May 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:0737-1: moderate: sudo: flaw without env_reset
by opensuse-security＠opensuse.org 31 May '14

31 May '14

openSUSE Security Update: sudo: flaw without env_reset ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0737-1 Rating: moderate References: #866503 Cross-References: CVE-2014-0106 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The following security issue was fixed: If the env_reset option is disabled in the sudoers file, a malicious user with sudo permissions may be able to run arbitrary commands with elevated privileges by manipulating the environment of a command the user is legitimately allowed to run. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-55 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): sudo-1.7.6p2-0.23.1 sudo-debuginfo-1.7.6p2-0.23.1 sudo-debugsource-1.7.6p2-0.23.1 References: http://support.novell.com/security/cve/CVE-2014-0106.html https://bugzilla.novell.com/866503

1 0

openSUSE-SU-2014:0736-1: policycoreutils setuid() fix
by opensuse-security＠opensuse.org 30 May '14

30 May '14

openSUSE Security Update: policycoreutils setuid() fix ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0736-1 Rating: low References: #876832 Cross-References: CVE-2014-3215 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Besides other enhancements, this version update contains: - fix for CVE-2014-3215 (bnc#876832) * use PR_SET_NO_NEW_PRIVS to prevent gain of new privileges * added libcap-ng-CVE-2014-3215.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-401 - openSUSE 12.3: zypper in -t patch openSUSE-2014-401 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libcap-ng-debugsource-0.7.3-2.4.1 libcap-ng-devel-0.7.3-2.4.1 libcap-ng-python-debugsource-0.7.3-2.4.1 libcap-ng-utils-0.7.3-2.4.1 libcap-ng-utils-debuginfo-0.7.3-2.4.1 libcap-ng0-0.7.3-2.4.1 libcap-ng0-debuginfo-0.7.3-2.4.1 python-capng-0.7.3-2.4.1 python-capng-debuginfo-0.7.3-2.4.1 - openSUSE 13.1 (x86_64): libcap-ng0-32bit-0.7.3-2.4.1 libcap-ng0-debuginfo-32bit-0.7.3-2.4.1 - openSUSE 12.3 (i586 x86_64): libcap-ng-debugsource-0.6.6-11.4.1 libcap-ng-devel-0.6.6-11.4.1 libcap-ng-python-debugsource-0.6.6-11.4.1 libcap-ng-utils-0.6.6-11.4.1 libcap-ng-utils-debuginfo-0.6.6-11.4.1 libcap-ng0-0.6.6-11.4.1 libcap-ng0-debuginfo-0.6.6-11.4.1 python-capng-0.6.6-11.4.1 python-capng-debuginfo-0.6.6-11.4.1 - openSUSE 12.3 (x86_64): libcap-ng0-32bit-0.6.6-11.4.1 libcap-ng0-debuginfo-32bit-0.6.6-11.4.1 References: http://support.novell.com/security/cve/CVE-2014-3215.html https://bugzilla.novell.com/876832

1 0

openSUSE-SU-2014:0735-1: moderate: python-lxml: Fixed input sanitization
by opensuse-security＠opensuse.org 30 May '14

30 May '14

openSUSE Security Update: python-lxml: Fixed input sanitization ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0735-1 Rating: moderate References: #657698 #877258 Cross-References: CVE-2014-3146 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: python-lxml was fixed to ensure proper input sanitization in clean_html (CVE-2014-3146). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-402 - openSUSE 12.3: zypper in -t patch openSUSE-2014-402 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): python-lxml-3.2.3-2.5.1 python-lxml-debuginfo-3.2.3-2.5.1 python-lxml-debugsource-3.2.3-2.5.1 - openSUSE 13.1 (noarch): python-lxml-doc-3.2.3-2.5.1 - openSUSE 12.3 (i586 x86_64): python-lxml-2.3.4-6.4.1 python-lxml-debuginfo-2.3.4-6.4.1 python-lxml-debugsource-2.3.4-6.4.1 python3-lxml-2.3.4-6.4.1 python3-lxml-debuginfo-2.3.4-6.4.1 python3-lxml-debugsource-2.3.4-6.4.1 - openSUSE 12.3 (noarch): python-lxml-doc-2.3.4-6.4.1 python3-lxml-doc-2.3.4-6.4.1 References: http://support.novell.com/security/cve/CVE-2014-3146.html https://bugzilla.novell.com/657698 https://bugzilla.novell.com/877258

1 0

openSUSE-SU-2014:0722-1: moderate: update for libgadu
by opensuse-security＠opensuse.org 28 May '14

