July 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2014:0954-1: moderate: clamav: 0.98.4 version update
by maintenance＠opensuse.org 31 Jul '14

31 Jul '14

openSUSE Recommended Update: clamav: 0.98.4 version update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0954-1 Rating: moderate References: #877475 #884589 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with clamav: -bnc#884589: Update to 0.98.4: * Fix infinite loop in clamdscan when clamd is not running. * Fix buffer underruns when handling multi-part MIME email attachments. * Fix onfiguration of OpenSSL on various platforms. * Fix linking issues with libclamunrar. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-71 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): clamav-0.98.4-33.1 clamav-debuginfo-0.98.4-33.1 clamav-debugsource-0.98.4-33.1 - openSUSE 11.4 (noarch): clamav-db-0.98.4-33.1 References: https://bugzilla.novell.com/877475 https://bugzilla.novell.com/884589

1 0

openSUSE-SU-2014:0953-2: important: ppc64-diag: fix for tmp races and information disclosure
by opensuse-security＠opensuse.org 31 Jul '14

31 Jul '14

openSUSE Security Update: ppc64-diag: fix for tmp races and information disclosure ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0953-2 Rating: important References: #882667 Cross-References: CVE-2014-4038 CVE-2014-4039 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: ppc64-diag was updated to fix tmp race issues (CVE-2014-4038) and a file disclosure problem in snapshot tarball generation (CVE-2014-4039). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (ppc ppc64): ppc64-diag-2.6.0-2.4.1 ppc64-diag-debuginfo-2.6.0-2.4.1 ppc64-diag-debugsource-2.6.0-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-4038.html http://support.novell.com/security/cve/CVE-2014-4039.html https://bugzilla.novell.com/882667

1 0

openSUSE-SU-2014:0953-1: important: ppc64-diag: fix for tmp races and information disclosure
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: ppc64-diag: fix for tmp races and information disclosure ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0953-1 Rating: important References: #882667 Cross-References: CVE-2014-4038 CVE-2014-4039 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: ppc64-diag was updated to fix tmp race issues (CVE-2014-4038) and a file disclosure problem in snapshot tarball generation (CVE-2014-4039). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (ppc ppc64): ppc64-diag-2.6.1-2.4.1 ppc64-diag-debuginfo-2.6.1-2.4.1 ppc64-diag-debugsource-2.6.1-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-4038.html http://support.novell.com/security/cve/CVE-2014-4039.html https://bugzilla.novell.com/882667

1 0

openSUSE-SU-2014:0952-1: moderate: gpg2: Fixed possible DoS
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: gpg2: Fixed possible DoS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0952-1 Rating: moderate References: #884130 Cross-References: CVE-2014-4617 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gpg2 was patched to fix a possible DoS. This security issue was fixed: - Denial of service through infinite loop with garbled compressed data packets (CVE-2014-4617) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gpg2-2.0.19-22.1 gpg2-debuginfo-2.0.19-22.1 gpg2-debugsource-2.0.19-22.1 - openSUSE 11.4 (noarch): gpg2-lang-2.0.19-22.1 References: http://support.novell.com/security/cve/CVE-2014-4617.html https://bugzilla.novell.com/884130

1 0

openSUSE-SU-2014:0951-1: moderate: memcached: Update fixes fixe security issues
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: memcached: Update fixes fixe security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0951-1 Rating: moderate References: #798458 #817781 #857188 #858676 #858677 Cross-References: CVE-2011-4971 CVE-2013-0179 CVE-2013-7239 CVE-2013-7290 CVE-2013-7291 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: memcached was updated to version 1.4.20 to fix five security issues. These security issues were fixed: - DoS when printing out keys to be deleted in verbose mode (CVE-2013-0179) - Remote DoS (crash) via a request that triggers "unbounded key print" (CVE-2013-7291) - Remote DoS (segmentation fault) via a request to delete a key (CVE-2013-7290) - SASL authentication allows wrong credentials to access memcache (CVE-2013-7239) - Remote DoS (CVE-2011-4971) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): memcached-1.4.20-7.1 memcached-debuginfo-1.4.20-7.1 memcached-debugsource-1.4.20-7.1 References: http://support.novell.com/security/cve/CVE-2011-4971.html http://support.novell.com/security/cve/CVE-2013-0179.html http://support.novell.com/security/cve/CVE-2013-7239.html http://support.novell.com/security/cve/CVE-2013-7290.html http://support.novell.com/security/cve/CVE-2013-7291.html https://bugzilla.novell.com/798458 https://bugzilla.novell.com/817781 https://bugzilla.novell.com/857188 https://bugzilla.novell.com/858676 https://bugzilla.novell.com/858677

