August 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2014:1074-1: digikam: Fixes flickr upload errors by using ssl
by maintenance＠opensuse.org 29 Aug '14

29 Aug '14

openSUSE Recommended Update: digikam: Fixes flickr upload errors by using ssl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1074-1 Rating: low References: #891629 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with digikam: - kde#336835/bnc#891629: Added patch which uses SSL URL for flickr to fix upload issues Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-521 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (aarch64 armv7hl ppc64): digikam-3.5.0-7.3 digikam-debuginfo-3.5.0-7.3 digikam-debugsource-3.5.0-7.3 kipi-plugins-3.5.0-7.3 kipi-plugins-acquireimage-3.5.0-7.3 kipi-plugins-acquireimage-debuginfo-3.5.0-7.3 kipi-plugins-debuginfo-3.5.0-7.3 kipi-plugins-geolocation-3.5.0-7.3 kipi-plugins-geolocation-debuginfo-3.5.0-7.3 libkface-devel-3.5.0-7.3 libkface2-3.5.0-7.3 libkface2-debuginfo-3.5.0-7.3 libkgeomap-devel-3.5.0-7.3 libkgeomap1-3.5.0-7.3 libkgeomap1-debuginfo-3.5.0-7.3 libmediawiki-devel-3.5.0-7.3 libmediawiki1-3.5.0-7.3 libmediawiki1-debuginfo-3.5.0-7.3 - openSUSE 13.1 (noarch): digikam-doc-3.5.0-7.3 digikam-lang-3.5.0-7.3 kipi-plugins-lang-3.5.0-7.3 libkgeomap-lang-3.5.0-7.3 References: https://bugzilla.novell.com/891629

1 0

openSUSE-SU-2014:1070-1: moderate: update for python3
by opensuse-security＠opensuse.org 28 Aug '14

28 Aug '14

openSUSE Security Update: update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1070-1 Rating: moderate References: #885882 #886001 Cross-References: CVE-2013-2099 CVE-2014-4650 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This python3 update fixes the following security and non security issues: - CGIHTTPServer filedisclosure and directory traversal through URL-encoded characters (CVE-2014-4650, bnc#885882) - DoS on ssl.match_hostname via a crafted certificate with too many wildcards (CVE-2013-2099, bnc#886001) - fix import_failed hook file names Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-517 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libpython3_3m1_0-3.3.0-6.23.1 libpython3_3m1_0-debuginfo-3.3.0-6.23.1 python3-3.3.0-6.23.1 python3-base-3.3.0-6.23.1 python3-base-debuginfo-3.3.0-6.23.1 python3-base-debugsource-3.3.0-6.23.1 python3-curses-3.3.0-6.23.1 python3-curses-debuginfo-3.3.0-6.23.1 python3-dbm-3.3.0-6.23.1 python3-dbm-debuginfo-3.3.0-6.23.1 python3-debuginfo-3.3.0-6.23.1 python3-debugsource-3.3.0-6.23.1 python3-devel-3.3.0-6.23.1 python3-devel-debuginfo-3.3.0-6.23.1 python3-idle-3.3.0-6.23.1 python3-testsuite-3.3.0-6.23.1 python3-testsuite-debuginfo-3.3.0-6.23.1 python3-tk-3.3.0-6.23.1 python3-tk-debuginfo-3.3.0-6.23.1 python3-tools-3.3.0-6.23.1 - openSUSE 12.3 (x86_64): libpython3_3m1_0-32bit-3.3.0-6.23.1 libpython3_3m1_0-debuginfo-32bit-3.3.0-6.23.1 python3-32bit-3.3.0-6.23.1 python3-base-32bit-3.3.0-6.23.1 python3-base-debuginfo-32bit-3.3.0-6.23.1 python3-debuginfo-32bit-3.3.0-6.23.1 - openSUSE 12.3 (noarch): python3-doc-3.3.0-6.23.1 python3-doc-pdf-3.3.0-6.23.1 References: http://support.novell.com/security/cve/CVE-2013-2099.html http://support.novell.com/security/cve/CVE-2014-4650.html https://bugzilla.novell.com/885882 https://bugzilla.novell.com/886001

1 0

openSUSE-SU-2014:1069-1: moderate: update for phpMyAdmin
by opensuse-security＠opensuse.org 28 Aug '14

28 Aug '14

openSUSE Security Update: update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1069-1 Rating: moderate References: #892401 Cross-References: CVE-2014-4349 CVE-2014-4955 CVE-2014-4986 CVE-2014-4987 CVE-2014-5273 CVE-2014-5274 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This phpMyAdmin update addresses several security and non security issues: - This is a phpMyAdmin version upgrade (bnc#892401): (From 4.1.14.3): * sf#4501 [security] XSS in table browse page (CVE-2014-5273) * sf#4502 [security] Self-XSS in enum value editor (CVE-2014-5273) * sf#4503 [security] Self-XSSes in monitor (CVE-2014-5273) * sf#4505 [security] XSS in view operations page (CVE-2014-5274) * sf#4504 [security] Self-XSS in query charts (CVE-2014-5273) * sf#4517 [security] XSS in relation view (CVE-2014-5273) (From 4.1.14.2): * sf#4488 [security] XSS injection due to unescaped table name (triggers)(CVE-2014-4955) * sf#4492 [security] XSS in AJAX confirmation messages (CVE-2014-4986) * sf#4491 [security] Missing validation for accessing User groups feature (CVE-2014-4987) (From 4.1.14.1): * sf#4464 [security] XSS injection due to unescaped db/table name in navigation hiding (CVE-2014-4349) (From 4.1.14.0 through 4.1.9.0): * Numerous non-security bugfixes are listed at https://github.com/phpmyadmin/phpmyadmin/blob/MAINT_4_1_14/ChangeLog Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-518 - openSUSE 12.3: zypper in -t patch openSUSE-2014-518 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): phpMyAdmin-4.1.14.3-8.1 - openSUSE 12.3 (noarch): phpMyAdmin-4.1.14.3-1.16.1 References: http://support.novell.com/security/cve/CVE-2014-4349.html http://support.novell.com/security/cve/CVE-2014-4955.html http://support.novell.com/security/cve/CVE-2014-4986.html http://support.novell.com/security/cve/CVE-2014-4987.html http://support.novell.com/security/cve/CVE-2014-5273.html http://support.novell.com/security/cve/CVE-2014-5274.html https://bugzilla.novell.com/892401

1 0

openSUSE-RU-2014:1068-1: git-review: Replaces python-git-review and fixes issue with non-english locale
by maintenance＠opensuse.org 28 Aug '14

28 Aug '14

openSUSE Recommended Update: git-review: Replaces python-git-review and fixes issue with non-english locale ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1068-1 Rating: low References: #889147 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with git-review: - replaces old package python-git-review - bnc#889147: Fixes issues with "git-review -s" on non-english locale Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-519 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (noarch): git-review-1.23-1.3 git-review-1.23-3.1 References: https://bugzilla.novell.com/889147

1 0

openSUSE-RU-2014:1067-1: git-review: Version update to 1.24 and fixes issue with non-english locales
by maintenance＠opensuse.org 28 Aug '14

28 Aug '14

openSUSE Recommended Update: git-review: Version update to 1.24 and fixes issue with non-english locales ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1067-1 Rating: low References: #889147 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with git-review: - update to 1.24 * Require python-requests * Update homepage on PyPI * Update requirements to OpenStack's recommendations * Update the README to mention dependencies * Ensure username is set for all tests * Provide nicer user message for missing remote ref * Fix a typo in HACKING.rst * Ignore newline in bp/bug search in commit message * Restrict tests SSH auth to only the provided key * Disable proxies for tests that clone over http * Keep track of gerrit.war and golden_site versions * Fix typo in manpage s/gireview/gitreview/ * Correct git review -l over http(s) - Avoid source Url, we're packaging from git - update to 1.23.61: * Topic: do not use '(detached' when detached * Use gerrit 2.8.5 instead of gerrit 2.6.1 in tests * Allow to specify default scheme in .gitreview file * Correct test_remote to support branchs without upstream * Remove parsing of --help and variants from our code * Python2: fixed UnicodeEncodeError * Skip invalid unicode in commit messages * Git review assumes the wrong ssh default port * Add http(s) protocol support to fetch_review and list_reviews * git-review.1 manpage fix for groff warnings * Fix parsing of SCP-style URLs, as these are valid in Git itself * "git review --setup" failed in Chinese localei * Bump hacking version in requirements * Reduce testr concurrnecy to 2 * Add http(s) protocol support to set_hooks_commit_msg * Add http(s) protocol support to test_remote * Verify if every attached file exists. Attach gerrig.config * Wrap exceptions that occur while running external process * Make Gerrit port and dir selection deterministic * Don't try to attach known_hosts if it's not there * Remove tox locale overrides * Fix the regex for setting topic * Add 2m timeout to tests * Attach Gerrit logs and known_hosts to failed tests * Change test gerrit ssh/http ports offset * Correct .Fl typo WRT --compare in the manual page * Ignore content of merge commits in reporting * Remove empty lines from git log output * Preserve merges when doing a rebase * Split git rev-parse --show-toplevel --git-dir on newline * Prefer .gitconfig username * Add more deterministic port selection for Gerrit * Document source location as git.openstack.org * Implement integration tests * Migrate to pbr * No longer check for new git-review releases - bnc#889147: Retrieve remote pushurl independently of user's locale Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-520 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): git-review-1.24-2.4.1 References: https://bugzilla.novell.com/889147

1 0

openSUSE-RU-2014:1066-1: octave: Fixes runtime dependencies
by maintenance＠opensuse.org 28 Aug '14

28 Aug '14

openSUSE Recommended Update: octave: Fixes runtime dependencies ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1066-1 Rating: low References: #892123 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with octave: - bnc#892123: Fixes runtime dependencies: makeinfo instead of texinfo Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-516 - openSUSE 12.3: zypper in -t patch openSUSE-2014-516 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): octave-3.6.4-6.4.1 octave-debuginfo-3.6.4-6.4.1 octave-debugsource-3.6.4-6.4.1 octave-devel-3.6.4-6.4.1 - openSUSE 13.1 (noarch): octave-doc-3.6.4-6.4.1 - openSUSE 12.3 (i586 x86_64): octave-3.6.3-4.8.1 octave-debuginfo-3.6.3-4.8.1 octave-debugsource-3.6.3-4.8.1 octave-devel-3.6.3-4.8.1 References: https://bugzilla.novell.com/892123

1 0

openSUSE-RU-2014:1062-1: moderate: kernel-firmware: Check for exact microcode filename
by maintenance＠opensuse.org 26 Aug '14

26 Aug '14

openSUSE Recommended Update: kernel-firmware: Check for exact microcode filename ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1062-1 Rating: moderate References: #890098 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with kernel-firmware: - BNC#890098: Check for exact microcode filename and drop hint if no matching binary could be found. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-515 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): kernel-firmware-20130714git-2.21.1 ucode-amd-20130714git-2.21.1 References: https://bugzilla.novell.com/890098

1 0

openSUSE-RU-2014:1061-1: important: kexec-tools: Rebuild against current xen-devel
by maintenance＠opensuse.org 26 Aug '14

26 Aug '14

openSUSE Recommended Update: kexec-tools: Rebuild against current xen-devel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1061-1 Rating: important References: #883686 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with kexec-tools: - bnc#883686: Rebuild against current xen-devel Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-514 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): kexec-tools-2.0.3-5.4.1 kexec-tools-debuginfo-2.0.3-5.4.1 kexec-tools-debugsource-2.0.3-5.4.1 References: https://bugzilla.novell.com/883686

1 0

openSUSE-SU-2014:1060-1: moderate: update for IPython
by opensuse-security＠opensuse.org 23 Aug '14

23 Aug '14

openSUSE Security Update: update for IPython ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1060-1 Rating: moderate References: #887577 Cross-References: CVE-2014-3429 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This IPython update fixes the following security issue: - RCE in IPython Notebook via cross-origin websocket connection (CVE-2014-3429, bnc#887577) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-513 - openSUSE 12.3: zypper in -t patch openSUSE-2014-513 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): python-pyzmq-13.0.0-4.4.1 python-pyzmq-debuginfo-13.0.0-4.4.1 python-pyzmq-debugsource-13.0.0-4.4.1 python-pyzmq-devel-13.0.0-4.4.1 - openSUSE 13.1 (noarch): IPython-0.13.1-4.4.1 IPython-1.0.0-2.4.3 IPython-doc-0.13.1-4.4.1 IPython-doc-1.0.0-2.4.3 - openSUSE 12.3 (noarch): IPython-0.13.1-4.4.1 IPython-doc-0.13.1-4.4.1 python3-IPython-0.13.1-4.4.1 References: http://support.novell.com/security/cve/CVE-2014-3429.html https://bugzilla.novell.com/887577

1 0

openSUSE-SU-2014:1059-1: moderate: update for libserf, subversion
by opensuse-security＠opensuse.org 23 Aug '14

23 Aug '14

openSUSE Security Update: update for libserf, subversion ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1059-1 Rating: moderate References: #889849 #890510 #890511 Cross-References: CVE-2014-3504 CVE-2014-3522 CVE-2014-3528 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This subversion and libserf update fixes several security and non security issues: - subversion: guard against md5 hash collisions when finding cached credentials [bnc#889849] [CVE-2014-3528] - subversion: ra_serf: properly match wildcards in SSL certs. [bnc#890511] [CVE-2014-3522] - libserf: Handle NUL bytes in fields of an X.509 certificate. [bnc#890510] [CVE-2014-3504] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-511 - openSUSE 12.3: zypper in -t patch openSUSE-2014-511 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libserf-1-1-1.3.7-16.1 libserf-1-1-debuginfo-1.3.7-16.1 libserf-debugsource-1.3.7-16.1 libserf-devel-1.3.7-16.1 libsvn_auth_gnome_keyring-1-0-1.8.10-2.29.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.8.10-2.29.1 libsvn_auth_kwallet-1-0-1.8.10-2.29.1 libsvn_auth_kwallet-1-0-debuginfo-1.8.10-2.29.1 subversion-1.8.10-2.29.1 subversion-debuginfo-1.8.10-2.29.1 subversion-debugsource-1.8.10-2.29.1 subversion-devel-1.8.10-2.29.1 subversion-perl-1.8.10-2.29.1 subversion-perl-debuginfo-1.8.10-2.29.1 subversion-python-1.8.10-2.29.1 subversion-python-debuginfo-1.8.10-2.29.1 subversion-ruby-1.8.10-2.29.1 subversion-ruby-debuginfo-1.8.10-2.29.1 subversion-server-1.8.10-2.29.1 subversion-server-debuginfo-1.8.10-2.29.1 subversion-tools-1.8.10-2.29.1 subversion-tools-debuginfo-1.8.10-2.29.1 - openSUSE 13.1 (noarch): subversion-bash-completion-1.8.10-2.29.1 - openSUSE 12.3 (i586 x86_64): libserf-1-0-1.1.1-2.4.1 libserf-1-0-debuginfo-1.1.1-2.4.1 libserf-debugsource-1.1.1-2.4.1 libserf-devel-1.1.1-2.4.1 libsvn_auth_gnome_keyring-1-0-1.7.18-2.36.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.7.18-2.36.1 libsvn_auth_kwallet-1-0-1.7.18-2.36.1 libsvn_auth_kwallet-1-0-debuginfo-1.7.18-2.36.1 subversion-1.7.18-2.36.1 subversion-debuginfo-1.7.18-2.36.1 subversion-debugsource-1.7.18-2.36.1 subversion-devel-1.7.18-2.36.1 subversion-perl-1.7.18-2.36.1 subversion-perl-debuginfo-1.7.18-2.36.1 subversion-python-1.7.18-2.36.1 subversion-python-debuginfo-1.7.18-2.36.1 subversion-server-1.7.18-2.36.1 subversion-server-debuginfo-1.7.18-2.36.1 subversion-tools-1.7.18-2.36.1 subversion-tools-debuginfo-1.7.18-2.36.1 - openSUSE 12.3 (noarch): subversion-bash-completion-1.7.18-2.36.1 References: http://support.novell.com/security/cve/CVE-2014-3504.html http://support.novell.com/security/cve/CVE-2014-3522.html http://support.novell.com/security/cve/CVE-2014-3528.html https://bugzilla.novell.com/889849 https://bugzilla.novell.com/890510 https://bugzilla.novell.com/890511

