May 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:0677-1: important: kernel: security and bugfix update
by opensuse-security＠opensuse.org 19 May '14

19 May '14

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0677-1 Rating: important References: #733022 #811746 #833968 #837111 #851426 #852652 #852967 #858233 #858638 #858869 #858870 #858872 #860835 #862145 #863335 #864025 #866102 #868653 #869414 #869898 #871148 #871252 #871325 #873717 #875690 #875798 Cross-References: CVE-2013-4254 CVE-2013-4579 CVE-2013-6885 CVE-2014-0101 CVE-2014-0196 CVE-2014-0069 CVE-2014-1438 CVE-2014-1444 CVE-2014-1445 CVE-2014-1446 CVE-2014-1690 CVE-2014-1737 CVE-2014-1738 CVE-2014-1874 CVE-2014-2523 CVE-2014-2672 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves 16 vulnerabilities and has 10 fixes is now available. Description: The Linux Kernel was updated to fix various security issues and bugs. Main security issues fixed: A security issue in the tty layer that was fixed that could be used by local attackers for code execution (CVE-2014-0196). Two security issues in the floppy driver were fixed that could be used by local attackers on machines with the floppy to crash the kernel or potentially execute code in the kernel (CVE-2014-1737 CVE-2014-1738). Other security issues and bugs that were fixed: - netfilter: nf_nat: fix access to uninitialized buffer in IRC NAT helper (bnc#860835 CVE-2014-1690). - net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH (bnc#866102, CVE-2014-0101). - n_tty: Fix a n_tty_write crash and code execution when echoing in raw mode (bnc#871252 bnc#875690 CVE-2014-0196). - netfilter: nf_ct_sip: support Cisco 7941/7945 IP phones (bnc#873717). - Update config files: re-enable twofish crypto support Software twofish crypto support was disabled in several architectures since openSUSE 10.3. For i386 and x86_64 it was on purpose, because hardware-accelerated alternatives exist. However for all other architectures it was by accident. Re-enable software twofish crypto support in arm, ia64 and ppc configuration files, to guarantee that at least one implementation is always available (bnc#871325). - Update config files: disable CONFIG_TOUCHSCREEN_W90X900 The w90p910_ts driver only makes sense on the W90x900 architecture, which we do not support. - ath9k: protect tid->sched check (bnc#871148,CVE-2014-2672). - Fix dst_neigh_lookup/dst_neigh_lookup_skb return value handling bug (bnc#869898). - SELinux: Fix kernel BUG on empty security contexts (bnc#863335,CVE-2014-1874). - hamradio/yam: fix info leak in ioctl (bnc#858872, CVE-2014-1446). - wanxl: fix info leak in ioctl (bnc#858870, CVE-2014-1445). - farsync: fix info leak in ioctl (bnc#858869, CVE-2014-1444). - ARM: 7809/1: perf: fix event validation for software group leaders (CVE-2013-4254, bnc#837111). - netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (bnc#868653, CVE-2014-2523). - ath9k_htc: properly set MAC address and BSSID mask (bnc#851426, CVE-2013-4579). - drm/ttm: don't oops if no invalidate_caches() (bnc#869414). - Apply missing patches.fixes/drm-nouveau-hwmon-rename-fan0-to-fan1.patch - xfs: growfs: use uncached buffers for new headers (bnc#858233). - xfs: use btree block initialisation functions in growfs (bnc#858233). - Revert "Delete patches.fixes/xfs-fix-xfs_buf_find-oops-on-blocks-beyond-the-filesystem-end ." (bnc#858233) Put back again the patch patches.fixes/xfs-fix-xfs_buf_find-oops-on-blocks-beyond-the-filesystem-end back as there is a better fix than reverting the affecting patch. - Delete patches.fixes/xfs-fix-xfs_buf_find-oops-on-blocks-beyond-the-filesystem-end . It turned out that this patch causes regressions (bnc#858233) The upstream 3.7.x also reverted it in the end (commit c3793e0d94af2). - tcp: syncookies: reduce cookie lifetime to 128 seconds (bnc#833968). - tcp: syncookies: reduce mss table to four values (bnc#833968). - x86, cpu, amd: Add workaround for family 16h, erratum 793 (bnc#852967 CVE-2013-6885). - cifs: ensure that uncached writes handle unmapped areas correctly (bnc#864025 CVE-2014-0069). - x86, fpu, amd: Clear exceptions in AMD FXSAVE workaround (bnc#858638 CVE-2014-1438). - xencons: generalize use of add_preferred_console() (bnc#733022, bnc#852652). - balloon: don't crash in HVM-with-PoD guests. - hwmon: (coretemp) Fix truncated name of alarm attributes. - NFS: Avoid PUTROOTFH when managing leases (bnc#811746). - cifs: delay super block destruction until all cifsFileInfo objects are gone (bnc#862145). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-376 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): kernel-default-3.7.10-1.32.1 kernel-default-base-3.7.10-1.32.1 kernel-default-base-debuginfo-3.7.10-1.32.1 kernel-default-debuginfo-3.7.10-1.32.1 kernel-default-debugsource-3.7.10-1.32.1 kernel-default-devel-3.7.10-1.32.1 kernel-default-devel-debuginfo-3.7.10-1.32.1 kernel-syms-3.7.10-1.32.1 - openSUSE 12.3 (i686 x86_64): kernel-debug-3.7.10-1.32.1 kernel-debug-base-3.7.10-1.32.1 kernel-debug-base-debuginfo-3.7.10-1.32.1 kernel-debug-debuginfo-3.7.10-1.32.1 kernel-debug-debugsource-3.7.10-1.32.1 kernel-debug-devel-3.7.10-1.32.1 kernel-debug-devel-debuginfo-3.7.10-1.32.1 kernel-desktop-3.7.10-1.32.1 kernel-desktop-base-3.7.10-1.32.1 kernel-desktop-base-debuginfo-3.7.10-1.32.1 kernel-desktop-debuginfo-3.7.10-1.32.1 kernel-desktop-debugsource-3.7.10-1.32.1 kernel-desktop-devel-3.7.10-1.32.1 kernel-desktop-devel-debuginfo-3.7.10-1.32.1 kernel-ec2-3.7.10-1.32.1 kernel-ec2-base-3.7.10-1.32.1 kernel-ec2-base-debuginfo-3.7.10-1.32.1 kernel-ec2-debuginfo-3.7.10-1.32.1 kernel-ec2-debugsource-3.7.10-1.32.1 kernel-ec2-devel-3.7.10-1.32.1 kernel-ec2-devel-debuginfo-3.7.10-1.32.1 kernel-trace-3.7.10-1.32.1 kernel-trace-base-3.7.10-1.32.1 kernel-trace-base-debuginfo-3.7.10-1.32.1 kernel-trace-debuginfo-3.7.10-1.32.1 kernel-trace-debugsource-3.7.10-1.32.1 kernel-trace-devel-3.7.10-1.32.1 kernel-trace-devel-debuginfo-3.7.10-1.32.1 kernel-vanilla-3.7.10-1.32.1 kernel-vanilla-debuginfo-3.7.10-1.32.1 kernel-vanilla-debugsource-3.7.10-1.32.1 kernel-vanilla-devel-3.7.10-1.32.1 kernel-vanilla-devel-debuginfo-3.7.10-1.32.1 kernel-xen-3.7.10-1.32.1 kernel-xen-base-3.7.10-1.32.1 kernel-xen-base-debuginfo-3.7.10-1.32.1 kernel-xen-debuginfo-3.7.10-1.32.1 kernel-xen-debugsource-3.7.10-1.32.1 kernel-xen-devel-3.7.10-1.32.1 kernel-xen-devel-debuginfo-3.7.10-1.32.1 - openSUSE 12.3 (noarch): kernel-devel-3.7.10-1.32.1 kernel-docs-3.7.10-1.32.2 kernel-source-3.7.10-1.32.1 kernel-source-vanilla-3.7.10-1.32.1 - openSUSE 12.3 (i686): kernel-pae-3.7.10-1.32.1 kernel-pae-base-3.7.10-1.32.1 kernel-pae-base-debuginfo-3.7.10-1.32.1 kernel-pae-debuginfo-3.7.10-1.32.1 kernel-pae-debugsource-3.7.10-1.32.1 kernel-pae-devel-3.7.10-1.32.1 kernel-pae-devel-debuginfo-3.7.10-1.32.1 References: http://support.novell.com/security/cve/CVE-2013-4254.html http://support.novell.com/security/cve/CVE-2013-4579.html http://support.novell.com/security/cve/CVE-2013-6885.html http://support.novell.com/security/cve/CVE-2014-0101.html http://support.novell.com/security/cve/CVE-2014-0196.html http://support.novell.com/security/cve/CVE-2014-0069.html http://support.novell.com/security/cve/CVE-2014-1438.html http://support.novell.com/security/cve/CVE-2014-1444.html http://support.novell.com/security/cve/CVE-2014-1445.html http://support.novell.com/security/cve/CVE-2014-1446.html http://support.novell.com/security/cve/CVE-2014-1690.html http://support.novell.com/security/cve/CVE-2014-1737.html http://support.novell.com/security/cve/CVE-2014-1738.html http://support.novell.com/security/cve/CVE-2014-1874.html http://support.novell.com/security/cve/CVE-2014-2523.html http://support.novell.com/security/cve/CVE-2014-2672.html https://bugzilla.novell.com/733022 https://bugzilla.novell.com/811746 https://bugzilla.novell.com/833968 https://bugzilla.novell.com/837111 https://bugzilla.novell.com/851426 https://bugzilla.novell.com/852652 https://bugzilla.novell.com/852967 https://bugzilla.novell.com/858233 https://bugzilla.novell.com/858638 https://bugzilla.novell.com/858869 https://bugzilla.novell.com/858870 https://bugzilla.novell.com/858872 https://bugzilla.novell.com/860835 https://bugzilla.novell.com/862145 https://bugzilla.novell.com/863335 https://bugzilla.novell.com/864025 https://bugzilla.novell.com/866102 https://bugzilla.novell.com/868653 https://bugzilla.novell.com/869414 https://bugzilla.novell.com/869898 https://bugzilla.novell.com/871148 https://bugzilla.novell.com/871252 https://bugzilla.novell.com/871325 https://bugzilla.novell.com/873717 https://bugzilla.novell.com/875690 https://bugzilla.novell.com/875798

