://bugzilla.novell.com/855685

1 0

openSUSE-SU-2014:0493-1: moderate: security and bugfix upgrade to version 0.8.12
by opensuse-security＠opensuse.org 08 Apr '14

08 Apr '14

openSUSE Security Update: security and bugfix upgrade to version 0.8.12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0493-1 Rating: moderate References: #824710 #861503 #861504 Cross-References: CVE-2013-2178 CVE-2013-7176 CVE-2013-7177 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The fail2ban tool was updated to version 0.8.12 to fix various security issues and also brings bugfixes and features. Security issues fixed: A remote unauthenticated attacker may cause arbitrary IP addresses to be blocked by Fail2ban causing legitimate users to be blocked from accessing services protected by Fail2ban. CVE-2013-7177 (cyrus-imap) and CVE-2013-7176 (postfix) - Use new flushlogs syntax after logrotate - Update to version 0.8.12 * Log rotation can now occur with the command "flushlogs" rather than reloading fail2ban or keeping the logtarget settings consistent in jail.conf/local and /etc/logrotate.d/fail2ban. (dep#697333, rh#891798). * Added ignorecommand option for allowing dynamic determination as to ignore and IP or not. * Remove indentation of name and loglevel while logging to SYSLOG to resolve syslog(-ng) parsing problems. (dep#730202). Log lines now also report "[PID]" after the name portion too. * Epoch dates can now be enclosed within [] * New actions: badips, firewallcmd-ipset, ufw, blocklist_de * New filters: solid-pop3d, nsd, openwebmail, horde, freeswitch, squid, ejabberd, openwebmail, groupoffice * Filter improvements: - apache-noscript now includes php cgi scripts - exim-spam filter to match spamassassin log entry for option SAdevnull. - Added to sshd filter expression for "Received disconnect from : 3: Auth fail" - Improved ACL-handling for Asterisk - Added improper command pipelining to postfix filter. * General fixes: - Added lots of jail.conf entries for missing filters that creaped in over the last year. - synchat changed to use push method which verifies whether all data was send. This ensures that all data is sent before closing the connection. - Fixed python 2.4 compatibility (as sub-second in date patterns weren't 2.4 compatible) - Complain/email actions fixed to only include relevant IPs to reporting * Filter fixes: - Added HTTP referrer bit of the apache access log to the apache filters. - Apache 2.4 perfork regexes fixed - Kernel syslog expression can have leading spaces - allow for ",milliseconds" in the custom date format of proftpd.log - recidive jail to block all protocols - smtps not a IANA standard so may be missing from /etc/services. Due to (still) common use 465 has been used as the explicit port number - Filter dovecot reordered session and TLS items in regex with wider scope for session characters * Ugly Fixes (Potentially incompatible changes): - Unfortunately at the end of last release when the action firewall-cmd-direct-new was added it was too long and had a broken action check. The action was renamed to firewallcmd-new to fit within jail name name length. (gh#fail2ban/fail2ban#395). - Last release added mysqld-syslog-iptables as a jail configuration. This jailname was too long and it has been renamed to mysqld-syslog. - Fixed formating of github references in changelog - reformatted spec-file - Update to version 0.8.11 - In light of CVE-2013-2178 that triggered our last release we have put a significant effort into tightening all of the regexs of our filters to avoid another similar vulnerability. We haven't examined all of these for a potential DoS scenario however it is possible that another DoS vulnerability exists that is fixed by this release. A large number of filters have been updated to include more failure regexs supporting previously unbanned failures and support newer application versions too. We have test cases for most of these now however if you have other examples that demonstrate that a filter is insufficient we welcome your feedback. During the tightening of the regexs to avoid DoS vulnerabilities there is the possibility that we have inadvertently, despite our best intentions, incorrectly allowed a failure to continue. Addresses a possible DoS. Closes gh#fail2ban/fail2ban#248, bnc#824710 within [Init]. Closes gh#fail2ban/fail2ban#232 * Updates to asterisk filter. Closes gh#fail2ban/fail2ban#227, gh#fail2ban/fail2ban#230. * Updates to asterisk to include AUTH_UNKNOWN_DOMAIN. Closes gh#fail2ban/fail2ban#244. on Fedora. Closes gh#fail2ban/fail2ban#112. Thanks to Camusensei for the bug report. insight. Closes gh#fail2ban/fail2ban#103. * [f2156604] pyinotify -- monitor IN_MOVED_TO events. Closes gh#fail2ban/fail2ban#184. Thanks to Jon Foster for report and troubleshooting. Orion Poplawski * [39667ff6] Avoid leaking file descriptors. Closes gh#fail2ban/fail2ban#167. Closes gh#fail2ban/fail2ban#147, gh#fail2ban/fail2ban#148. * [b6a68f51] Fix delaction on server side. Closes gh#fail2ban/fail2ban#124. the fail2ban-client. Closes gh#fail2ban/fail2ban#134. gh#fail2ban/fail2ban#70. Thanks to iGeorgeX for the idea. * [96eb8986] ' and " should also be escaped in action tags Closes gh#fail2ban/fail2ban#109 beilber for the idea. Closes gh#fail2ban/fail2ban#114. fail2ban is running. Closes gh#fail2ban/fail2ban#166. * [29d0df5] Add mysqld filter. Closes gh#fail2ban/fail2ban#152. * [bba3fd8] Add Sogo filter. Closes gh#fail2ban/fail2ban#117. * [be06b1b] Add action for iptables-ipsets. Closes gh#fail2ban/fail2ban#102. * [f336d9f] Add filter for webmin. Closes gh#fail2ban/fail2ban#99. consistently. Closes gh#fail2ban/fail2ban#172. * [b36835f] Add get cinfo to fail2ban-client. Closes gh#fail2ban/fail2ban#124. Closes gh#fail2ban/fail2ban#142. Closes gh#fail2ban/fail2ban#126. Bug report by Michael Heuberger. * [3aeb1a9] Add jail.conf manual page. Closes gh#fail2ban/fail2ban#143. banning due to misconfigured DNS. Close gh#fail2ban/fail2ban#64 * [0935566,5becaf8] Various python 2.4 and 2.5 compatibility fixes. Close gh#fail2ban/fail2ban#83 in the console. Close gh#fail2ban/fail2ban#91 the log file to take 'banip' or 'unbanip' in effect. Close gh#fail2ban/fail2ban#81, gh#fail2ban/fail2ban#86 * [f52ba99] downgraded "already banned" from WARN to INFO level. Closes gh#fail2ban/fail2ban#79 for this gh#fail2ban/fail2ban#87) message stays non-unicode. Close gh#fail2ban/fail2ban#32 friend to developers stuck with Windows (Closes gh#fail2ban/fail2ban#66) repeated offenders. Close gh#fail2ban/fail2ban#19 Close gh#fail2ban/fail2ban#47 (Closes: #669063) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-42 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): fail2ban-0.8.12-26.1 References: http://support.novell.com/security/cve/CVE-2013-2178.html http://support.novell.com/security/cve/CVE-2013-7176.html http://support.novell.com/security/cve/CVE-2013-7177.html https://bugzilla.novell.com/824710 https://bugzilla.novell.com/861503 https://bugzilla.novell.com/861504