1 0

openSUSE-SU-2014:1058-1: moderate: libgcrypt: Remediation for side-channel attack on Elgamal encryption subkeys
by opensuse-security＠opensuse.org 23 Aug '14

23 Aug '14

openSUSE Security Update: libgcrypt: Remediation for side-channel attack on Elgamal encryption subkeys ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1058-1 Rating: moderate References: #891018 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: libgcrypt was updated to 1.5.4 to prevent a side-channel attack on Elgamal encryption subkeys. Besides that the following issues were resolved: - Improved performance of RSA, DSA, and Elgamal by using a new exponentiation algorithm. - Fixed a subtle bug in mpi_set_bit which could set spurious bits. - Fixed a bug in an internal division function. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-512 - openSUSE 12.3: zypper in -t patch openSUSE-2014-512 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libgcrypt-debugsource-1.5.4-2.4.1 libgcrypt-devel-1.5.4-2.4.1 libgcrypt-devel-debuginfo-1.5.4-2.4.1 libgcrypt11-1.5.4-2.4.1 libgcrypt11-debuginfo-1.5.4-2.4.1 - openSUSE 13.1 (x86_64): libgcrypt-devel-32bit-1.5.4-2.4.1 libgcrypt-devel-debuginfo-32bit-1.5.4-2.4.1 libgcrypt11-32bit-1.5.4-2.4.1 libgcrypt11-debuginfo-32bit-1.5.4-2.4.1 - openSUSE 12.3 (i586 x86_64): libgcrypt-debugsource-1.5.4-12.8.1 libgcrypt-devel-1.5.4-12.8.1 libgcrypt-devel-debuginfo-1.5.4-12.8.1 libgcrypt11-1.5.4-12.8.1 libgcrypt11-debuginfo-1.5.4-12.8.1 - openSUSE 12.3 (x86_64): libgcrypt-devel-32bit-1.5.4-12.8.1 libgcrypt-devel-debuginfo-32bit-1.5.4-12.8.1 libgcrypt11-32bit-1.5.4-12.8.1 libgcrypt11-debuginfo-32bit-1.5.4-12.8.1 References: https://bugzilla.novell.com/891018

1 0

openSUSE-SU-2014:1052-1: moderate: update for openssl
by opensuse-security＠opensuse.org 21 Aug '14

21 Aug '14

openSUSE Security Update: update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1052-1 Rating: moderate References: #890764 #890765 #890766 #890767 #890768 #890769 #890770 #890771 #890772 Cross-References: CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 CVE-2014-3509 CVE-2014-3510 CVE-2014-3511 CVE-2014-3512 CVE-2014-5139 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This openssl update fixes the following security issues: - openssl 1.0.1i * Information leak in pretty printing functions (CVE-2014-3508) * Crash with SRP ciphersuite in Server Hello message (CVE-2014-5139) * Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509) * Double Free when processing DTLS packets (CVE-2014-3505) * DTLS memory exhaustion (CVE-2014-3506) * DTLS memory leak from zero-length fragments (CVE-2014-3507) * OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510) * OpenSSL TLS protocol downgrade attack (CVE-2014-3511) * SRP buffer overrun (CVE-2014-3512) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-509 - openSUSE 12.3: zypper in -t patch openSUSE-2014-509 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1i-11.52.1 libopenssl1_0_0-1.0.1i-11.52.1 libopenssl1_0_0-debuginfo-1.0.1i-11.52.1 openssl-1.0.1i-11.52.1 openssl-debuginfo-1.0.1i-11.52.1 openssl-debugsource-1.0.1i-11.52.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1i-11.52.1 libopenssl1_0_0-32bit-1.0.1i-11.52.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-11.52.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1i-11.52.1 - openSUSE 12.3 (i586 x86_64): libopenssl-devel-1.0.1i-1.64.1 libopenssl1_0_0-1.0.1i-1.64.1 libopenssl1_0_0-debuginfo-1.0.1i-1.64.1 openssl-1.0.1i-1.64.1 openssl-debuginfo-1.0.1i-1.64.1 openssl-debugsource-1.0.1i-1.64.1 - openSUSE 12.3 (x86_64): libopenssl-devel-32bit-1.0.1i-1.64.1 libopenssl1_0_0-32bit-1.0.1i-1.64.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-1.64.1 - openSUSE 12.3 (noarch): openssl-doc-1.0.1i-1.64.1 References: http://support.novell.com/security/cve/CVE-2014-3505.html http://support.novell.com/security/cve/CVE-2014-3506.html http://support.novell.com/security/cve/CVE-2014-3507.html http://support.novell.com/security/cve/CVE-2014-3508.html http://support.novell.com/security/cve/CVE-2014-3509.html http://support.novell.com/security/cve/CVE-2014-3510.html http://support.novell.com/security/cve/CVE-2014-3511.html http://support.novell.com/security/cve/CVE-2014-3512.html http://support.novell.com/security/cve/CVE-2014-5139.html https://bugzilla.novell.com/890764 https://bugzilla.novell.com/890765 https://bugzilla.novell.com/890766 https://bugzilla.novell.com/890767 https://bugzilla.novell.com/890768 https://bugzilla.novell.com/890769 https://bugzilla.novell.com/890770 https://bugzilla.novell.com/890771 https://bugzilla.novell.com/890772

1 0

openSUSE-SU-2014:1051-1: moderate: - Update to version neutron-2013.2.4.dev84.gbe0c1d1:
by opensuse-security＠opensuse.org 21 Aug '14

21 Aug '14

openSUSE Security Update: - Update to version neutron-2013.2.4.dev84.gbe0c1d1: ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1051-1 Rating: moderate References: #874757 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: - Update to version neutron-2013.2.4.dev84.gbe0c1d1: * Fix get_vif_port_by_id to only return relevant ports - Update to version neutron-2013.2.4.dev82.gd1a9a9d: * LBaaS add missing rootwrap filter for route * NVP plugin:fix delete sec group when backend is out of sync * Kill 'Skipping unknown group key: firewall_driver' log trace - Update to version neutron-2013.2.4.dev76.g0397e59: * Added missing plugin .ini files to setup.cfg - Update to version neutron-2013.2.4.dev75.g1859a5a: * OVS lib defer apply doesn't handle concurrency * Fixed floating IP logic in PLUMgrid plugin * tests/unit: Initialize core plugin in TestL3GwModeMixin - Update to version neutron-2013.2.4.dev69.ge5fed48: * Install SNAT rules for ipv4 only - Update to version neutron-2013.2.4.dev68.ge075c5f: * Optionally delete namespaces when they are no longer needed - Update to version neutron-2013.2.4.dev66.g208667b: * l2-population : send flooding entries when the last port goes down * l2-population/lb/vxlan : ip neigh add command failed - Update to version neutron-2013.2.4.dev62.g93a43a6: * Fixes the Hyper-V agent individual ports metrics - Update to version neutron-2013.2.4.dev60.ge312dc7: Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-510 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): python-greenlet-0.4.2-3.4.1 python-greenlet-debuginfo-0.4.2-3.4.1 python-greenlet-debugsource-0.4.2-3.4.1 - openSUSE 13.1 (noarch): openstack-neutron-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-dhcp-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-doc-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-ha-tool-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-hyperv-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-l3-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-lbaas-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-linuxbridge-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-metadata-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-metering-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-mlnx-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-nec-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-openvswitch-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-plugin-cisco-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-ryu-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-server-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-test-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-vmware-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-vpn-agent-2013.2.4.dev86.gb4b09a6-4.1 python-eventlet-0.14.0-2.4.1 python-eventlet-doc-0.14.0-2.4.1 python-greenlet-devel-0.4.2-3.4.1 python-iso8601-0.1.10-6.4.1 python-neutron-2013.2.4.dev86.gb4b09a6-4.1 python-neutronclient-2.3.4-6.1 python-neutronclient-test-2.3.4-6.1 python-py-1.4.22-2.4.1 python-pytest-2.6.0-2.4.1 References: https://bugzilla.novell.com/874757

1 0

openSUSE-SU-2014:1047-1: moderate: update for apache2-mod_security2
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for apache2-mod_security2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1047-1 Rating: moderate References: #871309 Cross-References: CVE-2013-5705 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This is apache2-mod_security2 update fixes the following security issue: - Specially drafted chunked http requests allow to bypass filters configured in mod_security2. This vulnerability is known as CVE-2013-5705 and was handled in bnc#871309. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-501 - openSUSE 12.3: zypper in -t patch openSUSE-2014-501 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-mod_security2-2.8.0-4.4.1 apache2-mod_security2-debuginfo-2.8.0-4.4.1 apache2-mod_security2-debugsource-2.8.0-4.4.1 - openSUSE 12.3 (i586 x86_64): apache2-mod_security2-2.7.5-2.10.1 apache2-mod_security2-debuginfo-2.7.5-2.10.1 apache2-mod_security2-debugsource-2.7.5-2.10.1 References: http://support.novell.com/security/cve/CVE-2013-5705.html https://bugzilla.novell.com/871309

1 0

openSUSE-SU-2014:1046-1: moderate: update for python
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1046-1 Rating: moderate References: #885882 Cross-References: CVE-2014-4650 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python update fixes the following security and non security issues: - CGIHTTPServer file disclosure and directory traversal through URL-encoded characters (CVE-2014-4650, bnc#885882) - remove link count optimizations that are incorrect on btrfs (and possibly other filesystems) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-504 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libpython2_7-1_0-2.7.3-10.20.1 libpython2_7-1_0-debuginfo-2.7.3-10.20.1 python-2.7.3-10.20.1 python-base-2.7.3-10.20.1 python-base-debuginfo-2.7.3-10.20.1 python-base-debugsource-2.7.3-10.20.1 python-curses-2.7.3-10.20.1 python-curses-debuginfo-2.7.3-10.20.1 python-debuginfo-2.7.3-10.20.1 python-debugsource-2.7.3-10.20.1 python-demo-2.7.3-10.20.1 python-devel-2.7.3-10.20.1 python-gdbm-2.7.3-10.20.1 python-gdbm-debuginfo-2.7.3-10.20.1 python-idle-2.7.3-10.20.1 python-tk-2.7.3-10.20.1 python-tk-debuginfo-2.7.3-10.20.1 python-xml-2.7.3-10.20.1 python-xml-debuginfo-2.7.3-10.20.1 - openSUSE 12.3 (x86_64): libpython2_7-1_0-32bit-2.7.3-10.20.1 libpython2_7-1_0-debuginfo-32bit-2.7.3-10.20.1 python-32bit-2.7.3-10.20.1 python-base-32bit-2.7.3-10.20.1 python-base-debuginfo-32bit-2.7.3-10.20.1 python-debuginfo-32bit-2.7.3-10.20.1 - openSUSE 12.3 (noarch): python-doc-2.7-10.20.1 python-doc-pdf-2.7-10.20.1 References: http://support.novell.com/security/cve/CVE-2014-4650.html https://bugzilla.novell.com/885882

1 0

openSUSE-SU-2014:1045-1: moderate: update for apache2
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1045-1 Rating: moderate References: #869105 #869106 #887765 #887768 Cross-References: CVE-2013-6438 CVE-2014-0098 CVE-2014-0226 CVE-2014-0231 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This apache2 update fixes the following security issues: - CRIME types of attack, based on size and timing analysis of compressed content, are now mitigated by the new SSLCompression directive, set to "no" in /etc/apache2/ssl-global.conf - ssl-global.conf: SSLHonorCipherOrder set to on - SSLCipherSuite updates to vhosts.d/vhost-ssl.template and apache2-default-vhost-ssl.conf - new config option CGIDScriptTimeout set to 60s in new file conf.d/cgid-timeout.conf, preventing worker processes hanging forever if a cgi launched from them has stopped reading input from the server. (bnc#887768, CVE-2014-0231) - fix for mod_status race condition in scoreboard handling and consecutive heap overflow and information disclosure if access to mod_status is granted to a potential attacker. (bnc#887765, CVE-2014-0226) - fixed improperly handled whitespace characters in CDATA sections of requests to mod_dav can lead to a crash, resulting in a DoS against the server. (bnc#869105, CVE-2013-6438) - fix for crash in parsing cookie content, resulting in a DoS against the server. (bnc#869106, CVE-2014-0098) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-502 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): apache2-2.2.22-10.12.1 apache2-debuginfo-2.2.22-10.12.1 apache2-debugsource-2.2.22-10.12.1 apache2-devel-2.2.22-10.12.1 apache2-event-2.2.22-10.12.1 apache2-event-debuginfo-2.2.22-10.12.1 apache2-example-pages-2.2.22-10.12.1 apache2-itk-2.2.22-10.12.1 apache2-itk-debuginfo-2.2.22-10.12.1 apache2-prefork-2.2.22-10.12.1 apache2-prefork-debuginfo-2.2.22-10.12.1 apache2-utils-2.2.22-10.12.1 apache2-utils-debuginfo-2.2.22-10.12.1 apache2-worker-2.2.22-10.12.1 apache2-worker-debuginfo-2.2.22-10.12.1 - openSUSE 12.3 (noarch): apache2-doc-2.2.22-10.12.1 References: http://support.novell.com/security/cve/CVE-2013-6438.html http://support.novell.com/security/cve/CVE-2014-0098.html http://support.novell.com/security/cve/CVE-2014-0226.html http://support.novell.com/security/cve/CVE-2014-0231.html https://bugzilla.novell.com/869105 https://bugzilla.novell.com/869106 https://bugzilla.novell.com/887765 https://bugzilla.novell.com/887768

1 0

openSUSE-SU-2014:1044-1: moderate: update for apache2
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1044-1 Rating: moderate References: #869105 #869106 #887765 #887767 #887768 #887771 Cross-References: CVE-2013-4352 CVE-2013-6438 CVE-2014-0098 CVE-2014-0117 CVE-2014-0226 CVE-2014-0231 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This apache2 update fixes the following security issues: - fix for crash in mod_proxy processing specially crafted requests with reverse proxy configurations that results in a crash and a DoS condition for the server. CVE-2014-0117 - new config option CGIDScriptTimeout set to 60s in new file conf.d/cgid-timeout.conf, preventing worker processes hanging forever if a cgi launched from them has stopped reading input from the server (DoS). CVE-2014-0231 - Fix for a NULL pointer dereference in mod_cache that causes a crash in caching forwarding configurations, resulting in a DoS condition. CVE-2013-4352 - fix for crash in parsing cookie content, resulting in a DoS against the server CVE-2014-0098 - fix for mod_status race condition in scoreboard handling and consecutive heap overflow and information disclosure if access to mod_status is granted to a potential attacker. CVE-2014-0226 - fix for improper handling of whitespace characters from CDATA sections to mod_dav, leading to a crash and a DoS condition of the apache server process CVE-2013-6438 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-503 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-2.4.6-6.27.1 apache2-debuginfo-2.4.6-6.27.1 apache2-debugsource-2.4.6-6.27.1 apache2-devel-2.4.6-6.27.1 apache2-event-2.4.6-6.27.1 apache2-event-debuginfo-2.4.6-6.27.1 apache2-example-pages-2.4.6-6.27.1 apache2-prefork-2.4.6-6.27.1 apache2-prefork-debuginfo-2.4.6-6.27.1 apache2-utils-2.4.6-6.27.1 apache2-utils-debuginfo-2.4.6-6.27.1 apache2-worker-2.4.6-6.27.1 apache2-worker-debuginfo-2.4.6-6.27.1 - openSUSE 13.1 (noarch): apache2-doc-2.4.6-6.27.1 References: http://support.novell.com/security/cve/CVE-2013-4352.html http://support.novell.com/security/cve/CVE-2013-6438.html http://support.novell.com/security/cve/CVE-2014-0098.html http://support.novell.com/security/cve/CVE-2014-0117.html http://support.novell.com/security/cve/CVE-2014-0226.html http://support.novell.com/security/cve/CVE-2014-0231.html https://bugzilla.novell.com/869105 https://bugzilla.novell.com/869106 https://bugzilla.novell.com/887765 https://bugzilla.novell.com/887767 https://bugzilla.novell.com/887768 https://bugzilla.novell.com/887771

