June 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:0821-1: moderate: dbus-1: Fixed possible DoS
by opensuse-security＠opensuse.org 20 Jun '14

20 Jun '14

openSUSE Security Update: dbus-1: Fixed possible DoS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0821-1 Rating: moderate References: #881137 Cross-References: CVE-2014-3477 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: dbus-1 was updated to fix a possible DoS (CVE-2014-3477). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-434 - openSUSE 12.3: zypper in -t patch openSUSE-2014-434 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): dbus-1-1.7.4-4.12.2 dbus-1-debuginfo-1.7.4-4.12.2 dbus-1-debugsource-1.7.4-4.12.1 dbus-1-devel-1.7.4-4.12.1 dbus-1-x11-1.7.4-4.12.2 dbus-1-x11-debuginfo-1.7.4-4.12.2 dbus-1-x11-debugsource-1.7.4-4.12.2 libdbus-1-3-1.7.4-4.12.1 libdbus-1-3-debuginfo-1.7.4-4.12.1 - openSUSE 13.1 (x86_64): dbus-1-debuginfo-32bit-1.7.4-4.12.2 dbus-1-devel-32bit-1.7.4-4.12.1 libdbus-1-3-32bit-1.7.4-4.12.1 libdbus-1-3-debuginfo-32bit-1.7.4-4.12.1 - openSUSE 13.1 (noarch): dbus-1-devel-doc-1.7.4-4.12.2 - openSUSE 12.3 (i586 x86_64): dbus-1-1.6.8-2.18.1 dbus-1-debuginfo-1.6.8-2.18.1 dbus-1-debugsource-1.6.8-2.18.1 dbus-1-devel-1.6.8-2.18.1 dbus-1-x11-1.6.8-2.18.1 dbus-1-x11-debuginfo-1.6.8-2.18.1 dbus-1-x11-debugsource-1.6.8-2.18.1 libdbus-1-3-1.6.8-2.18.1 libdbus-1-3-debuginfo-1.6.8-2.18.1 - openSUSE 12.3 (x86_64): dbus-1-32bit-1.6.8-2.18.1 dbus-1-debuginfo-32bit-1.6.8-2.18.1 dbus-1-devel-32bit-1.6.8-2.18.1 libdbus-1-3-32bit-1.6.8-2.18.1 libdbus-1-3-debuginfo-32bit-1.6.8-2.18.1 - openSUSE 12.3 (noarch): dbus-1-devel-doc-1.6.8-2.18.1 References: http://support.novell.com/security/cve/CVE-2014-3477.html https://bugzilla.novell.com/881137

1 0

openSUSE-RU-2014:0820-1: moderate: mdadm: fixes support of multi-level raid devices
by maintenance＠opensuse.org 20 Jun '14

20 Jun '14

openSUSE Recommended Update: mdadm: fixes support of multi-level raid devices ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0820-1 Rating: moderate References: #879384 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with mdadm: -bnc#879384: support multi-level raid devices for boot Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-433 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): mdadm-3.3-4.8.1 mdadm-debuginfo-3.3-4.8.1 mdadm-debugsource-3.3-4.8.1 References: https://bugzilla.novell.com/879384

1 0

openSUSE-SU-2014:0819-1: moderate: MozillaFirefox, mozilla-nspr: Update fixes nine security issues
by opensuse-security＠opensuse.org 20 Jun '14