1 0

openSUSE-SU-2014:0492-1: important: update for openssl
by opensuse-security＠opensuse.org 08 Apr '14

08 Apr '14

openSUSE Security Update: update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0492-1 Rating: important References: #872299 Cross-References: CVE-2014-0160 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This openssl update fixes one security issue: - bnc#872299: Fixed missing bounds checks for heartbeat messages (CVE-2014-0160). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-277 - openSUSE 12.3: zypper in -t patch openSUSE-2014-277 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1e-11.32.1 libopenssl1_0_0-1.0.1e-11.32.1 libopenssl1_0_0-debuginfo-1.0.1e-11.32.1 openssl-1.0.1e-11.32.1 openssl-debuginfo-1.0.1e-11.32.1 openssl-debugsource-1.0.1e-11.32.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1e-11.32.1 libopenssl1_0_0-32bit-1.0.1e-11.32.1 libopenssl1_0_0-debuginfo-32bit-1.0.1e-11.32.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1e-11.32.1 - openSUSE 12.3 (i586 x86_64): libopenssl-devel-1.0.1e-1.44.1 libopenssl1_0_0-1.0.1e-1.44.1 libopenssl1_0_0-debuginfo-1.0.1e-1.44.1 openssl-1.0.1e-1.44.1 openssl-debuginfo-1.0.1e-1.44.1 openssl-debugsource-1.0.1e-1.44.1 - openSUSE 12.3 (x86_64): libopenssl-devel-32bit-1.0.1e-1.44.1 libopenssl1_0_0-32bit-1.0.1e-1.44.1 libopenssl1_0_0-debuginfo-32bit-1.0.1e-1.44.1 - openSUSE 12.3 (noarch): openssl-doc-1.0.1e-1.44.1 References: http://support.novell.com/security/cve/CVE-2014-0160.html https://bugzilla.novell.com/872299