1 0

openSUSE-SU-2014:1043-1: moderate: update for krb5, krb5-doc, krb5-mini
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for krb5, krb5-doc, krb5-mini ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1043-1 Rating: moderate References: #891082 Cross-References: CVE-2014-4345 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Thit MIT krb5 update fixes the following security issue: - buffer overrun in kadmind with LDAP backend (bnc#891082, CVE-2014-4345) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-508 - openSUSE 12.3: zypper in -t patch openSUSE-2014-508 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): krb5-1.11.3-3.12.1 krb5-client-1.11.3-3.12.1 krb5-client-debuginfo-1.11.3-3.12.1 krb5-debuginfo-1.11.3-3.12.1 krb5-debugsource-1.11.3-3.12.1 krb5-devel-1.11.3-3.12.1 krb5-doc-1.11.3-3.12.1 krb5-mini-1.11.3-3.12.1 krb5-mini-debuginfo-1.11.3-3.12.1 krb5-mini-debugsource-1.11.3-3.12.1 krb5-mini-devel-1.11.3-3.12.1 krb5-plugin-kdb-ldap-1.11.3-3.12.1 krb5-plugin-kdb-ldap-debuginfo-1.11.3-3.12.1 krb5-plugin-preauth-pkinit-1.11.3-3.12.1 krb5-plugin-preauth-pkinit-debuginfo-1.11.3-3.12.1 krb5-server-1.11.3-3.12.1 krb5-server-debuginfo-1.11.3-3.12.1 - openSUSE 13.1 (x86_64): krb5-32bit-1.11.3-3.12.1 krb5-debuginfo-32bit-1.11.3-3.12.1 krb5-devel-32bit-1.11.3-3.12.1 - openSUSE 12.3 (i586 x86_64): krb5-1.10.2-10.30.1 krb5-client-1.10.2-10.30.1 krb5-client-debuginfo-1.10.2-10.30.1 krb5-debuginfo-1.10.2-10.30.1 krb5-debugsource-1.10.2-10.30.1 krb5-devel-1.10.2-10.30.1 krb5-mini-1.10.2-10.30.1 krb5-mini-debuginfo-1.10.2-10.30.1 krb5-mini-debugsource-1.10.2-10.30.1 krb5-mini-devel-1.10.2-10.30.1 krb5-plugin-kdb-ldap-1.10.2-10.30.1 krb5-plugin-kdb-ldap-debuginfo-1.10.2-10.30.1 krb5-plugin-preauth-pkinit-1.10.2-10.30.1 krb5-plugin-preauth-pkinit-debuginfo-1.10.2-10.30.1 krb5-server-1.10.2-10.30.1 krb5-server-debuginfo-1.10.2-10.30.1 - openSUSE 12.3 (x86_64): krb5-32bit-1.10.2-10.30.1 krb5-debuginfo-32bit-1.10.2-10.30.1 krb5-devel-32bit-1.10.2-10.30.1 - openSUSE 12.3 (noarch): krb5-doc-1.10.2-10.30.2 References: http://support.novell.com/security/cve/CVE-2014-4345.html https://bugzilla.novell.com/891082

1 0

openSUSE-SU-2014:1042-1: moderate: update for python3
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1042-1 Rating: moderate References: #885882 Cross-References: CVE-2014-4650 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python3 update fixes the following security and non security issues: - CGIHTTPServer file disclosure and directory traversal through URL-encoded characters (CVE-2014-4650, bnc#885882) - fix import_failed hook file names Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-506 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libpython3_3m1_0-3.3.5-5.16.1 libpython3_3m1_0-debuginfo-3.3.5-5.16.1 python3-3.3.5-5.16.1 python3-base-3.3.5-5.16.1 python3-base-debuginfo-3.3.5-5.16.1 python3-base-debugsource-3.3.5-5.16.1 python3-curses-3.3.5-5.16.1 python3-curses-debuginfo-3.3.5-5.16.1 python3-dbm-3.3.5-5.16.1 python3-dbm-debuginfo-3.3.5-5.16.1 python3-debuginfo-3.3.5-5.16.1 python3-debugsource-3.3.5-5.16.1 python3-devel-3.3.5-5.16.1 python3-devel-debuginfo-3.3.5-5.16.1 python3-idle-3.3.5-5.16.1 python3-testsuite-3.3.5-5.16.1 python3-testsuite-debuginfo-3.3.5-5.16.1 python3-tk-3.3.5-5.16.1 python3-tk-debuginfo-3.3.5-5.16.1 python3-tools-3.3.5-5.16.1 - openSUSE 13.1 (x86_64): libpython3_3m1_0-32bit-3.3.5-5.16.1 libpython3_3m1_0-debuginfo-32bit-3.3.5-5.16.1 python3-32bit-3.3.5-5.16.1 python3-base-32bit-3.3.5-5.16.1 python3-base-debuginfo-32bit-3.3.5-5.16.1 python3-debuginfo-32bit-3.3.5-5.16.1 - openSUSE 13.1 (noarch): python3-doc-3.3.5-5.16.1 python3-doc-pdf-3.3.5-5.16.1 References: http://support.novell.com/security/cve/CVE-2014-4650.html https://bugzilla.novell.com/885882

1 0

openSUSE-SU-2014:1041-1: moderate: update for python
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1041-1 Rating: moderate References: #885882 Cross-References: CVE-2014-4650 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python update fixes the following security and no security issues: - CGIHTTPServer file disclosure and directory traversal through URL-encoded characters (CVE-2014-4650, bnc#885882) - remove link count optimizations that are incorrect on btrfs (and possibly other filesystems) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-505 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libpython2_7-1_0-2.7.6-8.14.1 libpython2_7-1_0-debuginfo-2.7.6-8.14.1 python-2.7.6-8.14.1 python-base-2.7.6-8.14.1 python-base-debuginfo-2.7.6-8.14.1 python-base-debugsource-2.7.6-8.14.1 python-curses-2.7.6-8.14.1 python-curses-debuginfo-2.7.6-8.14.1 python-debuginfo-2.7.6-8.14.1 python-debugsource-2.7.6-8.14.1 python-demo-2.7.6-8.14.1 python-devel-2.7.6-8.14.1 python-gdbm-2.7.6-8.14.1 python-gdbm-debuginfo-2.7.6-8.14.1 python-idle-2.7.6-8.14.1 python-tk-2.7.6-8.14.1 python-tk-debuginfo-2.7.6-8.14.1 python-xml-2.7.6-8.14.1 python-xml-debuginfo-2.7.6-8.14.1 - openSUSE 13.1 (x86_64): libpython2_7-1_0-32bit-2.7.6-8.14.1 libpython2_7-1_0-debuginfo-32bit-2.7.6-8.14.1 python-32bit-2.7.6-8.14.1 python-base-32bit-2.7.6-8.14.1 python-base-debuginfo-32bit-2.7.6-8.14.1 python-debuginfo-32bit-2.7.6-8.14.1 - openSUSE 13.1 (noarch): python-doc-2.7.6-8.14.1 python-doc-pdf-2.7.6-8.14.1 References: http://support.novell.com/security/cve/CVE-2014-4650.html https://bugzilla.novell.com/885882

