May 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2014:0633-1: kdebase4-workspace, kdebase4-session: Update to 4.11.9
by maintenance＠opensuse.org 13 May '14

13 May '14

openSUSE Recommended Update: kdebase4-workspace, kdebase4-session: Update to 4.11.9 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0633-1 Rating: low References: #756198 #809835 #864305 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update fixes the following issues with kdebase4-workspace and kdebase4-session: - kdebase4-workspace: + Update to 4.11.9 * Bugfix release, includes fixes for kde#312947, bnc#756198, kde#327947, kde#329076, bnc#864305, kde#224200, bnc#809835 + kde#334159: Fix crash when DesktopNames is not set + bnc#756198, kde#312947: fix resumption from console mode when monotonic clock is in use + bnc#864305, kde#329076, kde#327947: password input dialog was not shown under certain circumstances + bnc#809835, kde#224200: screensaver processes might keep running in background when unlocking the screen + Update to 4.11.8 * KDE 4.12.4 release * See http://www.kde.org/announcements/announce-4.12.4.php + add support for dynamic multiseat + Update to 4.11.7 * KDE 4.13 Beta1 release * See http://www.kde.org/announcements/announce-4.13-beta1.php + remove the dependency on strigi + Explicitly request a Window drawable + align zoomed cursor to hotspot + be more aggressive about exiting zoom effect + spatial present windows zoom calculation + fix frontbuffer copying swap preference + fix sendToScreen for QuickTiled windows + reset desktopChangedWhileRotating on activation + ensure to show clients that need sessionInteract + fix off by 1 on multiscreen toppanel strutting + Perform the systemd version evaluation through a reg - kdebase4-session: + Added DesktopNames=KDE property to kde-plasma desktop file, as per latest fdo spec Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-356 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): kde4-kgreeter-plugins-4.11.9-111.1 kde4-kgreeter-plugins-debuginfo-4.11.9-111.1 kdebase4-workspace-4.11.9-111.1 kdebase4-workspace-branding-upstream-4.11.9-111.1 kdebase4-workspace-debuginfo-4.11.9-111.1 kdebase4-workspace-debugsource-4.11.9-111.1 kdebase4-workspace-devel-4.11.9-111.1 kdebase4-workspace-devel-debuginfo-4.11.9-111.1 kdebase4-workspace-ksysguardd-4.11.9-111.1 kdebase4-workspace-ksysguardd-debuginfo-4.11.9-111.1 kdebase4-workspace-liboxygenstyle-4.11.9-111.1 kdebase4-workspace-liboxygenstyle-debuginfo-4.11.9-111.1 kdebase4-workspace-plasma-calendar-4.11.9-111.1 kdebase4-workspace-plasma-calendar-debuginfo-4.11.9-111.1 kdm-4.11.9-111.1 kdm-branding-upstream-4.11.9-111.1 kdm-debuginfo-4.11.9-111.1 krandr-4.11.9-111.1 krandr-debuginfo-4.11.9-111.1 kwin-4.11.9-111.1 kwin-debuginfo-4.11.9-111.1 python-kdebase4-4.11.9-111.1 - openSUSE 13.1 (x86_64): kdebase4-workspace-liboxygenstyle-32bit-4.11.9-111.1 kdebase4-workspace-liboxygenstyle-debuginfo-32bit-4.11.9-111.1 - openSUSE 13.1 (noarch): kdebase4-session-4.11-2.8.1 References: https://bugzilla.novell.com/756198 https://bugzilla.novell.com/809835 https://bugzilla.novell.com/864305

1 0

openSUSE-RU-2014:0632-1: nfs-utils: Fix fallback from tcp to udp
by maintenance＠opensuse.org 13 May '14

13 May '14

openSUSE Recommended Update: nfs-utils: Fix fallback from tcp to udp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0632-1 Rating: low References: #863749 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with nfs-utils: - bnc#863749: Fix fallback from tcp to udp Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-355 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): nfs-client-1.2.8-4.13.1 nfs-client-debuginfo-1.2.8-4.13.1 nfs-doc-1.2.8-4.13.1 nfs-kernel-server-1.2.8-4.13.1 nfs-kernel-server-debuginfo-1.2.8-4.13.1 nfs-utils-debugsource-1.2.8-4.13.1 References: https://bugzilla.novell.com/863749

