July 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2014:0954-1: moderate: clamav: 0.98.4 version update
by maintenance＠opensuse.org 31 Jul '14

31 Jul '14

openSUSE Recommended Update: clamav: 0.98.4 version update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0954-1 Rating: moderate References: #877475 #884589 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with clamav: -bnc#884589: Update to 0.98.4: * Fix infinite loop in clamdscan when clamd is not running. * Fix buffer underruns when handling multi-part MIME email attachments. * Fix onfiguration of OpenSSL on various platforms. * Fix linking issues with libclamunrar. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-71 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): clamav-0.98.4-33.1 clamav-debuginfo-0.98.4-33.1 clamav-debugsource-0.98.4-33.1 - openSUSE 11.4 (noarch): clamav-db-0.98.4-33.1 References: https://bugzilla.novell.com/877475 https://bugzilla.novell.com/884589

1 0

openSUSE-SU-2014:0953-2: important: ppc64-diag: fix for tmp races and information disclosure
by opensuse-security＠opensuse.org 31 Jul '14

31 Jul '14

openSUSE Security Update: ppc64-diag: fix for tmp races and information disclosure ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0953-2 Rating: important References: #882667 Cross-References: CVE-2014-4038 CVE-2014-4039 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: ppc64-diag was updated to fix tmp race issues (CVE-2014-4038) and a file disclosure problem in snapshot tarball generation (CVE-2014-4039). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (ppc ppc64): ppc64-diag-2.6.0-2.4.1 ppc64-diag-debuginfo-2.6.0-2.4.1 ppc64-diag-debugsource-2.6.0-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-4038.html http://support.novell.com/security/cve/CVE-2014-4039.html https://bugzilla.novell.com/882667

1 0

openSUSE-SU-2014:0953-1: important: ppc64-diag: fix for tmp races and information disclosure
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: ppc64-diag: fix for tmp races and information disclosure ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0953-1 Rating: important References: #882667 Cross-References: CVE-2014-4038 CVE-2014-4039 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: ppc64-diag was updated to fix tmp race issues (CVE-2014-4038) and a file disclosure problem in snapshot tarball generation (CVE-2014-4039). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (ppc ppc64): ppc64-diag-2.6.1-2.4.1 ppc64-diag-debuginfo-2.6.1-2.4.1 ppc64-diag-debugsource-2.6.1-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-4038.html http://support.novell.com/security/cve/CVE-2014-4039.html https://bugzilla.novell.com/882667

1 0

openSUSE-SU-2014:0952-1: moderate: gpg2: Fixed possible DoS
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: gpg2: Fixed possible DoS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0952-1 Rating: moderate References: #884130 Cross-References: CVE-2014-4617 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gpg2 was patched to fix a possible DoS. This security issue was fixed: - Denial of service through infinite loop with garbled compressed data packets (CVE-2014-4617) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gpg2-2.0.19-22.1 gpg2-debuginfo-2.0.19-22.1 gpg2-debugsource-2.0.19-22.1 - openSUSE 11.4 (noarch): gpg2-lang-2.0.19-22.1 References: http://support.novell.com/security/cve/CVE-2014-4617.html https://bugzilla.novell.com/884130

1 0

openSUSE-SU-2014:0951-1: moderate: memcached: Update fixes fixe security issues
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: memcached: Update fixes fixe security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0951-1 Rating: moderate References: #798458 #817781 #857188 #858676 #858677 Cross-References: CVE-2011-4971 CVE-2013-0179 CVE-2013-7239 CVE-2013-7290 CVE-2013-7291 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: memcached was updated to version 1.4.20 to fix five security issues. These security issues were fixed: - DoS when printing out keys to be deleted in verbose mode (CVE-2013-0179) - Remote DoS (crash) via a request that triggers "unbounded key print" (CVE-2013-7291) - Remote DoS (segmentation fault) via a request to delete a key (CVE-2013-7290) - SASL authentication allows wrong credentials to access memcache (CVE-2013-7239) - Remote DoS (CVE-2011-4971) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): memcached-1.4.20-7.1 memcached-debuginfo-1.4.20-7.1 memcached-debugsource-1.4.20-7.1 References: http://support.novell.com/security/cve/CVE-2011-4971.html http://support.novell.com/security/cve/CVE-2013-0179.html http://support.novell.com/security/cve/CVE-2013-7239.html http://support.novell.com/security/cve/CVE-2013-7290.html http://support.novell.com/security/cve/CVE-2013-7291.html https://bugzilla.novell.com/798458 https://bugzilla.novell.com/817781 https://bugzilla.novell.com/857188 https://bugzilla.novell.com/858676 https://bugzilla.novell.com/858677

1 0

openSUSE-SU-2014:0950-1: important: Mozilla updates 07/2014
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: Mozilla updates 07/2014 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0950-1 Rating: important References: #887746 Cross-References: CVE-2014-1492 CVE-2014-1544 CVE-2014-1547 CVE-2014-1548 CVE-2014-1555 CVE-2014-1556 CVE-2014-1557 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: update to Firefox 24.7.0 and Thunderbird 24.7.0 including fixes for * MFSA 2014-56/CVE-2014-1547/CVE-2014-1548 Miscellaneous memory safety hazards * MFSA 2014-61/CVE-2014-1555 (bmo#1023121) Use-after-free with FireOnStateChange event * MFSA 2014-62/CVE-2014-1556 (bmo#1028891) Exploitable WebGL crash with Cesium JavaScript library * MFSA 2014-63/CVE-2014-1544 (bmo#963150) Use-after-free while when manipulating certificates in the trusted cache (solved with NSS 3.16.2 requirement) * MFSA 2014-64/CVE-2014-1557 (bmo#913805) Crash in Skia library when scaling high quality images - require NSS 3.16.2 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-24.7.0-119.1 MozillaFirefox-branding-upstream-24.7.0-119.1 MozillaFirefox-buildsymbols-24.7.0-119.1 MozillaFirefox-debuginfo-24.7.0-119.1 MozillaFirefox-debugsource-24.7.0-119.1 MozillaFirefox-devel-24.7.0-119.1 MozillaFirefox-translations-common-24.7.0-119.1 MozillaFirefox-translations-other-24.7.0-119.1 MozillaThunderbird-24.7.0-101.1 MozillaThunderbird-buildsymbols-24.7.0-101.1 MozillaThunderbird-debuginfo-24.7.0-101.1 MozillaThunderbird-debugsource-24.7.0-101.1 MozillaThunderbird-devel-24.7.0-101.1 MozillaThunderbird-translations-common-24.7.0-101.1 MozillaThunderbird-translations-other-24.7.0-101.1 enigmail-1.7-2.1 enigmail-debuginfo-1.7-2.1 enigmail-debugsource-1.7-2.1 libfreebl3-3.16.3-86.1 libfreebl3-debuginfo-3.16.3-86.1 libsoftokn3-3.16.3-86.1 libsoftokn3-debuginfo-3.16.3-86.1 mozilla-nss-3.16.3-86.1 mozilla-nss-certs-3.16.3-86.1 mozilla-nss-certs-debuginfo-3.16.3-86.1 mozilla-nss-debuginfo-3.16.3-86.1 mozilla-nss-debugsource-3.16.3-86.1 mozilla-nss-devel-3.16.3-86.1 mozilla-nss-sysinit-3.16.3-86.1 mozilla-nss-sysinit-debuginfo-3.16.3-86.1 mozilla-nss-tools-3.16.3-86.1 mozilla-nss-tools-debuginfo-3.16.3-86.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.16.3-86.1 libfreebl3-debuginfo-32bit-3.16.3-86.1 libsoftokn3-32bit-3.16.3-86.1 libsoftokn3-debuginfo-32bit-3.16.3-86.1 mozilla-nss-32bit-3.16.3-86.1 mozilla-nss-certs-32bit-3.16.3-86.1 mozilla-nss-certs-debuginfo-32bit-3.16.3-86.1 mozilla-nss-debuginfo-32bit-3.16.3-86.1 mozilla-nss-sysinit-32bit-3.16.3-86.1 mozilla-nss-sysinit-debuginfo-32bit-3.16.3-86.1 - openSUSE 11.4 (ia64): libfreebl3-debuginfo-x86-3.16.3-86.1 libfreebl3-x86-3.16.3-86.1 libsoftokn3-debuginfo-x86-3.16.3-86.1 libsoftokn3-x86-3.16.3-86.1 mozilla-nss-certs-debuginfo-x86-3.16.3-86.1 mozilla-nss-certs-x86-3.16.3-86.1 mozilla-nss-debuginfo-x86-3.16.3-86.1 mozilla-nss-sysinit-debuginfo-x86-3.16.3-86.1 mozilla-nss-sysinit-x86-3.16.3-86.1 mozilla-nss-x86-3.16.3-86.1 References: http://support.novell.com/security/cve/CVE-2014-1492.html http://support.novell.com/security/cve/CVE-2014-1544.html http://support.novell.com/security/cve/CVE-2014-1547.html http://support.novell.com/security/cve/CVE-2014-1548.html http://support.novell.com/security/cve/CVE-2014-1555.html http://support.novell.com/security/cve/CVE-2014-1556.html http://support.novell.com/security/cve/CVE-2014-1557.html https://bugzilla.novell.com/887746

1 0

openSUSE-SU-2014:0949-1: moderate: ntp: adjust default config against distributed denial of service attack
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: ntp: adjust default config against distributed denial of service attack ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0949-1 Rating: moderate References: #857195 Cross-References: CVE-2013-5211 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The NTP time service could be used for remote denial of service amplification attacks. This issue can be fixed by the administrator as we described in our security advisory SUSE-SA:2014:001 http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html and on http://support.novell.com/security/cve/CVE-2013-5211.html This update now also replaces the default ntp.conf template to fix this problem. Please note that if you have touched or modified ntp.conf yourself, it will not be automatically fixed, you need to merge the changes manually as described. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- - openSUSE 12.3: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): ntp-4.2.6p5-15.5.1 ntp-debuginfo-4.2.6p5-15.5.1 ntp-debugsource-4.2.6p5-15.5.1 ntp-doc-4.2.6p5-15.5.1 - openSUSE 12.3 (i586 x86_64): ntp-4.2.6p5-9.6.1 ntp-debuginfo-4.2.6p5-9.6.1 ntp-debugsource-4.2.6p5-9.6.1 ntp-doc-4.2.6p5-9.6.1 References: http://support.novell.com/security/cve/CVE-2013-5211.html https://bugzilla.novell.com/857195

1 0

openSUSE-SU-2014:0948-1: moderate: xalan-j2: Ensure secure processing
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: xalan-j2: Ensure secure processing ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0948-1 Rating: moderate References: #870082 Cross-References: CVE-2014-0107 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: xalan-j2 was updated to ensure secure processing can't be circumvented (CVE-2014-0107). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (noarch): xalan-j2-2.7.0-253.1 xalan-j2-demo-2.7.0-253.1 xalan-j2-javadoc-2.7.0-253.1 xalan-j2-manual-2.7.0-253.1 xalan-j2-xsltc-2.7.0-253.1 References: http://support.novell.com/security/cve/CVE-2014-0107.html https://bugzilla.novell.com/870082

1 0

openSUSE-RU-2014:0947-1: moderate: clamav: 0.98.4 version update
by maintenance＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Recommended Update: clamav: 0.98.4 version update ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0947-1 Rating: moderate References: #884589 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with clamav: -bnc#884589: Update to 0.98.4: * Fix infinite loop in clamdscan when clamd is not running. * Fix buffer underruns when handling multi-part MIME email attachments. * Fix onfiguration of OpenSSL on various platforms. * Fix linking issues with libclamunrar. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- - openSUSE 12.3: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): clamav-0.98.4-14.1 clamav-debuginfo-0.98.4-14.1 clamav-debugsource-0.98.4-14.1 - openSUSE 12.3 (i586 x86_64): clamav-0.98.4-5.22.1 clamav-debuginfo-0.98.4-5.22.1 clamav-debugsource-0.98.4-5.22.1 References: https://bugzilla.novell.com/884589

1 0

openSUSE-SU-2014:0946-1: moderate: update for pulseaudio
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: update for pulseaudio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0946-1 Rating: moderate References: Cross-References: CVE-2014-3970 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the following security issue: (bnc#881524) CVE-2014-3970 - Denial of service in module-rtp-recv Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- - openSUSE 12.3: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libpulse-devel-4.0.git.270.g9490a-12.1 libpulse-mainloop-glib0-4.0.git.270.g9490a-12.1 libpulse-mainloop-glib0-debuginfo-4.0.git.270.g9490a-12.1 libpulse0-4.0.git.270.g9490a-12.1 libpulse0-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-4.0.git.270.g9490a-12.1 pulseaudio-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-debugsource-4.0.git.270.g9490a-12.1 pulseaudio-esound-compat-4.0.git.270.g9490a-12.1 pulseaudio-gdm-hooks-4.0.git.270.g9490a-12.1 pulseaudio-module-bluetooth-4.0.git.270.g9490a-12.1 pulseaudio-module-bluetooth-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-module-gconf-4.0.git.270.g9490a-12.1 pulseaudio-module-gconf-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-module-jack-4.0.git.270.g9490a-12.1 pulseaudio-module-jack-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-module-lirc-4.0.git.270.g9490a-12.1 pulseaudio-module-lirc-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-module-x11-4.0.git.270.g9490a-12.1 pulseaudio-module-x11-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-module-zeroconf-4.0.git.270.g9490a-12.1 pulseaudio-module-zeroconf-debuginfo-4.0.git.270.g9490a-12.1 pulseaudio-system-wide-4.0.git.270.g9490a-12.1 pulseaudio-utils-4.0.git.270.g9490a-12.1 pulseaudio-utils-debuginfo-4.0.git.270.g9490a-12.1 - openSUSE 13.1 (x86_64): libpulse-mainloop-glib0-32bit-4.0.git.270.g9490a-12.1 libpulse-mainloop-glib0-debuginfo-32bit-4.0.git.270.g9490a-12.1 libpulse0-32bit-4.0.git.270.g9490a-12.1 libpulse0-debuginfo-32bit-4.0.git.270.g9490a-12.1 - openSUSE 13.1 (noarch): pulseaudio-lang-4.0.git.270.g9490a-12.1 - openSUSE 12.3 (i586 x86_64): libpulse-devel-3.0-1.10.1 libpulse-mainloop-glib0-3.0-1.10.1 libpulse-mainloop-glib0-debuginfo-3.0-1.10.1 libpulse0-3.0-1.10.1 libpulse0-debuginfo-3.0-1.10.1 pulseaudio-3.0-1.10.1 pulseaudio-debuginfo-3.0-1.10.1 pulseaudio-debugsource-3.0-1.10.1 pulseaudio-esound-compat-3.0-1.10.1 pulseaudio-gdm-hooks-3.0-1.10.1 pulseaudio-module-bluetooth-3.0-1.10.1 pulseaudio-module-bluetooth-debuginfo-3.0-1.10.1 pulseaudio-module-gconf-3.0-1.10.1 pulseaudio-module-gconf-debuginfo-3.0-1.10.1 pulseaudio-module-jack-3.0-1.10.1 pulseaudio-module-jack-debuginfo-3.0-1.10.1 pulseaudio-module-lirc-3.0-1.10.1 pulseaudio-module-lirc-debuginfo-3.0-1.10.1 pulseaudio-module-x11-3.0-1.10.1 pulseaudio-module-x11-debuginfo-3.0-1.10.1 pulseaudio-module-zeroconf-3.0-1.10.1 pulseaudio-module-zeroconf-debuginfo-3.0-1.10.1 pulseaudio-utils-3.0-1.10.1 pulseaudio-utils-debuginfo-3.0-1.10.1 - openSUSE 12.3 (x86_64): libpulse-mainloop-glib0-32bit-3.0-1.10.1 libpulse-mainloop-glib0-debuginfo-32bit-3.0-1.10.1 libpulse0-32bit-3.0-1.10.1 libpulse0-debuginfo-32bit-3.0-1.10.1 - openSUSE 12.3 (noarch): pulseaudio-lang-3.0-1.10.1 References: http://support.novell.com/security/cve/CVE-2014-3970.html