20 Jun '14

openSUSE Security Update: MozillaFirefox, mozilla-nspr: Update fixes nine security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0819-1 Rating: moderate References: #881874 Cross-References: CVE-2014-1533 CVE-2014-1534 CVE-2014-1536 CVE-2014-1537 CVE-2014-1538 CVE-2014-1539 CVE-2014-1540 CVE-2014-1541 CVE-2014-1542 CVE-2014-1543 CVE-2014-1545 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: mozilla-nspr was updated to version 4.10.6 to fix one security issue: * OOB write with sprintf and console functions (CVE-2014-1545) MozillaFirefox was updated to version 30.0 to fix eight security issues: * Miscellaneous memory safety hazards (CVE-2014-1533/CVE-2014-1534) * Use-after-free and out of bounds issues found using Address Sanitizer (CVE-2014-1536/CVE-2014-1537/CVE-2014-1538) * Use-after-free in Event Listener Manager (CVE-2014-1540) * Use-after-free with SMIL Animation Controller (CVE-2014-1541) * Buffer overflow in Web Audio Speex resampler (CVE-2014-1542) Several non-security bugs were also fixed in this release. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-432 - openSUSE 12.3: zypper in -t patch openSUSE-2014-432 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-30.0-29.1 MozillaFirefox-branding-upstream-30.0-29.1 MozillaFirefox-buildsymbols-30.0-29.1 MozillaFirefox-debuginfo-30.0-29.1 MozillaFirefox-debugsource-30.0-29.1 MozillaFirefox-devel-30.0-29.1 MozillaFirefox-translations-common-30.0-29.1 MozillaFirefox-translations-other-30.0-29.1 libfreebl3-3.16-23.1 libfreebl3-debuginfo-3.16-23.1 libsoftokn3-3.16-23.1 libsoftokn3-debuginfo-3.16-23.1 mozilla-nspr-4.10.6-12.1 mozilla-nspr-debuginfo-4.10.6-12.1 mozilla-nspr-debugsource-4.10.6-12.1 mozilla-nspr-devel-4.10.6-12.1 mozilla-nss-3.16-23.1 mozilla-nss-certs-3.16-23.1 mozilla-nss-certs-debuginfo-3.16-23.1 mozilla-nss-debuginfo-3.16-23.1 mozilla-nss-debugsource-3.16-23.1 mozilla-nss-devel-3.16-23.1 mozilla-nss-sysinit-3.16-23.1 mozilla-nss-sysinit-debuginfo-3.16-23.1 mozilla-nss-tools-3.16-23.1 mozilla-nss-tools-debuginfo-3.16-23.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.16-23.1 libfreebl3-debuginfo-32bit-3.16-23.1 libsoftokn3-32bit-3.16-23.1 libsoftokn3-debuginfo-32bit-3.16-23.1 mozilla-nspr-32bit-4.10.6-12.1 mozilla-nspr-debuginfo-32bit-4.10.6-12.1 mozilla-nss-32bit-3.16-23.1 mozilla-nss-certs-32bit-3.16-23.1 mozilla-nss-certs-debuginfo-32bit-3.16-23.1 mozilla-nss-debuginfo-32bit-3.16-23.1 mozilla-nss-sysinit-32bit-3.16-23.1 mozilla-nss-sysinit-debuginfo-32bit-3.16-23.1 - openSUSE 12.3 (i586 x86_64): MozillaFirefox-30.0-1.68.1 MozillaFirefox-branding-upstream-30.0-1.68.1 MozillaFirefox-buildsymbols-30.0-1.68.1 MozillaFirefox-debuginfo-30.0-1.68.1 MozillaFirefox-debugsource-30.0-1.68.1 MozillaFirefox-devel-30.0-1.68.1 MozillaFirefox-translations-common-30.0-1.68.1 MozillaFirefox-translations-other-30.0-1.68.1 libfreebl3-3.16-1.39.1 libfreebl3-debuginfo-3.16-1.39.1 libsoftokn3-3.16-1.39.1 libsoftokn3-debuginfo-3.16-1.39.1 mozilla-nspr-4.10.6-1.30.1 mozilla-nspr-debuginfo-4.10.6-1.30.1 mozilla-nspr-debugsource-4.10.6-1.30.1 mozilla-nspr-devel-4.10.6-1.30.1 mozilla-nss-3.16-1.39.1 mozilla-nss-certs-3.16-1.39.1 mozilla-nss-certs-debuginfo-3.16-1.39.1 mozilla-nss-debuginfo-3.16-1.39.1 mozilla-nss-debugsource-3.16-1.39.1 mozilla-nss-devel-3.16-1.39.1 mozilla-nss-sysinit-3.16-1.39.1 mozilla-nss-sysinit-debuginfo-3.16-1.39.1 mozilla-nss-tools-3.16-1.39.1 mozilla-nss-tools-debuginfo-3.16-1.39.1 - openSUSE 12.3 (x86_64): libfreebl3-32bit-3.16-1.39.1 libfreebl3-debuginfo-32bit-3.16-1.39.1 libsoftokn3-32bit-3.16-1.39.1 libsoftokn3-debuginfo-32bit-3.16-1.39.1 mozilla-nspr-32bit-4.10.6-1.30.1 mozilla-nspr-debuginfo-32bit-4.10.6-1.30.1 mozilla-nss-32bit-3.16-1.39.1 mozilla-nss-certs-32bit-3.16-1.39.1 mozilla-nss-certs-debuginfo-32bit-3.16-1.39.1 mozilla-nss-debuginfo-32bit-3.16-1.39.1 mozilla-nss-sysinit-32bit-3.16-1.39.1 mozilla-nss-sysinit-debuginfo-32bit-3.16-1.39.1 References: http://support.novell.com/security/cve/CVE-2014-1533.html http://support.novell.com/security/cve/CVE-2014-1534.html http://support.novell.com/security/cve/CVE-2014-1536.html http://support.novell.com/security/cve/CVE-2014-1537.html http://support.novell.com/security/cve/CVE-2014-1538.html http://support.novell.com/security/cve/CVE-2014-1539.html http://support.novell.com/security/cve/CVE-2014-1540.html http://support.novell.com/security/cve/CVE-2014-1541.html http://support.novell.com/security/cve/CVE-2014-1542.html http://support.novell.com/security/cve/CVE-2014-1543.html http://support.novell.com/security/cve/CVE-2014-1545.html https://bugzilla.novell.com/881874