1 0

openSUSE-RU-2014:0491-1: moderate: gnutls: Fixed access to www.bsi.de
by maintenance＠opensuse.org 08 Apr '14

08 Apr '14

openSUSE Recommended Update: gnutls: Fixed access to www.bsi.de ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0491-1 Rating: moderate References: #870551 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with gnutls: - bnc#870551: Fix access to www.bsi.de Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-276 - openSUSE 12.3: zypper in -t patch openSUSE-2014-276 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): gnutls-3.2.4-2.18.1 gnutls-debuginfo-3.2.4-2.18.1 gnutls-debugsource-3.2.4-2.18.1 libgnutls-devel-3.2.4-2.18.1 libgnutls-openssl-devel-3.2.4-2.18.1 libgnutls-openssl27-3.2.4-2.18.1 libgnutls-openssl27-debuginfo-3.2.4-2.18.1 libgnutls28-3.2.4-2.18.1 libgnutls28-debuginfo-3.2.4-2.18.1 libgnutlsxx-devel-3.2.4-2.18.1 libgnutlsxx28-3.2.4-2.18.1 libgnutlsxx28-debuginfo-3.2.4-2.18.1 - openSUSE 13.1 (x86_64): libgnutls-devel-32bit-3.2.4-2.18.1 libgnutls28-32bit-3.2.4-2.18.1 libgnutls28-debuginfo-32bit-3.2.4-2.18.1 - openSUSE 12.3 (i586 x86_64): gnutls-3.0.28-1.8.1 gnutls-debuginfo-3.0.28-1.8.1 gnutls-debugsource-3.0.28-1.8.1 libgnutls-devel-3.0.28-1.8.1 libgnutls-openssl-devel-3.0.28-1.8.1 libgnutls-openssl27-3.0.28-1.8.1 libgnutls-openssl27-debuginfo-3.0.28-1.8.1 libgnutls28-3.0.28-1.8.1 libgnutls28-debuginfo-3.0.28-1.8.1 libgnutlsxx-devel-3.0.28-1.8.1 libgnutlsxx28-3.0.28-1.8.1 libgnutlsxx28-debuginfo-3.0.28-1.8.1 - openSUSE 12.3 (x86_64): libgnutls-devel-32bit-3.0.28-1.8.1 libgnutls28-32bit-3.0.28-1.8.1 libgnutls28-debuginfo-32bit-3.0.28-1.8.1 References: https://bugzilla.novell.com/870551

1 0

openSUSE-RU-2014:0486-1:
by maintenance＠opensuse.org 07 Apr '14

07 Apr '14

This update fixes two bugs in mutt: - Enable mutt to parse e.g. PGP markers with CRLF - Fixed a mutt crashes in fgetwc in text_enriched_handler openSUSE Recommended Update: This update fixes two bugs in mutt: - Enable mutt to parse e.g. PGP markers with CRLF - Fixed a mutt crashes in fgetwc in text_enriched_handler ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0486-1 Rating: low References: #813498 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: mutt: bug fix update Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-275 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): mutt-1.5.21-36.10.1 mutt-debuginfo-1.5.21-36.10.1 mutt-debugsource-1.5.21-36.10.1 References: https://bugzilla.novell.com/813498

1 0

openSUSE-RU-2014:0485-1: important: sysconfig: fixes a regression introduced with last update and additional bugfixes
by maintenance＠opensuse.org 07 Apr '14