1 0

openSUSE-SU-2014:0945-1: moderate: php5: security fixes
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: php5: security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0945-1 Rating: moderate References: #885961 #886059 #886060 Cross-References: CVE-2014-4670 CVE-2014-4698 CVE-2014-4721 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: php5 was updated to fix security issues: CVE-2014-4670: Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP allowed context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments. CVE-2014-4698: Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP allowed context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting environments. CVE-2014-4721: The phpinfo implementation in ext/standard/info.c in PHP did not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a "type confusion" vulnerability, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- - openSUSE 12.3: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-mod_php5-5.4.20-21.1 apache2-mod_php5-debuginfo-5.4.20-21.1 php5-5.4.20-21.1 php5-bcmath-5.4.20-21.1 php5-bcmath-debuginfo-5.4.20-21.1 php5-bz2-5.4.20-21.1 php5-bz2-debuginfo-5.4.20-21.1 php5-calendar-5.4.20-21.1 php5-calendar-debuginfo-5.4.20-21.1 php5-ctype-5.4.20-21.1 php5-ctype-debuginfo-5.4.20-21.1 php5-curl-5.4.20-21.1 php5-curl-debuginfo-5.4.20-21.1 php5-dba-5.4.20-21.1 php5-dba-debuginfo-5.4.20-21.1 php5-debuginfo-5.4.20-21.1 php5-debugsource-5.4.20-21.1 php5-devel-5.4.20-21.1 php5-dom-5.4.20-21.1 php5-dom-debuginfo-5.4.20-21.1 php5-enchant-5.4.20-21.1 php5-enchant-debuginfo-5.4.20-21.1 php5-exif-5.4.20-21.1 php5-exif-debuginfo-5.4.20-21.1 php5-fastcgi-5.4.20-21.1 php5-fastcgi-debuginfo-5.4.20-21.1 php5-fileinfo-5.4.20-21.1 php5-fileinfo-debuginfo-5.4.20-21.1 php5-firebird-5.4.20-21.1 php5-firebird-debuginfo-5.4.20-21.1 php5-fpm-5.4.20-21.1 php5-fpm-debuginfo-5.4.20-21.1 php5-ftp-5.4.20-21.1 php5-ftp-debuginfo-5.4.20-21.1 php5-gd-5.4.20-21.1 php5-gd-debuginfo-5.4.20-21.1 php5-gettext-5.4.20-21.1 php5-gettext-debuginfo-5.4.20-21.1 php5-gmp-5.4.20-21.1 php5-gmp-debuginfo-5.4.20-21.1 php5-iconv-5.4.20-21.1 php5-iconv-debuginfo-5.4.20-21.1 php5-imap-5.4.20-21.1 php5-imap-debuginfo-5.4.20-21.1 php5-intl-5.4.20-21.1 php5-intl-debuginfo-5.4.20-21.1 php5-json-5.4.20-21.1 php5-json-debuginfo-5.4.20-21.1 php5-ldap-5.4.20-21.1 php5-ldap-debuginfo-5.4.20-21.1 php5-mbstring-5.4.20-21.1 php5-mbstring-debuginfo-5.4.20-21.1 php5-mcrypt-5.4.20-21.1 php5-mcrypt-debuginfo-5.4.20-21.1 php5-mssql-5.4.20-21.1 php5-mssql-debuginfo-5.4.20-21.1 php5-mysql-5.4.20-21.1 php5-mysql-debuginfo-5.4.20-21.1 php5-odbc-5.4.20-21.1 php5-odbc-debuginfo-5.4.20-21.1 php5-openssl-5.4.20-21.1 php5-openssl-debuginfo-5.4.20-21.1 php5-pcntl-5.4.20-21.1 php5-pcntl-debuginfo-5.4.20-21.1 php5-pdo-5.4.20-21.1 php5-pdo-debuginfo-5.4.20-21.1 php5-pgsql-5.4.20-21.1 php5-pgsql-debuginfo-5.4.20-21.1 php5-phar-5.4.20-21.1 php5-phar-debuginfo-5.4.20-21.1 php5-posix-5.4.20-21.1 php5-posix-debuginfo-5.4.20-21.1 php5-pspell-5.4.20-21.1 php5-pspell-debuginfo-5.4.20-21.1 php5-readline-5.4.20-21.1 php5-readline-debuginfo-5.4.20-21.1 php5-shmop-5.4.20-21.1 php5-shmop-debuginfo-5.4.20-21.1 php5-snmp-5.4.20-21.1 php5-snmp-debuginfo-5.4.20-21.1 php5-soap-5.4.20-21.1 php5-soap-debuginfo-5.4.20-21.1 php5-sockets-5.4.20-21.1 php5-sockets-debuginfo-5.4.20-21.1 php5-sqlite-5.4.20-21.1 php5-sqlite-debuginfo-5.4.20-21.1 php5-suhosin-5.4.20-21.1 php5-suhosin-debuginfo-5.4.20-21.1 php5-sysvmsg-5.4.20-21.1 php5-sysvmsg-debuginfo-5.4.20-21.1 php5-sysvsem-5.4.20-21.1 php5-sysvsem-debuginfo-5.4.20-21.1 php5-sysvshm-5.4.20-21.1 php5-sysvshm-debuginfo-5.4.20-21.1 php5-tidy-5.4.20-21.1 php5-tidy-debuginfo-5.4.20-21.1 php5-tokenizer-5.4.20-21.1 php5-tokenizer-debuginfo-5.4.20-21.1 php5-wddx-5.4.20-21.1 php5-wddx-debuginfo-5.4.20-21.1 php5-xmlreader-5.4.20-21.1 php5-xmlreader-debuginfo-5.4.20-21.1 php5-xmlrpc-5.4.20-21.1 php5-xmlrpc-debuginfo-5.4.20-21.1 php5-xmlwriter-5.4.20-21.1 php5-xmlwriter-debuginfo-5.4.20-21.1 php5-xsl-5.4.20-21.1 php5-xsl-debuginfo-5.4.20-21.1 php5-zip-5.4.20-21.1 php5-zip-debuginfo-5.4.20-21.1 php5-zlib-5.4.20-21.1 php5-zlib-debuginfo-5.4.20-21.1 - openSUSE 13.1 (noarch): php5-pear-5.4.20-21.1 - openSUSE 12.3 (i586 x86_64): apache2-mod_php5-5.3.17-3.25.1 apache2-mod_php5-debuginfo-5.3.17-3.25.1 php5-5.3.17-3.25.1 php5-bcmath-5.3.17-3.25.1 php5-bcmath-debuginfo-5.3.17-3.25.1 php5-bz2-5.3.17-3.25.1 php5-bz2-debuginfo-5.3.17-3.25.1 php5-calendar-5.3.17-3.25.1 php5-calendar-debuginfo-5.3.17-3.25.1 php5-ctype-5.3.17-3.25.1 php5-ctype-debuginfo-5.3.17-3.25.1 php5-curl-5.3.17-3.25.1 php5-curl-debuginfo-5.3.17-3.25.1 php5-dba-5.3.17-3.25.1 php5-dba-debuginfo-5.3.17-3.25.1 php5-debuginfo-5.3.17-3.25.1 php5-debugsource-5.3.17-3.25.1 php5-devel-5.3.17-3.25.1 php5-dom-5.3.17-3.25.1 php5-dom-debuginfo-5.3.17-3.25.1 php5-enchant-5.3.17-3.25.1 php5-enchant-debuginfo-5.3.17-3.25.1 php5-exif-5.3.17-3.25.1 php5-exif-debuginfo-5.3.17-3.25.1 php5-fastcgi-5.3.17-3.25.1 php5-fastcgi-debuginfo-5.3.17-3.25.1 php5-fileinfo-5.3.17-3.25.1 php5-fileinfo-debuginfo-5.3.17-3.25.1 php5-fpm-5.3.17-3.25.1 php5-fpm-debuginfo-5.3.17-3.25.1 php5-ftp-5.3.17-3.25.1 php5-ftp-debuginfo-5.3.17-3.25.1 php5-gd-5.3.17-3.25.1 php5-gd-debuginfo-5.3.17-3.25.1 php5-gettext-5.3.17-3.25.1 php5-gettext-debuginfo-5.3.17-3.25.1 php5-gmp-5.3.17-3.25.1 php5-gmp-debuginfo-5.3.17-3.25.1 php5-iconv-5.3.17-3.25.1 php5-iconv-debuginfo-5.3.17-3.25.1 php5-imap-5.3.17-3.25.1 php5-imap-debuginfo-5.3.17-3.25.1 php5-intl-5.3.17-3.25.1 php5-intl-debuginfo-5.3.17-3.25.1 php5-json-5.3.17-3.25.1 php5-json-debuginfo-5.3.17-3.25.1 php5-ldap-5.3.17-3.25.1 php5-ldap-debuginfo-5.3.17-3.25.1 php5-mbstring-5.3.17-3.25.1 php5-mbstring-debuginfo-5.3.17-3.25.1 php5-mcrypt-5.3.17-3.25.1 php5-mcrypt-debuginfo-5.3.17-3.25.1 php5-mssql-5.3.17-3.25.1 php5-mssql-debuginfo-5.3.17-3.25.1 php5-mysql-5.3.17-3.25.1 php5-mysql-debuginfo-5.3.17-3.25.1 php5-odbc-5.3.17-3.25.1 php5-odbc-debuginfo-5.3.17-3.25.1 php5-openssl-5.3.17-3.25.1 php5-openssl-debuginfo-5.3.17-3.25.1 php5-pcntl-5.3.17-3.25.1 php5-pcntl-debuginfo-5.3.17-3.25.1 php5-pdo-5.3.17-3.25.1 php5-pdo-debuginfo-5.3.17-3.25.1 php5-pgsql-5.3.17-3.25.1 php5-pgsql-debuginfo-5.3.17-3.25.1 php5-phar-5.3.17-3.25.1 php5-phar-debuginfo-5.3.17-3.25.1 php5-posix-5.3.17-3.25.1 php5-posix-debuginfo-5.3.17-3.25.1 php5-pspell-5.3.17-3.25.1 php5-pspell-debuginfo-5.3.17-3.25.1 php5-readline-5.3.17-3.25.1 php5-readline-debuginfo-5.3.17-3.25.1 php5-shmop-5.3.17-3.25.1 php5-shmop-debuginfo-5.3.17-3.25.1 php5-snmp-5.3.17-3.25.1 php5-snmp-debuginfo-5.3.17-3.25.1 php5-soap-5.3.17-3.25.1 php5-soap-debuginfo-5.3.17-3.25.1 php5-sockets-5.3.17-3.25.1 php5-sockets-debuginfo-5.3.17-3.25.1 php5-sqlite-5.3.17-3.25.1 php5-sqlite-debuginfo-5.3.17-3.25.1 php5-suhosin-5.3.17-3.25.1 php5-suhosin-debuginfo-5.3.17-3.25.1 php5-sysvmsg-5.3.17-3.25.1 php5-sysvmsg-debuginfo-5.3.17-3.25.1 php5-sysvsem-5.3.17-3.25.1 php5-sysvsem-debuginfo-5.3.17-3.25.1 php5-sysvshm-5.3.17-3.25.1 php5-sysvshm-debuginfo-5.3.17-3.25.1 php5-tidy-5.3.17-3.25.1 php5-tidy-debuginfo-5.3.17-3.25.1 php5-tokenizer-5.3.17-3.25.1 php5-tokenizer-debuginfo-5.3.17-3.25.1 php5-wddx-5.3.17-3.25.1 php5-wddx-debuginfo-5.3.17-3.25.1 php5-xmlreader-5.3.17-3.25.1 php5-xmlreader-debuginfo-5.3.17-3.25.1 php5-xmlrpc-5.3.17-3.25.1 php5-xmlrpc-debuginfo-5.3.17-3.25.1 php5-xmlwriter-5.3.17-3.25.1 php5-xmlwriter-debuginfo-5.3.17-3.25.1 php5-xsl-5.3.17-3.25.1 php5-xsl-debuginfo-5.3.17-3.25.1 php5-zip-5.3.17-3.25.1 php5-zip-debuginfo-5.3.17-3.25.1 php5-zlib-5.3.17-3.25.1 php5-zlib-debuginfo-5.3.17-3.25.1 - openSUSE 12.3 (noarch): php5-pear-5.3.17-3.25.1 References: http://support.novell.com/security/cve/CVE-2014-4670.html http://support.novell.com/security/cve/CVE-2014-4698.html http://support.novell.com/security/cve/CVE-2014-4721.html https://bugzilla.novell.com/885961 https://bugzilla.novell.com/886059 https://bugzilla.novell.com/886060

1 0

openSUSE-SU-2014:0944-1: moderate: samba: update to fix DOS and crash
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: samba: update to fix DOS and crash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0944-1 Rating: moderate References: #880962 #883758 Cross-References: CVE-2014-0244 CVE-2014-3493 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: samba was updated to fix two security issues. These security issues were fixed: - Fix segmentation fault in smbd_marshall_dir_entry()'s SMB_FIND_FILE_UNIX handler (CVE-2014-3493) - Fix nmbd denial of service (CVE-2014-0244) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): ldapsmb-1.34b-134.1 libldb-devel-1.0.2-134.1 libldb1-1.0.2-134.1 libldb1-debuginfo-1.0.2-134.1 libnetapi-devel-3.6.3-134.1 libnetapi0-3.6.3-134.1 libnetapi0-debuginfo-3.6.3-134.1 libsmbclient-devel-3.6.3-134.1 libsmbclient0-3.6.3-134.1 libsmbclient0-debuginfo-3.6.3-134.1 libsmbsharemodes-devel-3.6.3-134.1 libsmbsharemodes0-3.6.3-134.1 libsmbsharemodes0-debuginfo-3.6.3-134.1 libtalloc-devel-2.0.5-134.1 libtalloc2-2.0.5-134.1 libtalloc2-debuginfo-2.0.5-134.1 libtdb-devel-1.2.9-134.1 libtdb1-1.2.9-134.1 libtdb1-debuginfo-1.2.9-134.1 libtevent-devel-0.9.11-134.1 libtevent0-0.9.11-134.1 libtevent0-debuginfo-0.9.11-134.1 libwbclient-devel-3.6.3-134.1 libwbclient0-3.6.3-134.1 libwbclient0-debuginfo-3.6.3-134.1 samba-3.6.3-134.1 samba-client-3.6.3-134.1 samba-client-debuginfo-3.6.3-134.1 samba-debuginfo-3.6.3-134.1 samba-debugsource-3.6.3-134.1 samba-devel-3.6.3-134.1 samba-krb-printing-3.6.3-134.1 samba-krb-printing-debuginfo-3.6.3-134.1 samba-winbind-3.6.3-134.1 samba-winbind-debuginfo-3.6.3-134.1 - openSUSE 11.4 (x86_64): libldb1-32bit-1.0.2-134.1 libldb1-debuginfo-32bit-1.0.2-134.1 libsmbclient0-32bit-3.6.3-134.1 libsmbclient0-debuginfo-32bit-3.6.3-134.1 libtalloc2-32bit-2.0.5-134.1 libtalloc2-debuginfo-32bit-2.0.5-134.1 libtdb1-32bit-1.2.9-134.1 libtdb1-debuginfo-32bit-1.2.9-134.1 libtevent0-32bit-0.9.11-134.1 libtevent0-debuginfo-32bit-0.9.11-134.1 libwbclient0-32bit-3.6.3-134.1 libwbclient0-debuginfo-32bit-3.6.3-134.1 samba-32bit-3.6.3-134.1 samba-client-32bit-3.6.3-134.1 samba-client-debuginfo-32bit-3.6.3-134.1 samba-debuginfo-32bit-3.6.3-134.1 samba-winbind-32bit-3.6.3-134.1 samba-winbind-debuginfo-32bit-3.6.3-134.1 - openSUSE 11.4 (noarch): samba-doc-3.6.3-134.1 - openSUSE 11.4 (ia64): libldb1-debuginfo-x86-1.0.2-134.1 libldb1-x86-1.0.2-134.1 libsmbclient0-debuginfo-x86-3.6.3-134.1 libsmbclient0-x86-3.6.3-134.1 libtalloc2-debuginfo-x86-2.0.5-134.1 libtalloc2-x86-2.0.5-134.1 libtdb1-debuginfo-x86-1.2.9-134.1 libtdb1-x86-1.2.9-134.1 libtevent0-debuginfo-x86-0.9.11-134.1 libtevent0-x86-0.9.11-134.1 libwbclient0-debuginfo-x86-3.6.3-134.1 libwbclient0-x86-3.6.3-134.1 samba-client-debuginfo-x86-3.6.3-134.1 samba-client-x86-3.6.3-134.1 samba-debuginfo-x86-3.6.3-134.1 samba-winbind-debuginfo-x86-3.6.3-134.1 samba-winbind-x86-3.6.3-134.1 samba-x86-3.6.3-134.1 References: http://support.novell.com/security/cve/CVE-2014-0244.html http://support.novell.com/security/cve/CVE-2014-3493.html https://bugzilla.novell.com/880962 https://bugzilla.novell.com/883758

1 0

openSUSE-SU-2014:0943-1: moderate: apache2-mod_wsgi: fixed off-by-one error in setgroups
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: apache2-mod_wsgi: fixed off-by-one error in setgroups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0943-1 Rating: moderate References: #883229 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: apache2-mod_wsgi was updated to fix a small of-by-one error in its use of setgroups. Please see http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.2.4.html for more information. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-mod_wsgi-3.4-2.12.1 apache2-mod_wsgi-debuginfo-3.4-2.12.1 apache2-mod_wsgi-debugsource-3.4-2.12.1 References: https://bugzilla.novell.com/883229