1 0

openSUSE-SU-2014:0815-1: moderate: miniupnpc: Update to 1.9 to fix buffer overflow
by opensuse-security＠opensuse.org 18 Jun '14

18 Jun '14

openSUSE Security Update: miniupnpc: Update to 1.9 to fix buffer overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0815-1 Rating: moderate References: #881990 Cross-References: CVE-2014-3985 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: miniupnpc was updated to 1.9 to fix a potential buffer overrun in miniwget.c (CVE-2014-3985). Besides that the following issues were fixed: * added argument remoteHost to UPNP_GetSpecificPortMappingEntry() * increment API_VERSION to 10 * --help and -h arguments in upnpc.c * define MAXHOSTNAMELEN if not already done * update upnpreplyparse to allow larger values (128 chars instead of 64) * Update upnpreplyparse to take into account "empty" elements * validate upnpreplyparse.c code with "make check" * Fix Solaris build thanks to Maciej Małecki * Fix testminiwget.sh for BSD * Fixed Makefile for *BSD * Update Makefile to use JNAerator version 0.11 * Fix testminiwget.sh for use with dash * Use $(DESTDIR) in Makefile Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-431 - openSUSE 12.3: zypper in -t patch openSUSE-2014-431 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libminiupnpc-devel-1.9-2.4.1 libminiupnpc10-1.9-2.4.1 libminiupnpc10-debuginfo-1.9-2.4.1 miniupnpc-1.9-2.4.1 miniupnpc-debuginfo-1.9-2.4.1 python-miniupnpc-1.9-2.4.1 python-miniupnpc-debuginfo-1.9-2.4.1 - openSUSE 12.3 (i586 x86_64): libminiupnpc-devel-1.9-2.4.1 libminiupnpc10-1.9-2.4.1 libminiupnpc10-debuginfo-1.9-2.4.1 miniupnpc-1.9-2.4.1 miniupnpc-debuginfo-1.9-2.4.1 python-miniupnpc-1.9-2.4.1 python-miniupnpc-debuginfo-1.9-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-3985.html https://bugzilla.novell.com/881990

1 0

openSUSE-SU-2014:0814-1: moderate: rxvt-unicode: Enforce secure handling of window property values
by opensuse-security＠opensuse.org 18 Jun '14

18 Jun '14

openSUSE Security Update: rxvt-unicode: Enforce secure handling of window property values ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0814-1 Rating: moderate References: #876101 Cross-References: CVE-2014-3121 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rxvt-unicode was patched to ensure that window property values can not be queried in secure mode (CVE-2014-3121). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-430 - openSUSE 12.3: zypper in -t patch openSUSE-2014-430 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): rxvt-unicode-9.15-6.9.1 rxvt-unicode-debuginfo-9.15-6.9.1 rxvt-unicode-debugsource-9.15-6.9.1 - openSUSE 12.3 (i586 x86_64): rxvt-unicode-9.15-4.4.1 rxvt-unicode-debuginfo-9.15-4.4.1 rxvt-unicode-debugsource-9.15-4.4.1 References: http://support.novell.com/security/cve/CVE-2014-3121.html https://bugzilla.novell.com/876101

1 0

openSUSE-SU-2014:0813-1: moderate: typo3-cms-4_5: Update to 4.5.34 to fix eight security issues
by opensuse-security＠opensuse.org 18 Jun '14