1 0

openSUSE-RU-2014:0676-1: moderate: MozillaFirefox: update to 29.0.1 bugfix-release
by maintenance＠opensuse.org 19 May '14

19 May '14

openSUSE Recommended Update: MozillaFirefox: update to 29.0.1 bugfix-release ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0676-1 Rating: moderate References: #876833 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with MozillaFirefox: - update to Firefox 29.0.1 (bugfix-release) + bmo#1005958: Seer disabled by default + bmo#1001167: Session Restore failed with a corrupted sessionstore.js file + bnc#876833, bmo#1003707: pdf.js printing white page - general.useragent.locale gets overwritten with en-US while it should be using the active langpack's setting Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-374 - openSUSE 12.3: zypper in -t patch openSUSE-2014-374 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-29.0.1-24.1 MozillaFirefox-branding-upstream-29.0.1-24.1 MozillaFirefox-buildsymbols-29.0.1-24.1 MozillaFirefox-debuginfo-29.0.1-24.1 MozillaFirefox-debugsource-29.0.1-24.1 MozillaFirefox-devel-29.0.1-24.1 MozillaFirefox-translations-common-29.0.1-24.1 MozillaFirefox-translations-other-29.0.1-24.1 - openSUSE 12.3 (i586 x86_64): MozillaFirefox-29.0.1-1.63.1 MozillaFirefox-branding-upstream-29.0.1-1.63.1 MozillaFirefox-buildsymbols-29.0.1-1.63.1 MozillaFirefox-debuginfo-29.0.1-1.63.1 MozillaFirefox-debugsource-29.0.1-1.63.1 MozillaFirefox-devel-29.0.1-1.63.1 MozillaFirefox-translations-common-29.0.1-1.63.1 MozillaFirefox-translations-other-29.0.1-1.63.1 References: https://bugzilla.novell.com/876833