1 0

openSUSE-SU-2014:0942-1: moderate: Update to prevent insecure DNS TXT record parsing
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: Update to prevent insecure DNS TXT record parsing ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0942-1 Rating: moderate References: #882992 Cross-References: CVE-2014-4049 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: php5 was updated to prevent insecure DNS TXT record parsing. This security issue was fixed: - Heap-based buffer overflow in DNS TXT record parsing (CVE-2014-4049) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-mod_php5-5.3.5-367.1 apache2-mod_php5-debuginfo-5.3.5-367.1 php5-5.3.5-367.1 php5-bcmath-5.3.5-367.1 php5-bcmath-debuginfo-5.3.5-367.1 php5-bz2-5.3.5-367.1 php5-bz2-debuginfo-5.3.5-367.1 php5-calendar-5.3.5-367.1 php5-calendar-debuginfo-5.3.5-367.1 php5-ctype-5.3.5-367.1 php5-ctype-debuginfo-5.3.5-367.1 php5-curl-5.3.5-367.1 php5-curl-debuginfo-5.3.5-367.1 php5-dba-5.3.5-367.1 php5-dba-debuginfo-5.3.5-367.1 php5-debuginfo-5.3.5-367.1 php5-debugsource-5.3.5-367.1 php5-devel-5.3.5-367.1 php5-dom-5.3.5-367.1 php5-dom-debuginfo-5.3.5-367.1 php5-enchant-5.3.5-367.1 php5-enchant-debuginfo-5.3.5-367.1 php5-exif-5.3.5-367.1 php5-exif-debuginfo-5.3.5-367.1 php5-fastcgi-5.3.5-367.1 php5-fastcgi-debuginfo-5.3.5-367.1 php5-fileinfo-5.3.5-367.1 php5-fileinfo-debuginfo-5.3.5-367.1 php5-fpm-5.3.5-367.1 php5-fpm-debuginfo-5.3.5-367.1 php5-ftp-5.3.5-367.1 php5-ftp-debuginfo-5.3.5-367.1 php5-gd-5.3.5-367.1 php5-gd-debuginfo-5.3.5-367.1 php5-gettext-5.3.5-367.1 php5-gettext-debuginfo-5.3.5-367.1 php5-gmp-5.3.5-367.1 php5-gmp-debuginfo-5.3.5-367.1 php5-hash-5.3.5-367.1 php5-hash-debuginfo-5.3.5-367.1 php5-iconv-5.3.5-367.1 php5-iconv-debuginfo-5.3.5-367.1 php5-imap-5.3.5-367.1 php5-imap-debuginfo-5.3.5-367.1 php5-intl-5.3.5-367.1 php5-intl-debuginfo-5.3.5-367.1 php5-json-5.3.5-367.1 php5-json-debuginfo-5.3.5-367.1 php5-ldap-5.3.5-367.1 php5-ldap-debuginfo-5.3.5-367.1 php5-mbstring-5.3.5-367.1 php5-mbstring-debuginfo-5.3.5-367.1 php5-mcrypt-5.3.5-367.1 php5-mcrypt-debuginfo-5.3.5-367.1 php5-mysql-5.3.5-367.1 php5-mysql-debuginfo-5.3.5-367.1 php5-odbc-5.3.5-367.1 php5-odbc-debuginfo-5.3.5-367.1 php5-openssl-5.3.5-367.1 php5-openssl-debuginfo-5.3.5-367.1 php5-pcntl-5.3.5-367.1 php5-pcntl-debuginfo-5.3.5-367.1 php5-pdo-5.3.5-367.1 php5-pdo-debuginfo-5.3.5-367.1 php5-pgsql-5.3.5-367.1 php5-pgsql-debuginfo-5.3.5-367.1 php5-phar-5.3.5-367.1 php5-phar-debuginfo-5.3.5-367.1 php5-posix-5.3.5-367.1 php5-posix-debuginfo-5.3.5-367.1 php5-pspell-5.3.5-367.1 php5-pspell-debuginfo-5.3.5-367.1 php5-readline-5.3.5-367.1 php5-readline-debuginfo-5.3.5-367.1 php5-shmop-5.3.5-367.1 php5-shmop-debuginfo-5.3.5-367.1 php5-snmp-5.3.5-367.1 php5-snmp-debuginfo-5.3.5-367.1 php5-soap-5.3.5-367.1 php5-soap-debuginfo-5.3.5-367.1 php5-sockets-5.3.5-367.1 php5-sockets-debuginfo-5.3.5-367.1 php5-sqlite-5.3.5-367.1 php5-sqlite-debuginfo-5.3.5-367.1 php5-suhosin-5.3.5-367.1 php5-suhosin-debuginfo-5.3.5-367.1 php5-sysvmsg-5.3.5-367.1 php5-sysvmsg-debuginfo-5.3.5-367.1 php5-sysvsem-5.3.5-367.1 php5-sysvsem-debuginfo-5.3.5-367.1 php5-sysvshm-5.3.5-367.1 php5-sysvshm-debuginfo-5.3.5-367.1 php5-tidy-5.3.5-367.1 php5-tidy-debuginfo-5.3.5-367.1 php5-tokenizer-5.3.5-367.1 php5-tokenizer-debuginfo-5.3.5-367.1 php5-wddx-5.3.5-367.1 php5-wddx-debuginfo-5.3.5-367.1 php5-xmlreader-5.3.5-367.1 php5-xmlreader-debuginfo-5.3.5-367.1 php5-xmlrpc-5.3.5-367.1 php5-xmlrpc-debuginfo-5.3.5-367.1 php5-xmlwriter-5.3.5-367.1 php5-xmlwriter-debuginfo-5.3.5-367.1 php5-xsl-5.3.5-367.1 php5-xsl-debuginfo-5.3.5-367.1 php5-zip-5.3.5-367.1 php5-zip-debuginfo-5.3.5-367.1 php5-zlib-5.3.5-367.1 php5-zlib-debuginfo-5.3.5-367.1 - openSUSE 11.4 (noarch): php5-pear-5.3.5-367.1 References: http://support.novell.com/security/cve/CVE-2014-4049.html https://bugzilla.novell.com/882992

1 0

openSUSE-RU-2014:0941-1: vorbis-tools: Fixes segmentation fault of vcut
by maintenance＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Recommended Update: vorbis-tools: Fixes segmentation fault of vcut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0941-1 Rating: low References: #888360 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with vorbis-tools: -bnc#888360: Fixes segmentation fault of vcut Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): vorbis-tools-1.4.0-14.4.1 vorbis-tools-debuginfo-1.4.0-14.4.1 vorbis-tools-debugsource-1.4.0-14.4.1 - openSUSE 13.1 (noarch): vorbis-tools-lang-1.4.0-14.4.1 References: https://bugzilla.novell.com/888360

1 0

openSUSE-RU-2014:0940-1: ImageMagick: enable fft support
by maintenance＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Recommended Update: ImageMagick: enable fft support ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0940-1 Rating: low References: #885334 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with ImageMagick: -bnc#885334: enable fft support Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): ImageMagick-6.8.6.9-2.16.1 ImageMagick-debuginfo-6.8.6.9-2.16.1 ImageMagick-debugsource-6.8.6.9-2.16.1 ImageMagick-devel-6.8.6.9-2.16.1 ImageMagick-extra-6.8.6.9-2.16.1 ImageMagick-extra-debuginfo-6.8.6.9-2.16.1 libMagick++-6_Q16-2-6.8.6.9-2.16.1 libMagick++-6_Q16-2-debuginfo-6.8.6.9-2.16.1 libMagick++-devel-6.8.6.9-2.16.1 libMagickCore-6_Q16-1-6.8.6.9-2.16.1 libMagickCore-6_Q16-1-debuginfo-6.8.6.9-2.16.1 libMagickWand-6_Q16-1-6.8.6.9-2.16.1 libMagickWand-6_Q16-1-debuginfo-6.8.6.9-2.16.1 perl-PerlMagick-6.8.6.9-2.16.1 perl-PerlMagick-debuginfo-6.8.6.9-2.16.1 - openSUSE 13.1 (x86_64): ImageMagick-devel-32bit-6.8.6.9-2.16.1 libMagick++-6_Q16-2-32bit-6.8.6.9-2.16.1 libMagick++-6_Q16-2-debuginfo-32bit-6.8.6.9-2.16.1 libMagick++-devel-32bit-6.8.6.9-2.16.1 libMagickCore-6_Q16-1-32bit-6.8.6.9-2.16.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.6.9-2.16.1 libMagickWand-6_Q16-1-32bit-6.8.6.9-2.16.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.6.9-2.16.1 - openSUSE 13.1 (noarch): ImageMagick-doc-6.8.6.9-2.16.1 References: https://bugzilla.novell.com/885334

1 0

openSUSE-SU-2014:0939-1: important: MozillaFirefox: Update to Mozilla Firefox 31
by opensuse-security＠opensuse.org 30 Jul '14

30 Jul '14

openSUSE Security Update: MozillaFirefox: Update to Mozilla Firefox 31 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0939-1 Rating: important References: #887746 Cross-References: CVE-2014-1544 CVE-2014-1547 CVE-2014-1548 CVE-2014-1549 CVE-2014-1550 CVE-2014-1552 CVE-2014-1555 CVE-2014-1556 CVE-2014-1557 CVE-2014-1558 CVE-2014-1559 CVE-2014-1560 CVE-2014-1561 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: MozillaFirefox was updated to version 31 to fix various security issues and bugs: * MFSA 2014-56/CVE-2014-1547/CVE-2014-1548 Miscellaneous memory safety hazards * MFSA 2014-57/CVE-2014-1549 (bmo#1020205) Buffer overflow during Web Audio buffering for playback * MFSA 2014-58/CVE-2014-1550 (bmo#1020411) Use-after-free in Web Audio due to incorrect control message ordering * MFSA 2014-60/CVE-2014-1561 (bmo#1000514, bmo#910375) Toolbar dialog customization event spoofing * MFSA 2014-61/CVE-2014-1555 (bmo#1023121) Use-after-free with FireOnStateChange event * MFSA 2014-62/CVE-2014-1556 (bmo#1028891) Exploitable WebGL crash with Cesium JavaScript library * MFSA 2014-63/CVE-2014-1544 (bmo#963150) Use-after-free while when manipulating certificates in the trusted cache (solved with NSS 3.16.2 requirement) * MFSA 2014-64/CVE-2014-1557 (bmo#913805) Crash in Skia library when scaling high quality images * MFSA 2014-65/CVE-2014-1558/CVE-2014-1559/CVE-2014-1560 (bmo#1015973, bmo#1026022, bmo#997795) Certificate parsing broken by non-standard character encoding * MFSA 2014-66/CVE-2014-1552 (bmo#985135) IFRAME sandbox same-origin access through redirect Mozilla-nss was updated to 3.16.3: New Functions: * CERT_GetGeneralNameTypeFromString (This function was already added in NSS 3.16.2, however, it wasn't declared in a public header file.) Notable Changes: * The following 1024-bit CA certificates were removed - Entrust.net Secure Server Certification Authority - GTE CyberTrust Global Root - ValiCert Class 1 Policy Validation Authority - ValiCert Class 2 Policy Validation Authority - ValiCert Class 3 Policy Validation Authority * Additionally, the following CA certificate was removed as requested by the CA: - TDC Internet Root CA * The following CA certificates were added: - Certification Authority of WoSign - CA 沃通根证书 - DigiCert Assured ID Root G2 - DigiCert Assured ID Root G3 - DigiCert Global Root G2 - DigiCert Global Root G3 - DigiCert Trusted Root G4 - QuoVadis Root CA 1 G3 - QuoVadis Root CA 2 G3 - QuoVadis Root CA 3 G3 * The Trust Bits were changed for the following CA certificates - Class 3 Public Primary Certification Authority - Class 3 Public Primary Certification Authority - Class 2 Public Primary Certification Authority - G2 - VeriSign Class 2 Public Primary Certification Authority - G3 - AC Raíz Certicámara S.A. - NetLock Uzleti (Class B) Tanusitvanykiado - NetLock Expressz (Class C) Tanusitvanykiado changes in 3.16.2 New functionality: * DTLS 1.2 is supported. * The TLS application layer protocol negotiation (ALPN) extension is also supported on the server side. * RSA-OEAP is supported. Use the new PK11_PrivDecrypt and PK11_PubEncrypt functions with the CKM_RSA_PKCS_OAEP mechanism. * New Intel AES assembly code for 32-bit and 64-bit Windows, contributed by Shay Gueron and Vlad Krasnov of Intel. Notable Changes: * The btoa command has a new command-line option -w suffix, which causes the output to be wrapped in BEGIN/END lines with the given suffix * The certutil commands supports additionals types of subject alt name extensions. * The certutil command supports generic certificate extensions, by loading binary data from files, which have been prepared using external tools, or which have been extracted from other existing certificates and dumped to file. * The certutil command supports three new certificate usage specifiers. * The pp command supports printing UTF-8 (-u). * On Linux, NSS is built with the -ffunction-sections -fdata-sections compiler flags and the --gc-sections linker flag to allow unused functions to be discarded. changes in 3.16.1 New functionality: * Added the "ECC" flag for modutil to select the module used for elliptic curve cryptography (ECC) operations. New Macros * PUBLIC_MECH_ECC_FLAG a public mechanism flag for elliptic curve cryptography (ECC) operations * SECMOD_ECC_FLAG an NSS-internal mechanism flag for elliptic curve cryptography (ECC) operations. This macro has the same numeric value as PUBLIC_MECH_ECC_FLAG. Notable Changes: * Imposed name constraints on the French government root CA ANSSI (DCISS). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014- - openSUSE 12.3: zypper in -t patch openSUSE-2014- To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-31.0-33.1 MozillaFirefox-branding-upstream-31.0-33.1 MozillaFirefox-buildsymbols-31.0-33.1 MozillaFirefox-debuginfo-31.0-33.1 MozillaFirefox-debugsource-31.0-33.1 MozillaFirefox-devel-31.0-33.1 MozillaFirefox-translations-common-31.0-33.1 MozillaFirefox-translations-other-31.0-33.1 libfreebl3-3.16.3-27.1 libfreebl3-debuginfo-3.16.3-27.1 libsoftokn3-3.16.3-27.1 libsoftokn3-debuginfo-3.16.3-27.1 mozilla-nss-3.16.3-27.1 mozilla-nss-certs-3.16.3-27.1 mozilla-nss-certs-debuginfo-3.16.3-27.1 mozilla-nss-debuginfo-3.16.3-27.1 mozilla-nss-debugsource-3.16.3-27.1 mozilla-nss-devel-3.16.3-27.1 mozilla-nss-sysinit-3.16.3-27.1 mozilla-nss-sysinit-debuginfo-3.16.3-27.1 mozilla-nss-tools-3.16.3-27.1 mozilla-nss-tools-debuginfo-3.16.3-27.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.16.3-27.1 libfreebl3-debuginfo-32bit-3.16.3-27.1 libsoftokn3-32bit-3.16.3-27.1 libsoftokn3-debuginfo-32bit-3.16.3-27.1 mozilla-nss-32bit-3.16.3-27.1 mozilla-nss-certs-32bit-3.16.3-27.1 mozilla-nss-certs-debuginfo-32bit-3.16.3-27.1 mozilla-nss-debuginfo-32bit-3.16.3-27.1 mozilla-nss-sysinit-32bit-3.16.3-27.1 mozilla-nss-sysinit-debuginfo-32bit-3.16.3-27.1 - openSUSE 12.3 (i586 x86_64): MozillaFirefox-31.0-1.72.1 MozillaFirefox-branding-upstream-31.0-1.72.1 MozillaFirefox-buildsymbols-31.0-1.72.1 MozillaFirefox-debuginfo-31.0-1.72.1 MozillaFirefox-debugsource-31.0-1.72.1 MozillaFirefox-devel-31.0-1.72.1 MozillaFirefox-translations-common-31.0-1.72.1 MozillaFirefox-translations-other-31.0-1.72.1 libfreebl3-3.16.3-1.43.1 libfreebl3-debuginfo-3.16.3-1.43.1 libsoftokn3-3.16.3-1.43.1 libsoftokn3-debuginfo-3.16.3-1.43.1 mozilla-nss-3.16.3-1.43.1 mozilla-nss-certs-3.16.3-1.43.1 mozilla-nss-certs-debuginfo-3.16.3-1.43.1 mozilla-nss-debuginfo-3.16.3-1.43.1 mozilla-nss-debugsource-3.16.3-1.43.1 mozilla-nss-devel-3.16.3-1.43.1 mozilla-nss-sysinit-3.16.3-1.43.1 mozilla-nss-sysinit-debuginfo-3.16.3-1.43.1 mozilla-nss-tools-3.16.3-1.43.1 mozilla-nss-tools-debuginfo-3.16.3-1.43.1 - openSUSE 12.3 (x86_64): libfreebl3-32bit-3.16.3-1.43.1 libfreebl3-debuginfo-32bit-3.16.3-1.43.1 libsoftokn3-32bit-3.16.3-1.43.1 libsoftokn3-debuginfo-32bit-3.16.3-1.43.1 mozilla-nss-32bit-3.16.3-1.43.1 mozilla-nss-certs-32bit-3.16.3-1.43.1 mozilla-nss-certs-debuginfo-32bit-3.16.3-1.43.1 mozilla-nss-debuginfo-32bit-3.16.3-1.43.1 mozilla-nss-sysinit-32bit-3.16.3-1.43.1 mozilla-nss-sysinit-debuginfo-32bit-3.16.3-1.43.1 References: http://support.novell.com/security/cve/CVE-2014-1544.html http://support.novell.com/security/cve/CVE-2014-1547.html http://support.novell.com/security/cve/CVE-2014-1548.html http://support.novell.com/security/cve/CVE-2014-1549.html http://support.novell.com/security/cve/CVE-2014-1550.html http://support.novell.com/security/cve/CVE-2014-1552.html http://support.novell.com/security/cve/CVE-2014-1555.html http://support.novell.com/security/cve/CVE-2014-1556.html http://support.novell.com/security/cve/CVE-2014-1557.html http://support.novell.com/security/cve/CVE-2014-1558.html http://support.novell.com/security/cve/CVE-2014-1559.html http://support.novell.com/security/cve/CVE-2014-1560.html http://support.novell.com/security/cve/CVE-2014-1561.html https://bugzilla.novell.com/887746

