May 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:0715-1: moderate: PostfixAdmin: update to 2.3.7
by opensuse-security＠opensuse.org 27 May '14

27 May '14

openSUSE Security Update: PostfixAdmin: update to 2.3.7 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0715-1 Rating: moderate References: #870434 Cross-References: CVE-2014-2655 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Update PostfixAdmin to 2.3.7: - fix a SQL injection in list-virtual.php (CVE-2014-2655, bnc#870434) - add support for new longer TLDs like .international - fix various small bugs - translation updates for lt and da - vacation.pl: disable use of TLS by default due to a bug in Mail::Sender 0.8.22 (you can re-enable it with $smtp_tls_allowed) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-393 - openSUSE 12.3: zypper in -t patch openSUSE-2014-393 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): postfixadmin-2.3.7-5.4.1 - openSUSE 12.3 (noarch): postfixadmin-2.3.7-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-2655.html https://bugzilla.novell.com/870434

1 0

openSUSE-RU-2014:0712-1: moderate: Apache Subversion 1.7.17 non-security bugfix-release
by maintenance＠opensuse.org 26 May '14

26 May '14

openSUSE Recommended Update: Apache Subversion 1.7.17 non-security bugfix-release ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0712-1 Rating: moderate References: #877560 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with Apache Subversion: - bnc#877560: Update to 1.7.17 + Client-side bugfixes: * log: use proper peg revision over DAV * move: fix errors when moving files between an external and the parent working copy * copy: fix 'svn copy URL WC' on relocated working copies + Server-side bugfixes: * mod_dav_svn: blacklist building with broken versions of httpd; 2.2.25, 2.4.5 and 2.4.6 * mod_dav_svn: detect out of dateness correctly during commit + Developer-visible changes: * fix libmagic detection with custom LDFLAGS * fix a missing null byte when handling old pre-1.4 deltas * support building with Serf 1.3.x + Bindings: * javahl: fix crash from resolve callback throwing an exception Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-392 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.7.17-2.32.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.7.17-2.32.1 libsvn_auth_kwallet-1-0-1.7.17-2.32.1 libsvn_auth_kwallet-1-0-debuginfo-1.7.17-2.32.1 subversion-1.7.17-2.32.1 subversion-debuginfo-1.7.17-2.32.1 subversion-debugsource-1.7.17-2.32.1 subversion-devel-1.7.17-2.32.1 subversion-perl-1.7.17-2.32.1 subversion-perl-debuginfo-1.7.17-2.32.1 subversion-python-1.7.17-2.32.1 subversion-python-debuginfo-1.7.17-2.32.1 subversion-server-1.7.17-2.32.1 subversion-server-debuginfo-1.7.17-2.32.1 subversion-tools-1.7.17-2.32.1 subversion-tools-debuginfo-1.7.17-2.32.1 - openSUSE 12.3 (noarch): subversion-bash-completion-1.7.17-2.32.1 References: https://bugzilla.novell.com/877560

1 0

openSUSE-SU-2014:0711-1: moderate: libXfont: Fixed multiple vulnerabilities
by opensuse-security＠opensuse.org 23 May '14

23 May '14

openSUSE Security Update: libXfont: Fixed multiple vulnerabilities ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0711-1 Rating: moderate References: #857544 Cross-References: CVE-2014-0209 CVE-2014-0210 CVE-2014-0211 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: libxfont was updated to fix multiple vulnerabilities: - Integer overflow of allocations in font metadata file parsing (CVE-2014-0209). - Unvalidated length fields when parsing xfs protocol replies (CVE-2014-0210). - Integer overflows calculating memory needs for xfs replies (CVE-2014-0211). These vulnerabilities could be used by a local, authenticated user to raise privileges or by a remote attacker with control of the font server to execute code with the privileges of the X server. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-391 - openSUSE 12.3: zypper in -t patch openSUSE-2014-391 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libXfont-debugsource-1.4.6-2.8.1 libXfont-devel-1.4.6-2.8.1 libXfont1-1.4.6-2.8.1 libXfont1-debuginfo-1.4.6-2.8.1 - openSUSE 13.1 (x86_64): libXfont-devel-32bit-1.4.6-2.8.1 libXfont1-32bit-1.4.6-2.8.1 libXfont1-debuginfo-32bit-1.4.6-2.8.1 - openSUSE 12.3 (i586 x86_64): libXfont-debugsource-1.4.5-4.8.1 libXfont-devel-1.4.5-4.8.1 libXfont1-1.4.5-4.8.1 libXfont1-debuginfo-1.4.5-4.8.1 - openSUSE 12.3 (x86_64): libXfont-devel-32bit-1.4.5-4.8.1 libXfont1-32bit-1.4.5-4.8.1 libXfont1-debuginfo-32bit-1.4.5-4.8.1 References: http://support.novell.com/security/cve/CVE-2014-0209.html http://support.novell.com/security/cve/CVE-2014-0210.html http://support.novell.com/security/cve/CVE-2014-0211.html https://bugzilla.novell.com/857544

