July 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:0924-1: moderate: eet: fix security issue
by opensuse-security＠opensuse.org 21 Jul '14

21 Jul '14

openSUSE Security Update: eet: fix security issue ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0924-1 Rating: moderate References: Cross-References: CVE-2014-4611 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - lz4.patch security fix for CVE-2014-4611 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-469 - openSUSE 12.3: zypper in -t patch openSUSE-2014-469 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): eet-1.7.8-2.4.1 eet-debuginfo-1.7.8-2.4.1 eet-debugsource-1.7.8-2.4.1 eet-devel-1.7.8-2.4.1 eet-doc-html-1.7.8-2.4.1 eet-examples-1.7.8-2.4.1 libeet1-1.7.8-2.4.1 libeet1-debuginfo-1.7.8-2.4.1 - openSUSE 12.3 (i586 x86_64): eet-1.7.5-2.4.1 eet-debuginfo-1.7.5-2.4.1 eet-debugsource-1.7.5-2.4.1 eet-devel-1.7.5-2.4.1 eet-doc-html-1.7.5-2.4.1 eet-examples-1.7.5-2.4.1 libeet1-1.7.5-2.4.1 libeet1-debuginfo-1.7.5-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-4611.html

1 0

openSUSE-SU-2014:0923-1: moderate: - logrotate: fixed a security issue
by opensuse-security＠opensuse.org 21 Jul '14

21 Jul '14

openSUSE Security Update: - logrotate: fixed a security issue ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0923-1 Rating: moderate References: #862339 #878788 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: - update logrotate config file after switch to systemd (bnc#878788) - added "reload" capability which was lost during switch from sysvinit to systemd - privoxy-3.0.16-networkmanager.systemd.patch: update Networkmanager dispatcher to reload config of privoxy with systemd (bnc#862339) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-467 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): privoxy-3.0.21-2.12.1 privoxy-debuginfo-3.0.21-2.12.1 privoxy-debugsource-3.0.21-2.12.1 privoxy-doc-3.0.21-2.12.1 References: https://bugzilla.novell.com/862339 https://bugzilla.novell.com/878788

1 0

openSUSE-SU-2014:0922-1: moderate: lzo, liblzo-2-2: fix security issue.
by opensuse-security＠opensuse.org 21 Jul '14

21 Jul '14

openSUSE Security Update: lzo, liblzo-2-2: fix security issue. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0922-1 Rating: moderate References: #883947 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: bnc#883947: CVE-2014-4607: lzo: DoS or possible RCE by allowing an attacker to change controllflow Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-463 - openSUSE 12.3: zypper in -t patch openSUSE-2014-463 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): liblzo2-2-2.06-12.4.1 liblzo2-2-debuginfo-2.06-12.4.1 lzo-debugsource-2.06-12.4.1 lzo-devel-2.06-12.4.1 - openSUSE 13.1 (x86_64): liblzo2-2-32bit-2.06-12.4.1 liblzo2-2-debuginfo-32bit-2.06-12.4.1 lzo-devel-32bit-2.06-12.4.1 - openSUSE 12.3 (i586 x86_64): liblzo2-2-2.06-9.4.1 liblzo2-2-debuginfo-2.06-9.4.1 lzo-debugsource-2.06-9.4.1 lzo-devel-2.06-9.4.1 - openSUSE 12.3 (x86_64): liblzo2-2-32bit-2.06-9.4.1 liblzo2-2-debuginfo-32bit-2.06-9.4.1 lzo-devel-32bit-2.06-9.4.1 References: https://bugzilla.novell.com/883947

1 0

openSUSE-SU-2014:0921-1: moderate: dbus-1: fixes several security issues
by opensuse-security＠opensuse.org 21 Jul '14

21 Jul '14

openSUSE Security Update: dbus-1: fixes several security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0921-1 Rating: moderate References: #885241 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: CVE-2014-3532 denial of service in file descriptor passing feature CVE-2014-3533 local denial of service (force system services to exit) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-466 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): dbus-1-1.6.8-2.22.1 dbus-1-debuginfo-1.6.8-2.22.1 dbus-1-debugsource-1.6.8-2.22.1 dbus-1-devel-1.6.8-2.22.1 dbus-1-x11-1.6.8-2.22.1 dbus-1-x11-debuginfo-1.6.8-2.22.1 dbus-1-x11-debugsource-1.6.8-2.22.1 libdbus-1-3-1.6.8-2.22.1 libdbus-1-3-debuginfo-1.6.8-2.22.1 - openSUSE 12.3 (x86_64): dbus-1-32bit-1.6.8-2.22.1 dbus-1-debuginfo-32bit-1.6.8-2.22.1 dbus-1-devel-32bit-1.6.8-2.22.1 libdbus-1-3-32bit-1.6.8-2.22.1 libdbus-1-3-debuginfo-32bit-1.6.8-2.22.1 - openSUSE 12.3 (noarch): dbus-1-devel-doc-1.6.8-2.22.1 References: https://bugzilla.novell.com/885241

1 0

openSUSE-RU-2014:0918-1: aaa_base: remove "text/js" from mime.types
by maintenance＠opensuse.org 18 Jul '14