1 0

openSUSE-RU-2014:0675-1: spec-cleaner: Fixed few minor issues reported on github
by maintenance＠opensuse.org 19 May '14

19 May '14

openSUSE Recommended Update: spec-cleaner: Fixed few minor issues reported on github ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0675-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues with spec-cleaner: - Version bump to 0.5.6: * Few minor fixes as reported on github. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-373 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): spec-cleaner-0.5.6-6.8.1 References:

1 0

openSUSE-SU-2014:0674-1: moderate: libvirt: Fix migration with QEMU 1.6 and unsafe parsing of XML documents
by opensuse-security＠opensuse.org 19 May '14

19 May '14

openSUSE Security Update: libvirt: Fix migration with QEMU 1.6 and unsafe parsing of XML documents ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0674-1 Rating: moderate References: #873705 #875694 Cross-References: CVE-2014-0179 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update fixes the following issues with libvirt: - bnc#875694: Fix migration with QEMU 1.6. QEMU 1.6.0 introduced new migration status: setup. Libvirt does not expect such string in QMP and refuses to migrate with error "unexpected migration status in setup" - Patch to prevent expansion of entities when parsing XML files. This vulnerability allowed malicious users to read arbitrary files or cause a denial of service (CVE-2014-0179). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-372 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libvirt-1.1.2-2.32.1 libvirt-client-1.1.2-2.32.1 libvirt-client-debuginfo-1.1.2-2.32.1 libvirt-daemon-1.1.2-2.32.1 libvirt-daemon-config-network-1.1.2-2.32.1 libvirt-daemon-config-nwfilter-1.1.2-2.32.1 libvirt-daemon-debuginfo-1.1.2-2.32.1 libvirt-daemon-driver-interface-1.1.2-2.32.1 libvirt-daemon-driver-interface-debuginfo-1.1.2-2.32.1 libvirt-daemon-driver-lxc-1.1.2-2.32.1 libvirt-daemon-driver-lxc-debuginfo-1.1.2-2.32.1 libvirt-daemon-driver-network-1.1.2-2.32.1 libvirt-daemon-driver-network-debuginfo-1.1.2-2.32.1 libvirt-daemon-driver-nodedev-1.1.2-2.32.1 libvirt-daemon-driver-nodedev-debuginfo-1.1.2-2.32.1 libvirt-daemon-driver-nwfilter-1.1.2-2.32.1 libvirt-daemon-driver-nwfilter-debuginfo-1.1.2-2.32.1 libvirt-daemon-driver-qemu-1.1.2-2.32.1 libvirt-daemon-driver-qemu-debuginfo-1.1.2-2.32.1 libvirt-daemon-driver-secret-1.1.2-2.32.1 libvirt-daemon-driver-secret-debuginfo-1.1.2-2.32.1 libvirt-daemon-driver-storage-1.1.2-2.32.1 libvirt-daemon-driver-storage-debuginfo-1.1.2-2.32.1 libvirt-daemon-driver-uml-1.1.2-2.32.1 libvirt-daemon-driver-uml-debuginfo-1.1.2-2.32.1 libvirt-daemon-driver-vbox-1.1.2-2.32.1 libvirt-daemon-driver-vbox-debuginfo-1.1.2-2.32.1 libvirt-daemon-lxc-1.1.2-2.32.1 libvirt-daemon-qemu-1.1.2-2.32.1 libvirt-daemon-uml-1.1.2-2.32.1 libvirt-daemon-vbox-1.1.2-2.32.1 libvirt-debugsource-1.1.2-2.32.1 libvirt-devel-1.1.2-2.32.1 libvirt-doc-1.1.2-2.32.1 libvirt-lock-sanlock-1.1.2-2.32.1 libvirt-lock-sanlock-debuginfo-1.1.2-2.32.1 libvirt-login-shell-1.1.2-2.32.1 libvirt-login-shell-debuginfo-1.1.2-2.32.1 libvirt-python-1.1.2-2.32.1 libvirt-python-debuginfo-1.1.2-2.32.1 - openSUSE 13.1 (x86_64): libvirt-client-32bit-1.1.2-2.32.1 libvirt-client-debuginfo-32bit-1.1.2-2.32.1 libvirt-daemon-driver-libxl-1.1.2-2.32.1 libvirt-daemon-driver-libxl-debuginfo-1.1.2-2.32.1 libvirt-daemon-driver-xen-1.1.2-2.32.1 libvirt-daemon-driver-xen-debuginfo-1.1.2-2.32.1 libvirt-daemon-xen-1.1.2-2.32.1 libvirt-devel-32bit-1.1.2-2.32.1 References: http://support.novell.com/security/cve/CVE-2014-0179.html https://bugzilla.novell.com/873705 https://bugzilla.novell.com/875694