1 0

openSUSE-SU-2014:1040-1: moderate: samba
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1040-1 Rating: moderate References: #865627 #884056 #889429 #889539 #890005 #890008 Cross-References: CVE-2014-3560 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This samba update fixes the following security and non security issues: - Fix winbind service parameter usage; (bnc#890005). - lib/param: change the default for "winbind expand groups" to "0"; (bnc#890008). - Update to 4.1.11. + A malicious browser can send packets that may overwrite the heap of the target nmbd NetBIOS name services daemon; CVE-2014-3560; (bnc#889429). - Fix "net time" segfault; (bso#10728); (bnc#889539). - Update to 4.1.10. + net/doc: Make clear that net vampire is for NT4 domains only; (bso#3263). + dbcheck: Add check and test for various invalid userParameters values; (bso#8077). + s4:dsdb/samldb: Don't allow 'userParameters' to be modified over LDAP for now; (bso#8077). + Simple use case results in "no talloc stackframe around, leaking memory" error; (bso#8449). + s4:dsdb/repl_meta_data: Make sure objectGUID can't be deleted; (bso#9763). + dsdb: Always store and return the userParameters as a array of LE 16-bit values; (bso#10130). + s4:repl_meta_data: fix array assignment in replmd_process_linked_attribute(); (bso#10294). + ldb-samba: fix a memory leak in ldif_canonicalise_objectCategory(); (bso#10469). + dbchecker: Verify and fix broken dn values; (bso#10536). + dsdb: Rename private_data to rootdse_private_data in rootdse; (bso#10582). + s3: libsmbclient: Work around bugs in SLES cifsd and Apple smbx SMB1 servers; (bso#10587). + Fix "PANIC: assert failed at ../source3/smbd/open.c(1582): ret"; (bso#10593). + rid_array used before status checked - segmentation fault due to null pointer dereference; (bso#10627). + Samba won't start on a machine configured with only IPv4; (bso#10653). + msg_channel: Fix a 100% CPU loop; (bso#10663). + s3: smbd: Prevent file truncation on an open that fails with share mode violation; (bso#10671); (bnc#884056). + s3: SMB2: Fix leak of blocking lock records in the database; (bso#10673). + samba-tool: Add --site parameter to provision command; (bso#10674). + smbstatus: Fix an uninitialized variable; (bso#10680). + SMB1 blocking locks can fail notification on unlock, causing client timeout; (bso#10684). + s3: smbd: Locking, fix off-by one calculation in brl_pending_overlap(); (bso#10685). + 'RW2' smbtorture test fails when -N <numprocs> is set to 2 due to the invalid status check in the second client; (bso#10687). + wbcCredentialCache fails if challenge_blob is not first; (bso#10692). + Backport ldb-1.1.17 + changes from master; (bso#10693). + Fix SEGV from improperly formed SUBSTRING/PRESENCE filter; (bso#10693). + ldb: Add a env variable to disable RTLD_DEEPBIND; (bso#10693). + ldb: Do not build libldb-cmdline when using system ldb; (bso#10693). + ldb: Fix 1138330 Dereference null return value, fix CIDs 241329, 240798, 1034791, 1034792 1034910, 1034910); (bso#10693). + ldb: make the successful ldb_transaction_start() message clearer; (bso#10693). + ldb:pyldb: Add some more helper functions for LdbDn; (bso#10693). + ldb: Use of NULL pointer bugfix; (bso#10693). + lib/ldb: Fix compiler warnings; (bso#10693). + pyldb: Decrement ref counters on py_results and quiet warnings; (bso#10693). + s4-openldap: Remove use of talloc_reference in ldb_map_outbound.c; (bso#10693). + dsdb: Return NO_SUCH_OBJECT if a basedn is a deleted object; (bso#10694). + s4:dsdb/extended_dn_in: Don't force DSDB_SEARCH_SHOW_RECYCLED; (bso#10694). + Backport autobuild/selftest fixes from master; (bso#10696). + Backport drs-crackname fixes from master; (bso#10698). + smbd: Avoid double-free in get_print_db_byname; (bso#10699). + Backport access check related fixes from master; (bso#10700). + Backport provision fixes from master; (bso#10703). + s3:smb2_read: let smb2_sendfile_send_data() behave like send_file_readX(); (bso#10706). + s3: Fix missing braces in nfs4_acls.c. - Add missing newline to debug message in daemon_ready(); (bnc#865627). - BuildRequire systemd-devel, configure --with-systemd, and modify the service files accordingly on post-12.2 systems; (bso#10517); (bnc#865627). - Prevent file truncation on an open that fails with share mode violation; (bso#10671); (bnc#884056). Dependend libraries were version updated: libtdb was updated to version 1.3.0. (lots of bugfixes, some new functionality) libtevent was updated to 0.9.21. (lots of bugfixes, some new functionality) libldb was updated to to 1.1.17 (lots of bugfixes, some new functionality) libtalloc was updated to 2.1.1. (lots of bugfixes, some new functionality) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-507 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): ldb-debugsource-1.1.17-3.4.1 ldb-tools-1.1.17-3.4.1 ldb-tools-debuginfo-1.1.17-3.4.1 libdcerpc-atsvc-devel-4.1.11-3.26.1 libdcerpc-atsvc0-4.1.11-3.26.1 libdcerpc-atsvc0-debuginfo-4.1.11-3.26.1 libdcerpc-binding0-4.1.11-3.26.1 libdcerpc-binding0-debuginfo-4.1.11-3.26.1 libdcerpc-devel-4.1.11-3.26.1 libdcerpc-samr-devel-4.1.11-3.26.1 libdcerpc-samr0-4.1.11-3.26.1 libdcerpc-samr0-debuginfo-4.1.11-3.26.1 libdcerpc0-4.1.11-3.26.1 libdcerpc0-debuginfo-4.1.11-3.26.1 libgensec-devel-4.1.11-3.26.1 libgensec0-4.1.11-3.26.1 libgensec0-debuginfo-4.1.11-3.26.1 libldb-devel-1.1.17-3.4.1 libldb-devel-debuginfo-1.1.17-3.4.1 libldb1-1.1.17-3.4.1 libldb1-debuginfo-1.1.17-3.4.1 libndr-devel-4.1.11-3.26.1 libndr-krb5pac-devel-4.1.11-3.26.1 libndr-krb5pac0-4.1.11-3.26.1 libndr-krb5pac0-debuginfo-4.1.11-3.26.1 libndr-nbt-devel-4.1.11-3.26.1 libndr-nbt0-4.1.11-3.26.1 libndr-nbt0-debuginfo-4.1.11-3.26.1 libndr-standard-devel-4.1.11-3.26.1 libndr-standard0-4.1.11-3.26.1 libndr-standard0-debuginfo-4.1.11-3.26.1 libndr0-4.1.11-3.26.1 libndr0-debuginfo-4.1.11-3.26.1 libnetapi-devel-4.1.11-3.26.1 libnetapi0-4.1.11-3.26.1 libnetapi0-debuginfo-4.1.11-3.26.1 libpdb-devel-4.1.11-3.26.1 libpdb0-4.1.11-3.26.1 libpdb0-debuginfo-4.1.11-3.26.1 libregistry-devel-4.1.11-3.26.1 libregistry0-4.1.11-3.26.1 libregistry0-debuginfo-4.1.11-3.26.1 libsamba-credentials-devel-4.1.11-3.26.1 libsamba-credentials0-4.1.11-3.26.1 libsamba-credentials0-debuginfo-4.1.11-3.26.1 libsamba-hostconfig-devel-4.1.11-3.26.1 libsamba-hostconfig0-4.1.11-3.26.1 libsamba-hostconfig0-debuginfo-4.1.11-3.26.1 libsamba-policy-devel-4.1.11-3.26.1 libsamba-policy0-4.1.11-3.26.1 libsamba-policy0-debuginfo-4.1.11-3.26.1 libsamba-util-devel-4.1.11-3.26.1 libsamba-util0-4.1.11-3.26.1 libsamba-util0-debuginfo-4.1.11-3.26.1 libsamdb-devel-4.1.11-3.26.1 libsamdb0-4.1.11-3.26.1 libsamdb0-debuginfo-4.1.11-3.26.1 libsmbclient-devel-4.1.11-3.26.1 libsmbclient-raw-devel-4.1.11-3.26.1 libsmbclient-raw0-4.1.11-3.26.1 libsmbclient-raw0-debuginfo-4.1.11-3.26.1 libsmbclient0-4.1.11-3.26.1 libsmbclient0-debuginfo-4.1.11-3.26.1 libsmbconf-devel-4.1.11-3.26.1 libsmbconf0-4.1.11-3.26.1 libsmbconf0-debuginfo-4.1.11-3.26.1 libsmbldap-devel-4.1.11-3.26.1 libsmbldap0-4.1.11-3.26.1 libsmbldap0-debuginfo-4.1.11-3.26.1 libsmbsharemodes-devel-4.1.11-3.26.1 libsmbsharemodes0-4.1.11-3.26.1 libsmbsharemodes0-debuginfo-4.1.11-3.26.1 libtalloc-devel-2.1.1-7.4.1 libtalloc2-2.1.1-7.4.1 libtalloc2-debuginfo-2.1.1-7.4.1 libtdb-devel-1.3.0-4.4.1 libtdb1-1.3.0-4.4.1 libtdb1-debuginfo-1.3.0-4.4.1 libtevent-devel-0.9.21-4.4.1 libtevent-util-devel-4.1.11-3.26.1 libtevent-util0-4.1.11-3.26.1 libtevent-util0-debuginfo-4.1.11-3.26.1 libtevent0-0.9.21-4.4.1 libtevent0-debuginfo-0.9.21-4.4.1 libwbclient-devel-4.1.11-3.26.1 libwbclient0-4.1.11-3.26.1 libwbclient0-debuginfo-4.1.11-3.26.1 pyldb-1.1.17-3.4.1 pyldb-debuginfo-1.1.17-3.4.1 pyldb-devel-1.1.17-3.4.1 pytalloc-2.1.1-7.4.1 pytalloc-debuginfo-2.1.1-7.4.1 pytalloc-devel-2.1.1-7.4.1 python-tdb-1.3.0-4.4.1 python-tdb-debuginfo-1.3.0-4.4.1 python-tevent-0.9.21-4.4.1 python-tevent-debuginfo-0.9.21-4.4.1 samba-4.1.11-3.26.1 samba-client-4.1.11-3.26.1 samba-client-debuginfo-4.1.11-3.26.1 samba-core-devel-4.1.11-3.26.1 samba-debuginfo-4.1.11-3.26.1 samba-debugsource-4.1.11-3.26.1 samba-libs-4.1.11-3.26.1 samba-libs-debuginfo-4.1.11-3.26.1 samba-pidl-4.1.11-3.26.1 samba-python-4.1.11-3.26.1 samba-python-debuginfo-4.1.11-3.26.1 samba-test-4.1.11-3.26.1 samba-test-debuginfo-4.1.11-3.26.1 samba-test-devel-4.1.11-3.26.1 samba-winbind-4.1.11-3.26.1 samba-winbind-debuginfo-4.1.11-3.26.1 talloc-debugsource-2.1.1-7.4.1 tdb-debugsource-1.3.0-4.4.1 tdb-tools-1.3.0-4.4.1 tdb-tools-debuginfo-1.3.0-4.4.1 tevent-debugsource-0.9.21-4.4.1 - openSUSE 13.1 (x86_64): libdcerpc-atsvc0-32bit-4.1.11-3.26.1 libdcerpc-atsvc0-debuginfo-32bit-4.1.11-3.26.1 libdcerpc-binding0-32bit-4.1.11-3.26.1 libdcerpc-binding0-debuginfo-32bit-4.1.11-3.26.1 libdcerpc-samr0-32bit-4.1.11-3.26.1 libdcerpc-samr0-debuginfo-32bit-4.1.11-3.26.1 libdcerpc0-32bit-4.1.11-3.26.1 libdcerpc0-debuginfo-32bit-4.1.11-3.26.1 libgensec0-32bit-4.1.11-3.26.1 libgensec0-debuginfo-32bit-4.1.11-3.26.1 libldb1-32bit-1.1.17-3.4.1 libldb1-debuginfo-32bit-1.1.17-3.4.1 libndr-krb5pac0-32bit-4.1.11-3.26.1 libndr-krb5pac0-debuginfo-32bit-4.1.11-3.26.1 libndr-nbt0-32bit-4.1.11-3.26.1 libndr-nbt0-debuginfo-32bit-4.1.11-3.26.1 libndr-standard0-32bit-4.1.11-3.26.1 libndr-standard0-debuginfo-32bit-4.1.11-3.26.1 libndr0-32bit-4.1.11-3.26.1 libndr0-debuginfo-32bit-4.1.11-3.26.1 libnetapi0-32bit-4.1.11-3.26.1 libnetapi0-debuginfo-32bit-4.1.11-3.26.1 libpdb0-32bit-4.1.11-3.26.1 libpdb0-debuginfo-32bit-4.1.11-3.26.1 libregistry0-32bit-4.1.11-3.26.1 libregistry0-debuginfo-32bit-4.1.11-3.26.1 libsamba-credentials0-32bit-4.1.11-3.26.1 libsamba-credentials0-debuginfo-32bit-4.1.11-3.26.1 libsamba-hostconfig0-32bit-4.1.11-3.26.1 libsamba-hostconfig0-debuginfo-32bit-4.1.11-3.26.1 libsamba-policy0-32bit-4.1.11-3.26.1 libsamba-policy0-debuginfo-32bit-4.1.11-3.26.1 libsamba-util0-32bit-4.1.11-3.26.1 libsamba-util0-debuginfo-32bit-4.1.11-3.26.1 libsamdb0-32bit-4.1.11-3.26.1 libsamdb0-debuginfo-32bit-4.1.11-3.26.1 libsmbclient-raw0-32bit-4.1.11-3.26.1 libsmbclient-raw0-debuginfo-32bit-4.1.11-3.26.1 libsmbclient0-32bit-4.1.11-3.26.1 libsmbclient0-debuginfo-32bit-4.1.11-3.26.1 libsmbconf0-32bit-4.1.11-3.26.1 libsmbconf0-debuginfo-32bit-4.1.11-3.26.1 libsmbldap0-32bit-4.1.11-3.26.1 libsmbldap0-debuginfo-32bit-4.1.11-3.26.1 libtalloc2-32bit-2.1.1-7.4.1 libtalloc2-debuginfo-32bit-2.1.1-7.4.1 libtdb1-32bit-1.3.0-4.4.1 libtdb1-debuginfo-32bit-1.3.0-4.4.1 libtevent-util0-32bit-4.1.11-3.26.1 libtevent-util0-debuginfo-32bit-4.1.11-3.26.1 libtevent0-32bit-0.9.21-4.4.1 libtevent0-debuginfo-32bit-0.9.21-4.4.1 libwbclient0-32bit-4.1.11-3.26.1 libwbclient0-debuginfo-32bit-4.1.11-3.26.1 pyldb-32bit-1.1.17-3.4.1 pyldb-debuginfo-32bit-1.1.17-3.4.1 pytalloc-32bit-2.1.1-7.4.1 pytalloc-debuginfo-32bit-2.1.1-7.4.1 python-tdb-32bit-1.3.0-4.4.1 python-tdb-debuginfo-32bit-1.3.0-4.4.1 python-tevent-32bit-0.9.21-4.4.1 python-tevent-debuginfo-32bit-0.9.21-4.4.1 samba-32bit-4.1.11-3.26.1 samba-client-32bit-4.1.11-3.26.1 samba-client-debuginfo-32bit-4.1.11-3.26.1 samba-debuginfo-32bit-4.1.11-3.26.1 samba-libs-32bit-4.1.11-3.26.1 samba-libs-debuginfo-32bit-4.1.11-3.26.1 samba-winbind-32bit-4.1.11-3.26.1 samba-winbind-debuginfo-32bit-4.1.11-3.26.1 - openSUSE 13.1 (noarch): samba-doc-4.1.11-3.26.1 References: http://support.novell.com/security/cve/CVE-2014-3560.html https://bugzilla.novell.com/865627 https://bugzilla.novell.com/884056 https://bugzilla.novell.com/889429 https://bugzilla.novell.com/889539 https://bugzilla.novell.com/890005 https://bugzilla.novell.com/890008

1 0

openSUSE-SU-2014:1039-1: moderate: update for gpgme
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for gpgme ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1039-1 Rating: moderate References: #890123 Cross-References: CVE-2014-3564 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This gpgme update to version 1.4.4 fixes the following security and non i security issues: - Fixed possible overflow in gpgsm and uiserver engines. (CVE-2014-3564, bnc#890123) - Fixed possibled segv in gpgme_op_card_edit. - Fixed minor memleaks and possible zombie processes. - Fixed prototype inconsistencies and void pointer arithmetic. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-500 - openSUSE 12.3: zypper in -t patch openSUSE-2014-500 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): gpgme-1.4.4-2.4.1 gpgme-debugsource-1.4.4-2.4.1 libgpgme-devel-1.4.4-2.4.1 libgpgme11-1.4.4-2.4.1 libgpgme11-debuginfo-1.4.4-2.4.1 - openSUSE 13.1 (x86_64): libgpgme11-32bit-1.4.4-2.4.1 libgpgme11-debuginfo-32bit-1.4.4-2.4.1 - openSUSE 12.3 (i586 x86_64): gpgme-1.3.2-2.4.1 gpgme-debugsource-1.3.2-2.4.1 libgpgme-devel-1.3.2-2.4.1 libgpgme11-1.3.2-2.4.1 libgpgme11-debuginfo-1.3.2-2.4.1 - openSUSE 12.3 (x86_64): libgpgme11-32bit-1.3.2-2.4.1 libgpgme11-debuginfo-32bit-1.3.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-3564.html https://bugzilla.novell.com/890123

1 0

openSUSE-SU-2014:1038-1: moderate: update for wireshark
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1038-1 Rating: moderate References: #889899 #889900 #889901 #889906 Cross-References: CVE-2014-5161 CVE-2014-5162 CVE-2014-5163 CVE-2014-5164 CVE-2014-5165 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This wireshark version update to 1.10.9 fixes the following security issues: - fixes several crashes triggered by malformed protocol packages * The Catapult DCT2000 and IrDA dissectors could underrun a buffer wnpa-sec-2014-08 CVE-2014-5161 CVE-2014-5162 (bnc#889901) * The GSM Management dissector could crash wnpa-sec-2014-09 CVE-2014-5163 (bnc#889906) * The RLC dissector could crash wnpa-sec-2014-10 CVE-2014-5164 (bnc#889900) * The ASN.1 BER dissector could crash wnpa-sec-2014-11 CVE-2014-5165 (bnc#889899) - Further bug fixes as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.10.9.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-499 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): wireshark-1.10.9-20.1 wireshark-debuginfo-1.10.9-20.1 wireshark-debugsource-1.10.9-20.1 wireshark-devel-1.10.9-20.1 References: http://support.novell.com/security/cve/CVE-2014-5161.html http://support.novell.com/security/cve/CVE-2014-5162.html http://support.novell.com/security/cve/CVE-2014-5163.html http://support.novell.com/security/cve/CVE-2014-5164.html http://support.novell.com/security/cve/CVE-2014-5165.html https://bugzilla.novell.com/889899 https://bugzilla.novell.com/889900 https://bugzilla.novell.com/889901 https://bugzilla.novell.com/889906

1 0

openSUSE-RU-2014:1031-1: libyui-qt-pkg: Fix display of images in YaST QT's "Symbols" help
by maintenance＠opensuse.org 18 Aug '14

18 Aug '14

openSUSE Recommended Update: libyui-qt-pkg: Fix display of images in YaST QT's "Symbols" help ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1031-1 Rating: low References: #890718 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with libyui-qt-pkg: -bnc#890718: Fix display of images in YaST QT's "Symbols" help Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-497 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libyui-qt-pkg-debugsource-2.42.13-2.4.1 libyui-qt-pkg-devel-2.42.13-2.4.1 libyui-qt-pkg5-2.42.13-2.4.1 libyui-qt-pkg5-debuginfo-2.42.13-2.4.1 - openSUSE 13.1 (noarch): libyui-qt-pkg-doc-2.42.13-2.4.1 References: https://bugzilla.novell.com/890718

1 0

openSUSE-RU-2014:1030-1: libyui-qt-pkg: Fixes display of images in YaST QT's "Symbols" help
by maintenance＠opensuse.org 18 Aug '14

18 Aug '14

openSUSE Recommended Update: libyui-qt-pkg: Fixes display of images in YaST QT's "Symbols" help ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1030-1 Rating: low References: #831758 #890718 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues with libyui-qt-pkg: -bnc#890718: Fixes display of images in YaST QT's "Symbols" help -bnc#831758: added patch to actually install the "Symbols" help images Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-498 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libyui-qt-pkg-debugsource-2.42.5-1.5.1 libyui-qt-pkg-devel-2.42.5-1.5.1 libyui-qt-pkg4-2.42.5-1.5.1 libyui-qt-pkg4-debuginfo-2.42.5-1.5.1 - openSUSE 12.3 (noarch): libyui-qt-pkg-doc-2.42.5-1.5.1 References: https://bugzilla.novell.com/831758 https://bugzilla.novell.com/890718

1 0

openSUSE-SU-2014:1029-1: critical: update for flash-player
by opensuse-security＠opensuse.org 16 Aug '14

16 Aug '14

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1029-1 Rating: critical References: #891688 Cross-References: CVE-2014-0538 CVE-2014-0540 CVE-2014-0541 CVE-2014-0542 CVE-2014-0543 CVE-2014-0544 CVE-2014-0545 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This critical flash-player update fixes the following CVEs: - Security update to 11.2.202.400 (bnc#891688): * APSB14-18, CVE-2014-0538, CVE-2014-0540, CVE-2014-0541, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, CVE-2014-0545 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-75 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.400-123.1 flash-player-gnome-11.2.202.400-123.1 flash-player-kde4-11.2.202.400-123.1 References: http://support.novell.com/security/cve/CVE-2014-0538.html http://support.novell.com/security/cve/CVE-2014-0540.html http://support.novell.com/security/cve/CVE-2014-0541.html http://support.novell.com/security/cve/CVE-2014-0542.html http://support.novell.com/security/cve/CVE-2014-0543.html http://support.novell.com/security/cve/CVE-2014-0544.html http://support.novell.com/security/cve/CVE-2014-0545.html https://bugzilla.novell.com/891688

1 0

openSUSE-RU-2014:1025-1: moderate: Softwarestack update for openSUSE 13.1
by maintenance＠opensuse.org 15 Aug '14