28 May '14

openSUSE Security Update: update for libgadu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0722-1 Rating: moderate References: #878540 Cross-References: CVE-2013-6487 CVE-2014-3775 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: - Update to version 1.11.4, bugfix release: + Fix buffer overflow with remote code execution potential. Only triggerable by a Gadu-Gadu server or a man-in-the-middle. CVE-2013-6487 (bnc#861019, bnc#878540) + Fix memory overwrite in file transfer with proxy server. CVE-2014-3775 (bnc#878540) + Minor fixes reported by Pidgin project members. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-400 - openSUSE 12.3: zypper in -t patch openSUSE-2014-400 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libgadu-debugsource-1.11.4-4.4.1 libgadu-devel-1.11.4-4.4.1 libgadu3-1.11.4-4.4.1 libgadu3-debuginfo-1.11.4-4.4.1 - openSUSE 12.3 (i586 x86_64): libgadu-debugsource-1.11.4-2.4.1 libgadu-devel-1.11.4-2.4.1 libgadu3-1.11.4-2.4.1 libgadu3-debuginfo-1.11.4-2.4.1 References: http://support.novell.com/security/cve/CVE-2013-6487.html http://support.novell.com/security/cve/CVE-2014-3775.html https://bugzilla.novell.com/878540

1 0

openSUSE-RU-2014:0721-1: osc: Update to version 0.146
by maintenance＠opensuse.org 28 May '14

28 May '14

openSUSE Recommended Update: osc: Update to version 0.146 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0721-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues with osc: - Update to version 0.146 + support maintenance release request with acceptinfo data (OBS 2.6) + setlinkrev can be used to update frozen links to current revisions again + report errors in case request accept fails + support epoch number handling for local builds + support bugowner request handling for groups + support usage of fedoras mock to build packages + support build --prefer-pkgs for Arch linux + support bash-completion for .kiwi files Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-399 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): osc-0.146.0-2.16.1 References:

1 0

openSUSE-SU-2014:0720-1: moderate: update for rubygem-actionpack-3_2
by opensuse-security＠opensuse.org 28 May '14

28 May '14

openSUSE Security Update: update for rubygem-actionpack-3_2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0720-1 Rating: moderate References: #876714 Cross-References: CVE-2014-0130 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - fix CVE-2014-0130: rubygem-actionpack: directory traversal issue (bnc#876714) CVE-2014-0130.patch: contains the fix Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-396 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): rubygem-actionpack-3_2-3.2.12-1.28.1 rubygem-actionpack-3_2-doc-3.2.12-1.28.1 References: http://support.novell.com/security/cve/CVE-2014-0130.html https://bugzilla.novell.com/876714

1 0

openSUSE-SU-2014:0719-1: moderate: update for tor
by opensuse-security＠opensuse.org 28 May '14

28 May '14

openSUSE Security Update: update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0719-1 Rating: moderate References: #878486 Cross-References: CVE-2014-0160 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - tor 0.2.4.22 [bnc#878486] Tor was updated to the recommended version of the 0.2.4.x series. - major features in 0.2.4.x: - improved client resilience - support better link encryption with forward secrecy - new NTor circuit handshake - change relay queue for circuit create requests from size-based limit to time-based limit - many bug fixes and minor features - changes contained in 0.2.4.22: Backports numerous high-priority fixes. These include blocking all authority signing keys that may have been affected by the OpenSSL "heartbleed" bug, choosing a far more secure set of TLS ciphersuites by default, closing a couple of memory leaks that could be used to run a target relay out of RAM. - Major features (security) - Block authority signing keys that were used on authorities vulnerable to the "heartbleed" bug in OpenSSL (CVE-2014-0160). - Major bugfixes (security, OOM): - Fix a memory leak that could occur if a microdescriptor parse fails during the tokenizing step. - Major bugfixes (TLS cipher selection): - The relay ciphersuite list is now generated automatically based on uniform criteria, and includes all OpenSSL ciphersuites with acceptable strength and forward secrecy. - Relays now trust themselves to have a better view than clients of which TLS ciphersuites are better than others. - Clients now try to advertise the same list of ciphersuites as Firefox 28. - includes changes from 0.2.4.21: Further improves security against potential adversaries who find breaking 1024-bit crypto doable, and backports several stability and robustness patches from the 0.2.5 branch. - Major features (client security): - When we choose a path for a 3-hop circuit, make sure it contains at least one relay that supports the NTor circuit extension handshake. Otherwise, there is a chance that we're building a circuit that's worth attacking by an adversary who finds breaking 1024-bit crypto doable, and that chance changes the game theory. - Major bugfixes: - Do not treat streams that fail with reason END_STREAM_REASON_INTERNAL as indicating a definite circuit failure, since it could also indicate an ENETUNREACH connection error - includes changes from 0.2.4.20: - Do not allow OpenSSL engines to replace the PRNG, even when HardwareAccel is set. - Fix assertion failure when AutomapHostsOnResolve yields an IPv6 address. - Avoid launching spurious extra circuits when a stream is pending. - packaging changes: - remove init script shadowing systemd unit - general cleanup - Add tor-fw-helper for UPnP port forwarding; not used by default - fix logrotate on systemd-only setups without init scripts, work tor-0.2.2.37-logrotate.patch to tor-0.2.4.x-logrotate.patch - verify source tarball signature Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-398 - openSUSE 12.3: zypper in -t patch openSUSE-2014-398 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): tor-0.2.4.22-5.8.1 tor-debuginfo-0.2.4.22-5.8.1 tor-debugsource-0.2.4.22-5.8.1 - openSUSE 12.3 (i586 x86_64): tor-0.2.4.22-2.8.1 tor-debuginfo-0.2.4.22-2.8.1 tor-debugsource-0.2.4.22-2.8.1 References: http://support.novell.com/security/cve/CVE-2014-0160.html https://bugzilla.novell.com/878486