1 0

openSUSE-SU-2014:0950-1: important: Mozilla updates 07/2014
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: Mozilla updates 07/2014 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0950-1 Rating: important References: #887746 Cross-References: CVE-2014-1492 CVE-2014-1544 CVE-2014-1547 CVE-2014-1548 CVE-2014-1555 CVE-2014-1556 CVE-2014-1557 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: update to Firefox 24.7.0 and Thunderbird 24.7.0 including fixes for * MFSA 2014-56/CVE-2014-1547/CVE-2014-1548 Miscellaneous memory safety hazards * MFSA 2014-61/CVE-2014-1555 (bmo#1023121) Use-after-free with FireOnStateChange event * MFSA 2014-62/CVE-2014-1556 (bmo#1028891) Exploitable WebGL crash with Cesium JavaScript library * MFSA 2014-63/CVE-2014-1544 (bmo#963150) Use-after-free while when manipulating certificates in the trusted cache (solved with NSS 3.16.2 requirement) * MFSA 2014-64/CVE-2014-1557 (bmo#913805) Crash in Skia library when scaling high quality images - require NSS 3.16.2 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-24.7.0-119.1 MozillaFirefox-branding-upstream-24.7.0-119.1 MozillaFirefox-buildsymbols-24.7.0-119.1 MozillaFirefox-debuginfo-24.7.0-119.1 MozillaFirefox-debugsource-24.7.0-119.1 MozillaFirefox-devel-24.7.0-119.1 MozillaFirefox-translations-common-24.7.0-119.1 MozillaFirefox-translations-other-24.7.0-119.1 MozillaThunderbird-24.7.0-101.1 MozillaThunderbird-buildsymbols-24.7.0-101.1 MozillaThunderbird-debuginfo-24.7.0-101.1 MozillaThunderbird-debugsource-24.7.0-101.1 MozillaThunderbird-devel-24.7.0-101.1 MozillaThunderbird-translations-common-24.7.0-101.1 MozillaThunderbird-translations-other-24.7.0-101.1 enigmail-1.7-2.1 enigmail-debuginfo-1.7-2.1 enigmail-debugsource-1.7-2.1 libfreebl3-3.16.3-86.1 libfreebl3-debuginfo-3.16.3-86.1 libsoftokn3-3.16.3-86.1 libsoftokn3-debuginfo-3.16.3-86.1 mozilla-nss-3.16.3-86.1 mozilla-nss-certs-3.16.3-86.1 mozilla-nss-certs-debuginfo-3.16.3-86.1 mozilla-nss-debuginfo-3.16.3-86.1 mozilla-nss-debugsource-3.16.3-86.1 mozilla-nss-devel-3.16.3-86.1 mozilla-nss-sysinit-3.16.3-86.1 mozilla-nss-sysinit-debuginfo-3.16.3-86.1 mozilla-nss-tools-3.16.3-86.1 mozilla-nss-tools-debuginfo-3.16.3-86.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.16.3-86.1 libfreebl3-debuginfo-32bit-3.16.3-86.1 libsoftokn3-32bit-3.16.3-86.1 libsoftokn3-debuginfo-32bit-3.16.3-86.1 mozilla-nss-32bit-3.16.3-86.1 mozilla-nss-certs-32bit-3.16.3-86.1 mozilla-nss-certs-debuginfo-32bit-3.16.3-86.1 mozilla-nss-debuginfo-32bit-3.16.3-86.1 mozilla-nss-sysinit-32bit-3.16.3-86.1 mozilla-nss-sysinit-debuginfo-32bit-3.16.3-86.1 - openSUSE 11.4 (ia64): libfreebl3-debuginfo-x86-3.16.3-86.1 libfreebl3-x86-3.16.3-86.1 libsoftokn3-debuginfo-x86-3.16.3-86.1 libsoftokn3-x86-3.16.3-86.1 mozilla-nss-certs-debuginfo-x86-3.16.3-86.1 mozilla-nss-certs-x86-3.16.3-86.1 mozilla-nss-debuginfo-x86-3.16.3-86.1 mozilla-nss-sysinit-debuginfo-x86-3.16.3-86.1 mozilla-nss-sysinit-x86-3.16.3-86.1 mozilla-nss-x86-3.16.3-86.1 References: http://support.novell.com/security/cve/CVE-2014-1492.html http://support.novell.com/security/cve/CVE-2014-1544.html http://support.novell.com/security/cve/CVE-2014-1547.html http://support.novell.com/security/cve/CVE-2014-1548.html http://support.novell.com/security/cve/CVE-2014-1555.html http://support.novell.com/security/cve/CVE-2014-1556.html http://support.novell.com/security/cve/CVE-2014-1557.html https://bugzilla.novell.com/887746