15 Aug '14

openSUSE Recommended Update: Softwarestack update for openSUSE 13.1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1025-1 Rating: moderate References: #883951 #885254 #888919 #889426 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following issues with the Softwarestack: -libzypp: + bnc#888919: * Remove orphaned package caches on refresh * Fix gpg key creation/modification date computation + bnc#885254: Fix wrong '//' when extending URLs with an empty path + updated translations -libzypp-testsuite-tools: +bnc#889426: Also install deptestomatic.noui + Add support for hardware dependencies, multiversion packages. -zypper: + updated translations + bnc#883951: fix zypper.8 man page format Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-495 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libzypp-13.10.4-23.1 libzypp-debuginfo-13.10.4-23.1 libzypp-debugsource-13.10.4-23.1 libzypp-devel-13.10.4-23.1 libzypp-testsuite-tools-4.4.1-2.4.1 zypper-1.9.17-26.1 zypper-debuginfo-1.9.17-26.1 zypper-debugsource-1.9.17-26.1 - openSUSE 13.1 (noarch): zypper-aptitude-1.9.17-26.1 zypper-log-1.9.17-26.1 References: https://bugzilla.novell.com/883951 https://bugzilla.novell.com/885254 https://bugzilla.novell.com/888919 https://bugzilla.novell.com/889426

1 0

openSUSE-RU-2014:1024-1: sg3_utils: Fixed error reversion from openSUSE 12.2
by maintenance＠opensuse.org 15 Aug '14

15 Aug '14

openSUSE Recommended Update: sg3_utils: Fixed error reversion from openSUSE 12.2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1024-1 Rating: low References: #815156 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with sg3_utils: - replaced old files - bnc#815156: removed patch to fix error reversion from openSUSE 12.2 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-496 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libsgutils-devel-1.36-3.4.1 libsgutils2-2-1.36-3.4.1 libsgutils2-2-debuginfo-1.36-3.4.1 sg3_utils-1.36-3.4.1 sg3_utils-debuginfo-1.36-3.4.1 sg3_utils-debugsource-1.36-3.4.1 References: https://bugzilla.novell.com/815156

1 0

openSUSE-SU-2014:1020-1: critical: update for flash-player
by opensuse-security＠opensuse.org 14 Aug '14

14 Aug '14

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1020-1 Rating: critical References: #891688 Cross-References: CVE-2014-0538 CVE-2014-0540 CVE-2014-0541 CVE-2014-0542 CVE-2014-0543 CVE-2014-0544 CVE-2014-0545 Affected Products: openSUSE 13.1:NonFree openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This critical flash-player update fixes the following CVEs: - Security update to 11.2.202.400 (bnc#891688): * APSB14-18, CVE-2014-0538, CVE-2014-0540, CVE-2014-0541, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, CVE-2014-0545 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2014-494 - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2014-494 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.400-62.1 flash-player-gnome-11.2.202.400-62.1 flash-player-kde4-11.2.202.400-62.1 - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.400-2.88.1 flash-player-gnome-11.2.202.400-2.88.1 flash-player-kde4-11.2.202.400-2.88.1 References: http://support.novell.com/security/cve/CVE-2014-0538.html http://support.novell.com/security/cve/CVE-2014-0540.html http://support.novell.com/security/cve/CVE-2014-0541.html http://support.novell.com/security/cve/CVE-2014-0542.html http://support.novell.com/security/cve/CVE-2014-0543.html http://support.novell.com/security/cve/CVE-2014-0544.html http://support.novell.com/security/cve/CVE-2014-0545.html https://bugzilla.novell.com/891688

1 0

openSUSE-SU-2014:0987-1: moderate: cipher upgrade and SNI support for apache2-mod_nss
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: cipher upgrade and SNI support for apache2-mod_nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0987-1 Rating: moderate References: #859439 #863518 #878681 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update introduces Server Name Indication support to mod_nss, which was not available previously. In addition to SNI, GCM ciphers have been added to the cipher list of mod_nss. A bug was corrected that prevented the entry of the certificate store passphrase if such a passphrase was set. Please note that the configuration presets were slightly changed so that the new ciphers are preferred (NSSCipherSuite directive), and the VirtualHost directive is now contained in /etc/apache2/vhosts.d/vhost-nss.templace (not used by apache because not named *.conf). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-74 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-mod_nss-1.0.8-6.1 apache2-mod_nss-debuginfo-1.0.8-6.1 apache2-mod_nss-debugsource-1.0.8-6.1 References: https://bugzilla.novell.com/859439 https://bugzilla.novell.com/863518 https://bugzilla.novell.com/878681

1 0

openSUSE-SU-2014:0986-1: moderate: update exim to version 4.83
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: update exim to version 4.83 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0986-1 Rating: moderate References: #764120 #888520 Cross-References: CVE-2012-5671 CVE-2014-2957 CVE-2014-2972 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This release of Exim includes one incompatible fix: the behavior of expansion of arguments to math comparison functions (<, <=, =, =>, >) was unexpected, expanding the values twice; CVE-2014-2972; (bnc#888520). This update also addresses CVE-2012-5671, CVE-2014-2957, and the bugs 764120 and 888520. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-73 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): exim-4.83-27.1 exim-debuginfo-4.83-27.1 exim-debugsource-4.83-27.1 eximon-4.83-27.1 eximon-debuginfo-4.83-27.1 eximstats-html-4.83-27.1 References: http://support.novell.com/security/cve/CVE-2012-5671.html http://support.novell.com/security/cve/CVE-2014-2957.html http://support.novell.com/security/cve/CVE-2014-2972.html https://bugzilla.novell.com/764120 https://bugzilla.novell.com/888520

1 0

openSUSE-SU-2014:0985-1: important: kernel: security and bugfix update
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0985-1 Rating: important References: #768714 #851686 #855657 #866101 #867531 #867723 #879071 #880484 #882189 #883518 #883724 #883795 #884840 #885422 #885725 #886629 Cross-References: CVE-2014-0100 CVE-2014-0131 CVE-2014-2309 CVE-2014-3917 CVE-2014-4014 CVE-2014-4171 CVE-2014-4508 CVE-2014-4652 CVE-2014-4653 CVE-2014-4654 CVE-2014-4655 CVE-2014-4656 CVE-2014-4667 CVE-2014-4699 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves 14 vulnerabilities and has two fixes is now available. Description: The Linux kernel was updated to fix security issues and bugs: Security issues fixed: CVE-2014-4699: The Linux kernel on Intel processors did not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allowed local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls. CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel did not properly manage a certain backlog value, which allowed remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet. CVE-2014-4171: mm/shmem.c in the Linux kernel did not properly implement the interaction between range notification and hole punching, which allowed local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call. CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. CVE-2014-0100: Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load. CVE-2014-4656: Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function. CVE-2014-4655: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not properly maintain the user_ctl_count value, which allowed local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls. CVE-2014-4654: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allowed local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call. CVE-2014-4653: sound/core/control.c in the ALSA control implementation in the Linux kernel did not ensure possession of a read/write lock, which allowed local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. CVE-2014-4652: Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. CVE-2014-4014: The capabilities implementation in the Linux kernel did not properly consider that namespaces are inapplicable to inodes, which allowed local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root. CVE-2014-2309: The ip6_route_add function in net/ipv6/route.c in the Linux kernel did not properly count the addition of routes, which allowed remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets. CVE-2014-3917: kernel/auditsc.c in the Linux kernel, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allowed local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number. CVE-2014-0131: Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel allowed attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. Bugs fixed: - Don't trigger congestion wait on dirty-but-not-writeout pages (bnc#879071). - via-velocity: fix netif_receive_skb use in irq disabled section (bnc#851686). - HID: logitech-dj: Fix USB 3.0 issue (bnc#886629). - tg3: Change nvram command timeout value to 50ms (bnc#768714 bnc#855657). - tg3: Override clock, link aware and link idle mode during NVRAM dump (bnc#768714 bnc#855657). - tg3: Set the MAC clock to the fastest speed during boot code load (bnc#768714 bnc#855657). - ALSA: usb-audio: Fix deadlocks at resuming (bnc#884840). - ALSA: usb-audio: Save mixer status only once at suspend (bnc#884840). - ALSA: usb-audio: Resume mixer values properly (bnc#884840). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-493 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i686 x86_64): kernel-debug-3.11.10-21.1 kernel-debug-base-3.11.10-21.1 kernel-debug-base-debuginfo-3.11.10-21.1 kernel-debug-debuginfo-3.11.10-21.1 kernel-debug-debugsource-3.11.10-21.1 kernel-debug-devel-3.11.10-21.1 kernel-debug-devel-debuginfo-3.11.10-21.1 kernel-desktop-3.11.10-21.1 kernel-desktop-base-3.11.10-21.1 kernel-desktop-base-debuginfo-3.11.10-21.1 kernel-desktop-debuginfo-3.11.10-21.1 kernel-desktop-debugsource-3.11.10-21.1 kernel-desktop-devel-3.11.10-21.1 kernel-desktop-devel-debuginfo-3.11.10-21.1 kernel-ec2-3.11.10-21.1 kernel-ec2-base-3.11.10-21.1 kernel-ec2-base-debuginfo-3.11.10-21.1 kernel-ec2-debuginfo-3.11.10-21.1 kernel-ec2-debugsource-3.11.10-21.1 kernel-ec2-devel-3.11.10-21.1 kernel-ec2-devel-debuginfo-3.11.10-21.1 kernel-trace-3.11.10-21.1 kernel-trace-base-3.11.10-21.1 kernel-trace-base-debuginfo-3.11.10-21.1 kernel-trace-debuginfo-3.11.10-21.1 kernel-trace-debugsource-3.11.10-21.1 kernel-trace-devel-3.11.10-21.1 kernel-trace-devel-debuginfo-3.11.10-21.1 kernel-vanilla-3.11.10-21.1 kernel-vanilla-debuginfo-3.11.10-21.1 kernel-vanilla-debugsource-3.11.10-21.1 kernel-vanilla-devel-3.11.10-21.1 kernel-vanilla-devel-debuginfo-3.11.10-21.1 kernel-xen-3.11.10-21.1 kernel-xen-base-3.11.10-21.1 kernel-xen-base-debuginfo-3.11.10-21.1 kernel-xen-debuginfo-3.11.10-21.1 kernel-xen-debugsource-3.11.10-21.1 kernel-xen-devel-3.11.10-21.1 kernel-xen-devel-debuginfo-3.11.10-21.1 - openSUSE 13.1 (i586 x86_64): cloop-2.639-11.13.1 cloop-debuginfo-2.639-11.13.1 cloop-debugsource-2.639-11.13.1 cloop-kmp-default-2.639_k3.11.10_21-11.13.1 cloop-kmp-default-debuginfo-2.639_k3.11.10_21-11.13.1 cloop-kmp-desktop-2.639_k3.11.10_21-11.13.1 cloop-kmp-desktop-debuginfo-2.639_k3.11.10_21-11.13.1 cloop-kmp-xen-2.639_k3.11.10_21-11.13.1 cloop-kmp-xen-debuginfo-2.639_k3.11.10_21-11.13.1 crash-7.0.2-2.13.1 crash-debuginfo-7.0.2-2.13.1 crash-debugsource-7.0.2-2.13.1 crash-devel-7.0.2-2.13.1 crash-doc-7.0.2-2.13.1 crash-eppic-7.0.2-2.13.1 crash-eppic-debuginfo-7.0.2-2.13.1 crash-gcore-7.0.2-2.13.1 crash-gcore-debuginfo-7.0.2-2.13.1 crash-kmp-default-7.0.2_k3.11.10_21-2.13.1 crash-kmp-default-debuginfo-7.0.2_k3.11.10_21-2.13.1 crash-kmp-desktop-7.0.2_k3.11.10_21-2.13.1 crash-kmp-desktop-debuginfo-7.0.2_k3.11.10_21-2.13.1 crash-kmp-xen-7.0.2_k3.11.10_21-2.13.1 crash-kmp-xen-debuginfo-7.0.2_k3.11.10_21-2.13.1 hdjmod-debugsource-1.28-16.13.1 hdjmod-kmp-default-1.28_k3.11.10_21-16.13.1 hdjmod-kmp-default-debuginfo-1.28_k3.11.10_21-16.13.1 hdjmod-kmp-desktop-1.28_k3.11.10_21-16.13.1 hdjmod-kmp-desktop-debuginfo-1.28_k3.11.10_21-16.13.1 hdjmod-kmp-xen-1.28_k3.11.10_21-16.13.1 hdjmod-kmp-xen-debuginfo-1.28_k3.11.10_21-16.13.1 ipset-6.21.1-2.17.1 ipset-debuginfo-6.21.1-2.17.1 ipset-debugsource-6.21.1-2.17.1 ipset-devel-6.21.1-2.17.1 ipset-kmp-default-6.21.1_k3.11.10_21-2.17.1 ipset-kmp-default-debuginfo-6.21.1_k3.11.10_21-2.17.1 ipset-kmp-desktop-6.21.1_k3.11.10_21-2.17.1 ipset-kmp-desktop-debuginfo-6.21.1_k3.11.10_21-2.17.1 ipset-kmp-xen-6.21.1_k3.11.10_21-2.17.1 ipset-kmp-xen-debuginfo-6.21.1_k3.11.10_21-2.17.1 iscsitarget-1.4.20.3-13.13.1 iscsitarget-debuginfo-1.4.20.3-13.13.1 iscsitarget-debugsource-1.4.20.3-13.13.1 iscsitarget-kmp-default-1.4.20.3_k3.11.10_21-13.13.1 iscsitarget-kmp-default-debuginfo-1.4.20.3_k3.11.10_21-13.13.1 iscsitarget-kmp-desktop-1.4.20.3_k3.11.10_21-13.13.1 iscsitarget-kmp-desktop-debuginfo-1.4.20.3_k3.11.10_21-13.13.1 iscsitarget-kmp-xen-1.4.20.3_k3.11.10_21-13.13.1 iscsitarget-kmp-xen-debuginfo-1.4.20.3_k3.11.10_21-13.13.1 kernel-default-3.11.10-21.1 kernel-default-base-3.11.10-21.1 kernel-default-base-debuginfo-3.11.10-21.1 kernel-default-debuginfo-3.11.10-21.1 kernel-default-debugsource-3.11.10-21.1 kernel-default-devel-3.11.10-21.1 kernel-default-devel-debuginfo-3.11.10-21.1 kernel-syms-3.11.10-21.1 libipset3-6.21.1-2.17.1 libipset3-debuginfo-6.21.1-2.17.1 ndiswrapper-1.58-13.1 ndiswrapper-debuginfo-1.58-13.1 ndiswrapper-debugsource-1.58-13.1 ndiswrapper-kmp-default-1.58_k3.11.10_21-13.1 ndiswrapper-kmp-default-debuginfo-1.58_k3.11.10_21-13.1 ndiswrapper-kmp-desktop-1.58_k3.11.10_21-13.1 ndiswrapper-kmp-desktop-debuginfo-1.58_k3.11.10_21-13.1 pcfclock-0.44-258.13.1 pcfclock-debuginfo-0.44-258.13.1 pcfclock-debugsource-0.44-258.13.1 pcfclock-kmp-default-0.44_k3.11.10_21-258.13.1 pcfclock-kmp-default-debuginfo-0.44_k3.11.10_21-258.13.1 pcfclock-kmp-desktop-0.44_k3.11.10_21-258.13.1 pcfclock-kmp-desktop-debuginfo-0.44_k3.11.10_21-258.13.1 python-virtualbox-4.2.18-2.18.1 python-virtualbox-debuginfo-4.2.18-2.18.1 vhba-kmp-debugsource-20130607-2.14.1 vhba-kmp-default-20130607_k3.11.10_21-2.14.1 vhba-kmp-default-debuginfo-20130607_k3.11.10_21-2.14.1 vhba-kmp-desktop-20130607_k3.11.10_21-2.14.1 vhba-kmp-desktop-debuginfo-20130607_k3.11.10_21-2.14.1 vhba-kmp-xen-20130607_k3.11.10_21-2.14.1 vhba-kmp-xen-debuginfo-20130607_k3.11.10_21-2.14.1 virtualbox-4.2.18-2.18.1 virtualbox-debuginfo-4.2.18-2.18.1 virtualbox-debugsource-4.2.18-2.18.1 virtualbox-devel-4.2.18-2.18.1 virtualbox-guest-kmp-default-4.2.18_k3.11.10_21-2.18.1 virtualbox-guest-kmp-default-debuginfo-4.2.18_k3.11.10_21-2.18.1 virtualbox-guest-kmp-desktop-4.2.18_k3.11.10_21-2.18.1 virtualbox-guest-kmp-desktop-debuginfo-4.2.18_k3.11.10_21-2.18.1 virtualbox-guest-tools-4.2.18-2.18.1 virtualbox-guest-tools-debuginfo-4.2.18-2.18.1 virtualbox-guest-x11-4.2.18-2.18.1 virtualbox-guest-x11-debuginfo-4.2.18-2.18.1 virtualbox-host-kmp-default-4.2.18_k3.11.10_21-2.18.1 virtualbox-host-kmp-default-debuginfo-4.2.18_k3.11.10_21-2.18.1 virtualbox-host-kmp-desktop-4.2.18_k3.11.10_21-2.18.1 virtualbox-host-kmp-desktop-debuginfo-4.2.18_k3.11.10_21-2.18.1 virtualbox-qt-4.2.18-2.18.1 virtualbox-qt-debuginfo-4.2.18-2.18.1 virtualbox-websrv-4.2.18-2.18.1 virtualbox-websrv-debuginfo-4.2.18-2.18.1 xen-debugsource-4.3.2_01-21.1 xen-devel-4.3.2_01-21.1 xen-kmp-default-4.3.2_01_k3.11.10_21-21.1 xen-kmp-default-debuginfo-4.3.2_01_k3.11.10_21-21.1 xen-kmp-desktop-4.3.2_01_k3.11.10_21-21.1 xen-kmp-desktop-debuginfo-4.3.2_01_k3.11.10_21-21.1 xen-libs-4.3.2_01-21.1 xen-libs-debuginfo-4.3.2_01-21.1 xen-tools-domU-4.3.2_01-21.1 xen-tools-domU-debuginfo-4.3.2_01-21.1 xtables-addons-2.3-2.13.1 xtables-addons-debuginfo-2.3-2.13.1 xtables-addons-debugsource-2.3-2.13.1 xtables-addons-kmp-default-2.3_k3.11.10_21-2.13.1 xtables-addons-kmp-default-debuginfo-2.3_k3.11.10_21-2.13.1 xtables-addons-kmp-desktop-2.3_k3.11.10_21-2.13.1 xtables-addons-kmp-desktop-debuginfo-2.3_k3.11.10_21-2.13.1 xtables-addons-kmp-xen-2.3_k3.11.10_21-2.13.1 xtables-addons-kmp-xen-debuginfo-2.3_k3.11.10_21-2.13.1 - openSUSE 13.1 (noarch): kernel-devel-3.11.10-21.1 kernel-docs-3.11.10-21.3 kernel-source-3.11.10-21.1 kernel-source-vanilla-3.11.10-21.1 - openSUSE 13.1 (x86_64): xen-4.3.2_01-21.1 xen-doc-html-4.3.2_01-21.1 xen-libs-32bit-4.3.2_01-21.1 xen-libs-debuginfo-32bit-4.3.2_01-21.1 xen-tools-4.3.2_01-21.1 xen-tools-debuginfo-4.3.2_01-21.1 xen-xend-tools-4.3.2_01-21.1 xen-xend-tools-debuginfo-4.3.2_01-21.1 - openSUSE 13.1 (i686): kernel-pae-3.11.10-21.1 kernel-pae-base-3.11.10-21.1 kernel-pae-base-debuginfo-3.11.10-21.1 kernel-pae-debuginfo-3.11.10-21.1 kernel-pae-debugsource-3.11.10-21.1 kernel-pae-devel-3.11.10-21.1 kernel-pae-devel-debuginfo-3.11.10-21.1 - openSUSE 13.1 (i586): cloop-kmp-pae-2.639_k3.11.10_21-11.13.1 cloop-kmp-pae-debuginfo-2.639_k3.11.10_21-11.13.1 crash-kmp-pae-7.0.2_k3.11.10_21-2.13.1 crash-kmp-pae-debuginfo-7.0.2_k3.11.10_21-2.13.1 hdjmod-kmp-pae-1.28_k3.11.10_21-16.13.1 hdjmod-kmp-pae-debuginfo-1.28_k3.11.10_21-16.13.1 ipset-kmp-pae-6.21.1_k3.11.10_21-2.17.1 ipset-kmp-pae-debuginfo-6.21.1_k3.11.10_21-2.17.1 iscsitarget-kmp-pae-1.4.20.3_k3.11.10_21-13.13.1 iscsitarget-kmp-pae-debuginfo-1.4.20.3_k3.11.10_21-13.13.1 ndiswrapper-kmp-pae-1.58_k3.11.10_21-13.1 ndiswrapper-kmp-pae-debuginfo-1.58_k3.11.10_21-13.1 pcfclock-kmp-pae-0.44_k3.11.10_21-258.13.1 pcfclock-kmp-pae-debuginfo-0.44_k3.11.10_21-258.13.1 vhba-kmp-pae-20130607_k3.11.10_21-2.14.1 vhba-kmp-pae-debuginfo-20130607_k3.11.10_21-2.14.1 virtualbox-guest-kmp-pae-4.2.18_k3.11.10_21-2.18.1 virtualbox-guest-kmp-pae-debuginfo-4.2.18_k3.11.10_21-2.18.1 virtualbox-host-kmp-pae-4.2.18_k3.11.10_21-2.18.1 virtualbox-host-kmp-pae-debuginfo-4.2.18_k3.11.10_21-2.18.1 xen-kmp-pae-4.3.2_01_k3.11.10_21-21.1 xen-kmp-pae-debuginfo-4.3.2_01_k3.11.10_21-21.1 xtables-addons-kmp-pae-2.3_k3.11.10_21-2.13.1 xtables-addons-kmp-pae-debuginfo-2.3_k3.11.10_21-2.13.1 References: http://support.novell.com/security/cve/CVE-2014-0100.html http://support.novell.com/security/cve/CVE-2014-0131.html http://support.novell.com/security/cve/CVE-2014-2309.html http://support.novell.com/security/cve/CVE-2014-3917.html http://support.novell.com/security/cve/CVE-2014-4014.html http://support.novell.com/security/cve/CVE-2014-4171.html http://support.novell.com/security/cve/CVE-2014-4508.html http://support.novell.com/security/cve/CVE-2014-4652.html http://support.novell.com/security/cve/CVE-2014-4653.html http://support.novell.com/security/cve/CVE-2014-4654.html http://support.novell.com/security/cve/CVE-2014-4655.html http://support.novell.com/security/cve/CVE-2014-4656.html http://support.novell.com/security/cve/CVE-2014-4667.html http://support.novell.com/security/cve/CVE-2014-4699.html https://bugzilla.novell.com/768714 https://bugzilla.novell.com/851686 https://bugzilla.novell.com/855657 https://bugzilla.novell.com/866101 https://bugzilla.novell.com/867531 https://bugzilla.novell.com/867723 https://bugzilla.novell.com/879071 https://bugzilla.novell.com/880484 https://bugzilla.novell.com/882189 https://bugzilla.novell.com/883518 https://bugzilla.novell.com/883724 https://bugzilla.novell.com/883795 https://bugzilla.novell.com/884840 https://bugzilla.novell.com/885422 https://bugzilla.novell.com/885725 https://bugzilla.novell.com/886629