1 0

openSUSE-SU-2014:0673-1: moderate: flash-player: Fixed access restrictions bypass
by opensuse-security＠opensuse.org 18 May '14

18 May '14

openSUSE Security Update: flash-player: Fixed access restrictions bypass ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0673-1 Rating: moderate References: #877649 Cross-References: CVE-2014-0516 CVE-2014-0517 CVE-2014-0518 CVE-2014-0519 CVE-2014-0520 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: flash-player was updated to fix several security issues. - Remote attackers could bypass the Same Origin Policy via unspecified vectors (CVE-2014-0516) - Bypass intended access restrictions via unspecified vectors (CVE-2014-0517) - Bypass intended access restrictions via unspecified vectors (CVE-2014-0518) - Bypass intended access restrictions via unspecified vectors (CVE-2014-0519) - Bypass intended access restrictions via unspecified vectors (CVE-2014-0520) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-52 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.359-111.1 flash-player-gnome-11.2.202.359-111.1 flash-player-kde4-11.2.202.359-111.1 References: http://support.novell.com/security/cve/CVE-2014-0516.html http://support.novell.com/security/cve/CVE-2014-0517.html http://support.novell.com/security/cve/CVE-2014-0518.html http://support.novell.com/security/cve/CVE-2014-0519.html http://support.novell.com/security/cve/CVE-2014-0520.html https://bugzilla.novell.com/877649

1 0

openSUSE-SU-2014:0669-1: moderate: update for chromium
by opensuse-security＠opensuse.org 16 May '14

16 May '14

openSUSE Security Update: update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0669-1 Rating: moderate References: #875408 Cross-References: CVE-2014-1730 CVE-2014-1731 CVE-2014-1732 CVE-2014-1733 CVE-2014-1734 CVE-2014-1735 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: - Update to Chromium 34.0.1847.132 * Security update: - CVE-2014-1730: Type confusion in V8 - CVE-2014-1731: Type confusion in DOM - CVE-2014-1732: Use-after-free in Speech Recognition - CVE-2014-1733: Compiler bug in Seccomp-BPF - CVE-2014-1734: Various fixes from internal audits, fuzzing and other initiatives - CVE-2014-1735: Multiple vulnerabilities in V8 fixed in version 3.24.35.33 - Update to Chromium 34.0.1847.131 * Bugfixes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-371 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-34.0.1847.132-33.1 chromedriver-debuginfo-34.0.1847.132-33.1 chromium-34.0.1847.132-33.1 chromium-debuginfo-34.0.1847.132-33.1 chromium-debugsource-34.0.1847.132-33.1 chromium-desktop-gnome-34.0.1847.132-33.1 chromium-desktop-kde-34.0.1847.132-33.1 chromium-ffmpegsumo-34.0.1847.132-33.1 chromium-ffmpegsumo-debuginfo-34.0.1847.132-33.1 chromium-suid-helper-34.0.1847.132-33.1 chromium-suid-helper-debuginfo-34.0.1847.132-33.1 References: http://support.novell.com/security/cve/CVE-2014-1730.html http://support.novell.com/security/cve/CVE-2014-1731.html http://support.novell.com/security/cve/CVE-2014-1732.html http://support.novell.com/security/cve/CVE-2014-1733.html http://support.novell.com/security/cve/CVE-2014-1734.html http://support.novell.com/security/cve/CVE-2014-1735.html https://bugzilla.novell.com/875408