1 0

openSUSE-SU-2014:0710-1:
by opensuse-security＠opensuse.org 23 May '14

23 May '14

openSUSE Security Update: ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0710-1 Rating: low References: #876862 Cross-References: CVE-2014-3230 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: No description available. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-390 - openSUSE 12.3: zypper in -t patch openSUSE-2014-390 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): perl-LWP-Protocol-https-6.04-2.4.1 - openSUSE 12.3 (noarch): perl-LWP-Protocol-https-6.03-4.4.1 References: http://support.novell.com/security/cve/CVE-2014-3230.html https://bugzilla.novell.com/876862

1 0

openSUSE-RU-2014:0709-1: vhba-kmp: update to match current kernel
by maintenance＠opensuse.org 23 May '14

23 May '14

openSUSE Recommended Update: vhba-kmp: update to match current kernel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0709-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: The vhba-kmp package was updated to match the current kernel release. No code changes were done. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-389 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): vhba-kmp-debugsource-20130607-2.8.1 vhba-kmp-default-20130607_k3.11.10_11-2.8.1 vhba-kmp-default-debuginfo-20130607_k3.11.10_11-2.8.1 vhba-kmp-desktop-20130607_k3.11.10_11-2.8.1 vhba-kmp-desktop-debuginfo-20130607_k3.11.10_11-2.8.1 vhba-kmp-xen-20130607_k3.11.10_11-2.8.1 vhba-kmp-xen-debuginfo-20130607_k3.11.10_11-2.8.1 - openSUSE 13.1 (i586): vhba-kmp-pae-20130607_k3.11.10_11-2.8.1 vhba-kmp-pae-debuginfo-20130607_k3.11.10_11-2.8.1 References:

1 0

openSUSE-RU-2014:0708-1: moderate: clamav: Update to 0.98.3
by maintenance＠opensuse.org 23 May '14

23 May '14

openSUSE Recommended Update: clamav: Update to 0.98.3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0708-1 Rating: moderate References: #877475 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with clamav: - bnc#877475: Update to 0.98.3 + Support for common raw disk image formats using 512 byte sectors, specifically GPT, APM, and MBR partitioning. + Experimental support of OpenIOC files. ClamAV will now extract file hashes from OpenIOC files residing in the signature database location, and generate ClamAV hash signatures. ClamAV uses no other OpenIOC features at this time. No OpenIOC files will be delivered through freshclam. See openioc.org and iocbucket.com for additional information about OpenIOC. + All ClamAV sockets (clamd, freshclam, clamav-milter, clamdscan, clamdtop) now support IPV6 addresses and configuration parameters. + Use OpenSSL file hash functions for improved performance. OpenSSL is now prerequisite software for ClamAV 0.98.3. + Improved detection of malware scripts within image files. + Change to circumvent possible denial of service when processing icons within specially crafted PE files. Icon limits are now in place with corresponding clamd and clamscan configuration parameters. + Improvements to the fidelity of the ClamAV pattern matcher. + Opt-in collection of statistics. * Statistics collected are: sizes and MD5 hashes of files, PE file section counts and section MD5 hashes, and names and counts of detected viruses. Enable statistics collection with the --enable-stats clamscan flag or StatsEnabled clamd configuration parameter. + Improvements to ClamAV build process, unit tests, and platform support. + Improve error handling in freshclam. + ClamAV 0.98.3 also includes miscellaneous bug fixes and documentation improvements. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-388 - openSUSE 12.3: zypper in -t patch openSUSE-2014-388 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): clamav-0.98.3-10.2 clamav-debuginfo-0.98.3-10.2 clamav-debugsource-0.98.3-10.2 - openSUSE 12.3 (i586 x86_64): clamav-0.98.3-5.18.2 clamav-debuginfo-0.98.3-5.18.2 clamav-debugsource-0.98.3-5.18.2 References: https://bugzilla.novell.com/877475