1 0

openSUSE-RU-2014:0927-1: SuSEfirewall2: enable DHCPv6 reply handling
by maintenance＠opensuse.org 21 Jul '14

21 Jul '14

openSUSE Recommended Update: SuSEfirewall2: enable DHCPv6 reply handling ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0927-1 Rating: low References: #783002 #887850 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with SuSEfirewall2: - bnc#783002: + allows DHCPv6 replies to arrive at the machine, even with the firewall enabled. + This avoids curious effects in networks where IPv6 numbers are distributed via DHCPv6. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-468 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): SuSEfirewall2-3.6.302-1.8.1 References: https://bugzilla.novell.com/783002 https://bugzilla.novell.com/887850

1 0

openSUSE-SU-2014:0926-1: moderate: dbus-1: fixes several issues
by opensuse-security＠opensuse.org 21 Jul '14

21 Jul '14

openSUSE Security Update: dbus-1: fixes several issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0926-1 Rating: moderate References: #885241 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: CVE-2014-3532 CVE-2014-3533 bnc#885241 fdo#80163 fdo#79694 fdo#80469 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-465 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): dbus-1-1.7.4-4.16.2 dbus-1-debuginfo-1.7.4-4.16.2 dbus-1-debugsource-1.7.4-4.16.1 dbus-1-devel-1.7.4-4.16.1 dbus-1-x11-1.7.4-4.16.2 dbus-1-x11-debuginfo-1.7.4-4.16.2 dbus-1-x11-debugsource-1.7.4-4.16.2 libdbus-1-3-1.7.4-4.16.1 libdbus-1-3-debuginfo-1.7.4-4.16.1 - openSUSE 13.1 (x86_64): dbus-1-debuginfo-32bit-1.7.4-4.16.2 dbus-1-devel-32bit-1.7.4-4.16.1 libdbus-1-3-32bit-1.7.4-4.16.1 libdbus-1-3-debuginfo-32bit-1.7.4-4.16.1 - openSUSE 13.1 (noarch): dbus-1-devel-doc-1.7.4-4.16.2 References: https://bugzilla.novell.com/885241

1 0

openSUSE-SU-2014:0925-1: php, php5, php53: fixes several security issues
by opensuse-security＠opensuse.org 21 Jul '14

21 Jul '14

openSUSE Security Update: php, php5, php53: fixes several security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0925-1 Rating: low References: #884986 #884987 #884989 #884990 #884991 #884992 Cross-References: CVE-2014-0207 CVE-2014-3478 CVE-2014-3479 CVE-2014-3480 CVE-2014-3487 CVE-2014-3515 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update fixes the following security issues with php, php5 and php53: - bnc#884986, CVE-2014-0207: file: php5: cdf_read_short_sector insufficient boundary check - bnc#884987, CVE-2014-3478: file: mconvert incorrect handling of truncated pascal string size - bnc#884989, CVE-2014-3479: php53: file: cdf_check_stream_offset insufficient boundary check - bnc#884990, CVE-2014-3480: php53: file: cdf_count_chain insufficient boundary check - bnc#884991, CVE-2014-3487: php53: file: cdf_read_property_info insufficient boundary check - bnc#884992, CVE-2014-3515: php5: unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-464 - openSUSE 12.3: zypper in -t patch openSUSE-2014-464 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-mod_php5-5.4.20-16.1 apache2-mod_php5-debuginfo-5.4.20-16.1 php5-5.4.20-16.1 php5-bcmath-5.4.20-16.1 php5-bcmath-debuginfo-5.4.20-16.1 php5-bz2-5.4.20-16.1 php5-bz2-debuginfo-5.4.20-16.1 php5-calendar-5.4.20-16.1 php5-calendar-debuginfo-5.4.20-16.1 php5-ctype-5.4.20-16.1 php5-ctype-debuginfo-5.4.20-16.1 php5-curl-5.4.20-16.1 php5-curl-debuginfo-5.4.20-16.1 php5-dba-5.4.20-16.1 php5-dba-debuginfo-5.4.20-16.1 php5-debuginfo-5.4.20-16.1 php5-debugsource-5.4.20-16.1 php5-devel-5.4.20-16.1 php5-dom-5.4.20-16.1 php5-dom-debuginfo-5.4.20-16.1 php5-enchant-5.4.20-16.1 php5-enchant-debuginfo-5.4.20-16.1 php5-exif-5.4.20-16.1 php5-exif-debuginfo-5.4.20-16.1 php5-fastcgi-5.4.20-16.1 php5-fastcgi-debuginfo-5.4.20-16.1 php5-fileinfo-5.4.20-16.1 php5-fileinfo-debuginfo-5.4.20-16.1 php5-firebird-5.4.20-16.1 php5-firebird-debuginfo-5.4.20-16.1 php5-fpm-5.4.20-16.1 php5-fpm-debuginfo-5.4.20-16.1 php5-ftp-5.4.20-16.1 php5-ftp-debuginfo-5.4.20-16.1 php5-gd-5.4.20-16.1 php5-gd-debuginfo-5.4.20-16.1 php5-gettext-5.4.20-16.1 php5-gettext-debuginfo-5.4.20-16.1 php5-gmp-5.4.20-16.1 php5-gmp-debuginfo-5.4.20-16.1 php5-iconv-5.4.20-16.1 php5-iconv-debuginfo-5.4.20-16.1 php5-imap-5.4.20-16.1 php5-imap-debuginfo-5.4.20-16.1 php5-intl-5.4.20-16.1 php5-intl-debuginfo-5.4.20-16.1 php5-json-5.4.20-16.1 php5-json-debuginfo-5.4.20-16.1 php5-ldap-5.4.20-16.1 php5-ldap-debuginfo-5.4.20-16.1 php5-mbstring-5.4.20-16.1 php5-mbstring-debuginfo-5.4.20-16.1 php5-mcrypt-5.4.20-16.1 php5-mcrypt-debuginfo-5.4.20-16.1 php5-mssql-5.4.20-16.1 php5-mssql-debuginfo-5.4.20-16.1 php5-mysql-5.4.20-16.1 php5-mysql-debuginfo-5.4.20-16.1 php5-odbc-5.4.20-16.1 php5-odbc-debuginfo-5.4.20-16.1 php5-openssl-5.4.20-16.1 php5-openssl-debuginfo-5.4.20-16.1 php5-pcntl-5.4.20-16.1 php5-pcntl-debuginfo-5.4.20-16.1 php5-pdo-5.4.20-16.1 php5-pdo-debuginfo-5.4.20-16.1 php5-pgsql-5.4.20-16.1 php5-pgsql-debuginfo-5.4.20-16.1 php5-phar-5.4.20-16.1 php5-phar-debuginfo-5.4.20-16.1 php5-posix-5.4.20-16.1 php5-posix-debuginfo-5.4.20-16.1 php5-pspell-5.4.20-16.1 php5-pspell-debuginfo-5.4.20-16.1 php5-readline-5.4.20-16.1 php5-readline-debuginfo-5.4.20-16.1 php5-shmop-5.4.20-16.1 php5-shmop-debuginfo-5.4.20-16.1 php5-snmp-5.4.20-16.1 php5-snmp-debuginfo-5.4.20-16.1 php5-soap-5.4.20-16.1 php5-soap-debuginfo-5.4.20-16.1 php5-sockets-5.4.20-16.1 php5-sockets-debuginfo-5.4.20-16.1 php5-sqlite-5.4.20-16.1 php5-sqlite-debuginfo-5.4.20-16.1 php5-suhosin-5.4.20-16.1 php5-suhosin-debuginfo-5.4.20-16.1 php5-sysvmsg-5.4.20-16.1 php5-sysvmsg-debuginfo-5.4.20-16.1 php5-sysvsem-5.4.20-16.1 php5-sysvsem-debuginfo-5.4.20-16.1 php5-sysvshm-5.4.20-16.1 php5-sysvshm-debuginfo-5.4.20-16.1 php5-tidy-5.4.20-16.1 php5-tidy-debuginfo-5.4.20-16.1 php5-tokenizer-5.4.20-16.1 php5-tokenizer-debuginfo-5.4.20-16.1 php5-wddx-5.4.20-16.1 php5-wddx-debuginfo-5.4.20-16.1 php5-xmlreader-5.4.20-16.1 php5-xmlreader-debuginfo-5.4.20-16.1 php5-xmlrpc-5.4.20-16.1 php5-xmlrpc-debuginfo-5.4.20-16.1 php5-xmlwriter-5.4.20-16.1 php5-xmlwriter-debuginfo-5.4.20-16.1 php5-xsl-5.4.20-16.1 php5-xsl-debuginfo-5.4.20-16.1 php5-zip-5.4.20-16.1 php5-zip-debuginfo-5.4.20-16.1 php5-zlib-5.4.20-16.1 php5-zlib-debuginfo-5.4.20-16.1 - openSUSE 13.1 (noarch): php5-pear-5.4.20-16.1 - openSUSE 12.3 (i586 x86_64): apache2-mod_php5-5.3.17-3.20.1 apache2-mod_php5-debuginfo-5.3.17-3.20.1 php5-5.3.17-3.20.1 php5-bcmath-5.3.17-3.20.1 php5-bcmath-debuginfo-5.3.17-3.20.1 php5-bz2-5.3.17-3.20.1 php5-bz2-debuginfo-5.3.17-3.20.1 php5-calendar-5.3.17-3.20.1 php5-calendar-debuginfo-5.3.17-3.20.1 php5-ctype-5.3.17-3.20.1 php5-ctype-debuginfo-5.3.17-3.20.1 php5-curl-5.3.17-3.20.1 php5-curl-debuginfo-5.3.17-3.20.1 php5-dba-5.3.17-3.20.1 php5-dba-debuginfo-5.3.17-3.20.1 php5-debuginfo-5.3.17-3.20.1 php5-debugsource-5.3.17-3.20.1 php5-devel-5.3.17-3.20.1 php5-dom-5.3.17-3.20.1 php5-dom-debuginfo-5.3.17-3.20.1 php5-enchant-5.3.17-3.20.1 php5-enchant-debuginfo-5.3.17-3.20.1 php5-exif-5.3.17-3.20.1 php5-exif-debuginfo-5.3.17-3.20.1 php5-fastcgi-5.3.17-3.20.1 php5-fastcgi-debuginfo-5.3.17-3.20.1 php5-fileinfo-5.3.17-3.20.1 php5-fileinfo-debuginfo-5.3.17-3.20.1 php5-fpm-5.3.17-3.20.1 php5-fpm-debuginfo-5.3.17-3.20.1 php5-ftp-5.3.17-3.20.1 php5-ftp-debuginfo-5.3.17-3.20.1 php5-gd-5.3.17-3.20.1 php5-gd-debuginfo-5.3.17-3.20.1 php5-gettext-5.3.17-3.20.1 php5-gettext-debuginfo-5.3.17-3.20.1 php5-gmp-5.3.17-3.20.1 php5-gmp-debuginfo-5.3.17-3.20.1 php5-iconv-5.3.17-3.20.1 php5-iconv-debuginfo-5.3.17-3.20.1 php5-imap-5.3.17-3.20.1 php5-imap-debuginfo-5.3.17-3.20.1 php5-intl-5.3.17-3.20.1 php5-intl-debuginfo-5.3.17-3.20.1 php5-json-5.3.17-3.20.1 php5-json-debuginfo-5.3.17-3.20.1 php5-ldap-5.3.17-3.20.1 php5-ldap-debuginfo-5.3.17-3.20.1 php5-mbstring-5.3.17-3.20.1 php5-mbstring-debuginfo-5.3.17-3.20.1 php5-mcrypt-5.3.17-3.20.1 php5-mcrypt-debuginfo-5.3.17-3.20.1 php5-mssql-5.3.17-3.20.1 php5-mssql-debuginfo-5.3.17-3.20.1 php5-mysql-5.3.17-3.20.1 php5-mysql-debuginfo-5.3.17-3.20.1 php5-odbc-5.3.17-3.20.1 php5-odbc-debuginfo-5.3.17-3.20.1 php5-openssl-5.3.17-3.20.1 php5-openssl-debuginfo-5.3.17-3.20.1 php5-pcntl-5.3.17-3.20.1 php5-pcntl-debuginfo-5.3.17-3.20.1 php5-pdo-5.3.17-3.20.1 php5-pdo-debuginfo-5.3.17-3.20.1 php5-pgsql-5.3.17-3.20.1 php5-pgsql-debuginfo-5.3.17-3.20.1 php5-phar-5.3.17-3.20.1 php5-phar-debuginfo-5.3.17-3.20.1 php5-posix-5.3.17-3.20.1 php5-posix-debuginfo-5.3.17-3.20.1 php5-pspell-5.3.17-3.20.1 php5-pspell-debuginfo-5.3.17-3.20.1 php5-readline-5.3.17-3.20.1 php5-readline-debuginfo-5.3.17-3.20.1 php5-shmop-5.3.17-3.20.1 php5-shmop-debuginfo-5.3.17-3.20.1 php5-snmp-5.3.17-3.20.1 php5-snmp-debuginfo-5.3.17-3.20.1 php5-soap-5.3.17-3.20.1 php5-soap-debuginfo-5.3.17-3.20.1 php5-sockets-5.3.17-3.20.1 php5-sockets-debuginfo-5.3.17-3.20.1 php5-sqlite-5.3.17-3.20.1 php5-sqlite-debuginfo-5.3.17-3.20.1 php5-suhosin-5.3.17-3.20.1 php5-suhosin-debuginfo-5.3.17-3.20.1 php5-sysvmsg-5.3.17-3.20.1 php5-sysvmsg-debuginfo-5.3.17-3.20.1 php5-sysvsem-5.3.17-3.20.1 php5-sysvsem-debuginfo-5.3.17-3.20.1 php5-sysvshm-5.3.17-3.20.1 php5-sysvshm-debuginfo-5.3.17-3.20.1 php5-tidy-5.3.17-3.20.1 php5-tidy-debuginfo-5.3.17-3.20.1 php5-tokenizer-5.3.17-3.20.1 php5-tokenizer-debuginfo-5.3.17-3.20.1 php5-wddx-5.3.17-3.20.1 php5-wddx-debuginfo-5.3.17-3.20.1 php5-xmlreader-5.3.17-3.20.1 php5-xmlreader-debuginfo-5.3.17-3.20.1 php5-xmlrpc-5.3.17-3.20.1 php5-xmlrpc-debuginfo-5.3.17-3.20.1 php5-xmlwriter-5.3.17-3.20.1 php5-xmlwriter-debuginfo-5.3.17-3.20.1 php5-xsl-5.3.17-3.20.1 php5-xsl-debuginfo-5.3.17-3.20.1 php5-zip-5.3.17-3.20.1 php5-zip-debuginfo-5.3.17-3.20.1 php5-zlib-5.3.17-3.20.1 php5-zlib-debuginfo-5.3.17-3.20.1 - openSUSE 12.3 (noarch): php5-pear-5.3.17-3.20.1 References: http://support.novell.com/security/cve/CVE-2014-0207.html http://support.novell.com/security/cve/CVE-2014-3478.html http://support.novell.com/security/cve/CVE-2014-3479.html http://support.novell.com/security/cve/CVE-2014-3480.html http://support.novell.com/security/cve/CVE-2014-3487.html http://support.novell.com/security/cve/CVE-2014-3515.html https://bugzilla.novell.com/884986 https://bugzilla.novell.com/884987 https://bugzilla.novell.com/884989 https://bugzilla.novell.com/884990 https://bugzilla.novell.com/884991 https://bugzilla.novell.com/884992

1 0

openSUSE-SU-2014:0924-1: moderate: eet: fix security issue
by opensuse-security＠opensuse.org 21 Jul '14

21 Jul '14

openSUSE Security Update: eet: fix security issue ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0924-1 Rating: moderate References: Cross-References: CVE-2014-4611 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - lz4.patch security fix for CVE-2014-4611 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-469 - openSUSE 12.3: zypper in -t patch openSUSE-2014-469 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): eet-1.7.8-2.4.1 eet-debuginfo-1.7.8-2.4.1 eet-debugsource-1.7.8-2.4.1 eet-devel-1.7.8-2.4.1 eet-doc-html-1.7.8-2.4.1 eet-examples-1.7.8-2.4.1 libeet1-1.7.8-2.4.1 libeet1-debuginfo-1.7.8-2.4.1 - openSUSE 12.3 (i586 x86_64): eet-1.7.5-2.4.1 eet-debuginfo-1.7.5-2.4.1 eet-debugsource-1.7.5-2.4.1 eet-devel-1.7.5-2.4.1 eet-doc-html-1.7.5-2.4.1 eet-examples-1.7.5-2.4.1 libeet1-1.7.5-2.4.1 libeet1-debuginfo-1.7.5-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-4611.html

1 0

openSUSE-SU-2014:0923-1: moderate: - logrotate: fixed a security issue
by opensuse-security＠opensuse.org 21 Jul '14