1 0

openSUSE-SU-2014:0984-1: moderate: update for kdirstat
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: update for kdirstat ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0984-1 Rating: moderate References: #868682 Cross-References: CVE-2014-2528 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The following security fixes are fixed in this update: - command injection (CVE-2014-2528) with patch from upstream (bnc#868682) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-489 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): kdirstat-2.4.4-273.4.1 kdirstat-debuginfo-2.4.4-273.4.1 kdirstat-debugsource-2.4.4-273.4.1 References: http://support.novell.com/security/cve/CVE-2014-2528.html https://bugzilla.novell.com/868682

1 0

openSUSE-SU-2014:0983-1: moderate: update for exim
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0983-1 Rating: moderate References: #694798 #695144 #888520 Cross-References: CVE-2011-1407 CVE-2012-5671 CVE-2014-2957 CVE-2014-2972 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Changes in exim: - Silence static checkers; (beo#1506). - update to 4.83 This release of Exim includes one incompatible fix: + the behavior of expansion of arguments to math comparison functions (<, <=, =, =>, >) was unexpected, expanding the values twice; CVE-2014-2972; (bnc#888520) This release contains the following enhancements and bugfixes: + PRDR was promoted from Experimental to mainline + OCSP Stapling was promoted from Experimental to mainline + new Experimental feature Proxy Protocol + new Experimental feature DSN (Delivery Status Notifications) + TLS session improvements + TLS SNI fixes + LDAP enhancements + DMARC fixes (previous CVE-2014-2957) and new $dmarc_domain_policy + several new operations (listextract, utf8clean, md5, sha1) + enforce header formatting with verify=header_names_ascii + new commandline option -oMm + new TLSA dns lookup + new malware "sock" type + cutthrough routing enhancements + logging enhancements + DNSSEC enhancements + exiqgrep enhancements + deprecating non-standard SPF results + build and portability fixes + documentation fixes and enhancements - Verify source tar ball gpg signature. - Refresh exim-enable_ecdh_openssl.patch and strip version number from the patch filename. - exim482-enable_ecdh_openssl.patch: Enable ECDH (elliptic curve diffie hellman) support, taken from http://bugs.exim.org/show_bug.cgi?id=1397 - BuildRequire libopenssl-devel only on SUSE systems. - Fix suse_version condition of the pre- and postun scriptlets. - Call service_add_pre from pre scriptlet on post-12.2 systems. - update to 4.82 - Add -bI: framework, and -bI:sieve for querying sieve capabilities. - Make -n do something, by making it not do something. When combined with -bP, the name of an option is not output. - Added tls_dh_min_bits SMTP transport driver option, only honoured by GnuTLS. - First step towards DNSSEC, provide $sender_host_dnssec for $sender_host_name and config options to manage this, and basic check routines. - DSCP support for outbound connections and control modifier for inbound. - Cyrus SASL: set local and remote IP;port properties for driver. (Only plugin which currently uses this is kerberos4, which nobody should be using, but we should make it available and other future plugins might conceivably use it, even though it would break NAT; stuff *should* be using channel bindings instead). - Handle "exim -L <tag>" to indicate to use syslog with tag as the process name; added for Sendmail compatibility; requires admin caller. Handle -G as equivalent to "control = suppress_local_fixups" (we used to just ignore it); requires trusted caller. Also parse but ignore: -Ac -Am -X<logfile> Bugzilla 1117. - Bugzilla 1258 - Refactor MAIL FROM optional args processing. - Add +smtp_confirmation as a default logging option. - Bugzilla 198 - Implement remove_header ACL modifier. - Bugzilla 1197, 1281, 1283 - Spec typo. - Bugzilla 1290 - Spec grammar fixes. - Bugzilla 1285 - Spec omission, fix docbook errors for spec.txt creation. - Add Experimental DMARC support using libopendmarc libraries. - Fix an out of order global option causing a segfault. Reported to dev mailing list by by Dmitry Isaikin. - Bugzilla 1201 & 304 - New cutthrough-delivery feature, with TLS support. - Support "G" suffix to numbers in ${if comparisons. - Handle smtp transport tls_sni option forced-fail for OpenSSL. - Bugzilla 1196 - Spec examples corrections - Add expansion operators ${listnamed:name} and ${listcount:string} - Add gnutls_allow_auto_pkcs11 option (was originally called gnutls_enable_pkcs11, but renamed to more accurately indicate its function. - Let Linux makefile inherit CFLAGS/CFLAGS_DYNAMIC. Pulled from Debian 30_dontoverridecflags.dpatch by Andreas Metzler. - Add expansion item ${acl {name}{arg}...}, expansion condition "acl {{name}{arg}...}", and optional args on acl condition "acl = name arg..." - Permit multiple router/transport headers_add/remove lines. - Add dnsdb pseudo-lookup "a+" to do an "aaaa" + "a" combination. - Avoid using a waiting database for a single-message-only transport. Performance patch from Paul Fisher. Bugzilla 1262. - Strip leading/trailing newlines from add_header ACL modifier data. Bugzilla 884. - Add $headers_added variable, with content from use of ACL modifier add_header (but not yet added to the message). Bugzilla 199. - Add 8bitmime log_selector, for 8bitmime status on the received line. Pulled from Bugzilla 817 by Wolfgang Breyha. - SECURITY: protect DKIM DNS decoding from remote exploit. CVE-2012-5671 (nb: this is the same fix as in Exim 4.80.1) - Add A= logging on delivery lines, and a client_set_id option on authenticators. - Add optional authenticated_sender logging to A= and a log_selector for control. - Unbreak server_set_id for NTLM/SPA auth, broken by 4.80 PP/29. - Dovecot auth: log better reason to rejectlog if Dovecot did not advertise SMTP AUTH mechanism to us, instead of a generic protocol violation error. Also, make Exim more robust to bad data from the Dovecot auth socket. - Fix ultimate retry timeouts for intermittently deliverable recipients. - When a queue runner is handling a message, Exim first routes the recipient addresses, during which it prunes them based on the retry hints database. After that it attempts to deliver the message to any remaining recipients. It then updates the hints database using the retry rules. - So if a recipient address works intermittently, it can get repeatedly deferred at routing time. The retry hints record remains fresh so the address never reaches the final cutoff time. - This is a fairly common occurrence when a user is bumping up against their storage quota. Exim had some logic in its local delivery code to deal with this. However it did not apply to per-recipient defers in remote deliveries, e.g. over LMTP to a separate IMAP message store. - This change adds a proper retry rule check during routing so that the final cutoff time is checked against the message's age. We only do this check if there is an address retry record and there is not a domain retry record; this implies that previous attempts to handle the address had the retry_use_local_parts option turned on. We use this as an approximation for the destination being like a local delivery, as in LMTP. - I suspect this new check makes the old local delivery cutoff check redundant, but I have not verified this so I left the code in place. - Correct gecos expansion when From: is a prefix of the username. - Test 0254 submits a message to Exim with the header Resent-From: f - When I ran the test suite under the user fanf2, Exim expanded the header to contain my full name, whereas it should have added a Resent-Sender: header. It erroneously treats any prefix of the username as equal to the username. This change corrects that bug. - DCC debug and logging tidyup Error conditions log to paniclog rather than rejectlog. Debug lines prefixed by "DCC: " to remove any ambiguity. - Avoid unnecessary rebuilds of lookup-related code. - Fix OCSP reinitialisation in SNI handling for Exim/TLS as server. Bug spotted by Jeremy Harris; was flawed since initial commit. Would have resulted in OCSP responses post-SNI triggering an Exim NULL dereference and crash. - Add $router_name and $transport_name variables. Bugzilla 308. - Define SIOCGIFCONF_GIVES_ADDR for GNU Hurd. Bug detection, analysis and fix by Samuel Thibault. Bugzilla 1331, Debian bug #698092. - Update eximstats to watch out for senders sending 'HELO [IpAddr]' - SMTP PRDR (http://www.eric-a-hall.com/specs/draft-hall-prdr-00.txt). Server implementation by Todd Lyons, client by JH. Only enabled when compiled with EXPERIMENTAL_PRDR. A new config variable "prdr_enable" controls whether the server advertises the facility. If the client requests PRDR a new acl_data_smtp_prdr ACL is called once for each recipient, after the body content is received and before the acl_smtp_data ACL. The client is controlled by bolth of: a hosts_try_prdr option on the smtp transport, and the server advertisement. Default client logging of deliveries and rejections involving PRDR are flagged with the string "PRDR". - Fix problems caused by timeouts during quit ACLs trying to double fclose(). Diagnosis by Todd Lyons. Update configure.default to handle IPv6 localhost better. Patch by Alain Williams (plus minor tweaks). Bugzilla 880. - OpenSSL made graceful with empty tls_verify_certificates setting. This is now consistent with GnuTLS, and is now documented: the previous undocumented portable approach to treating the option as unset was to force an expansion failure. That still works, and an empty string is now equivalent. - Renamed DNSSEC-enabling option to "dns_dnssec_ok", to make it clearer that Exim is using the DO (DNSSEC OK) EDNS0 resolver flag, not performing validation itself. - Added force_command boolean option to pipe transport. Patch from Nick Koston, of cPanel Inc. - AUTH support on callouts (and hence cutthrough-deliveries). Bugzilla 321, 823. - Added udpsend ACL modifer and hexquote expansion operator - Fix eximon continuous updating with timestamped log-files. Broken in a format-string cleanup in 4.80, missed when I repaired the other false fix of the same issue. Report and fix from Heiko Schlichting. Bugzilla 1363. - Guard LDAP TLS usage against Solaris LDAP variant. Report from Prashanth Katuri. - Support safari_ecdhe_ecdsa_bug for openssl_options. It's SecureTransport, so affects any MacOS clients which use the system-integrated TLS libraries, including email clients. - Fix segfault from trying to fprintf() to a NULL stdio FILE* if using a MIME ACL for non-SMTP local injection. Report and assistance in diagnosis by Warren Baker. - Adjust exiqgrep to be case-insensitive for sender/receiver. - Fix comparisons for 64b. Bugzilla 1385. - Add expansion variable $authenticated_fail_id to keep track of last id that failed so it may be referenced in subsequent ACL's. - Bugzilla 1375 - Prevent TLS rebinding in ldap. Patch provided by Alexander Miroch. - Bugzilla 1382 - Option ldap_require_cert overrides start_tls ldap library initialization, allowing self-signed CA's to be used. Also properly sets require_cert option later in code by using NULL (global ldap config) instead of ldap handle (per session). Bug diagnosis and testing by alxgomz. - Enhanced documentation in the ratelimit.pl script provided in the src/util/ subdirectory. - Bug 1301 - Imported transport SQL logging patch from Axel Rau renamed to Transport Post Delivery Action by Jeremy Harris, as EXPERIMENTAL_TPDA. - Bugzilla 1217 - Redis lookup support has been added. It is only enabled when Exim is compiled with EXPERIMENTAL_REDIS. A new config variable redis_servers = needs to be configured which will be used by the redis lookup. Patch from Warren Baker, of The Packet Hub. - Fix exiqsumm summary for corner case. Patch provided by Richard Hall. - Bugzilla 1289 - Clarify host/ip processing when have errors looking up a hostname or reverse DNS when processing a host list. Used suggestions from multiple comments on this bug. - Bugzilla 1057 - Multiple clamd TCP targets patch from Mark Zealey. - Had previously added a -CONTINUE option to runtest in the test suite. Missed a few lines, added it to make the runtest require no keyboard interaction. - Bugzilla 1402 - Test 533 fails if any part of the path to the test suite contains upper case chars. Make router use caseful_local_part. - Bugzilla 1400 - Add AVOID_GNUTLS_PKCS11 build option. Allows GnuTLS support when GnuTLS has been built with p11-kit. - Add systemd support for openSUSE > 12.2 - Remove some obsolete conditionnal macros - exim.spec forces the use of SSL libraries, so make sure the BuildRequires are there. Also add previously implicit cyrus-sasl back. - Fixed another remote code execution issue (CVE-2011-1407 / bnc#694798) - Fixed STARTTLS command injection (bnc#695144) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-482 - openSUSE 12.3: zypper in -t patch openSUSE-2014-482 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): exim-4.83-6.4.1 exim-debuginfo-4.83-6.4.1 exim-debugsource-4.83-6.4.1 eximon-4.83-6.4.1 eximon-debuginfo-4.83-6.4.1 eximstats-html-4.83-6.4.1 - openSUSE 12.3 (i586 x86_64): exim-4.83-3.4.1 exim-debuginfo-4.83-3.4.1 exim-debugsource-4.83-3.4.1 eximon-4.83-3.4.1 eximon-debuginfo-4.83-3.4.1 eximstats-html-4.83-3.4.1 References: http://support.novell.com/security/cve/CVE-2011-1407.html http://support.novell.com/security/cve/CVE-2012-5671.html http://support.novell.com/security/cve/CVE-2014-2957.html http://support.novell.com/security/cve/CVE-2014-2972.html https://bugzilla.novell.com/694798 https://bugzilla.novell.com/695144 https://bugzilla.novell.com/888520