1 0

openSUSE-SU-2014:0629-1: moderate: update for seamonkey
by opensuse-security＠opensuse.org 12 May '14

12 May '14

openSUSE Security Update: update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0629-1 Rating: moderate References: #875378 Cross-References: CVE-2014-1492 CVE-2014-1518 CVE-2014-1519 CVE-2014-1522 CVE-2014-1523 CVE-2014-1524 CVE-2014-1525 CVE-2014-1526 CVE-2014-1528 CVE-2014-1529 CVE-2014-1530 CVE-2014-1531 CVE-2014-1532 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This is a SeaMonkey update to version 2.26: * MFSA 2014-34/CVE-2014-1518/CVE-2014-1519 Miscellaneous memory safety hazards * MFSA 2014-36/CVE-2014-1522 (bmo#995289) Web Audio memory corruption issues * MFSA 2014-37/CVE-2014-1523 (bmo#969226) Out of bounds read while decoding JPG images * MFSA 2014-38/CVE-2014-1524 (bmo#989183) Buffer overflow when using non-XBL object as XBL * MFSA 2014-39/CVE-2014-1525 (bmo#989210) Use-after-free in the Text Track Manager for HTML video * MFSA 2014-41/CVE-2014-1528 (bmo#963962) Out-of-bounds write in Cairo * MFSA 2014-42/CVE-2014-1529 (bmo#987003) Privilege escalation through Web Notification API * MFSA 2014-43/CVE-2014-1530 (bmo#895557) Cross-site scripting (XSS) using history navigations * MFSA 2014-44/CVE-2014-1531 (bmo#987140) Use-after-free in imgLoader while resizing images * MFSA 2014-45/CVE-2014-1492 (bmo#903885) Incorrect IDNA domain name matching for wildcard certificates (fixed by NSS 3.16) * MFSA 2014-46/CVE-2014-1532 (bmo#966006) Use-after-free in nsHostResolver * MFSA 2014-47/CVE-2014-1526 (bmo#988106) Debugger can bypass XrayWrappers with JavaScript - rebased patches - added aarch64 porting patches * mozilla-aarch64-bmo-810631.patch * mozilla-aarch64-bmo-962488.patch * mozilla-aarch64-bmo-963023.patch * mozilla-aarch64-bmo-963024.patch * mozilla-aarch64-bmo-963027.patch - requires NSPR 4.10.3 and NSS 3.16 - added mozilla-icu-strncat.patch to fix post build checks Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-354 - openSUSE 12.3: zypper in -t patch openSUSE-2014-354 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): seamonkey-2.26-20.1 seamonkey-debuginfo-2.26-20.1 seamonkey-debugsource-2.26-20.1 seamonkey-dom-inspector-2.26-20.1 seamonkey-irc-2.26-20.1 seamonkey-translations-common-2.26-20.1 seamonkey-translations-other-2.26-20.1 seamonkey-venkman-2.26-20.1 - openSUSE 12.3 (i586 x86_64): seamonkey-2.26-1.45.1 seamonkey-debuginfo-2.26-1.45.1 seamonkey-debugsource-2.26-1.45.1 seamonkey-dom-inspector-2.26-1.45.1 seamonkey-irc-2.26-1.45.1 seamonkey-translations-common-2.26-1.45.1 seamonkey-translations-other-2.26-1.45.1 seamonkey-venkman-2.26-1.45.1 References: http://support.novell.com/security/cve/CVE-2014-1492.html http://support.novell.com/security/cve/CVE-2014-1518.html http://support.novell.com/security/cve/CVE-2014-1519.html http://support.novell.com/security/cve/CVE-2014-1522.html http://support.novell.com/security/cve/CVE-2014-1523.html http://support.novell.com/security/cve/CVE-2014-1524.html http://support.novell.com/security/cve/CVE-2014-1525.html http://support.novell.com/security/cve/CVE-2014-1526.html http://support.novell.com/security/cve/CVE-2014-1528.html http://support.novell.com/security/cve/CVE-2014-1529.html http://support.novell.com/security/cve/CVE-2014-1530.html http://support.novell.com/security/cve/CVE-2014-1531.html http://support.novell.com/security/cve/CVE-2014-1532.html https://bugzilla.novell.com/875378