1 0

openSUSE-SU-2014:0668-1: moderate: update for chromium
by opensuse-security＠opensuse.org 16 May '14

16 May '14

openSUSE Security Update: update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0668-1 Rating: moderate References: #875408 Cross-References: CVE-2014-1730 CVE-2014-1731 CVE-2014-1732 CVE-2014-1733 CVE-2014-1734 CVE-2014-1735 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: - Update to Chromium 34.0.1847.132 * Security update: - CVE-2014-1730: Type confusion in V8 - CVE-2014-1731: Type confusion in DOM - CVE-2014-1732: Use-after-free in Speech Recognition - CVE-2014-1733: Compiler bug in Seccomp-BPF - CVE-2014-1734: Various fixes from internal audits, fuzzing and other initiatives - CVE-2014-1735: Multiple vulnerabilities in V8 fixed in version 3.24.35.33 - Update to Chromium 34.0.1847.131 * Bugfixes Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-370 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): chromedriver-34.0.1847.132-1.41.2 chromedriver-debuginfo-34.0.1847.132-1.41.2 chromium-34.0.1847.132-1.41.2 chromium-debuginfo-34.0.1847.132-1.41.2 chromium-debugsource-34.0.1847.132-1.41.2 chromium-desktop-gnome-34.0.1847.132-1.41.2 chromium-desktop-kde-34.0.1847.132-1.41.2 chromium-ffmpegsumo-34.0.1847.132-1.41.2 chromium-ffmpegsumo-debuginfo-34.0.1847.132-1.41.2 chromium-suid-helper-34.0.1847.132-1.41.2 chromium-suid-helper-debuginfo-34.0.1847.132-1.41.2 References: http://support.novell.com/security/cve/CVE-2014-1730.html http://support.novell.com/security/cve/CVE-2014-1731.html http://support.novell.com/security/cve/CVE-2014-1732.html http://support.novell.com/security/cve/CVE-2014-1733.html http://support.novell.com/security/cve/CVE-2014-1734.html http://support.novell.com/security/cve/CVE-2014-1735.html https://bugzilla.novell.com/875408

1 0

openSUSE-SU-2014:0650-1: moderate: libvirt: Fixed unsafe parsing of XML documents
by opensuse-security＠opensuse.org 15 May '14

15 May '14

openSUSE Security Update: libvirt: Fixed unsafe parsing of XML documents ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0650-1 Rating: moderate References: #873705 Cross-References: CVE-2014-0179 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libvirt was patched to prevent expansion of entities when parsing XML files. This vulnerability allowed malicious users to read arbitrary files or cause a denial of service (CVE-2014-0179). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-369 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libvirt-1.0.2-1.18.1 libvirt-client-1.0.2-1.18.1 libvirt-client-debuginfo-1.0.2-1.18.1 libvirt-debuginfo-1.0.2-1.18.1 libvirt-debugsource-1.0.2-1.18.1 libvirt-devel-1.0.2-1.18.1 libvirt-doc-1.0.2-1.18.1 libvirt-lock-sanlock-1.0.2-1.18.1 libvirt-lock-sanlock-debuginfo-1.0.2-1.18.1 libvirt-python-1.0.2-1.18.1 libvirt-python-debuginfo-1.0.2-1.18.1 - openSUSE 12.3 (x86_64): libvirt-client-32bit-1.0.2-1.18.1 libvirt-client-debuginfo-32bit-1.0.2-1.18.1 libvirt-devel-32bit-1.0.2-1.18.1 References: http://support.novell.com/security/cve/CVE-2014-0179.html https://bugzilla.novell.com/873705