1 0

openSUSE-SU-2014:0982-1: important: chromium: update to 36.0.1985.125
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: chromium: update to 36.0.1985.125 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0982-1 Rating: important References: #882263 #882264 #882265 #887952 #887955 Cross-References: CVE-2014-3154 CVE-2014-3155 CVE-2014-3156 CVE-2014-3157 CVE-2014-3160 CVE-2014-3162 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: Chromium was updated to version 36.0.1985.125. New Functionality: * Rich Notifications Improvements * An Updated Incognito / Guest NTP design * The addition of a Browser crash recovery bubble * Chrome App Launcher for Linux * Lots of under the hood changes for stability and performance Security Fixes (bnc#887952,bnc#887955): * CVE-2014-3160: Same-Origin-Policy bypass in SVG * CVE-2014-3162: Various fixes from internal audits, fuzzing and other initiatives and 24 more fixes for which no description was given. Packaging changes: * Switch to newer method to retrieve toolchain packages. Dropping the three naclsdk_*tgz files. Everything is now included in the toolchain_linux_x86.tar.bz2 tarball * Add Courgette.tar.xz as that the build process now requires some files from Courgette in order to build succesfully. This does not mean that Courgette is build/delivered. Includes also an update to Chromium 35.0.1916.153 Security fixes (bnc#882264,bnc#882264,bnc#882265,bnc#882263): * CVE-2014-3154: Use-after-free in filesystem api * CVE-2014-3155: Out-of-bounds read in SPDY * CVE-2014-3156: Buffer overflow in clipboard * CVE-2014-3157: Heap overflow in media Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-483 - openSUSE 12.3: zypper in -t patch openSUSE-2014-483 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-36.0.1985.125-41.1 chromedriver-debuginfo-36.0.1985.125-41.1 chromium-36.0.1985.125-41.1 chromium-debuginfo-36.0.1985.125-41.1 chromium-debugsource-36.0.1985.125-41.1 chromium-desktop-gnome-36.0.1985.125-41.1 chromium-desktop-kde-36.0.1985.125-41.1 chromium-ffmpegsumo-36.0.1985.125-41.1 chromium-ffmpegsumo-debuginfo-36.0.1985.125-41.1 chromium-suid-helper-36.0.1985.125-41.1 chromium-suid-helper-debuginfo-36.0.1985.125-41.1 - openSUSE 12.3 (i586 x86_64): chromedriver-36.0.1985.125-1.50.1 chromedriver-debuginfo-36.0.1985.125-1.50.1 chromium-36.0.1985.125-1.50.1 chromium-debuginfo-36.0.1985.125-1.50.1 chromium-debugsource-36.0.1985.125-1.50.1 chromium-desktop-gnome-36.0.1985.125-1.50.1 chromium-desktop-kde-36.0.1985.125-1.50.1 chromium-ffmpegsumo-36.0.1985.125-1.50.1 chromium-ffmpegsumo-debuginfo-36.0.1985.125-1.50.1 chromium-suid-helper-36.0.1985.125-1.50.1 chromium-suid-helper-debuginfo-36.0.1985.125-1.50.1 References: http://support.novell.com/security/cve/CVE-2014-3154.html http://support.novell.com/security/cve/CVE-2014-3155.html http://support.novell.com/security/cve/CVE-2014-3156.html http://support.novell.com/security/cve/CVE-2014-3157.html http://support.novell.com/security/cve/CVE-2014-3160.html http://support.novell.com/security/cve/CVE-2014-3162.html https://bugzilla.novell.com/882263 https://bugzilla.novell.com/882264 https://bugzilla.novell.com/882265 https://bugzilla.novell.com/887952 https://bugzilla.novell.com/887955

1 0

openSUSE-SU-2014:0981-1: moderate: kdelibs4: update to fix a DBUS / PolicyKit checking race condition
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: kdelibs4: update to fix a DBUS / PolicyKit checking race condition ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0981-1 Rating: moderate References: #819437 #864716 Cross-References: CVE-2014-5033 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: KDE4 Libraries and Workspace received a security fix to fix a race condition in DBUS/Polkit authorization, where local attackers could potentially call root KDE services without proper authenticiation. (CVE-2014-5033) Additionaly a interlaced GIF display bug in KHTML was fixed. (kde#330148) This update also includes a kdebase4-workspace minor version update to 4.11.11 with various bugfixes. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-485 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): kde4-kgreeter-plugins-4.11.11-115.3 kde4-kgreeter-plugins-debuginfo-4.11.11-115.3 kdebase4-workspace-4.11.11-115.3 kdebase4-workspace-branding-upstream-4.11.11-115.3 kdebase4-workspace-debuginfo-4.11.11-115.3 kdebase4-workspace-debugsource-4.11.11-115.3 kdebase4-workspace-devel-4.11.11-115.3 kdebase4-workspace-devel-debuginfo-4.11.11-115.3 kdebase4-workspace-ksysguardd-4.11.11-115.3 kdebase4-workspace-ksysguardd-debuginfo-4.11.11-115.3 kdebase4-workspace-liboxygenstyle-4.11.11-115.3 kdebase4-workspace-liboxygenstyle-debuginfo-4.11.11-115.3 kdebase4-workspace-plasma-calendar-4.11.11-115.3 kdebase4-workspace-plasma-calendar-debuginfo-4.11.11-115.3 kdelibs4-4.11.5-484.1 kdelibs4-branding-upstream-4.11.5-484.1 kdelibs4-core-4.11.5-484.1 kdelibs4-core-debuginfo-4.11.5-484.1 kdelibs4-debuginfo-4.11.5-484.1 kdelibs4-debugsource-4.11.5-484.1 kdelibs4-doc-4.11.5-484.1 kdelibs4-doc-debuginfo-4.11.5-484.1 kdm-4.11.11-115.3 kdm-branding-upstream-4.11.11-115.3 kdm-debuginfo-4.11.11-115.3 krandr-4.11.11-115.3 krandr-debuginfo-4.11.11-115.3 kwin-4.11.11-115.3 kwin-debuginfo-4.11.11-115.3 libkde4-4.11.5-484.1 libkde4-debuginfo-4.11.5-484.1 libkde4-devel-4.11.5-484.1 libkdecore4-4.11.5-484.1 libkdecore4-debuginfo-4.11.5-484.1 libkdecore4-devel-4.11.5-484.1 libkdecore4-devel-debuginfo-4.11.5-484.1 libksuseinstall-devel-4.11.5-484.1 libksuseinstall1-4.11.5-484.1 libksuseinstall1-debuginfo-4.11.5-484.1 python-kdebase4-4.11.11-115.3 - openSUSE 13.1 (x86_64): kdebase4-workspace-liboxygenstyle-32bit-4.11.11-115.3 kdebase4-workspace-liboxygenstyle-debuginfo-32bit-4.11.11-115.3 libkde4-32bit-4.11.5-484.1 libkde4-debuginfo-32bit-4.11.5-484.1 libkdecore4-32bit-4.11.5-484.1 libkdecore4-debuginfo-32bit-4.11.5-484.1 libksuseinstall1-32bit-4.11.5-484.1 libksuseinstall1-debuginfo-32bit-4.11.5-484.1 - openSUSE 13.1 (noarch): kdelibs4-apidocs-4.11.5-484.1 References: http://support.novell.com/security/cve/CVE-2014-5033.html https://bugzilla.novell.com/819437 https://bugzilla.novell.com/864716

1 0

openSUSE-SU-2014:0980-1: moderate: transmission
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: transmission ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0980-1 Rating: moderate References: #887079 Cross-References: CVE-2014-4909 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: transmission was updated to fix a peer communication vulnerability (no known exploits). (bnc#887079, CVE-2014-4909). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-484 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): transmission-2.82-2.4.1 transmission-daemon-2.82-2.4.1 transmission-daemon-debuginfo-2.82-2.4.1 transmission-debuginfo-2.82-2.4.1 transmission-debugsource-2.82-2.4.1 transmission-gtk-2.82-2.4.1 transmission-gtk-debuginfo-2.82-2.4.1 transmission-qt-2.82-2.4.1 transmission-qt-debuginfo-2.82-2.4.1 - openSUSE 13.1 (noarch): transmission-common-2.82-2.4.1 transmission-gtk-lang-2.82-2.4.1 transmission-qt-lang-2.82-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-4909.html https://bugzilla.novell.com/887079

1 0

openSUSE-SU-2014:0979-1: moderate: cipher upgrade and SNI support for apache2-mod_nss, bug fixes
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: cipher upgrade and SNI support for apache2-mod_nss, bug fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0979-1 Rating: moderate References: #859439 #863518 #878681 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: apache2-mod_nss is alternative yet not exclusive to mod_nss. This update introduces Server Name Indication support to mod_nss, which was not available previously. In addition to SNI, GCM ciphers have been added to the cipher list of mod_nss. A bug was corrected that prevented the entry of the certificate store passphrase if such a passphrase was set. Please note that the configuration presets were slightly changed so that the new ciphers are preferred (NSSCipherSuite directive), and the VirtualHost directive is now contained in /etc/apache2/vhosts.d/vhost-nss.templace (not used by apache because not named *.conf). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-488 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-mod_nss-1.0.8-6.13.1 apache2-mod_nss-debuginfo-1.0.8-6.13.1 apache2-mod_nss-debugsource-1.0.8-6.13.1 References: https://bugzilla.novell.com/859439 https://bugzilla.novell.com/863518 https://bugzilla.novell.com/878681

1 0

openSUSE-SU-2014:0978-1: moderate: update for jbigkit
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: update for jbigkit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0978-1 Rating: moderate References: #870855 Cross-References: CVE-2013-6369 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The following security issue is fixed in this update - [bnc#870855] - CVE-2013-6369: jbigkit buffer overflow Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-490 - openSUSE 12.3: zypper in -t patch openSUSE-2014-490 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): jbigkit-2.0-10.4.1 jbigkit-debuginfo-2.0-10.4.1 jbigkit-debugsource-2.0-10.4.1 libjbig-devel-2.0-10.4.1 libjbig2-2.0-10.4.1 libjbig2-debuginfo-2.0-10.4.1 - openSUSE 13.1 (x86_64): libjbig-devel-32bit-2.0-10.4.1 libjbig2-32bit-2.0-10.4.1 libjbig2-debuginfo-32bit-2.0-10.4.1 - openSUSE 12.3 (i586 x86_64): jbigkit-2.0-6.4.1 libjbig-devel-2.0-6.4.1 libjbig2-2.0-6.4.1 - openSUSE 12.3 (x86_64): libjbig-devel-32bit-2.0-6.4.1 libjbig2-32bit-2.0-6.4.1 References: http://support.novell.com/security/cve/CVE-2013-6369.html https://bugzilla.novell.com/870855