21 Jul '14

openSUSE Security Update: - logrotate: fixed a security issue ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0923-1 Rating: moderate References: #862339 #878788 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: - update logrotate config file after switch to systemd (bnc#878788) - added "reload" capability which was lost during switch from sysvinit to systemd - privoxy-3.0.16-networkmanager.systemd.patch: update Networkmanager dispatcher to reload config of privoxy with systemd (bnc#862339) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-467 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): privoxy-3.0.21-2.12.1 privoxy-debuginfo-3.0.21-2.12.1 privoxy-debugsource-3.0.21-2.12.1 privoxy-doc-3.0.21-2.12.1 References: https://bugzilla.novell.com/862339 https://bugzilla.novell.com/878788

1 0

openSUSE-SU-2014:0922-1: moderate: lzo, liblzo-2-2: fix security issue.
by opensuse-security＠opensuse.org 21 Jul '14

21 Jul '14

openSUSE Security Update: lzo, liblzo-2-2: fix security issue. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0922-1 Rating: moderate References: #883947 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: bnc#883947: CVE-2014-4607: lzo: DoS or possible RCE by allowing an attacker to change controllflow Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-463 - openSUSE 12.3: zypper in -t patch openSUSE-2014-463 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): liblzo2-2-2.06-12.4.1 liblzo2-2-debuginfo-2.06-12.4.1 lzo-debugsource-2.06-12.4.1 lzo-devel-2.06-12.4.1 - openSUSE 13.1 (x86_64): liblzo2-2-32bit-2.06-12.4.1 liblzo2-2-debuginfo-32bit-2.06-12.4.1 lzo-devel-32bit-2.06-12.4.1 - openSUSE 12.3 (i586 x86_64): liblzo2-2-2.06-9.4.1 liblzo2-2-debuginfo-2.06-9.4.1 lzo-debugsource-2.06-9.4.1 lzo-devel-2.06-9.4.1 - openSUSE 12.3 (x86_64): liblzo2-2-32bit-2.06-9.4.1 liblzo2-2-debuginfo-32bit-2.06-9.4.1 lzo-devel-32bit-2.06-9.4.1 References: https://bugzilla.novell.com/883947

1 0

openSUSE-SU-2014:0921-1: moderate: dbus-1: fixes several security issues
by opensuse-security＠opensuse.org 21 Jul '14

21 Jul '14

openSUSE Security Update: dbus-1: fixes several security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0921-1 Rating: moderate References: #885241 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: CVE-2014-3532 denial of service in file descriptor passing feature CVE-2014-3533 local denial of service (force system services to exit) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-466 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): dbus-1-1.6.8-2.22.1 dbus-1-debuginfo-1.6.8-2.22.1 dbus-1-debugsource-1.6.8-2.22.1 dbus-1-devel-1.6.8-2.22.1 dbus-1-x11-1.6.8-2.22.1 dbus-1-x11-debuginfo-1.6.8-2.22.1 dbus-1-x11-debugsource-1.6.8-2.22.1 libdbus-1-3-1.6.8-2.22.1 libdbus-1-3-debuginfo-1.6.8-2.22.1 - openSUSE 12.3 (x86_64): dbus-1-32bit-1.6.8-2.22.1 dbus-1-debuginfo-32bit-1.6.8-2.22.1 dbus-1-devel-32bit-1.6.8-2.22.1 libdbus-1-3-32bit-1.6.8-2.22.1 libdbus-1-3-debuginfo-32bit-1.6.8-2.22.1 - openSUSE 12.3 (noarch): dbus-1-devel-doc-1.6.8-2.22.1 References: https://bugzilla.novell.com/885241

1 0

openSUSE-RU-2014:0918-1: aaa_base: remove "text/js" from mime.types
by maintenance＠opensuse.org 18 Jul '14

18 Jul '14

openSUSE Recommended Update: aaa_base: remove "text/js" from mime.types ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0918-1 Rating: low References: #812427 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with aaa_base: - bnc#812427: remove "text/js" from mime.types Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-462 - openSUSE 12.3: zypper in -t patch openSUSE-2014-462 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): aaa_base-13.1-16.42.1 aaa_base-debuginfo-13.1-16.42.1 aaa_base-debugsource-13.1-16.42.1 aaa_base-extras-13.1-16.42.1 aaa_base-malloccheck-13.1-16.42.1 - openSUSE 12.3 (i586 x86_64): aaa_base-12.3-14.22.1 aaa_base-debuginfo-12.3-14.22.1 aaa_base-debugsource-12.3-14.22.1 aaa_base-extras-12.3-14.22.1 aaa_base-malloccheck-12.3-14.22.1 References: https://bugzilla.novell.com/812427

1 0

openSUSE-RU-2014:0914-1: mkinitrd: Make booting from bcache devices possible
by maintenance＠opensuse.org 17 Jul '14

17 Jul '14

openSUSE Recommended Update: mkinitrd: Make booting from bcache devices possible ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0914-1 Rating: low References: #880845 #880846 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with mkinitrd: - bnc#880846: Make booting from bcache devices possible - bnc#880845: Fixes mkinitrd failures with bcache device present Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-461 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): mkinitrd-2.8.1-5.1 mkinitrd-debuginfo-2.8.1-5.1 mkinitrd-debugsource-2.8.1-5.1 References: https://bugzilla.novell.com/880845 https://bugzilla.novell.com/880846

1 0

openSUSE-SU-2014:0913-1: critical: flash-player
by opensuse-security＠opensuse.org 17 Jul '14

17 Jul '14

openSUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0913-1 Rating: critical References: #886472 Cross-References: CVE-2014-0537 CVE-2014-0539 CVE-2014-4671 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: - Security update to 11.2.202.394 (bnc#886472): * APSB14-17, CVE-2014-0537, CVE-2014-0539, CVE-2014-4671 - License update (LICENSE -> Flash%20Player_14.0.pdf). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-70 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.394-119.1 flash-player-gnome-11.2.202.394-119.1 flash-player-kde4-11.2.202.394-119.1 References: http://support.novell.com/security/cve/CVE-2014-0537.html http://support.novell.com/security/cve/CVE-2014-0539.html http://support.novell.com/security/cve/CVE-2014-4671.html https://bugzilla.novell.com/886472

1 0

openSUSE-SU-2014:0903-1: critical: flash-player
by opensuse-security＠opensuse.org 16 Jul '14

16 Jul '14

openSUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0903-1 Rating: critical References: #886472 Cross-References: CVE-2014-0537 CVE-2014-0539 CVE-2014-4671 Affected Products: openSUSE 13.1:NonFree openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: - Security update to 11.2.202.394 (bnc#886472): * APSB14-17, CVE-2014-0537, CVE-2014-0539, CVE-2014-4671 - License update (LICENSE -> Flash%20Player_14.0.pdf). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2014-460 - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2014-460 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.394-58.1 flash-player-gnome-11.2.202.394-58.1 flash-player-kde4-11.2.202.394-58.1 - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.394-2.84.1 flash-player-gnome-11.2.202.394-2.84.1 flash-player-kde4-11.2.202.394-2.84.1 References: http://support.novell.com/security/cve/CVE-2014-0537.html http://support.novell.com/security/cve/CVE-2014-0539.html http://support.novell.com/security/cve/CVE-2014-4671.html https://bugzilla.novell.com/886472

1 0

openSUSE-RU-2014:0892-1: moderate: openSUSE-build-key: publish extended GPG key
by maintenance＠opensuse.org 14 Jul '14

14 Jul '14

openSUSE Recommended Update: openSUSE-build-key: publish extended GPG key ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0892-1 Rating: moderate References: #886446 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The openSUSE project as shipped on 12.3 and 13.1 has an expiry date of May 2014. In May 2014 we extended the expiry of the key, and the update repositories have already the newer key in repomd.xml.key and autoimported those into existing systems. For fresh installations and for in-system usage, openSUSE-build-key is updated and also includes this extended key now. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-457 - openSUSE 12.3: zypper in -t patch openSUSE-2014-457 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): openSUSE-build-key-1.0-24.4.1 - openSUSE 12.3 (noarch): openSUSE-build-key-1.0-22.4.1 References: https://bugzilla.novell.com/886446

1 0

openSUSE-RU-2014:0891-1: iftop: Update to version 0.99.4
by maintenance＠opensuse.org 14 Jul '14

14 Jul '14

openSUSE Recommended Update: iftop: Update to version 0.99.4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0891-1 Rating: low References: #875625 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This Update fixes the following issues with iftop: - Update to version 0.99 RC 4 (0.99.4) * bnc#875625: fixes memory leakeage * added patch to define the MAC address of the interface as char instead of integer, which results in correct commandline output * added patch to extend the scale[] array up to terabit. 10gbit is not uncommon, 100gbit 40 and 100 gbit are coming, 400 gbit and terabit are future possibilities. * added patch to fix overshooting when calculating the first rateixd * added patch to allow unlimited number of lines in text output, using "iftop -t -L 0" - Update to version 1.0pre4: * Man page documentation of -t mode. * Compile time warning fixes. - Update to version 1.0pre3: * bugs and compilation issues were fixed * a "text output" mode was added. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-459 - openSUSE 12.3: zypper in -t patch openSUSE-2014-459 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): iftop-0.99.4-8.4.1 iftop-debuginfo-0.99.4-8.4.1 iftop-debugsource-0.99.4-8.4.1 - openSUSE 12.3 (i586 x86_64): iftop-0.99.4-5.4.1 iftop-debuginfo-0.99.4-5.4.1 iftop-debugsource-0.99.4-5.4.1 References: https://bugzilla.novell.com/875625

1 0

openSUSE-SU-2014:0890-1: moderate: python, python3: Fixed JSON module
by opensuse-security＠opensuse.org 12 Jul '14

12 Jul '14

openSUSE Security Update: python, python3: Fixed JSON module ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0890-1 Rating: moderate References: #884075 Cross-References: CVE-2014-4616 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: python and python3 were updated to fix one security issue. This security issue was fixed: - Missing boundary check in JSON module (CVE-2014-4616) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-458 - openSUSE 12.3: zypper in -t patch openSUSE-2014-458 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libpython2_7-1_0-2.7.6-8.10.1 libpython2_7-1_0-debuginfo-2.7.6-8.10.1 libpython3_3m1_0-3.3.5-5.12.1 libpython3_3m1_0-debuginfo-3.3.5-5.12.1 python-2.7.6-8.10.1 python-base-2.7.6-8.10.1 python-base-debuginfo-2.7.6-8.10.1 python-base-debugsource-2.7.6-8.10.1 python-curses-2.7.6-8.10.1 python-curses-debuginfo-2.7.6-8.10.1 python-debuginfo-2.7.6-8.10.1 python-debugsource-2.7.6-8.10.1 python-demo-2.7.6-8.10.1 python-devel-2.7.6-8.10.1 python-gdbm-2.7.6-8.10.1 python-gdbm-debuginfo-2.7.6-8.10.1 python-idle-2.7.6-8.10.1 python-tk-2.7.6-8.10.1 python-tk-debuginfo-2.7.6-8.10.1 python-xml-2.7.6-8.10.1 python-xml-debuginfo-2.7.6-8.10.1 python3-3.3.5-5.12.1 python3-base-3.3.5-5.12.1 python3-base-debuginfo-3.3.5-5.12.1 python3-base-debugsource-3.3.5-5.12.1 python3-curses-3.3.5-5.12.1 python3-curses-debuginfo-3.3.5-5.12.1 python3-dbm-3.3.5-5.12.1 python3-dbm-debuginfo-3.3.5-5.12.1 python3-debuginfo-3.3.5-5.12.1 python3-debugsource-3.3.5-5.12.1 python3-devel-3.3.5-5.12.1 python3-devel-debuginfo-3.3.5-5.12.1 python3-idle-3.3.5-5.12.1 python3-testsuite-3.3.5-5.12.1 python3-testsuite-debuginfo-3.3.5-5.12.1 python3-tk-3.3.5-5.12.1 python3-tk-debuginfo-3.3.5-5.12.1 python3-tools-3.3.5-5.12.1 - openSUSE 13.1 (x86_64): libpython2_7-1_0-32bit-2.7.6-8.10.1 libpython2_7-1_0-debuginfo-32bit-2.7.6-8.10.1 libpython3_3m1_0-32bit-3.3.5-5.12.1 libpython3_3m1_0-debuginfo-32bit-3.3.5-5.12.1 python-32bit-2.7.6-8.10.1 python-base-32bit-2.7.6-8.10.1 python-base-debuginfo-32bit-2.7.6-8.10.1 python-debuginfo-32bit-2.7.6-8.10.1 python3-32bit-3.3.5-5.12.1 python3-base-32bit-3.3.5-5.12.1 python3-base-debuginfo-32bit-3.3.5-5.12.1 python3-debuginfo-32bit-3.3.5-5.12.1 - openSUSE 13.1 (noarch): python-doc-2.7.6-8.10.1 python-doc-pdf-2.7.6-8.10.1 python3-doc-3.3.5-5.12.1 python3-doc-pdf-3.3.5-5.12.1 - openSUSE 12.3 (i586 x86_64): libpython2_7-1_0-2.7.3-10.16.1 libpython2_7-1_0-debuginfo-2.7.3-10.16.1 libpython3_3m1_0-3.3.0-6.19.1 libpython3_3m1_0-debuginfo-3.3.0-6.19.1 python-2.7.3-10.16.1 python-base-2.7.3-10.16.1 python-base-debuginfo-2.7.3-10.16.1 python-base-debugsource-2.7.3-10.16.1 python-curses-2.7.3-10.16.1 python-curses-debuginfo-2.7.3-10.16.1 python-debuginfo-2.7.3-10.16.1 python-debugsource-2.7.3-10.16.1 python-demo-2.7.3-10.16.1 python-devel-2.7.3-10.16.1 python-gdbm-2.7.3-10.16.1 python-gdbm-debuginfo-2.7.3-10.16.1 python-idle-2.7.3-10.16.1 python-tk-2.7.3-10.16.1 python-tk-debuginfo-2.7.3-10.16.1 python-xml-2.7.3-10.16.1 python-xml-debuginfo-2.7.3-10.16.1 python3-3.3.0-6.19.1 python3-base-3.3.0-6.19.1 python3-base-debuginfo-3.3.0-6.19.1 python3-base-debugsource-3.3.0-6.19.1 python3-curses-3.3.0-6.19.1 python3-curses-debuginfo-3.3.0-6.19.1 python3-dbm-3.3.0-6.19.1 python3-dbm-debuginfo-3.3.0-6.19.1 python3-debuginfo-3.3.0-6.19.1 python3-debugsource-3.3.0-6.19.1 python3-devel-3.3.0-6.19.1 python3-devel-debuginfo-3.3.0-6.19.1 python3-idle-3.3.0-6.19.1 python3-testsuite-3.3.0-6.19.1 python3-testsuite-debuginfo-3.3.0-6.19.1 python3-tk-3.3.0-6.19.1 python3-tk-debuginfo-3.3.0-6.19.1 python3-tools-3.3.0-6.19.1 - openSUSE 12.3 (x86_64): libpython2_7-1_0-32bit-2.7.3-10.16.1 libpython2_7-1_0-debuginfo-32bit-2.7.3-10.16.1 libpython3_3m1_0-32bit-3.3.0-6.19.1 libpython3_3m1_0-debuginfo-32bit-3.3.0-6.19.1 python-32bit-2.7.3-10.16.1 python-base-32bit-2.7.3-10.16.1 python-base-debuginfo-32bit-2.7.3-10.16.1 python-debuginfo-32bit-2.7.3-10.16.1 python3-32bit-3.3.0-6.19.1 python3-base-32bit-3.3.0-6.19.1 python3-base-debuginfo-32bit-3.3.0-6.19.1 python3-debuginfo-32bit-3.3.0-6.19.1 - openSUSE 12.3 (noarch): python-doc-2.7-10.16.1 python-doc-pdf-2.7-10.16.1 python3-doc-3.3.0-6.19.1 python3-doc-pdf-3.3.0-6.19.1 References: http://support.novell.com/security/cve/CVE-2014-4616.html https://bugzilla.novell.com/884075

1 0

openSUSE-RU-2014:0884-1: OpenLP: Updated from version 2.0.4 to version 2.0.5
by maintenance＠opensuse.org 10 Jul '14

10 Jul '14

openSUSE Recommended Update: OpenLP: Updated from version 2.0.4 to version 2.0.5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0884-1 Rating: low References: #884901 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with openLP: -bnc#884901: Update to version 2.0.5 * Upstream bugfix/stabilization release * Final release in the 2.0 branch * Change to BibleGateway URL to use legacy web interface * lp#719514 : Issues with Themes when comparing theme files * lp#1326664: Improved error messages with Easy Worship Song Imports * lp#1310523: Allow more than 26 equal verses within a Song * lp#1296104: Handle songs where two optional breaks follow each other * lp#1136278: Improve Database update error handling Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-456 - openSUSE 12.3: zypper in -t patch openSUSE-2014-456 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): OpenLP-2.0.5-8.1 - openSUSE 12.3 (noarch): OpenLP-2.0.5-2.16.1 References: https://bugzilla.novell.com/884901

1 0

openSUSE-SU-2014:0878-1: important: kernel update fixes local privilege escalation and a regression causing a crash if IPsec peer is unavailable
by opensuse-security＠opensuse.org 08 Jul '14