1 0

openSUSE-SU-2014:0718-1: moderate: update for rubygem-actionpack-3_2
by opensuse-security＠opensuse.org 28 May '14

28 May '14

openSUSE Security Update: update for rubygem-actionpack-3_2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0718-1 Rating: moderate References: #876714 Cross-References: CVE-2014-0130 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - fix CVE-2014-0130: rubygem-actionpack: directory traversal issue (bnc#876714) CVE-2014-0130.patch: contains the fix Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-397 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): rubygem-actionpack-3_2-3.2.13-2.24.1 rubygem-actionpack-3_2-doc-3.2.13-2.24.1 References: http://support.novell.com/security/cve/CVE-2014-0130.html https://bugzilla.novell.com/876714

1 0

openSUSE-RU-2014:0717-1: moderate: apache2: Several fixes
by maintenance＠opensuse.org 27 May '14

27 May '14

openSUSE Recommended Update: apache2: Several fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0717-1 Rating: moderate References: #859439 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with apache2: - bnc#859439: service reload can cause log data to be lost with logrotate under some circumstances: remove "-t" from service reload. - logrotate now uses systemctl semantics, not rcapache2 reload any more. - removed php5 and authz_default from /etc/sysconfig/apache2 upon fresh install - authz_default no longer exists, and php5 should not be enabled by default. This reverts a change from Peter Poeml from March 2005: mod_php5 only runs with prefork MPM, and we have different ways to run php5 by now; prefork is default-conservative and may vanish. - rcapache2 now points at service (systemd facilitation), not at /etc/init.d/apache2 any more. /etc/init.d/apache2 is gone, but can be found at /usr/share/apache2/rc.apache2 . Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-395 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-2.4.6-6.23.1 apache2-debuginfo-2.4.6-6.23.1 apache2-debugsource-2.4.6-6.23.1 apache2-devel-2.4.6-6.23.1 apache2-event-2.4.6-6.23.1 apache2-event-debuginfo-2.4.6-6.23.1 apache2-example-pages-2.4.6-6.23.1 apache2-prefork-2.4.6-6.23.1 apache2-prefork-debuginfo-2.4.6-6.23.1 apache2-utils-2.4.6-6.23.1 apache2-utils-debuginfo-2.4.6-6.23.1 apache2-worker-2.4.6-6.23.1 apache2-worker-debuginfo-2.4.6-6.23.1 - openSUSE 13.1 (noarch): apache2-doc-2.4.6-6.23.1 References: https://bugzilla.novell.com/859439

1 0

openSUSE-SU-2014:0716-1: moderate: libxml2, python-libxml2: Prevent external entities from being loaded
by opensuse-security＠opensuse.org 27 May '14

27 May '14

openSUSE Security Update: libxml2, python-libxml2: Prevent external entities from being loaded ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0716-1 Rating: moderate References: #876652 Cross-References: CVE-2014-0191 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Updated fix for openSUSE-SU-2014:0645-1 because of a regression that caused xmllint to break. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-394 - openSUSE 12.3: zypper in -t patch openSUSE-2014-394 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libxml2-2-2.9.1-2.8.1 libxml2-2-debuginfo-2.9.1-2.8.1 libxml2-debugsource-2.9.1-2.8.1 libxml2-devel-2.9.1-2.8.1 libxml2-tools-2.9.1-2.8.1 libxml2-tools-debuginfo-2.9.1-2.8.1 python-libxml2-2.9.1-2.8.1 python-libxml2-debuginfo-2.9.1-2.8.1 python-libxml2-debugsource-2.9.1-2.8.1 - openSUSE 13.1 (x86_64): libxml2-2-32bit-2.9.1-2.8.1 libxml2-2-debuginfo-32bit-2.9.1-2.8.1 libxml2-devel-32bit-2.9.1-2.8.1 - openSUSE 13.1 (noarch): libxml2-doc-2.9.1-2.8.1 - openSUSE 12.3 (i586 x86_64): libxml2-2-2.9.0-2.25.1 libxml2-2-debuginfo-2.9.0-2.25.1 libxml2-debugsource-2.9.0-2.25.1 libxml2-devel-2.9.0-2.25.1 libxml2-tools-2.9.0-2.25.1 libxml2-tools-debuginfo-2.9.0-2.25.1 python-libxml2-2.9.0-2.25.1 python-libxml2-debuginfo-2.9.0-2.25.1 python-libxml2-debugsource-2.9.0-2.25.1 - openSUSE 12.3 (x86_64): libxml2-2-32bit-2.9.0-2.25.1 libxml2-2-debuginfo-32bit-2.9.0-2.25.1 libxml2-devel-32bit-2.9.0-2.25.1 - openSUSE 12.3 (noarch): libxml2-doc-2.9.0-2.25.1 References: http://support.novell.com/security/cve/CVE-2014-0191.html https://bugzilla.novell.com/876652

1 0