1 0

openSUSE-RU-2014:0649-1: glibc: Properly handle forced elision in pthread mutex trylock
by maintenance＠opensuse.org 15 May '14

15 May '14

openSUSE Recommended Update: glibc: Properly handle forced elision in pthread mutex trylock ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0649-1 Rating: low References: #865968 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with glibc: - bnc#865968: Properly handle forced elision in pthread mutex trylock Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-368 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): glibc-2.18-4.15.1 glibc-debuginfo-2.18-4.15.1 glibc-debugsource-2.18-4.15.1 glibc-devel-2.18-4.15.1 glibc-devel-debuginfo-2.18-4.15.1 glibc-devel-static-2.18-4.15.1 glibc-extra-2.18-4.15.1 glibc-extra-debuginfo-2.18-4.15.1 glibc-locale-2.18-4.15.1 glibc-locale-debuginfo-2.18-4.15.1 glibc-profile-2.18-4.15.1 glibc-utils-2.18-4.15.2 glibc-utils-debuginfo-2.18-4.15.2 glibc-utils-debugsource-2.18-4.15.2 nscd-2.18-4.15.1 nscd-debuginfo-2.18-4.15.1 - openSUSE 13.1 (x86_64): glibc-32bit-2.18-4.15.2 glibc-debuginfo-32bit-2.18-4.15.2 glibc-devel-32bit-2.18-4.15.2 glibc-devel-debuginfo-32bit-2.18-4.15.2 glibc-devel-static-32bit-2.18-4.15.2 glibc-locale-32bit-2.18-4.15.2 glibc-locale-debuginfo-32bit-2.18-4.15.2 glibc-profile-32bit-2.18-4.15.2 glibc-utils-32bit-2.18-4.15.2 glibc-utils-debuginfo-32bit-2.18-4.15.2 - openSUSE 13.1 (noarch): glibc-html-2.18-4.15.1 glibc-i18ndata-2.18-4.15.1 glibc-i18ndata-2.18-4.15.2 glibc-info-2.18-4.15.1 glibc-info-2.18-4.15.2 - openSUSE 13.1 (i686): glibc-2.18-4.15.2 glibc-debuginfo-2.18-4.15.2 glibc-debugsource-2.18-4.15.2 glibc-devel-2.18-4.15.2 glibc-devel-debuginfo-2.18-4.15.2 glibc-devel-static-2.18-4.15.2 glibc-extra-2.18-4.15.2 glibc-extra-debuginfo-2.18-4.15.2 glibc-locale-2.18-4.15.2 glibc-locale-debuginfo-2.18-4.15.2 glibc-obsolete-2.18-4.15.2 glibc-obsolete-debuginfo-2.18-4.15.2 glibc-profile-2.18-4.15.2 nscd-2.18-4.15.2 nscd-debuginfo-2.18-4.15.2 - openSUSE 13.1 (i586): glibc-obsolete-2.18-4.15.1 glibc-obsolete-debuginfo-2.18-4.15.1 References: https://bugzilla.novell.com/865968

1 0

openSUSE-RU-2014:0648-1: moderate: libserf: Update Serf to 1.3.5
by maintenance＠opensuse.org 15 May '14

15 May '14

openSUSE Recommended Update: libserf: Update Serf to 1.3.5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0648-1 Rating: moderate References: #875382 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with libserf: - bnc#875382: Serf 1.3.5 + This release fixes a crash during SSL tunnel setup, fixes Negotiate/Kerberos authentication in some specific scenario's and brings some other small changes. * Fix issue: no reverse lookup during Negotiate authentication for proxies. * Fix a crash caused by incorrect reuse of the ssltunnel CONNECT request * Cancel request if response parsing failed + authn callback set * Update the expired certificates in the test suite. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-365 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libserf-1-1-1.3.5-8.1 libserf-1-1-debuginfo-1.3.5-8.1 libserf-debugsource-1.3.5-8.1 libserf-devel-1.3.5-8.1 References: https://bugzilla.novell.com/875382

1 0