08 Jul '14

openSUSE Security Update: kernel update fixes local privilege escalation and a regression causing a crash if IPsec peer is unavailable ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0878-1 Rating: important References: #877775 #880892 Cross-References: CVE-2014-3153 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: kernel update for Evergreen 11.4 fixes local privilege escalation in futex code (bnc#880892 / CVE-2014-3153) and a regression causing a crash if IPsec peer is unavailable Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-69 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): kernel-debug-3.0.101-87.1 kernel-debug-base-3.0.101-87.1 kernel-debug-base-debuginfo-3.0.101-87.1 kernel-debug-debuginfo-3.0.101-87.1 kernel-debug-debugsource-3.0.101-87.1 kernel-debug-devel-3.0.101-87.1 kernel-debug-devel-debuginfo-3.0.101-87.1 kernel-debug-hmac-3.0.101-87.1 kernel-default-3.0.101-87.1 kernel-default-base-3.0.101-87.1 kernel-default-base-debuginfo-3.0.101-87.1 kernel-default-debuginfo-3.0.101-87.1 kernel-default-debugsource-3.0.101-87.1 kernel-default-devel-3.0.101-87.1 kernel-default-devel-debuginfo-3.0.101-87.1 kernel-default-hmac-3.0.101-87.1 kernel-desktop-3.0.101-87.1 kernel-desktop-base-3.0.101-87.1 kernel-desktop-base-debuginfo-3.0.101-87.1 kernel-desktop-debuginfo-3.0.101-87.1 kernel-desktop-debugsource-3.0.101-87.1 kernel-desktop-devel-3.0.101-87.1 kernel-desktop-devel-debuginfo-3.0.101-87.1 kernel-desktop-hmac-3.0.101-87.1 kernel-ec2-3.0.101-87.1 kernel-ec2-base-3.0.101-87.1 kernel-ec2-base-debuginfo-3.0.101-87.1 kernel-ec2-debuginfo-3.0.101-87.1 kernel-ec2-debugsource-3.0.101-87.1 kernel-ec2-devel-3.0.101-87.1 kernel-ec2-devel-debuginfo-3.0.101-87.1 kernel-ec2-extra-3.0.101-87.1 kernel-ec2-extra-debuginfo-3.0.101-87.1 kernel-ec2-hmac-3.0.101-87.1 kernel-source-3.0.101-87.1 kernel-source-vanilla-3.0.101-87.1 kernel-syms-3.0.101-87.1 kernel-trace-3.0.101-87.1 kernel-trace-base-3.0.101-87.1 kernel-trace-base-debuginfo-3.0.101-87.1 kernel-trace-debuginfo-3.0.101-87.1 kernel-trace-debugsource-3.0.101-87.1 kernel-trace-devel-3.0.101-87.1 kernel-trace-devel-debuginfo-3.0.101-87.1 kernel-trace-hmac-3.0.101-87.1 kernel-vanilla-3.0.101-87.1 kernel-vanilla-base-3.0.101-87.1 kernel-vanilla-base-debuginfo-3.0.101-87.1 kernel-vanilla-debuginfo-3.0.101-87.1 kernel-vanilla-debugsource-3.0.101-87.1 kernel-vanilla-devel-3.0.101-87.1 kernel-vanilla-devel-debuginfo-3.0.101-87.1 kernel-vanilla-hmac-3.0.101-87.1 kernel-xen-3.0.101-87.1 kernel-xen-base-3.0.101-87.1 kernel-xen-base-debuginfo-3.0.101-87.1 kernel-xen-debuginfo-3.0.101-87.1 kernel-xen-debugsource-3.0.101-87.1 kernel-xen-devel-3.0.101-87.1 kernel-xen-devel-debuginfo-3.0.101-87.1 kernel-xen-hmac-3.0.101-87.1 preload-1.2-6.65.1 preload-debuginfo-1.2-6.65.1 preload-debugsource-1.2-6.65.1 preload-kmp-default-1.2_3.0.101_87-6.65.1 preload-kmp-default-debuginfo-1.2_3.0.101_87-6.65.1 preload-kmp-desktop-1.2_3.0.101_87-6.65.1 preload-kmp-desktop-debuginfo-1.2_3.0.101_87-6.65.1 - openSUSE 11.4 (noarch): kernel-docs-3.0.101-87.2 - openSUSE 11.4 (i586): kernel-pae-3.0.101-87.1 kernel-pae-base-3.0.101-87.1 kernel-pae-base-debuginfo-3.0.101-87.1 kernel-pae-debuginfo-3.0.101-87.1 kernel-pae-debugsource-3.0.101-87.1 kernel-pae-devel-3.0.101-87.1 kernel-pae-devel-debuginfo-3.0.101-87.1 kernel-pae-hmac-3.0.101-87.1 kernel-vmi-3.0.101-87.1 kernel-vmi-base-3.0.101-87.1 kernel-vmi-base-debuginfo-3.0.101-87.1 kernel-vmi-debuginfo-3.0.101-87.1 kernel-vmi-debugsource-3.0.101-87.1 kernel-vmi-devel-3.0.101-87.1 kernel-vmi-devel-debuginfo-3.0.101-87.1 kernel-vmi-hmac-3.0.101-87.1 References: http://support.novell.com/security/cve/CVE-2014-3153.html https://bugzilla.novell.com/877775 https://bugzilla.novell.com/880892

1 0

openSUSE-SU-2014:0874-1: moderate: dbus-1: Fixed possible DoS
by opensuse-security＠opensuse.org 05 Jul '14

05 Jul '14

openSUSE Security Update: dbus-1: Fixed possible DoS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0874-1 Rating: moderate References: #881137 Cross-References: CVE-2014-3477 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: dbus-1 was updated to fix a possible DoS (CVE-2014-3477). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-68 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): dbus-1-1.4.1-7.35.1 dbus-1-debuginfo-1.4.1-7.35.1 dbus-1-debugsource-1.4.1-7.35.1 dbus-1-devel-1.4.1-7.35.1 dbus-1-x11-1.4.1-7.35.1 dbus-1-x11-debuginfo-1.4.1-7.35.1 dbus-1-x11-debugsource-1.4.1-7.35.1 - openSUSE 11.4 (x86_64): dbus-1-32bit-1.4.1-7.35.1 dbus-1-debuginfo-32bit-1.4.1-7.35.1 dbus-1-devel-32bit-1.4.1-7.35.1 - openSUSE 11.4 (noarch): dbus-1-devel-doc-1.4.1-7.35.1 - openSUSE 11.4 (ia64): dbus-1-debuginfo-x86-1.4.1-7.35.1 dbus-1-x86-1.4.1-7.35.1 References: http://support.novell.com/security/cve/CVE-2014-3477.html https://bugzilla.novell.com/881137

1 0

openSUSE-SU-2014:0867-1: moderate: memcached: Update fixes fixe security issues
by opensuse-security＠opensuse.org 03 Jul '14

03 Jul '14

openSUSE Security Update: memcached: Update fixes fixe security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0867-1 Rating: moderate References: #798458 #817781 #857188 #858676 #858677 Cross-References: CVE-2011-4971 CVE-2013-0179 CVE-2013-7239 CVE-2013-7290 CVE-2013-7291 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: memcached was updated to version 1.4.20 to fix five security issues. These security issues were fixed: - DoS when printing out keys to be deleted in verbose mode (CVE-2013-0179) - Remote DoS (crash) via a request that triggers "unbounded key print" (CVE-2013-7291) - Remote DoS (segmentation fault) via a request to delete a key (CVE-2013-7290) - SASL authentication allows wrong credentials to access memcache (CVE-2013-7239) - Remote DoS (CVE-2011-4971) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-454 - openSUSE 12.3: zypper in -t patch openSUSE-2014-454 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): memcached-1.4.20-6.4.1 memcached-debuginfo-1.4.20-6.4.1 memcached-debugsource-1.4.20-6.4.1 - openSUSE 12.3 (i586 x86_64): memcached-1.4.20-3.4.1 memcached-debuginfo-1.4.20-3.4.1 memcached-debugsource-1.4.20-3.4.1 References: http://support.novell.com/security/cve/CVE-2011-4971.html http://support.novell.com/security/cve/CVE-2013-0179.html http://support.novell.com/security/cve/CVE-2013-7239.html http://support.novell.com/security/cve/CVE-2013-7290.html http://support.novell.com/security/cve/CVE-2013-7291.html https://bugzilla.novell.com/798458 https://bugzilla.novell.com/817781 https://bugzilla.novell.com/857188 https://bugzilla.novell.com/858676 https://bugzilla.novell.com/858677

1 0

openSUSE-SU-2014:0866-1: moderate: gpg2: Fixed possible DoS
by opensuse-security＠opensuse.org 03 Jul '14

03 Jul '14

openSUSE Security Update: gpg2: Fixed possible DoS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0866-1 Rating: moderate References: #884130 Cross-References: CVE-2014-4617 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gpg2 was patched to fix a possible DoS. This security issue was fixed: - Denial of service through infinite loop with garbled compressed data packets (CVE-2014-4617) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-455 - openSUSE 12.3: zypper in -t patch openSUSE-2014-455 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): gpg2-2.0.22-8.1 gpg2-debuginfo-2.0.22-8.1 gpg2-debugsource-2.0.22-8.1 - openSUSE 13.1 (noarch): gpg2-lang-2.0.22-8.1 - openSUSE 12.3 (i586 x86_64): gpg2-2.0.19-5.16.1 gpg2-debuginfo-2.0.19-5.16.1 gpg2-debugsource-2.0.19-5.16.1 - openSUSE 12.3 (noarch): gpg2-lang-2.0.19-5.16.1 References: http://support.novell.com/security/cve/CVE-2014-4617.html https://bugzilla.novell.com/884130

1 0

openSUSE-RU-2014:0865-1: lapack: Moved libraries to subdirectories for fixing update-alternatives
by maintenance＠opensuse.org 02 Jul '14

02 Jul '14

openSUSE Recommended Update: lapack: Moved libraries to subdirectories for fixing update-alternatives ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0865-1 Rating: low References: Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues with lapack: -bnc#861081: * Move libraries to subdirectories for fixing update-alternatives * Add scripts for fixing migration problems Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-453 - openSUSE 12.3: zypper in -t patch openSUSE-2014-453 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): blas-devel-3.4.2-6.4.1 blas-devel-static-3.4.2-6.4.1 lapack-debugsource-3.4.2-6.4.1 lapack-devel-3.4.2-6.4.1 lapack-devel-static-3.4.2-6.4.1 lapacke-devel-3.4.2-6.4.1 lapacke-devel-static-3.4.2-6.4.1 libblas3-3.4.2-6.4.1 libblas3-debuginfo-3.4.2-6.4.1 liblapack3-3.4.2-6.4.1 liblapack3-debuginfo-3.4.2-6.4.1 liblapacke3-3.4.2-6.4.1 liblapacke3-debuginfo-3.4.2-6.4.1 - openSUSE 13.1 (x86_64): blas-devel-32bit-3.4.2-6.4.1 lapack-devel-32bit-3.4.2-6.4.1 lapacke-devel-32bit-3.4.2-6.4.1 libblas3-32bit-3.4.2-6.4.1 libblas3-debuginfo-32bit-3.4.2-6.4.1 liblapack3-32bit-3.4.2-6.4.1 liblapack3-debuginfo-32bit-3.4.2-6.4.1 liblapacke3-32bit-3.4.2-6.4.1 liblapacke3-debuginfo-32bit-3.4.2-6.4.1 - openSUSE 13.1 (noarch): blas-man-3.4.2-6.4.1 lapack-man-3.4.2-6.4.1 - openSUSE 12.3 (i586 x86_64): blas-devel-3.4.2-3.4.1 lapack-debugsource-3.4.2-3.4.1 lapack-devel-3.4.2-3.4.1 lapacke-devel-3.4.2-3.4.1 libblas3-3.4.2-3.4.1 libblas3-debuginfo-3.4.2-3.4.1 liblapack3-3.4.2-3.4.1 liblapack3-debuginfo-3.4.2-3.4.1 liblapacke3-3.4.2-3.4.1 liblapacke3-debuginfo-3.4.2-3.4.1 - openSUSE 12.3 (x86_64): blas-devel-32bit-3.4.2-3.4.1 lapack-devel-32bit-3.4.2-3.4.1 lapacke-devel-32bit-3.4.2-3.4.1 libblas3-32bit-3.4.2-3.4.1 libblas3-debuginfo-32bit-3.4.2-3.4.1 liblapack3-32bit-3.4.2-3.4.1 liblapack3-debuginfo-32bit-3.4.2-3.4.1 liblapacke3-32bit-3.4.2-3.4.1 liblapacke3-debuginfo-32bit-3.4.2-3.4.1 - openSUSE 12.3 (noarch): blas-man-3.4.2-3.4.1 lapack-man-3.4.2-3.4.1 References:

1 0

openSUSE-SU-2014:0862-1: moderate: freerdp: Fixes for integer overflows
by opensuse-security＠opensuse.org 01 Jul '14

01 Jul '14

openSUSE Security Update: freerdp: Fixes for integer overflows ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0862-1 Rating: moderate References: #857491 #880317 Cross-References: CVE-2014-0250 CVE-2014-0791 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: freerdp was patched to fix several integer overflows. These security issues were fixed: * Integer overflow (CVE-2014-0791) * Integer overflows in memory allocations in client/X11/xf_graphics.c (CVE-2014-0250) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-452 - openSUSE 12.3: zypper in -t patch openSUSE-2014-452 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): freerdp-1.0.2-3.4.1 freerdp-debuginfo-1.0.2-3.4.1 freerdp-debugsource-1.0.2-3.4.1 freerdp-devel-1.0.2-3.4.1 libfreerdp-1_0-1.0.2-3.4.1 libfreerdp-1_0-debuginfo-1.0.2-3.4.1 libfreerdp-1_0-plugins-1.0.2-3.4.1 libfreerdp-1_0-plugins-debuginfo-1.0.2-3.4.1 - openSUSE 12.3 (i586 x86_64): freerdp-1.0.2-11.12.1 freerdp-debuginfo-1.0.2-11.12.1 freerdp-debugsource-1.0.2-11.12.1 freerdp-devel-1.0.2-11.12.1 libfreerdp-1_0-1.0.2-11.12.1 libfreerdp-1_0-debuginfo-1.0.2-11.12.1 libfreerdp-1_0-plugins-1.0.2-11.12.1 libfreerdp-1_0-plugins-debuginfo-1.0.2-11.12.1 References: http://support.novell.com/security/cve/CVE-2014-0250.html http://support.novell.com/security/cve/CVE-2014-0791.html https://bugzilla.novell.com/857491 https://bugzilla.novell.com/880317

1 0

openSUSE-SU-2014:0861-1: moderate: xalan-j2: Ensure secure processing
by opensuse-security＠opensuse.org 01 Jul '14

01 Jul '14

openSUSE Security Update: xalan-j2: Ensure secure processing ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0861-1 Rating: moderate References: #870082 Cross-References: CVE-2014-0107 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: xalan-j2 was updated to ensure secure processing can't be circumvented (CVE-2014-0107). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-445 - openSUSE 12.3: zypper in -t patch openSUSE-2014-445 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): xalan-j2-2.7.0-262.4.1 xalan-j2-demo-2.7.0-262.4.1 xalan-j2-manual-2.7.0-262.4.1 xalan-j2-xsltc-2.7.0-262.4.1 - openSUSE 12.3 (noarch): xalan-j2-2.7.0-259.4.1 xalan-j2-demo-2.7.0-259.4.1 xalan-j2-javadoc-2.7.0-259.4.1 xalan-j2-manual-2.7.0-259.4.1 xalan-j2-xsltc-2.7.0-259.4.1 References: http://support.novell.com/security/cve/CVE-2014-0107.html https://bugzilla.novell.com/870082

1 0

openSUSE-SU-2014:0860-1: moderate: libreoffice: Update fixes over 80 bugs
by opensuse-security＠opensuse.org 01 Jul '14