1 0

openSUSE-RU-2014:0628-1: moderate: kiwi to v5.05.67
by maintenance＠opensuse.org 12 May '14

12 May '14

openSUSE Recommended Update: kiwi to v5.05.67 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0628-1 Rating: moderate References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: kiwi was updated to v5.05.67 to supply features used in SUSE Linux Enterprise 12 development and base for building appliances in openSUSE 13.1. - Fixed check for .repo file The repo path is stored quoted for use use with the shell but the perl test operator can't deal with shell escaped characters and failed. Thus shell's test built-in is used instead - Use existing credentials name for repositories * Don't add a credentials name to repositories if there is already one - Make partedGetPartitionID more robust * If we can't find a partition label for the disk don't proceed checking for a partition ID and return an unknown ID 'xx' - Use suse parted 'type' command extension to setup swap partition type. This is done because the upstream way of setting swap type is broken in the suse parted. - Fixed __hasBootDescription() runtime check for pxe type The type in the XML is 'pxe' but the boot description is named 'netboot' - Use existing credentials name for repositories * Don't add a credentials name to repositories if there is already one - Fixed pxePartitionInputGeneric In case of a raid setup via pxeboot the required partition type 'fd' is not explicitly provided in the PART line of the client config. Instead the raid information is given in an additional RAID variable. Thus the pxePartitionInputGeneric function has to set the partition type 'fd' if the RAID variable is set too. - Make partedGetPartitionID more robust * If we can't find a partition label for the disk don't proceed checking for a partition ID and return an unknown ID 'xx' - Use suse parted 'type' command extension to setup swap partition type. This is done because the upstream way of setting swap type is broken in the suse parted. - Fixed message displayed when the partition table is created/updated. Even in the case of creating a new partition table the message said something about repartition of the disk which is misleading. Thus the message changed to just tell the user about a partition process happening now - Fixed --bootcd post processing mode - Fixed --bootusb post processing mode - Fixed __hasBootDescription() runtime check for pxe type The type in the XML is 'pxe' but the boot description is named 'netboot' - Fixed message logging * don't log message to already closed file descriptor - Removed done statement from last Kiwi message * The Done message at the last line was confusing, especially when KIWI exited with errors. To keep consistency and since the done message wasn't really needed because the last message is not a task it was also removed for the success messages. - Added __hasBootDescription runtime check Code written by Tim Hardeck. The test looks up the required boot image description according to the selected build type if no such description exists the build exit with an error telling the user which rpm package is missing on the build machine - Fixed tests for KIWIRuntimeChecker code * for each test call the corresponding runtime checker function and not the container method which always calls all of them * added variable KIWI_NO_FS which allows to switch off runtime checks which accesses the filesystem. They can only be safely called if the filesystem environment is controlled too - Fixed __hasBootLoaderTools() runtime check to check for the bootloader tool if 'grub' is selected - Fixed runtime check __hasBootLoaderTools check for grub2-bios-setup only if the firmare is set to: bios - Revert "- use ext4 filesystem for clic'ed live iso's" ext4 seems not supported on SLE11 but Studio uses clicfs to build live images. This reverts commit fbeff95f4724. - Added __hasBootLoaderTools runtime check With this check we test if the tool chain to install the requested bootloader is installed on the image build machine Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-350 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): kiwi-5.05.67-25.1 kiwi-debugsource-5.05.67-25.1 kiwi-desc-isoboot-requires-5.05.67-25.1 kiwi-desc-netboot-requires-5.05.67-25.1 kiwi-desc-oemboot-requires-5.05.67-25.1 kiwi-desc-vmxboot-requires-5.05.67-25.1 kiwi-tools-5.05.67-25.1 kiwi-tools-debuginfo-5.05.67-25.1 - openSUSE 13.1 (noarch): kiwi-desc-isoboot-5.05.67-25.1 kiwi-desc-netboot-5.05.67-25.1 kiwi-desc-oemboot-5.05.67-25.1 kiwi-desc-vmxboot-5.05.67-25.1 kiwi-doc-5.05.67-25.1 kiwi-instsource-5.05.67-25.1 kiwi-media-requires-5.05.67-25.1 kiwi-pxeboot-5.05.67-25.1 kiwi-templates-5.05.67-25.1 kiwi-test-5.05.67-25.1 References:

1 0

openSUSE-RU-2014:0627-1: libdc1394: Removed obsoleted patch
by maintenance＠opensuse.org 12 May '14

12 May '14

openSUSE Recommended Update: libdc1394: Removed obsoleted patch ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0627-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issue with libdc1394: - Removed obsoleted patch after package uses -export-symbols-regex to limit visible symbols now. (reported on mailinglist: http://lists.opensuse.org/opensuse-packaging/2014-04/msg0006 4.html) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-352 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libdc1394-2.2.1-2.4.1 libdc1394-22-2.2.1-2.4.1 libdc1394-22-debuginfo-2.2.1-2.4.1 libdc1394-debuginfo-2.2.1-2.4.1 libdc1394-debugsource-2.2.1-2.4.1 libdc1394-devel-2.2.1-2.4.1 - openSUSE 13.1 (x86_64): libdc1394-22-32bit-2.2.1-2.4.1 libdc1394-22-debuginfo-32bit-2.2.1-2.4.1 libdc1394-debuginfo-32bit-2.2.1-2.4.1 References:

1 0

openSUSE-RU-2014:0626-1: moderate: yast2: Make sure the system ruby is used
by maintenance＠opensuse.org 12 May '14

12 May '14

openSUSE Recommended Update: yast2: Make sure the system ruby is used ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0626-1 Rating: moderate References: #845897 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with yast2: - bnc#845897: Make sure that the system ruby is used Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-353 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): yast2-3.0.14-17.1 yast2-devel-doc-3.0.14-17.1 References: https://bugzilla.novell.com/845897

1 0

openSUSE-RU-2014:0625-1: fcitx: several bugfixes
by maintenance＠opensuse.org 12 May '14

12 May '14

openSUSE Recommended Update: fcitx: several bugfixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0625-1 Rating: low References: #851983 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with fcitx: - bnc#851983: fix systray icon problem - fix potential risk of current ENV - support sogou pinyin released by Sougou INC. - artwork update Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-351 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): fcitx-4.2.8.3-9.1 fcitx-debuginfo-4.2.8.3-9.1 fcitx-devel-4.2.8.3-9.1 fcitx-devel-debuginfo-4.2.8.3-9.1 fcitx-gtk2-4.2.8.3-9.1 fcitx-gtk3-4.2.8.3-9.1 fcitx-pinyin-4.2.8.3-9.1 fcitx-pinyin-tools-4.2.8.3-9.1 fcitx-pinyin-tools-debuginfo-4.2.8.3-9.1 fcitx-qt4-4.2.8.3-9.1 fcitx-qt4-debuginfo-4.2.8.3-9.1 fcitx-quwei-4.2.8.3-9.1 fcitx-table-4.2.8.3-9.1 fcitx-table-tools-4.2.8.3-9.1 fcitx-table-tools-debuginfo-4.2.8.3-9.1 libfcitx-4_2_8-4.2.8.3-9.1 typelib-1_0-Fcitx-1_0-4.2.8.3-9.1 - openSUSE 13.1 (x86_64): fcitx-gtk2-32bit-4.2.8.3-9.1 fcitx-gtk3-32bit-4.2.8.3-9.1 fcitx-qt4-32bit-4.2.8.3-9.1 fcitx-qt4-debuginfo-32bit-4.2.8.3-9.1 libfcitx-4_2_8-32bit-4.2.8.3-9.1 - openSUSE 13.1 (noarch): fcitx-branding-openSUSE-4.2.8.3-9.1 fcitx-skin-classic-4.2.8.3-9.1 fcitx-skin-dark-4.2.8.3-9.1 fcitx-skin-new-air-4.2.8.3-9.1 fcitx-table-cn-bingchan-4.2.8.3-9.1 fcitx-table-cn-cangjie-4.2.8.3-9.1 fcitx-table-cn-dianbao-4.2.8.3-9.1 fcitx-table-cn-erbi-4.2.8.3-9.1 fcitx-table-cn-wanfeng-4.2.8.3-9.1 fcitx-table-cn-wubi-4.2.8.3-9.1 fcitx-table-cn-wubi-pinyin-4.2.8.3-9.1 fcitx-table-cn-ziran-4.2.8.3-9.1 References: https://bugzilla.novell.com/851983