07 Apr '14

openSUSE Recommended Update: sysconfig: fixes a regression introduced with last update and additional bugfixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0485-1 Rating: important References: #846361 #860644 #866870 #868323 #869761 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. Description: This update fixes the following issues with sysconfig: - bnc#869761,bnc#866870: ifup: startmode ifplugd logic error regression fix, Fixed a logic error regression breaking startmode ifplugd introduced while fixing bnc#846361 - bnc#860644, bnc#868323: netconfig: improved troubleshooting capabilities. Added NETCONFIG_VERBOSE and NETCONFIG_FORCE_REPLACE config variables allowing to run all netconfig calls in debug mode and force update of modified files as default. Show service, policy resolving info and log the commandline in debug mode. Fixed to log info/warnings that were printed to stderr only before. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-273 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): sysconfig-0.81.5-26.1 sysconfig-debugsource-0.81.5-26.1 sysconfig-netconfig-0.81.5-26.1 sysconfig-network-0.81.5-26.1 sysconfig-network-debuginfo-0.81.5-26.1 udevmountd-0.81.5-26.1 udevmountd-debuginfo-0.81.5-26.1 References: https://bugzilla.novell.com/846361 https://bugzilla.novell.com/860644 https://bugzilla.novell.com/866870 https://bugzilla.novell.com/868323 https://bugzilla.novell.com/869761

1 0

openSUSE-RU-2014:0484-1: ruby20: Do not replace $LDFLAGS with $libs in pkg_config
by maintenance＠opensuse.org 07 Apr '14

07 Apr '14

openSUSE Recommended Update: ruby20: Do not replace $LDFLAGS with $libs in pkg_config ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0484-1 Rating: low References: #870546 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes following issues with ruby20: - bnc#870546: Do not replace $LDFLAGS with $libs in pkg_config * fixes building of gems with native extensions such as Nokogiri Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-274 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): ruby20-2.0.0.p247-3.15.1 ruby20-debuginfo-2.0.0.p247-3.15.1 ruby20-debugsource-2.0.0.p247-3.15.1 ruby20-devel-2.0.0.p247-3.15.1 ruby20-devel-extra-2.0.0.p247-3.15.1 ruby20-tk-2.0.0.p247-3.15.1 ruby20-tk-debuginfo-2.0.0.p247-3.15.1 - openSUSE 13.1 (noarch): ruby20-doc-ri-2.0.0.p247-3.15.1 References: https://bugzilla.novell.com/870546

1 0

openSUSE-SU-2014:0483-1: moderate: xen: security and bugfix release to 4.2.4 c/s 26280
by opensuse-security＠opensuse.org 04 Apr '14