1 0

openSUSE-SU-2014:0949-1: moderate: ntp: adjust default config against distributed denial of service attack
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: ntp: adjust default config against distributed denial of service attack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0949-1 Rating: moderate References: #857195 Cross-References: CVE-2013-5211 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The NTP time service could be used for remote denial of service amplification attacks. This issue can be fixed by the administrator as we described in our security advisory SUSE-SA:2014:001 http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html and on http://support.novell.com/security/cve/CVE-2013-5211.html This update now also replaces the default ntp.conf template to fix this problem. Please note that if you have touched or modified ntp.conf yourself, it will not be automatically fixed, you need to merge the changes manually as described. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- - openSUSE 12.3: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): ntp-4.2.6p5-15.5.1 ntp-debuginfo-4.2.6p5-15.5.1 ntp-debugsource-4.2.6p5-15.5.1 ntp-doc-4.2.6p5-15.5.1 - openSUSE 12.3 (i586 x86_64): ntp-4.2.6p5-9.6.1 ntp-debuginfo-4.2.6p5-9.6.1 ntp-debugsource-4.2.6p5-9.6.1 ntp-doc-4.2.6p5-9.6.1 References: http://support.novell.com/security/cve/CVE-2013-5211.html https://bugzilla.novell.com/857195

1 0

openSUSE-SU-2014:0948-1: moderate: xalan-j2: Ensure secure processing
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: xalan-j2: Ensure secure processing ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0948-1 Rating: moderate References: #870082 Cross-References: CVE-2014-0107 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: xalan-j2 was updated to ensure secure processing can't be circumvented (CVE-2014-0107). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): xalan-j2-2.7.0-253.1 xalan-j2-demo-2.7.0-253.1 xalan-j2-javadoc-2.7.0-253.1 xalan-j2-manual-2.7.0-253.1 xalan-j2-xsltc-2.7.0-253.1 References: http://support.novell.com/security/cve/CVE-2014-0107.html https://bugzilla.novell.com/870082

1 0

openSUSE-RU-2014:0947-1: moderate: clamav: 0.98.4 version update
by maintenance＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Recommended Update: clamav: 0.98.4 version update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0947-1 Rating: moderate References: #884589 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with clamav: -bnc#884589: Update to 0.98.4: * Fix infinite loop in clamdscan when clamd is not running. * Fix buffer underruns when handling multi-part MIME email attachments. * Fix onfiguration of OpenSSL on various platforms. * Fix linking issues with libclamunrar. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- - openSUSE 12.3: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): clamav-0.98.4-14.1 clamav-debuginfo-0.98.4-14.1 clamav-debugsource-0.98.4-14.1 - openSUSE 12.3 (i586 x86_64): clamav-0.98.4-5.22.1 clamav-debuginfo-0.98.4-5.22.1 clamav-debugsource-0.98.4-5.22.1 References: https://bugzilla.novell.com/884589