1 0

openSUSE-SU-2014:0620-1: moderate: update for python-eyeD3
by opensuse-security＠opensuse.org 07 May '14

07 May '14

openSUSE Security Update: update for python-eyeD3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0620-1 Rating: moderate References: #863744 Cross-References: CVE-2014-1934 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python-eyeD3 fixes the following security issue. - bnc#863744: Fixed insecure use of temporary files (CVE-2014-1934). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-348 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): python-eyeD3-0.7.3-3.4.1 References: http://support.novell.com/security/cve/CVE-2014-1934.html https://bugzilla.novell.com/863744

1 0

openSUSE-SU-2014:0619-1: moderate: update for python-eyeD3
by opensuse-security＠opensuse.org 07 May '14

07 May '14

openSUSE Security Update: update for python-eyeD3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0619-1 Rating: moderate References: #863744 Cross-References: CVE-2014-1934 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python-eyeD3 update fixes the following security issue: - bnc#863744: Fixed insecure use of temporary files (CVE-2014-1934). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-349 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): python-eyeD3-0.6.18-5.4.1 References: http://support.novell.com/security/cve/CVE-2014-1934.html https://bugzilla.novell.com/863744

1 0

openSUSE-SU-2014:0618-1: moderate: update for libpng12
by opensuse-security＠opensuse.org 07 May '14

07 May '14

openSUSE Security Update: update for libpng12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0618-1 Rating: moderate References: #873123 #873124 Cross-References: CVE-2013-7353 CVE-2013-7354 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This libpng12 update fixes the following two security issues. - bnc#873123: Fixed integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2() (CVE-2013-7354). - bnc#873124: Fixed integer overflow leading to a heap-based buffer overflow in png_set_unknown_chunks() (CVE-2013-7353). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-347 - openSUSE 12.3: zypper in -t patch openSUSE-2014-347 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libpng12-0-1.2.50-6.4.1 libpng12-0-debuginfo-1.2.50-6.4.1 libpng12-compat-devel-1.2.50-6.4.1 libpng12-debugsource-1.2.50-6.4.1 libpng12-devel-1.2.50-6.4.1 - openSUSE 13.1 (x86_64): libpng12-0-32bit-1.2.50-6.4.1 libpng12-0-debuginfo-32bit-1.2.50-6.4.1 libpng12-compat-devel-32bit-1.2.50-6.4.1 libpng12-devel-32bit-1.2.50-6.4.1 - openSUSE 12.3 (i586 x86_64): libpng12-0-1.2.50-3.6.1 libpng12-0-debuginfo-1.2.50-3.6.1 libpng12-compat-devel-1.2.50-3.6.1 libpng12-debugsource-1.2.50-3.6.1 libpng12-devel-1.2.50-3.6.1 - openSUSE 12.3 (x86_64): libpng12-0-32bit-1.2.50-3.6.1 libpng12-0-debuginfo-32bit-1.2.50-3.6.1 libpng12-compat-devel-32bit-1.2.50-3.6.1 libpng12-devel-32bit-1.2.50-3.6.1 References: http://support.novell.com/security/cve/CVE-2013-7353.html http://support.novell.com/security/cve/CVE-2013-7354.html https://bugzilla.novell.com/873123 https://bugzilla.novell.com/873124

1 0