04 Apr '14

openSUSE Security Update: xen: security and bugfix release to 4.2.4 c/s 26280 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0483-1 Rating: moderate References: #831120 #833251 #833483 #840997 #842417 #846849 #848014 #848657 #849665 #849667 #849668 #853048 #853049 #858311 #858496 #860163 #860165 #860300 #860302 #861256 #863297 Cross-References: CVE-2013-2212 CVE-2013-4494 CVE-2013-4551 CVE-2013-4553 CVE-2013-4554 CVE-2013-6400 CVE-2013-6885 CVE-2014-1642 CVE-2014-1666 CVE-2014-1891 CVE-2014-1892 CVE-2014-1893 CVE-2014-1894 CVE-2014-1895 CVE-2014-1896 CVE-2014-1950 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves 16 vulnerabilities and has 5 fixes is now available. Description: Xen was updated to fix various bugs and security issues: Update to Xen version 4.2.4 c/s 26280. - bnc#861256 - CVE-2014-1950: xen: XSA-88: use-after-free in xc_cpupool_getinfo() under memory pressure. (fix included with update) - bnc#863297: xend/pvscsi: recognize also SCSI CDROM devices - bnc#858496 - CVE-2014-1642: Xen: XSA-83: Out-of-memory condition yielding memory corruption during IRQ setup - bnc#860163 - xen: XSA-84: integer overflow in several XSM/Flask hypercalls (CVE-2014-1891 CVE-2014-1892 CVE-2014-1893 CVE-2014-1894) - bnc#860165 - CVE-2014-1895: xen: XSA-85: Off-by-one error in FLASK_AVC_CACHESTAT hypercall - bnc#860300 - CVE-2014-1896: xen: XSA-86: libvchan failure handling malicious ring indexes - bnc#860302 - CVE-2014-1666: xen: XSA-87: PHYSDEVOP_{prepare,release}_msix exposed to unprivileged guests - bnc#858311 - Server is not booting in kernel XEN after latest updates - (XEN) setup 0000:00:18.0 for d0 failed (-19) - bnc#858496 - CVE-2014-1642: Xen: XSA-83: Out-of-memory condition yielding memory corruption during IRQ setup - bnc#853049 - CVE-2013-6885: xen: XSA-82: Guest triggerable AMD CPU erratum may cause host hang - bnc#853048 - CVE-2013-6400: xen: XSA-80: IOMMU TLB flushing may be inadvertently suppressed - bnc#831120 - CVE-2013-2212: xen: XSA-60: Excessive time to disable caching with HVM guests with PCI passthrough - bnc#848014 - [HP HPS] Xen hypervisor panics on 8-blades nPar with 46-bit memory addressing - bnc#833251 - [HP BCS SLES11 Bug]: In HPs UEFI x86_64 platform and with xen environment, in booting stage ,xen hypervisor will panic. - pygrub: Support (/dev/xvda) style disk specifications - bnc#849667 - CVE-2014-1895: xen: XSA-74: Lock order reversal between page_alloc_lock and mm_rwlock - bnc#849668 - CVE-2013-4554: xen: XSA-76: Hypercalls exposed to privilege rings 1 and 2 of HVM guests - bnc#842417 - In HPs UEFI x86_64 platform and sles11sp3 with xen environment, dom0 will soft lockup on multiple blades nPar. - bnc#848014 - [HP HPS] Xen hypervisor panics on 8-blades nPar with 46-bit memory addressing - bnc#846849 - Soft lockup with PCI passthrough and many VCPUs - bnc#833483 - Boot Failure with xen kernel in UEFI mode with error "No memory for trampoline" - bnc#849665 - CVE-2013-4551: xen: XSA-75: Host crash due to guest VMX instruction execution - The upstream version of checking for xend when using the 'xl' command is used is not working. - bnc#840997 - It is possible to start a VM twice on the same node. - bnc#848657 - xen: CVE-2013-4494: XSA-73: Lock order reversal between page allocation and grant table locks Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-271 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): xen-debugsource-4.2.4_02-1.26.2 xen-devel-4.2.4_02-1.26.2 xen-kmp-default-4.2.4_02_k3.7.10_1.28-1.26.2 xen-kmp-default-debuginfo-4.2.4_02_k3.7.10_1.28-1.26.2 xen-kmp-desktop-4.2.4_02_k3.7.10_1.28-1.26.2 xen-kmp-desktop-debuginfo-4.2.4_02_k3.7.10_1.28-1.26.2 xen-libs-4.2.4_02-1.26.2 xen-libs-debuginfo-4.2.4_02-1.26.2 xen-tools-domU-4.2.4_02-1.26.2 xen-tools-domU-debuginfo-4.2.4_02-1.26.2 - openSUSE 12.3 (x86_64): xen-4.2.4_02-1.26.2 xen-doc-html-4.2.4_02-1.26.2 xen-doc-pdf-4.2.4_02-1.26.2 xen-libs-32bit-4.2.4_02-1.26.2 xen-libs-debuginfo-32bit-4.2.4_02-1.26.2 xen-tools-4.2.4_02-1.26.2 xen-tools-debuginfo-4.2.4_02-1.26.2 - openSUSE 12.3 (i586): xen-kmp-pae-4.2.4_02_k3.7.10_1.28-1.26.2 xen-kmp-pae-debuginfo-4.2.4_02_k3.7.10_1.28-1.26.2 References: http://support.novell.com/security/cve/CVE-2013-2212.html http://support.novell.com/security/cve/CVE-2013-4494.html http://support.novell.com/security/cve/CVE-2013-4551.html http://support.novell.com/security/cve/CVE-2013-4553.html http://support.novell.com/security/cve/CVE-2013-4554.html http://support.novell.com/security/cve/CVE-2013-6400.html http://support.novell.com/security/cve/CVE-2013-6885.html http://support.novell.com/security/cve/CVE-2014-1642.html http://support.novell.com/security/cve/CVE-2014-1666.html http://support.novell.com/security/cve/CVE-2014-1891.html http://support.novell.com/security/cve/CVE-2014-1892.html http://support.novell.com/security/cve/CVE-2014-1893.html http://support.novell.com/security/cve/CVE-2014-1894.html http://support.novell.com/security/cve/CVE-2014-1895.html http://support.novell.com/security/cve/CVE-2014-1896.html http://support.novell.com/security/cve/CVE-2014-1950.html https://bugzilla.novell.com/831120 https://bugzilla.novell.com/833251 https://bugzilla.novell.com/833483 https://bugzilla.novell.com/840997 https://bugzilla.novell.com/842417 https://bugzilla.novell.com/846849 https://bugzilla.novell.com/848014 https://bugzilla.novell.com/848657 https://bugzilla.novell.com/849665 https://bugzilla.novell.com/849667 https://bugzilla.novell.com/849668 https://bugzilla.novell.com/853048 https://bugzilla.novell.com/853049 https://bugzilla.novell.com/858311 https://bugzilla.novell.com/858496 https://bugzilla.novell.com/860163 https://bugzilla.novell.com/860165 https://bugzilla.novell.com/860300 https://bugzilla.novell.com/860302 https://bugzilla.novell.com/861256 https://bugzilla.novell.com/863297