01 Jul '14

openSUSE Security Update: libreoffice: Update fixes over 80 bugs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0860-1 Rating: moderate References: #249775 #404254 #407958 #410982 #411855 #414248 #417316 #417320 #418307 #421939 #422206 #422559 #422569 #422677 #758883 #766481 #766487 #779697 #821208 #879996 Cross-References: CVE-2014-0247 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has 19 fixes is now available. Description: libreoffice was updated to version 4.1.6.2, thereby fixing over 80 bugs. This security issue was fixed: - VBA macros executed unconditionally (CVE-2014-0247) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-446 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libreoffice-4.1.6.2-21.1 libreoffice-base-4.1.6.2-21.1 libreoffice-base-debuginfo-4.1.6.2-21.1 libreoffice-base-drivers-mysql-4.1.6.2-21.1 libreoffice-base-drivers-mysql-debuginfo-4.1.6.2-21.1 libreoffice-base-drivers-postgresql-4.1.6.2-21.1 libreoffice-base-drivers-postgresql-debuginfo-4.1.6.2-21.1 libreoffice-base-extensions-4.1.6.2-21.1 libreoffice-calc-4.1.6.2-21.1 libreoffice-calc-debuginfo-4.1.6.2-21.1 libreoffice-calc-extensions-4.1.6.2-21.1 libreoffice-debuginfo-4.1.6.2-21.1 libreoffice-debugsource-4.1.6.2-21.1 libreoffice-draw-4.1.6.2-21.1 libreoffice-draw-debuginfo-4.1.6.2-21.1 libreoffice-draw-extensions-4.1.6.2-21.1 libreoffice-filters-optional-4.1.6.2-21.1 libreoffice-gnome-4.1.6.2-21.1 libreoffice-gnome-debuginfo-4.1.6.2-21.1 libreoffice-icon-themes-prebuilt-4.1.6.2-21.1 libreoffice-impress-4.1.6.2-21.1 libreoffice-impress-debuginfo-4.1.6.2-21.1 libreoffice-impress-extensions-4.1.6.2-21.1 libreoffice-impress-extensions-debuginfo-4.1.6.2-21.1 libreoffice-kde-4.1.6.2-21.1 libreoffice-kde-debuginfo-4.1.6.2-21.1 libreoffice-kde4-4.1.6.2-21.1 libreoffice-kde4-debuginfo-4.1.6.2-21.1 libreoffice-l10n-prebuilt-4.1.6.2-21.1 libreoffice-mailmerge-4.1.6.2-21.1 libreoffice-math-4.1.6.2-21.1 libreoffice-math-debuginfo-4.1.6.2-21.1 libreoffice-officebean-4.1.6.2-21.1 libreoffice-officebean-debuginfo-4.1.6.2-21.1 libreoffice-pyuno-4.1.6.2-21.1 libreoffice-pyuno-debuginfo-4.1.6.2-21.1 libreoffice-sdk-4.1.6.2-21.1 libreoffice-sdk-debuginfo-4.1.6.2-21.1 libreoffice-sdk-doc-4.1.6.2-21.1 libreoffice-writer-4.1.6.2-21.1 libreoffice-writer-debuginfo-4.1.6.2-21.1 libreoffice-writer-extensions-4.1.6.2-21.1 - openSUSE 13.1 (noarch): libreoffice-branding-upstream-4.1.6.2-21.1 libreoffice-help-ast-4.1.6.2-21.1 libreoffice-help-bg-4.1.6.2-21.1 libreoffice-help-ca-4.1.6.2-21.1 libreoffice-help-cs-4.1.6.2-21.1 libreoffice-help-da-4.1.6.2-21.1 libreoffice-help-de-4.1.6.2-21.1 libreoffice-help-el-4.1.6.2-21.1 libreoffice-help-en-GB-4.1.6.2-21.1 libreoffice-help-en-US-4.1.6.2-21.1 libreoffice-help-en-ZA-4.1.6.2-21.1 libreoffice-help-es-4.1.6.2-21.1 libreoffice-help-et-4.1.6.2-21.1 libreoffice-help-eu-4.1.6.2-21.1 libreoffice-help-fi-4.1.6.2-21.1 libreoffice-help-fr-4.1.6.2-21.1 libreoffice-help-gl-4.1.6.2-21.1 libreoffice-help-gu-IN-4.1.6.2-21.1 libreoffice-help-hi-IN-4.1.6.2-21.1 libreoffice-help-hu-4.1.6.2-21.1 libreoffice-help-it-4.1.6.2-21.1 libreoffice-help-ja-4.1.6.2-21.1 libreoffice-help-km-4.1.6.2-21.1 libreoffice-help-ko-4.1.6.2-21.1 libreoffice-help-mk-4.1.6.2-21.1 libreoffice-help-nb-4.1.6.2-21.1 libreoffice-help-nl-4.1.6.2-21.1 libreoffice-help-pl-4.1.6.2-21.1 libreoffice-help-pt-4.1.6.2-21.1 libreoffice-help-pt-BR-4.1.6.2-21.1 libreoffice-help-ru-4.1.6.2-21.1 libreoffice-help-sk-4.1.6.2-21.1 libreoffice-help-sl-4.1.6.2-21.1 libreoffice-help-sv-4.1.6.2-21.1 libreoffice-help-tr-4.1.6.2-21.1 libreoffice-help-vi-4.1.6.2-21.1 libreoffice-help-zh-CN-4.1.6.2-21.1 libreoffice-help-zh-TW-4.1.6.2-21.1 libreoffice-icon-theme-crystal-4.1.6.2-21.1 libreoffice-icon-theme-galaxy-4.1.6.2-21.1 libreoffice-icon-theme-hicontrast-4.1.6.2-21.1 libreoffice-icon-theme-oxygen-4.1.6.2-21.1 libreoffice-icon-theme-tango-4.1.6.2-21.1 libreoffice-l10n-af-4.1.6.2-21.1 libreoffice-l10n-am-4.1.6.2-21.1 libreoffice-l10n-ar-4.1.6.2-21.1 libreoffice-l10n-as-4.1.6.2-21.1 libreoffice-l10n-ast-4.1.6.2-21.1 libreoffice-l10n-be-BY-4.1.6.2-21.1 libreoffice-l10n-bg-4.1.6.2-21.1 libreoffice-l10n-br-4.1.6.2-21.1 libreoffice-l10n-ca-4.1.6.2-21.1 libreoffice-l10n-cs-4.1.6.2-21.1 libreoffice-l10n-cy-4.1.6.2-21.1 libreoffice-l10n-da-4.1.6.2-21.1 libreoffice-l10n-de-4.1.6.2-21.1 libreoffice-l10n-el-4.1.6.2-21.1 libreoffice-l10n-en-GB-4.1.6.2-21.1 libreoffice-l10n-en-ZA-4.1.6.2-21.1 libreoffice-l10n-eo-4.1.6.2-21.1 libreoffice-l10n-es-4.1.6.2-21.1 libreoffice-l10n-et-4.1.6.2-21.1 libreoffice-l10n-eu-4.1.6.2-21.1 libreoffice-l10n-fi-4.1.6.2-21.1 libreoffice-l10n-fr-4.1.6.2-21.1 libreoffice-l10n-ga-4.1.6.2-21.1 libreoffice-l10n-gd-4.1.6.2-21.1 libreoffice-l10n-gl-4.1.6.2-21.1 libreoffice-l10n-gu-IN-4.1.6.2-21.1 libreoffice-l10n-he-4.1.6.2-21.1 libreoffice-l10n-hi-IN-4.1.6.2-21.1 libreoffice-l10n-hr-4.1.6.2-21.1 libreoffice-l10n-hu-4.1.6.2-21.1 libreoffice-l10n-id-4.1.6.2-21.1 libreoffice-l10n-is-4.1.6.2-21.1 libreoffice-l10n-it-4.1.6.2-21.1 libreoffice-l10n-ja-4.1.6.2-21.1 libreoffice-l10n-ka-4.1.6.2-21.1 libreoffice-l10n-km-4.1.6.2-21.1 libreoffice-l10n-kn-4.1.6.2-21.1 libreoffice-l10n-ko-4.1.6.2-21.1 libreoffice-l10n-lt-4.1.6.2-21.1 libreoffice-l10n-mk-4.1.6.2-21.1 libreoffice-l10n-ml-4.1.6.2-21.1 libreoffice-l10n-mr-4.1.6.2-21.1 libreoffice-l10n-nb-4.1.6.2-21.1 libreoffice-l10n-nl-4.1.6.2-21.1 libreoffice-l10n-nn-4.1.6.2-21.1 libreoffice-l10n-nr-4.1.6.2-21.1 libreoffice-l10n-om-4.1.6.2-21.1 libreoffice-l10n-or-4.1.6.2-21.1 libreoffice-l10n-pa-IN-4.1.6.2-21.1 libreoffice-l10n-pl-4.1.6.2-21.1 libreoffice-l10n-pt-4.1.6.2-21.1 libreoffice-l10n-pt-BR-4.1.6.2-21.1 libreoffice-l10n-ro-4.1.6.2-21.1 libreoffice-l10n-ru-4.1.6.2-21.1 libreoffice-l10n-rw-4.1.6.2-21.1 libreoffice-l10n-sh-4.1.6.2-21.1 libreoffice-l10n-sk-4.1.6.2-21.1 libreoffice-l10n-sl-4.1.6.2-21.1 libreoffice-l10n-sr-4.1.6.2-21.1 libreoffice-l10n-ss-4.1.6.2-21.1 libreoffice-l10n-st-4.1.6.2-21.1 libreoffice-l10n-sv-4.1.6.2-21.1 libreoffice-l10n-ta-4.1.6.2-21.1 libreoffice-l10n-te-4.1.6.2-21.1 libreoffice-l10n-tg-4.1.6.2-21.1 libreoffice-l10n-th-4.1.6.2-21.1 libreoffice-l10n-tr-4.1.6.2-21.1 libreoffice-l10n-ts-4.1.6.2-21.1 libreoffice-l10n-ug-4.1.6.2-21.1 libreoffice-l10n-uk-4.1.6.2-21.1 libreoffice-l10n-ve-4.1.6.2-21.1 libreoffice-l10n-vi-4.1.6.2-21.1 libreoffice-l10n-xh-4.1.6.2-21.1 libreoffice-l10n-zh-CN-4.1.6.2-21.1 libreoffice-l10n-zh-TW-4.1.6.2-21.1 libreoffice-l10n-zu-4.1.6.2-21.1 References: http://support.novell.com/security/cve/CVE-2014-0247.html https://bugzilla.novell.com/249775 https://bugzilla.novell.com/404254 https://bugzilla.novell.com/407958 https://bugzilla.novell.com/410982 https://bugzilla.novell.com/411855 https://bugzilla.novell.com/414248 https://bugzilla.novell.com/417316 https://bugzilla.novell.com/417320 https://bugzilla.novell.com/418307 https://bugzilla.novell.com/421939 https://bugzilla.novell.com/422206 https://bugzilla.novell.com/422559 https://bugzilla.novell.com/422569 https://bugzilla.novell.com/422677 https://bugzilla.novell.com/758883 https://bugzilla.novell.com/766481 https://bugzilla.novell.com/766487 https://bugzilla.novell.com/779697 https://bugzilla.novell.com/821208 https://bugzilla.novell.com/879996

1 0

openSUSE-SU-2014:0859-1: moderate: samba: Update fixes four security issues
by opensuse-security＠opensuse.org 01 Jul '14

01 Jul '14

openSUSE Security Update: samba: Update fixes four security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0859-1 Rating: moderate References: #846586 #866354 #866927 #869707 #870570 #870607 #870957 #871701 #872396 #873177 #873658 #874180 #874656 #875046 #879390 #880962 #883758 Cross-References: CVE-2014-0178 CVE-2014-0239 CVE-2014-0244 CVE-2014-3493 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves four vulnerabilities and has 13 fixes is now available. Description: samba was updated to version 4.1.9 to fix four security issues and various non-security bugs. These security issues were fixed: - Fix nmbd denial of service (CVE-2014-0244) - Fix segmentation fault in smbd_marshall_dir_entry()'s SMB_FIND_FILE_UNIX handler (CVE-2014-3493) - Malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response (CVE-2014-0178) - DNS: Don't reply to replies (CVE-2014-0239) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-450 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libdcerpc-atsvc-devel-4.1.9-3.22.1 libdcerpc-atsvc0-4.1.9-3.22.1 libdcerpc-atsvc0-debuginfo-4.1.9-3.22.1 libdcerpc-binding0-4.1.9-3.22.1 libdcerpc-binding0-debuginfo-4.1.9-3.22.1 libdcerpc-devel-4.1.9-3.22.1 libdcerpc-samr-devel-4.1.9-3.22.1 libdcerpc-samr0-4.1.9-3.22.1 libdcerpc-samr0-debuginfo-4.1.9-3.22.1 libdcerpc0-4.1.9-3.22.1 libdcerpc0-debuginfo-4.1.9-3.22.1 libgensec-devel-4.1.9-3.22.1 libgensec0-4.1.9-3.22.1 libgensec0-debuginfo-4.1.9-3.22.1 libndr-devel-4.1.9-3.22.1 libndr-krb5pac-devel-4.1.9-3.22.1 libndr-krb5pac0-4.1.9-3.22.1 libndr-krb5pac0-debuginfo-4.1.9-3.22.1 libndr-nbt-devel-4.1.9-3.22.1 libndr-nbt0-4.1.9-3.22.1 libndr-nbt0-debuginfo-4.1.9-3.22.1 libndr-standard-devel-4.1.9-3.22.1 libndr-standard0-4.1.9-3.22.1 libndr-standard0-debuginfo-4.1.9-3.22.1 libndr0-4.1.9-3.22.1 libndr0-debuginfo-4.1.9-3.22.1 libnetapi-devel-4.1.9-3.22.1 libnetapi0-4.1.9-3.22.1 libnetapi0-debuginfo-4.1.9-3.22.1 libpdb-devel-4.1.9-3.22.1 libpdb0-4.1.9-3.22.1 libpdb0-debuginfo-4.1.9-3.22.1 libregistry-devel-4.1.9-3.22.1 libregistry0-4.1.9-3.22.1 libregistry0-debuginfo-4.1.9-3.22.1 libsamba-credentials-devel-4.1.9-3.22.1 libsamba-credentials0-4.1.9-3.22.1 libsamba-credentials0-debuginfo-4.1.9-3.22.1 libsamba-hostconfig-devel-4.1.9-3.22.1 libsamba-hostconfig0-4.1.9-3.22.1 libsamba-hostconfig0-debuginfo-4.1.9-3.22.1 libsamba-policy-devel-4.1.9-3.22.1 libsamba-policy0-4.1.9-3.22.1 libsamba-policy0-debuginfo-4.1.9-3.22.1 libsamba-util-devel-4.1.9-3.22.1 libsamba-util0-4.1.9-3.22.1 libsamba-util0-debuginfo-4.1.9-3.22.1 libsamdb-devel-4.1.9-3.22.1 libsamdb0-4.1.9-3.22.1 libsamdb0-debuginfo-4.1.9-3.22.1 libsmbclient-devel-4.1.9-3.22.1 libsmbclient-raw-devel-4.1.9-3.22.1 libsmbclient-raw0-4.1.9-3.22.1 libsmbclient-raw0-debuginfo-4.1.9-3.22.1 libsmbclient0-4.1.9-3.22.1 libsmbclient0-debuginfo-4.1.9-3.22.1 libsmbconf-devel-4.1.9-3.22.1 libsmbconf0-4.1.9-3.22.1 libsmbconf0-debuginfo-4.1.9-3.22.1 libsmbldap-devel-4.1.9-3.22.1 libsmbldap0-4.1.9-3.22.1 libsmbldap0-debuginfo-4.1.9-3.22.1 libsmbsharemodes-devel-4.1.9-3.22.1 libsmbsharemodes0-4.1.9-3.22.1 libsmbsharemodes0-debuginfo-4.1.9-3.22.1 libtevent-util-devel-4.1.9-3.22.1 libtevent-util0-4.1.9-3.22.1 libtevent-util0-debuginfo-4.1.9-3.22.1 libwbclient-devel-4.1.9-3.22.1 libwbclient0-4.1.9-3.22.1 libwbclient0-debuginfo-4.1.9-3.22.1 samba-4.1.9-3.22.1 samba-client-4.1.9-3.22.1 samba-client-debuginfo-4.1.9-3.22.1 samba-core-devel-4.1.9-3.22.1 samba-debuginfo-4.1.9-3.22.1 samba-debugsource-4.1.9-3.22.1 samba-libs-4.1.9-3.22.1 samba-libs-debuginfo-4.1.9-3.22.1 samba-pidl-4.1.9-3.22.1 samba-python-4.1.9-3.22.1 samba-python-debuginfo-4.1.9-3.22.1 samba-test-4.1.9-3.22.1 samba-test-debuginfo-4.1.9-3.22.1 samba-test-devel-4.1.9-3.22.1 samba-winbind-4.1.9-3.22.1 samba-winbind-debuginfo-4.1.9-3.22.1 - openSUSE 13.1 (x86_64): libdcerpc-atsvc0-32bit-4.1.9-3.22.1 libdcerpc-atsvc0-debuginfo-32bit-4.1.9-3.22.1 libdcerpc-binding0-32bit-4.1.9-3.22.1 libdcerpc-binding0-debuginfo-32bit-4.1.9-3.22.1 libdcerpc-samr0-32bit-4.1.9-3.22.1 libdcerpc-samr0-debuginfo-32bit-4.1.9-3.22.1 libdcerpc0-32bit-4.1.9-3.22.1 libdcerpc0-debuginfo-32bit-4.1.9-3.22.1 libgensec0-32bit-4.1.9-3.22.1 libgensec0-debuginfo-32bit-4.1.9-3.22.1 libndr-krb5pac0-32bit-4.1.9-3.22.1 libndr-krb5pac0-debuginfo-32bit-4.1.9-3.22.1 libndr-nbt0-32bit-4.1.9-3.22.1 libndr-nbt0-debuginfo-32bit-4.1.9-3.22.1 libndr-standard0-32bit-4.1.9-3.22.1 libndr-standard0-debuginfo-32bit-4.1.9-3.22.1 libndr0-32bit-4.1.9-3.22.1 libndr0-debuginfo-32bit-4.1.9-3.22.1 libnetapi0-32bit-4.1.9-3.22.1 libnetapi0-debuginfo-32bit-4.1.9-3.22.1 libpdb0-32bit-4.1.9-3.22.1 libpdb0-debuginfo-32bit-4.1.9-3.22.1 libregistry0-32bit-4.1.9-3.22.1 libregistry0-debuginfo-32bit-4.1.9-3.22.1 libsamba-credentials0-32bit-4.1.9-3.22.1 libsamba-credentials0-debuginfo-32bit-4.1.9-3.22.1 libsamba-hostconfig0-32bit-4.1.9-3.22.1 libsamba-hostconfig0-debuginfo-32bit-4.1.9-3.22.1 libsamba-policy0-32bit-4.1.9-3.22.1 libsamba-policy0-debuginfo-32bit-4.1.9-3.22.1 libsamba-util0-32bit-4.1.9-3.22.1 libsamba-util0-debuginfo-32bit-4.1.9-3.22.1 libsamdb0-32bit-4.1.9-3.22.1 libsamdb0-debuginfo-32bit-4.1.9-3.22.1 libsmbclient-raw0-32bit-4.1.9-3.22.1 libsmbclient-raw0-debuginfo-32bit-4.1.9-3.22.1 libsmbclient0-32bit-4.1.9-3.22.1 libsmbclient0-debuginfo-32bit-4.1.9-3.22.1 libsmbconf0-32bit-4.1.9-3.22.1 libsmbconf0-debuginfo-32bit-4.1.9-3.22.1 libsmbldap0-32bit-4.1.9-3.22.1 libsmbldap0-debuginfo-32bit-4.1.9-3.22.1 libtevent-util0-32bit-4.1.9-3.22.1 libtevent-util0-debuginfo-32bit-4.1.9-3.22.1 libwbclient0-32bit-4.1.9-3.22.1 libwbclient0-debuginfo-32bit-4.1.9-3.22.1 samba-32bit-4.1.9-3.22.1 samba-client-32bit-4.1.9-3.22.1 samba-client-debuginfo-32bit-4.1.9-3.22.1 samba-debuginfo-32bit-4.1.9-3.22.1 samba-libs-32bit-4.1.9-3.22.1 samba-libs-debuginfo-32bit-4.1.9-3.22.1 samba-winbind-32bit-4.1.9-3.22.1 samba-winbind-debuginfo-32bit-4.1.9-3.22.1 - openSUSE 13.1 (noarch): samba-doc-4.1.9-3.22.1 References: http://support.novell.com/security/cve/CVE-2014-0178.html http://support.novell.com/security/cve/CVE-2014-0239.html http://support.novell.com/security/cve/CVE-2014-0244.html http://support.novell.com/security/cve/CVE-2014-3493.html https://bugzilla.novell.com/846586 https://bugzilla.novell.com/866354 https://bugzilla.novell.com/866927 https://bugzilla.novell.com/869707 https://bugzilla.novell.com/870570 https://bugzilla.novell.com/870607 https://bugzilla.novell.com/870957 https://bugzilla.novell.com/871701 https://bugzilla.novell.com/872396 https://bugzilla.novell.com/873177 https://bugzilla.novell.com/873658 https://bugzilla.novell.com/874180 https://bugzilla.novell.com/874656 https://bugzilla.novell.com/875046 https://bugzilla.novell.com/879390 https://bugzilla.novell.com/880962 https://bugzilla.novell.com/883758