1 0

openSUSE-SU-2014:0946-1: moderate: update for pulseaudio
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: update for pulseaudio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0946-1 Rating: moderate References: Cross-References: CVE-2014-3970 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue: (bnc#881524) CVE-2014-3970 - Denial of service in module-rtp-recv Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- - openSUSE 12.3: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libpulse-devel-4.0.git.270.g9490a-12.1 libpulse-mainloop-glib0-4.0.git.270.g9490a-12.1 libpulse-mainloop-glib0-debuginfo-4.0.git.270.g9490a-12.1 libpulse0-4.0.git.270.g9490a-12.1 libpulse0-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-4.0.git.270.g9490a-12.1 pulseaudio-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-debugsource-4.0.git.270.g9490a-12.1 pulseaudio-esound-compat-4.0.git.270.g9490a-12.1 pulseaudio-gdm-hooks-4.0.git.270.g9490a-12.1 pulseaudio-module-bluetooth-4.0.git.270.g9490a-12.1 pulseaudio-module-bluetooth-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-module-gconf-4.0.git.270.g9490a-12.1 pulseaudio-module-gconf-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-module-jack-4.0.git.270.g9490a-12.1 pulseaudio-module-jack-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-module-lirc-4.0.git.270.g9490a-12.1 pulseaudio-module-lirc-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-module-x11-4.0.git.270.g9490a-12.1 pulseaudio-module-x11-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-module-zeroconf-4.0.git.270.g9490a-12.1 pulseaudio-module-zeroconf-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-system-wide-4.0.git.270.g9490a-12.1 pulseaudio-utils-4.0.git.270.g9490a-12.1 pulseaudio-utils-debuginfo-4.0.git.270.g9490a-12.1 - openSUSE 13.1 (x86_64): libpulse-mainloop-glib0-32bit-4.0.git.270.g9490a-12.1 libpulse-mainloop-glib0-debuginfo-32bit-4.0.git.270.g9490a-12.1 libpulse0-32bit-4.0.git.270.g9490a-12.1 libpulse0-debuginfo-32bit-4.0.git.270.g9490a-12.1 - openSUSE 13.1 (noarch): pulseaudio-lang-4.0.git.270.g9490a-12.1 - openSUSE 12.3 (i586 x86_64): libpulse-devel-3.0-1.10.1 libpulse-mainloop-glib0-3.0-1.10.1 libpulse-mainloop-glib0-debuginfo-3.0-1.10.1 libpulse0-3.0-1.10.1 libpulse0-debuginfo-3.0-1.10.1 pulseaudio-3.0-1.10.1 pulseaudio-debuginfo-3.0-1.10.1 pulseaudio-debugsource-3.0-1.10.1 pulseaudio-esound-compat-3.0-1.10.1 pulseaudio-gdm-hooks-3.0-1.10.1 pulseaudio-module-bluetooth-3.0-1.10.1 pulseaudio-module-bluetooth-debuginfo-3.0-1.10.1 pulseaudio-module-gconf-3.0-1.10.1 pulseaudio-module-gconf-debuginfo-3.0-1.10.1 pulseaudio-module-jack-3.0-1.10.1 pulseaudio-module-jack-debuginfo-3.0-1.10.1 pulseaudio-module-lirc-3.0-1.10.1 pulseaudio-module-lirc-debuginfo-3.0-1.10.1 pulseaudio-module-x11-3.0-1.10.1 pulseaudio-module-x11-debuginfo-3.0-1.10.1 pulseaudio-module-zeroconf-3.0-1.10.1 pulseaudio-module-zeroconf-debuginfo-3.0-1.10.1 pulseaudio-utils-3.0-1.10.1 pulseaudio-utils-debuginfo-3.0-1.10.1 - openSUSE 12.3 (x86_64): libpulse-mainloop-glib0-32bit-3.0-1.10.1 libpulse-mainloop-glib0-debuginfo-32bit-3.0-1.10.1 libpulse0-32bit-3.0-1.10.1 libpulse0-debuginfo-32bit-3.0-1.10.1 - openSUSE 12.3 (noarch): pulseaudio-lang-3.0-1.10.1 References: http://support.novell.com/security/cve/CVE-2014-3970.html

1 0