1 0

openSUSE-RU-2014:0707-1: syslog-ng: Update from 3.4.5 to 3.4.7 and one additional fix
by maintenance＠opensuse.org 23 May '14

23 May '14

openSUSE Recommended Update: syslog-ng: Update from 3.4.5 to 3.4.7 and one additional fix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0707-1 Rating: low References: #846762 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with syslog-ng: - bnc#846762: use system(); for local logs - update from 3.4.5 to 3.4.7 (bugfix release) + Node flag propagation has been fixed, so flags(final) works the same as it did in 3.3, when embedded log statements are used too. + Using the value-pairs() framework, either via the $(format-json) template function or any of the destinations that make use of it, will now correctly skip and ignore empty values, even in SDATA. + A file descriptor and memory leak has been fixed in the syslog() destination. + The pdbtool program will warn in test mode when a test message has no program attribute. + If the PID property is overwritten, syslog-ng will now stop using the cached MSGHDR value, and therefore, use the newly set PID instead, as it was supposed to. + The localport() option of various network destinations has been restored, and will work correctly now. + The upstart service file in contrib has been updated to use a different process mode (background), as we do not need a supervisor when running under upstart. This also means that upstart will be far less confused. + The system() source has been fixed on Solaris and HP-UX: it correctly recognises the system on Solaris, and uses /dev/log (and not /dev/pipe) on HP-UX. + The sun-streams() source has been fixed, it compiles and works again. + A very rare and short race condition has been fixed in the pipe() source and destination modules, which could leave the pipe available with elevated permissions for a short time. + The SQL, MongoDB and SMTP modules were fixed to not cause a segmentation fault when loaded before the socket module. + The syslog-format() module has been fixed to only set the PROGRAM to "kernel" if all of the previous conditions apply, and the message is a local message. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-386 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): syslog-ng-3.4.7-2.8.2 syslog-ng-debuginfo-3.4.7-2.8.2 syslog-ng-debugsource-3.4.7-2.8.2 syslog-ng-geoip-3.4.7-2.8.2 syslog-ng-geoip-debuginfo-3.4.7-2.8.2 syslog-ng-json-3.4.7-2.8.2 syslog-ng-json-debuginfo-3.4.7-2.8.2 syslog-ng-smtp-3.4.7-2.8.2 syslog-ng-smtp-debuginfo-3.4.7-2.8.2 syslog-ng-sql-3.4.7-2.8.2 syslog-ng-sql-debuginfo-3.4.7-2.8.2 References: https://bugzilla.novell.com/846762

1 0

openSUSE-SU-2014:0706-1: moderate: mumble: Fixed remote DoS vulnerabilities
by opensuse-security＠opensuse.org 23 May '14