1 0

openSUSE-SU-2014:0482-1: moderate: xen: update to 4.3.2 c/s 27404 security and bugfix release
by opensuse-security＠opensuse.org 04 Apr '14

04 Apr '14

openSUSE Security Update: xen: update to 4.3.2 c/s 27404 security and bugfix release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0482-1 Rating: moderate References: #831120 #853048 #853049 Cross-References: CVE-2013-2212 CVE-2013-4553 CVE-2013-4554 CVE-2013-6400 CVE-2013-6885 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: Xen was updated to fix security issues and bugs. Update to bug fix release Xen 4.3.2 c/s 27404 - CVE-2013-6885: xen: XSA-82: A guest triggerable AMD CPU erratum may cause host hangs. - CVE-2013-6400: xen: XSA-80: IOMMU TLB flushing may be inadvertently suppressed, potentially leaking information to other guests. - CVE-2013-2212: xen: XSA-60: Excessive time to disable caching with HVM guests with PCI passthrough - pygrub: Support (/dev/xvda) style disk specifications Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-272 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): xen-debugsource-4.3.2_01-12.1 xen-devel-4.3.2_01-12.1 xen-kmp-default-4.3.2_01_k3.11.10_7-12.1 xen-kmp-default-debuginfo-4.3.2_01_k3.11.10_7-12.1 xen-kmp-desktop-4.3.2_01_k3.11.10_7-12.1 xen-kmp-desktop-debuginfo-4.3.2_01_k3.11.10_7-12.1 xen-libs-4.3.2_01-12.1 xen-libs-debuginfo-4.3.2_01-12.1 xen-tools-domU-4.3.2_01-12.1 xen-tools-domU-debuginfo-4.3.2_01-12.1 - openSUSE 13.1 (x86_64): xen-4.3.2_01-12.1 xen-doc-html-4.3.2_01-12.1 xen-libs-32bit-4.3.2_01-12.1 xen-libs-debuginfo-32bit-4.3.2_01-12.1 xen-tools-4.3.2_01-12.1 xen-tools-debuginfo-4.3.2_01-12.1 xen-xend-tools-4.3.2_01-12.1 xen-xend-tools-debuginfo-4.3.2_01-12.1 - openSUSE 13.1 (i586): xen-kmp-pae-4.3.2_01_k3.11.10_7-12.1 xen-kmp-pae-debuginfo-4.3.2_01_k3.11.10_7-12.1 References: http://support.novell.com/security/cve/CVE-2013-2212.html http://support.novell.com/security/cve/CVE-2013-4553.html http://support.novell.com/security/cve/CVE-2013-4554.html http://support.novell.com/security/cve/CVE-2013-6400.html http://support.novell.com/security/cve/CVE-2013-6885.html https://bugzilla.novell.com/831120 https://bugzilla.novell.com/853048 https://bugzilla.novell.com/853049

1 0

openSUSE-SU-2014:0481-1: moderate: file: fixed potential CPU consumption problem
by opensuse-security＠opensuse.org 04 Apr '14

04 Apr '14

openSUSE Security Update: file: fixed potential CPU consumption problem ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0481-1 Rating: moderate References: #869906 Cross-References: CVE-2013-7345 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: file was updated to fix extensive backtracking in awk rule regular expression which could lead to a CPU consumption denial of service. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-270 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): file-5.11-12.23.1 file-debuginfo-5.11-12.23.1 file-debugsource-5.11-12.23.1 file-devel-5.11-12.23.1 libmagic-data-5.11-12.23.1 libmagic1-5.11-12.23.1 libmagic1-debuginfo-5.11-12.23.1 python-magic-5.11-12.23.1 - openSUSE 12.3 (x86_64): libmagic1-32bit-5.11-12.23.1 libmagic1-debuginfo-32bit-5.11-12.23.1 References: http://support.novell.com/security/cve/CVE-2013-7345.html https://bugzilla.novell.com/869906

1 0