1 0

openSUSE-SU-2014:0858-1: moderate: MozillaThunderbird: Update fixes six security issues
by opensuse-security＠opensuse.org 01 Jul '14

01 Jul '14

openSUSE Security Update: MozillaThunderbird: Update fixes six security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0858-1 Rating: moderate References: #881874 Cross-References: CVE-2014-1533 CVE-2014-1534 CVE-2014-1536 CVE-2014-1537 CVE-2014-1538 CVE-2014-1541 CVE-2014-1545 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: MozillaThunderbird was updated to version 24.6.0 to fix six security issues: * Miscellaneous memory safety hazards (CVE-2014-1533/CVE-2014-1534) * Use-after-free and out of bounds issues found using Address Sanitizer (CVE-2014-1536/CVE-2014-1537/CVE-2014-1538) * Use-after-free with SMIL Animation Controller (CVE-2014-1541) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-447 - openSUSE 12.3: zypper in -t patch openSUSE-2014-447 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-24.6.0-70.23.3 MozillaThunderbird-buildsymbols-24.6.0-70.23.3 MozillaThunderbird-debuginfo-24.6.0-70.23.3 MozillaThunderbird-debugsource-24.6.0-70.23.3 MozillaThunderbird-devel-24.6.0-70.23.3 MozillaThunderbird-translations-common-24.6.0-70.23.3 MozillaThunderbird-translations-other-24.6.0-70.23.3 enigmail-1.6.0+24.6.0-70.23.3 enigmail-debuginfo-1.6.0+24.6.0-70.23.3 - openSUSE 12.3 (i586 x86_64): MozillaThunderbird-24.6.0-61.51.3 MozillaThunderbird-buildsymbols-24.6.0-61.51.3 MozillaThunderbird-debuginfo-24.6.0-61.51.3 MozillaThunderbird-debugsource-24.6.0-61.51.3 MozillaThunderbird-devel-24.6.0-61.51.3 MozillaThunderbird-translations-common-24.6.0-61.51.3 MozillaThunderbird-translations-other-24.6.0-61.51.3 enigmail-1.6.0+24.6.0-61.51.3 enigmail-debuginfo-1.6.0+24.6.0-61.51.3 References: http://support.novell.com/security/cve/CVE-2014-1533.html http://support.novell.com/security/cve/CVE-2014-1534.html http://support.novell.com/security/cve/CVE-2014-1536.html http://support.novell.com/security/cve/CVE-2014-1537.html http://support.novell.com/security/cve/CVE-2014-1538.html http://support.novell.com/security/cve/CVE-2014-1541.html http://support.novell.com/security/cve/CVE-2014-1545.html https://bugzilla.novell.com/881874

1 0

openSUSE-SU-2014:0857-1: moderate: samba: Threes
by opensuse-security＠opensuse.org 01 Jul '14

01 Jul '14

openSUSE Security Update: samba: Threes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0857-1 Rating: moderate References: #685093 #872396 #879390 #880962 #883758 Cross-References: CVE-2014-0178 CVE-2014-0244 CVE-2014-3493 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: samba was updated to fix three security issues and two non-security issues. These security issues were fixed: - Fix segmentation fault in smbd_marshall_dir_entry()'s SMB_FIND_FILE_UNIX handler (CVE-2014-3493) - Fix nmbd denial of service (CVE-2014-0244) - Fix malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response (CVE-2014-0178) These non-security issues were fixed: - Fix printer job purging; (bso#10612); (bnc#879390). - Package the get_printing_ticket binary with 0700 permissions on post-11.4 systems; (bnc#685093). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-449 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libnetapi-devel-3.6.12-59.23.1 libnetapi0-3.6.12-59.23.1 libnetapi0-debuginfo-3.6.12-59.23.1 libsmbclient-devel-3.6.12-59.23.1 libsmbclient0-3.6.12-59.23.1 libsmbclient0-debuginfo-3.6.12-59.23.1 libsmbsharemodes-devel-3.6.12-59.23.1 libsmbsharemodes0-3.6.12-59.23.1 libsmbsharemodes0-debuginfo-3.6.12-59.23.1 libwbclient-devel-3.6.12-59.23.1 libwbclient0-3.6.12-59.23.1 libwbclient0-debuginfo-3.6.12-59.23.1 samba-3.6.12-59.23.1 samba-client-3.6.12-59.23.1 samba-client-debuginfo-3.6.12-59.23.1 samba-debuginfo-3.6.12-59.23.1 samba-debugsource-3.6.12-59.23.1 samba-devel-3.6.12-59.23.1 samba-krb-printing-3.6.12-59.23.1 samba-krb-printing-debuginfo-3.6.12-59.23.1 samba-winbind-3.6.12-59.23.1 samba-winbind-debuginfo-3.6.12-59.23.1 - openSUSE 12.3 (x86_64): libsmbclient0-32bit-3.6.12-59.23.1 libsmbclient0-debuginfo-32bit-3.6.12-59.23.1 libwbclient0-32bit-3.6.12-59.23.1 libwbclient0-debuginfo-32bit-3.6.12-59.23.1 samba-32bit-3.6.12-59.23.1 samba-client-32bit-3.6.12-59.23.1 samba-client-debuginfo-32bit-3.6.12-59.23.1 samba-debuginfo-32bit-3.6.12-59.23.1 samba-winbind-32bit-3.6.12-59.23.1 samba-winbind-debuginfo-32bit-3.6.12-59.23.1 - openSUSE 12.3 (noarch): samba-doc-3.6.12-59.23.1 References: http://support.novell.com/security/cve/CVE-2014-0178.html http://support.novell.com/security/cve/CVE-2014-0244.html http://support.novell.com/security/cve/CVE-2014-3493.html https://bugzilla.novell.com/685093 https://bugzilla.novell.com/872396 https://bugzilla.novell.com/879390 https://bugzilla.novell.com/880962 https://bugzilla.novell.com/883758

1 0

openSUSE-SU-2014:0856-1: important: kernel: security and bugfix release
by opensuse-security＠opensuse.org 01 Jul '14

01 Jul '14

openSUSE Security Update: kernel: security and bugfix release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0856-1 Rating: important References: #869563 #870173 #870576 #871561 #873374 #876102 #878274 #880892 Cross-References: CVE-2013-7339 CVE-2014-0055 CVE-2014-0077 CVE-2014-2678 CVE-2014-2851 CVE-2014-3122 CVE-2014-3153 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: The Linux kernel was updated to fix security issues and bugs: Security issues fixed: CVE-2014-3153: The futex_requeue function in kernel/futex.c in the Linux kernel did not ensure that calls have two different futex addresses, which allowed local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. CVE-2014-0077: drivers/vhost/net.c in the Linux kernel, when mergeable buffers are disabled, did not properly validate packet lengths, which allowed guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. CVE-2014-0055: The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package did not properly handle vhost_get_vq_desc errors, which allowed guest OS users to cause a denial of service (host OS crash) via unspecified vectors. CVE-2014-2678: The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports. CVE-2013-7339: The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports. CVE-2014-2851: Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. CVE-2014-3122: The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel did not properly consider which pages must be locked, which allowed local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires removal of page-table mappings. Bugs fixed: - memcg: deprecate memory.force_empty knob (bnc#878274). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-451 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): kernel-default-3.7.10-1.36.1 kernel-default-base-3.7.10-1.36.1 kernel-default-base-debuginfo-3.7.10-1.36.1 kernel-default-debuginfo-3.7.10-1.36.1 kernel-default-debugsource-3.7.10-1.36.1 kernel-default-devel-3.7.10-1.36.1 kernel-default-devel-debuginfo-3.7.10-1.36.1 kernel-syms-3.7.10-1.36.1 - openSUSE 12.3 (i686 x86_64): kernel-debug-3.7.10-1.36.1 kernel-debug-base-3.7.10-1.36.1 kernel-debug-base-debuginfo-3.7.10-1.36.1 kernel-debug-debuginfo-3.7.10-1.36.1 kernel-debug-debugsource-3.7.10-1.36.1 kernel-debug-devel-3.7.10-1.36.1 kernel-debug-devel-debuginfo-3.7.10-1.36.1 kernel-desktop-3.7.10-1.36.1 kernel-desktop-base-3.7.10-1.36.1 kernel-desktop-base-debuginfo-3.7.10-1.36.1 kernel-desktop-debuginfo-3.7.10-1.36.1 kernel-desktop-debugsource-3.7.10-1.36.1 kernel-desktop-devel-3.7.10-1.36.1 kernel-desktop-devel-debuginfo-3.7.10-1.36.1 kernel-ec2-3.7.10-1.36.1 kernel-ec2-base-3.7.10-1.36.1 kernel-ec2-base-debuginfo-3.7.10-1.36.1 kernel-ec2-debuginfo-3.7.10-1.36.1 kernel-ec2-debugsource-3.7.10-1.36.1 kernel-ec2-devel-3.7.10-1.36.1 kernel-ec2-devel-debuginfo-3.7.10-1.36.1 kernel-trace-3.7.10-1.36.1 kernel-trace-base-3.7.10-1.36.1 kernel-trace-base-debuginfo-3.7.10-1.36.1 kernel-trace-debuginfo-3.7.10-1.36.1 kernel-trace-debugsource-3.7.10-1.36.1 kernel-trace-devel-3.7.10-1.36.1 kernel-trace-devel-debuginfo-3.7.10-1.36.1 kernel-vanilla-3.7.10-1.36.1 kernel-vanilla-debuginfo-3.7.10-1.36.1 kernel-vanilla-debugsource-3.7.10-1.36.1 kernel-vanilla-devel-3.7.10-1.36.1 kernel-vanilla-devel-debuginfo-3.7.10-1.36.1 kernel-xen-3.7.10-1.36.1 kernel-xen-base-3.7.10-1.36.1 kernel-xen-base-debuginfo-3.7.10-1.36.1 kernel-xen-debuginfo-3.7.10-1.36.1 kernel-xen-debugsource-3.7.10-1.36.1 kernel-xen-devel-3.7.10-1.36.1 kernel-xen-devel-debuginfo-3.7.10-1.36.1 - openSUSE 12.3 (noarch): kernel-devel-3.7.10-1.36.1 kernel-docs-3.7.10-1.36.2 kernel-source-3.7.10-1.36.1 kernel-source-vanilla-3.7.10-1.36.1 - openSUSE 12.3 (i686): kernel-pae-3.7.10-1.36.1 kernel-pae-base-3.7.10-1.36.1 kernel-pae-base-debuginfo-3.7.10-1.36.1 kernel-pae-debuginfo-3.7.10-1.36.1 kernel-pae-debugsource-3.7.10-1.36.1 kernel-pae-devel-3.7.10-1.36.1 kernel-pae-devel-debuginfo-3.7.10-1.36.1 References: http://support.novell.com/security/cve/CVE-2013-7339.html http://support.novell.com/security/cve/CVE-2014-0055.html http://support.novell.com/security/cve/CVE-2014-0077.html http://support.novell.com/security/cve/CVE-2014-2678.html http://support.novell.com/security/cve/CVE-2014-2851.html http://support.novell.com/security/cve/CVE-2014-3122.html http://support.novell.com/security/cve/CVE-2014-3153.html https://bugzilla.novell.com/869563 https://bugzilla.novell.com/870173 https://bugzilla.novell.com/870576 https://bugzilla.novell.com/871561 https://bugzilla.novell.com/873374 https://bugzilla.novell.com/876102 https://bugzilla.novell.com/878274 https://bugzilla.novell.com/880892

1 0

openSUSE-SU-2014:0855-1: moderate: seamonkey: Update fixes nine security issues
by opensuse-security＠opensuse.org 01 Jul '14

01 Jul '14

openSUSE Security Update: seamonkey: Update fixes nine security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0855-1 Rating: moderate References: #881874 Cross-References: CVE-2014-1533 CVE-2014-1534 CVE-2014-1536 CVE-2014-1537 CVE-2014-1538 CVE-2014-1539 CVE-2014-1540 CVE-2014-1541 CVE-2014-1542 CVE-2014-1543 CVE-2014-1545 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: seamonkey was updated to version 2.26.1 to fix nine security issues. These security issues were fixed: * Miscellaneous memory safety hazards (CVE-2014-1533/CVE-2014-1534) * Use-after-free and out of bounds issues found using Address Sanitizer (CVE-2014-1536/CVE-2014-1537/CVE-2014-1538) * Use-after-free in Event Listener Manager (CVE-2014-1540) * Use-after-free with SMIL Animation Controller (CVE-2014-1541) * Buffer overflow in Web Audio Speex resampler (CVE-2014-1542) * Out of bounds write in NSPR (CVE-2014-1545) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-448 - openSUSE 12.3: zypper in -t patch openSUSE-2014-448 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): seamonkey-2.26.1-28.3 seamonkey-debuginfo-2.26.1-28.3 seamonkey-debugsource-2.26.1-28.3 seamonkey-dom-inspector-2.26.1-28.3 seamonkey-irc-2.26.1-28.3 seamonkey-translations-common-2.26.1-28.3 seamonkey-translations-other-2.26.1-28.3 seamonkey-venkman-2.26.1-28.3 - openSUSE 12.3 (i586 x86_64): seamonkey-2.26.1-1.53.3 seamonkey-debuginfo-2.26.1-1.53.3 seamonkey-debugsource-2.26.1-1.53.3 seamonkey-dom-inspector-2.26.1-1.53.3 seamonkey-irc-2.26.1-1.53.3 seamonkey-translations-common-2.26.1-1.53.3 seamonkey-translations-other-2.26.1-1.53.3 seamonkey-venkman-2.26.1-1.53.3 References: http://support.novell.com/security/cve/CVE-2014-1533.html http://support.novell.com/security/cve/CVE-2014-1534.html http://support.novell.com/security/cve/CVE-2014-1536.html http://support.novell.com/security/cve/CVE-2014-1537.html http://support.novell.com/security/cve/CVE-2014-1538.html http://support.novell.com/security/cve/CVE-2014-1539.html http://support.novell.com/security/cve/CVE-2014-1540.html http://support.novell.com/security/cve/CVE-2014-1541.html http://support.novell.com/security/cve/CVE-2014-1542.html http://support.novell.com/security/cve/CVE-2014-1543.html http://support.novell.com/security/cve/CVE-2014-1545.html https://bugzilla.novell.com/881874

1 0

openSUSE-RU-2014:0854-1: spec-cleaner: Version update to 0.5.8
by maintenance＠opensuse.org 01 Jul '14

01 Jul '14

openSUSE Recommended Update: spec-cleaner: Version update to 0.5.8 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0854-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issues with spec-cleaner: - update version to 0.5.8: * brown paperbag release fixing tests on py3. * Updates about smp_mflags parsing * makeinstall macro replacing improvements. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-444 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): spec-cleaner-0.5.8-6.12.1 References:

1 0