18 Jul '14

openSUSE Recommended Update: aaa_base: remove "text/js" from mime.types ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0918-1 Rating: low References: #812427 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with aaa_base: - bnc#812427: remove "text/js" from mime.types Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-462 - openSUSE 12.3: zypper in -t patch openSUSE-2014-462 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): aaa_base-13.1-16.42.1 aaa_base-debuginfo-13.1-16.42.1 aaa_base-debugsource-13.1-16.42.1 aaa_base-extras-13.1-16.42.1 aaa_base-malloccheck-13.1-16.42.1 - openSUSE 12.3 (i586 x86_64): aaa_base-12.3-14.22.1 aaa_base-debuginfo-12.3-14.22.1 aaa_base-debugsource-12.3-14.22.1 aaa_base-extras-12.3-14.22.1 aaa_base-malloccheck-12.3-14.22.1 References: https://bugzilla.novell.com/812427

1 0

openSUSE-RU-2014:0914-1: mkinitrd: Make booting from bcache devices possible
by maintenance＠opensuse.org 17 Jul '14

17 Jul '14

openSUSE Recommended Update: mkinitrd: Make booting from bcache devices possible ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0914-1 Rating: low References: #880845 #880846 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with mkinitrd: - bnc#880846: Make booting from bcache devices possible - bnc#880845: Fixes mkinitrd failures with bcache device present Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-461 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): mkinitrd-2.8.1-5.1 mkinitrd-debuginfo-2.8.1-5.1 mkinitrd-debugsource-2.8.1-5.1 References: https://bugzilla.novell.com/880845 https://bugzilla.novell.com/880846

1 0

openSUSE-SU-2014:0913-1: critical: flash-player
by opensuse-security＠opensuse.org 17 Jul '14

17 Jul '14

openSUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0913-1 Rating: critical References: #886472 Cross-References: CVE-2014-0537 CVE-2014-0539 CVE-2014-4671 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: - Security update to 11.2.202.394 (bnc#886472): * APSB14-17, CVE-2014-0537, CVE-2014-0539, CVE-2014-4671 - License update (LICENSE -> Flash%20Player_14.0.pdf). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-70 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.394-119.1 flash-player-gnome-11.2.202.394-119.1 flash-player-kde4-11.2.202.394-119.1 References: http://support.novell.com/security/cve/CVE-2014-0537.html http://support.novell.com/security/cve/CVE-2014-0539.html http://support.novell.com/security/cve/CVE-2014-4671.html https://bugzilla.novell.com/886472

1 0

openSUSE-SU-2014:0903-1: critical: flash-player
by opensuse-security＠opensuse.org 16 Jul '14

16 Jul '14

openSUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0903-1 Rating: critical References: #886472 Cross-References: CVE-2014-0537 CVE-2014-0539 CVE-2014-4671 Affected Products: openSUSE 13.1:NonFree openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: - Security update to 11.2.202.394 (bnc#886472): * APSB14-17, CVE-2014-0537, CVE-2014-0539, CVE-2014-4671 - License update (LICENSE -> Flash%20Player_14.0.pdf). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2014-460 - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2014-460 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.394-58.1 flash-player-gnome-11.2.202.394-58.1 flash-player-kde4-11.2.202.394-58.1 - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.394-2.84.1 flash-player-gnome-11.2.202.394-2.84.1 flash-player-kde4-11.2.202.394-2.84.1 References: http://support.novell.com/security/cve/CVE-2014-0537.html http://support.novell.com/security/cve/CVE-2014-0539.html http://support.novell.com/security/cve/CVE-2014-4671.html https://bugzilla.novell.com/886472

1 0

openSUSE-RU-2014:0892-1: moderate: openSUSE-build-key: publish extended GPG key
by maintenance＠opensuse.org 14 Jul '14

14 Jul '14

openSUSE Recommended Update: openSUSE-build-key: publish extended GPG key ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0892-1 Rating: moderate References: #886446 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The openSUSE project as shipped on 12.3 and 13.1 has an expiry date of May 2014. In May 2014 we extended the expiry of the key, and the update repositories have already the newer key in repomd.xml.key and autoimported those into existing systems. For fresh installations and for in-system usage, openSUSE-build-key is updated and also includes this extended key now. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-457 - openSUSE 12.3: zypper in -t patch openSUSE-2014-457 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): openSUSE-build-key-1.0-24.4.1 - openSUSE 12.3 (noarch): openSUSE-build-key-1.0-22.4.1 References: https://bugzilla.novell.com/886446

1 0

openSUSE-RU-2014:0891-1: iftop: Update to version 0.99.4
by maintenance＠opensuse.org 14 Jul '14

14 Jul '14

openSUSE Recommended Update: iftop: Update to version 0.99.4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0891-1 Rating: low References: #875625 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This Update fixes the following issues with iftop: - Update to version 0.99 RC 4 (0.99.4) * bnc#875625: fixes memory leakeage * added patch to define the MAC address of the interface as char instead of integer, which results in correct commandline output * added patch to extend the scale[] array up to terabit. 10gbit is not uncommon, 100gbit 40 and 100 gbit are coming, 400 gbit and terabit are future possibilities. * added patch to fix overshooting when calculating the first rateixd * added patch to allow unlimited number of lines in text output, using "iftop -t -L 0" - Update to version 1.0pre4: * Man page documentation of -t mode. * Compile time warning fixes. - Update to version 1.0pre3: * bugs and compilation issues were fixed * a "text output" mode was added. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-459 - openSUSE 12.3: zypper in -t patch openSUSE-2014-459 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): iftop-0.99.4-8.4.1 iftop-debuginfo-0.99.4-8.4.1 iftop-debugsource-0.99.4-8.4.1 - openSUSE 12.3 (i586 x86_64): iftop-0.99.4-5.4.1 iftop-debuginfo-0.99.4-5.4.1 iftop-debugsource-0.99.4-5.4.1 References: https://bugzilla.novell.com/875625

1 0