18 Jun '14

openSUSE Security Update: typo3-cms-4_5: Update to 4.5.34 to fix eight security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0813-1 Rating: moderate References: #881280 #881281 #881282 Cross-References: CVE-2014-3941 CVE-2014-3942 CVE-2014-3943 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: typo3-cms-4_5 was updated to version 4.5.34 to fix eight security vulnerabilities and several other bugs. These security problems where fixed: * Add trusted HTTP_HOST configuration (CVE-2014-3941) * XSS in (old) extension manager information function (CVE-2014-3943) * XSS in new content element wizard (CVE-2014-3943) * XSS in template tools on root page (CVE-2014-3943) * XSS in Backend Layout Wizard (CVE-2014-3943) * Encode URL for use in JavaScript (CVE-2014-3943) * Fix insecure unserialize in colorpicker (CVE-2014-3942) * Remove charts.swf to get rid of XSS vulnerability (CVE-2014-3943) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-429 - openSUSE 12.3: zypper in -t patch openSUSE-2014-429 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): typo3-cms-4_5-4.5.34-2.4.1 - openSUSE 12.3 (noarch): typo3-cms-4_5-4.5.34-2.8.1 References: http://support.novell.com/security/cve/CVE-2014-3941.html http://support.novell.com/security/cve/CVE-2014-3942.html http://support.novell.com/security/cve/CVE-2014-3943.html https://bugzilla.novell.com/881280 https://bugzilla.novell.com/881281 https://bugzilla.novell.com/881282

1 0

openSUSE-RU-2014:0812-1: moderate: dhcp: Two recommended bug fixes
by maintenance＠opensuse.org 18 Jun '14

18 Jun '14

openSUSE Recommended Update: dhcp: Two recommended bug fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0812-1 Rating: moderate References: #868250 #868253 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with dhcp: - bnc#868250: Fixed dhcp server start script to use correct libdir - bnc#868253: Fixed dhcp server to chown leases to run user at start Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-427 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): dhcp-4.2.5.P1-0.6.9.1 dhcp-client-4.2.5.P1-0.6.9.1 dhcp-client-debuginfo-4.2.5.P1-0.6.9.1 dhcp-debuginfo-4.2.5.P1-0.6.9.1 dhcp-debugsource-4.2.5.P1-0.6.9.1 dhcp-devel-4.2.5.P1-0.6.9.1 dhcp-doc-4.2.5.P1-0.6.9.1 dhcp-relay-4.2.5.P1-0.6.9.1 dhcp-relay-debuginfo-4.2.5.P1-0.6.9.1 dhcp-server-4.2.5.P1-0.6.9.1 dhcp-server-debuginfo-4.2.5.P1-0.6.9.1 References: https://bugzilla.novell.com/868250 https://bugzilla.novell.com/868253

1 0

openSUSE-RU-2014:0811-1: moderate: libserf: Update Serf to 1.3.6
by maintenance＠opensuse.org 18 Jun '14

18 Jun '14

openSUSE Recommended Update: libserf: Update Serf to 1.3.6 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0811-1 Rating: moderate References: #881902 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with libserf: - bnc#881902: Update Serf to 1.3.6 + This release fixes an instability introduced in serf 1.3.5 * Revert r2319 from serf 1.3.5: this change was making serf call handle_response multiple times in case of an error response, leading to unexpected behavior. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-426 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libserf-1-1-1.3.6-12.1 libserf-1-1-debuginfo-1.3.6-12.1 libserf-debugsource-1.3.6-12.1 libserf-devel-1.3.6-12.1 References: https://bugzilla.novell.com/881902

1 0

openSUSE-RU-2014:0810-1: gtk-sharp-beans: Add patch to fix pkgconfig file
by maintenance＠opensuse.org 18 Jun '14

18 Jun '14

openSUSE Recommended Update: gtk-sharp-beans: Add patch to fix pkgconfig file ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0810-1 Rating: low References: #782905 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with gtk-sharp-beans: - bnc#782905: Added gtk-sharp-beans-pc-fix.patch to fix pkgconfig file. Without this MonoDevelop can't see the library. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-428 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): gtk-sharp-beans-2.14.1-17.4.1 gtk-sharp-beans-devel-2.14.1-17.4.1 References: https://bugzilla.novell.com/782905

1 0

openSUSE-SU-2014:0805-1: moderate: sendmail: Close file descriptors before executing programs
by opensuse-security＠opensuse.org 17 Jun '14

17 Jun '14

openSUSE Security Update: sendmail: Close file descriptors before executing programs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0805-1 Rating: moderate References: #881284 Cross-References: CVE-2014-3956 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: sendmail was updated to properly close file descriptors before executing programs. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-66 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): rmail-8.14.3-64.1 rmail-debuginfo-8.14.3-64.1 sendmail-8.14.4-64.1 sendmail-debuginfo-8.14.4-64.1 sendmail-debugsource-8.14.4-64.1 sendmail-devel-8.14.4-64.1 References: http://support.novell.com/security/cve/CVE-2014-3956.html https://bugzilla.novell.com/881284

1 0