23 May '14

openSUSE Security Update: mumble: Fixed remote DoS vulnerabilities ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0706-1 Rating: moderate References: #877969 #877971 Cross-References: CVE-2014-3755 CVE-2014-3756 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: mumble was updated to fix two security issues. - The Mumble client did not properly HTML-escape some external strings before using them in a rich-text (HTML) context (CVE-2014-3756). - SVG images with local file references could trigger client DoS (CVE-2014-3755). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-387 - openSUSE 12.3: zypper in -t patch openSUSE-2014-387 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): mumble-1.2.6-2.12.2 mumble-debuginfo-1.2.6-2.12.2 mumble-debugsource-1.2.6-2.12.2 mumble-server-1.2.6-2.12.2 mumble-server-debuginfo-1.2.6-2.12.2 - openSUSE 13.1 (x86_64): mumble-32bit-1.2.6-2.12.2 mumble-debuginfo-32bit-1.2.6-2.12.2 - openSUSE 12.3 (i586 x86_64): mumble-1.2.6-21.8.1 mumble-debuginfo-1.2.6-21.8.1 mumble-debugsource-1.2.6-21.8.1 mumble-server-1.2.6-21.8.1 mumble-server-debuginfo-1.2.6-21.8.1 - openSUSE 12.3 (x86_64): mumble-32bit-1.2.6-21.8.1 mumble-debuginfo-32bit-1.2.6-21.8.1 References: http://support.novell.com/security/cve/CVE-2014-3755.html http://support.novell.com/security/cve/CVE-2014-3756.html https://bugzilla.novell.com/877969 https://bugzilla.novell.com/877971

1 0

openSUSE-SU-2014:0701-1: moderate: libxml2: external parameter entity loaded when entity substitution is disabled
by opensuse-security＠opensuse.org 22 May '14

22 May '14

openSUSE Security Update: libxml2: external parameter entity loaded when entity substitution is disabled ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0701-1 Rating: moderate References: #876652 Cross-References: CVE-2014-0191 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: It was found that libxml2 incorrectly performs entity substituton in the doctype prolog, even if the application using libxml2 disabled any entity substitution. A remote attacker could provide a specially-crafted XML file that, when processed, would lead to the exhaustion of CPU and memory resources or file descriptors. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-53 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libxml2-2.7.8-49.1 libxml2-debuginfo-2.7.8-49.1 libxml2-debugsource-2.7.8-49.1 libxml2-devel-2.7.8-49.1 - openSUSE 11.4 (x86_64): libxml2-32bit-2.7.8-49.1 libxml2-debuginfo-32bit-2.7.8-49.1 libxml2-devel-32bit-2.7.8-49.1 - openSUSE 11.4 (noarch): libxml2-doc-2.7.8-49.1 - openSUSE 11.4 (ia64): libxml2-debuginfo-x86-2.7.8-49.1 libxml2-x86-2.7.8-49.1 References: http://support.novell.com/security/cve/CVE-2014-0191.html https://bugzilla.novell.com/876652

1 0

openSUSE-SU-2014:0700-1: moderate: strongswan: Fix for authentication bypass and DoS vulnerability
by opensuse-security＠opensuse.org 22 May '14

22 May '14

openSUSE Security Update: strongswan: Fix for authentication bypass and DoS vulnerability ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0700-1 Rating: moderate References: #870572 #876449 Cross-References: CVE-2014-2338 CVE-2014-2891 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: strongswan was fixed to correct two issues: - Fix for DoS vulnerability by a NULL-pointer dereference (CVE-2014-2891). - Fix for a authentication bypass vulnerability in the IKEv2 code (CVE-2014-2338). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-54 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): strongswan-4.5.0-6.64.1 strongswan-debugsource-4.5.0-6.64.1 strongswan-doc-4.5.0-6.64.1 strongswan-ikev1-4.5.0-6.64.1 strongswan-ikev1-debuginfo-4.5.0-6.64.1 strongswan-ikev2-4.5.0-6.64.1 strongswan-ikev2-debuginfo-4.5.0-6.64.1 strongswan-ipsec-4.5.0-6.64.1 strongswan-ipsec-debuginfo-4.5.0-6.64.1 strongswan-libs0-4.5.0-6.64.1 strongswan-libs0-debuginfo-4.5.0-6.64.1 strongswan-mysql-4.5.0-6.64.1 strongswan-mysql-debuginfo-4.5.0-6.64.1 strongswan-nm-4.5.0-6.64.1 strongswan-nm-debuginfo-4.5.0-6.64.1 strongswan-sqlite-4.5.0-6.64.1 strongswan-sqlite-debuginfo-4.5.0-6.64.1 References: http://support.novell.com/security/cve/CVE-2014-2338.html http://support.novell.com/security/cve/CVE-2014-2891.html https://bugzilla.novell.com/870572 https://bugzilla.novell.com/876449

1 0