1 0

openSUSE-SU-2014:0977-1: krb5
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0977-1 Rating: low References: #886016 #888697 Cross-References: CVE-2014-4341 CVE-2014-4342 CVE-2014-4343 CVE-2014-4344 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: The following security isses are fixed in this update: CVE-2014-4341 CVE-2014-4342: denial of service flaws when handling RFC 1964 tokens (bnc#886016) CVE-2014-4343 CVE-2014-4344: multiple flaws in SPNEGO (bnc#888697) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-486 - openSUSE 12.3: zypper in -t patch openSUSE-2014-486 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): krb5-1.11.3-3.8.1 krb5-client-1.11.3-3.8.1 krb5-client-debuginfo-1.11.3-3.8.1 krb5-debuginfo-1.11.3-3.8.1 krb5-debugsource-1.11.3-3.8.1 krb5-devel-1.11.3-3.8.1 krb5-doc-1.11.3-3.8.1 krb5-mini-1.11.3-3.8.1 krb5-mini-debuginfo-1.11.3-3.8.1 krb5-mini-debugsource-1.11.3-3.8.1 krb5-mini-devel-1.11.3-3.8.1 krb5-plugin-kdb-ldap-1.11.3-3.8.1 krb5-plugin-kdb-ldap-debuginfo-1.11.3-3.8.1 krb5-plugin-preauth-pkinit-1.11.3-3.8.1 krb5-plugin-preauth-pkinit-debuginfo-1.11.3-3.8.1 krb5-server-1.11.3-3.8.1 krb5-server-debuginfo-1.11.3-3.8.1 - openSUSE 13.1 (x86_64): krb5-32bit-1.11.3-3.8.1 krb5-debuginfo-32bit-1.11.3-3.8.1 krb5-devel-32bit-1.11.3-3.8.1 - openSUSE 12.3 (i586 x86_64): krb5-1.10.2-10.26.1 krb5-client-1.10.2-10.26.1 krb5-client-debuginfo-1.10.2-10.26.1 krb5-debuginfo-1.10.2-10.26.1 krb5-debugsource-1.10.2-10.26.1 krb5-devel-1.10.2-10.26.1 krb5-mini-1.10.2-10.26.1 krb5-mini-debuginfo-1.10.2-10.26.1 krb5-mini-debugsource-1.10.2-10.26.1 krb5-mini-devel-1.10.2-10.26.1 krb5-plugin-kdb-ldap-1.10.2-10.26.1 krb5-plugin-kdb-ldap-debuginfo-1.10.2-10.26.1 krb5-plugin-preauth-pkinit-1.10.2-10.26.1 krb5-plugin-preauth-pkinit-debuginfo-1.10.2-10.26.1 krb5-server-1.10.2-10.26.1 krb5-server-debuginfo-1.10.2-10.26.1 - openSUSE 12.3 (x86_64): krb5-32bit-1.10.2-10.26.1 krb5-debuginfo-32bit-1.10.2-10.26.1 krb5-devel-32bit-1.10.2-10.26.1 - openSUSE 12.3 (noarch): krb5-doc-1.10.2-10.26.2 References: http://support.novell.com/security/cve/CVE-2014-4341.html http://support.novell.com/security/cve/CVE-2014-4342.html http://support.novell.com/security/cve/CVE-2014-4343.html http://support.novell.com/security/cve/CVE-2014-4344.html https://bugzilla.novell.com/886016 https://bugzilla.novell.com/888697

1 0

openSUSE-SU-2014:0976-1: important: MozillaThunderbird: Update to 24.7.0
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: MozillaThunderbird: Update to 24.7.0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0976-1 Rating: important References: #887746 Cross-References: CVE-2014-1544 CVE-2014-1547 CVE-2014-1548 CVE-2014-1555 CVE-2014-1556 CVE-2014-1557 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: MozillaThunderbird was updated to Thunderbird 24.7.0 (bnc#887746) * MFSA 2014-56/CVE-2014-1547/CVE-2014-1548 Miscellaneous memory safety hazards * MFSA 2014-61/CVE-2014-1555 (bmo#1023121) Use-after-free with FireOnStateChange event * MFSA 2014-62/CVE-2014-1556 (bmo#1028891) Exploitable WebGL crash with Cesium JavaScript library * MFSA 2014-63/CVE-2014-1544 (bmo#963150) Use-after-free while when manipulating certificates in the trusted cache (solved with NSS 3.16.2 requirement) * MFSA 2014-64/CVE-2014-1557 (bmo#913805) Crash in Skia library when scaling high quality images A standalone enigmail 1.7 package that was previously built as part of MozillaThunderbird was added. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-487 - openSUSE 12.3: zypper in -t patch openSUSE-2014-487 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-24.7.0-70.27.1 MozillaThunderbird-buildsymbols-24.7.0-70.27.1 MozillaThunderbird-debuginfo-24.7.0-70.27.1 MozillaThunderbird-debugsource-24.7.0-70.27.1 MozillaThunderbird-devel-24.7.0-70.27.1 MozillaThunderbird-translations-common-24.7.0-70.27.1 MozillaThunderbird-translations-other-24.7.0-70.27.1 enigmail-1.7-2.1 enigmail-debuginfo-1.7-2.1 enigmail-debugsource-1.7-2.1 - openSUSE 12.3 (i586 x86_64): MozillaThunderbird-24.7.0-61.55.1 MozillaThunderbird-buildsymbols-24.7.0-61.55.1 MozillaThunderbird-debuginfo-24.7.0-61.55.1 MozillaThunderbird-debugsource-24.7.0-61.55.1 MozillaThunderbird-devel-24.7.0-61.55.1 MozillaThunderbird-translations-common-24.7.0-61.55.1 MozillaThunderbird-translations-other-24.7.0-61.55.1 enigmail-1.7-2.1 enigmail-debuginfo-1.7-2.1 enigmail-debugsource-1.7-2.1 References: http://support.novell.com/security/cve/CVE-2014-1544.html http://support.novell.com/security/cve/CVE-2014-1547.html http://support.novell.com/security/cve/CVE-2014-1548.html http://support.novell.com/security/cve/CVE-2014-1555.html http://support.novell.com/security/cve/CVE-2014-1556.html http://support.novell.com/security/cve/CVE-2014-1557.html https://bugzilla.novell.com/887746

1 0

openSUSE-SU-2014:0975-1: moderate: update for tor
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0975-1 Rating: moderate References: #889688 Cross-References: CVE-2014-5117 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: - Tor 0.2.4.23 [bnc#889688] [CVE-2014-5117] Slows down the risk from guard rotation and backports several important fixes from the Tor 0.2.5 alpha release series. - Major features: - Clients now look at the "usecreatefast" consensus parameter to decide whether to use CREATE_FAST or CREATE cells for the first hop of their circuit. This approach can improve security on connections where Tor's circuit handshake is stronger than the available TLS connection security levels, but the tradeoff is more computational load on guard relays. - Make the number of entry guards configurable via a new NumEntryGuards consensus parameter, and the number of directory guards configurable via a new NumDirectoryGuards consensus parameter. - Major bugfixes: - Fix a bug in the bounds-checking in the 32-bit curve25519-donna implementation that caused incorrect results on 32-bit implementations when certain malformed inputs were used along with a small class of private ntor keys. - Minor bugfixes: - Warn and drop the circuit if we receive an inbound 'relay early' cell. - Correct a confusing error message when trying to extend a circuit via the control protocol but we don't know a descriptor or microdescriptor for one of the specified relays. - Avoid an illegal read from stack when initializing the TLS module using a version of OpenSSL without all of the ciphers used by the v2 link handshake. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-492 - openSUSE 12.3: zypper in -t patch openSUSE-2014-492 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): tor-0.2.4.23-5.12.1 tor-debuginfo-0.2.4.23-5.12.1 tor-debugsource-0.2.4.23-5.12.1 - openSUSE 12.3 (i586 x86_64): tor-0.2.4.23-2.12.1 tor-debuginfo-0.2.4.23-2.12.1 tor-debugsource-0.2.4.23-2.12.1 References: http://support.novell.com/security/cve/CVE-2014-5117.html https://bugzilla.novell.com/889688

1 0

openSUSE-SU-2014:0974-1: elfutils
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: elfutils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0974-1 Rating: low References: #872785 Cross-References: CVE-2014-0172 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Fix integer overflow in check_section (CVE-2014-0172, bnc#872785) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-491 - openSUSE 12.3: zypper in -t patch openSUSE-2014-491 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): elfutils-0.155-6.4.1 elfutils-debuginfo-0.155-6.4.1 elfutils-debugsource-0.155-6.4.1 libasm-devel-0.155-6.4.1 libasm1-0.155-6.4.1 libasm1-debuginfo-0.155-6.4.1 libdw-devel-0.155-6.4.1 libdw1-0.155-6.4.1 libdw1-debuginfo-0.155-6.4.1 libebl-devel-0.155-6.4.1 libebl1-0.155-6.4.1 libebl1-debuginfo-0.155-6.4.1 libelf-devel-0.155-6.4.1 libelf1-0.155-6.4.1 libelf1-debuginfo-0.155-6.4.1 - openSUSE 13.1 (x86_64): libasm1-32bit-0.155-6.4.1 libasm1-debuginfo-32bit-0.155-6.4.1 libdw1-32bit-0.155-6.4.1 libdw1-debuginfo-32bit-0.155-6.4.1 libebl1-32bit-0.155-6.4.1 libebl1-debuginfo-32bit-0.155-6.4.1 libelf-devel-32bit-0.155-6.4.1 libelf1-32bit-0.155-6.4.1 libelf1-debuginfo-32bit-0.155-6.4.1 - openSUSE 12.3 (i586 x86_64): elfutils-0.155-2.4.1 elfutils-debuginfo-0.155-2.4.1 elfutils-debugsource-0.155-2.4.1 libasm-devel-0.155-2.4.1 libasm1-0.155-2.4.1 libasm1-debuginfo-0.155-2.4.1 libdw-devel-0.155-2.4.1 libdw1-0.155-2.4.1 libdw1-debuginfo-0.155-2.4.1 libebl-devel-0.155-2.4.1 libebl1-0.155-2.4.1 libebl1-debuginfo-0.155-2.4.1 libelf-devel-0.155-2.4.1 libelf1-0.155-2.4.1 libelf1-debuginfo-0.155-2.4.1 - openSUSE 12.3 (x86_64): libasm1-32bit-0.155-2.4.1 libasm1-debuginfo-32bit-0.155-2.4.1 libdw1-32bit-0.155-2.4.1 libdw1-debuginfo-32bit-0.155-2.4.1 libebl1-32bit-0.155-2.4.1 libebl1-debuginfo-32bit-0.155-2.4.1 libelf-devel-32bit-0.155-2.4.1 libelf1-32bit-0.155-2.4.1 libelf1-debuginfo-32bit-0.155-2.4.1 References: http://support.novell.com/security/cve/CVE-2014-0172.html https://bugzilla.novell.com/872785

1 0

openSUSE-RU-2014:0971-1: hunspell: Make hunspell work with emacs and UTF-8
by maintenance＠opensuse.org 08 Aug '14

08 Aug '14

openSUSE Recommended Update: hunspell: Make hunspell work with emacs and UTF-8 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0971-1 Rating: low References: #883505 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with hunspell: -bnc#883505: fixes behaviour in emacs when fed with UTF-8 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-481 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): hunspell-1.3.2-15.4.1 hunspell-debuginfo-1.3.2-15.4.1 hunspell-debugsource-1.3.2-15.4.1 hunspell-devel-1.3.2-15.4.1 hunspell-static-1.3.2-15.4.1 hunspell-tools-1.3.2-15.4.1 hunspell-tools-debuginfo-1.3.2-15.4.1 - openSUSE 13.1 (x86_64): hunspell-32bit-1.3.2-15.4.1 hunspell-debuginfo-32bit-1.3.2-15.4.1 References: https://bugzilla.novell.com/883505

1 0

openSUSE-SU-2014:0969-1: important: security issues addressed, most notably the mod_security heap overflow known as CVE-2014-0226
by opensuse-security＠opensuse.org 07 Aug '14

07 Aug '14

openSUSE Security Update: security issues addressed, most notably the mod_security heap overflow known as CVE-2014-0226 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0969-1 Rating: important References: #859916 #869105 #869106 #871309 #887765 #887768 Cross-References: CVE-2013-5705 CVE-2013-6438 CVE-2014-0098 CVE-2014-0226 CVE-2014-0231 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: apache2: - ECC support was added to mod_ssl - fix for a race condition in mod_status known as CVE-2014-0226 can lead to information disclosure; mod_status is not active by default, and is normally only open for connects from localhost. - fix for bug known as CVE-2014-0098 that can crash the apache process if a specially designed cookie is sent to the server (log_cookie.c) - fix for crash bug in mod_dav known as CVE-2013-6438 - fix for a problem with non-responsive CGI scripts that would otherwise cause the server to stall and deny service. CVE-2014-0231, new configuration parameter CGIDScriptTimeout defaults to 60s. apache2-mod_security2: - specially drafted chunked http requests allow an attacker to bypass filters configured in mod_security2. This vulnerability is known as CVE-2013-5705. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-72 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-2.2.17-80.1 apache2-debuginfo-2.2.17-80.1 apache2-debugsource-2.2.17-80.1 apache2-devel-2.2.17-80.1 apache2-event-2.2.17-80.1 apache2-event-debuginfo-2.2.17-80.1 apache2-example-certificates-2.2.17-80.1 apache2-example-pages-2.2.17-80.1 apache2-itk-2.2.17-80.1 apache2-itk-debuginfo-2.2.17-80.1 apache2-mod_security2-2.7.5-16.1 apache2-mod_security2-debuginfo-2.7.5-16.1 apache2-mod_security2-debugsource-2.7.5-16.1 apache2-prefork-2.2.17-80.1 apache2-prefork-debuginfo-2.2.17-80.1 apache2-utils-2.2.17-80.1 apache2-utils-debuginfo-2.2.17-80.1 apache2-worker-2.2.17-80.1 apache2-worker-debuginfo-2.2.17-80.1 - openSUSE 11.4 (noarch): apache2-doc-2.2.17-80.1 References: http://support.novell.com/security/cve/CVE-2013-5705.html http://support.novell.com/security/cve/CVE-2013-6438.html http://support.novell.com/security/cve/CVE-2014-0098.html http://support.novell.com/security/cve/CVE-2014-0226.html http://support.novell.com/security/cve/CVE-2014-0231.html https://bugzilla.novell.com/859916 https://bugzilla.novell.com/869105 https://bugzilla.novell.com/869106 https://bugzilla.novell.com/871309 https://bugzilla.novell.com/887765 https://bugzilla.novell.com/887768

1 0

openSUSE-RU-2014:0965-1: moderate: NetworkManager: simplify netlink msg validation
by maintenance＠opensuse.org 06 Aug '14

06 Aug '14

openSUSE Recommended Update: NetworkManager: simplify netlink msg validation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0965-1 Rating: moderate References: #888210 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with NetworkManager: - bnc#888210: Simplify netlink msg validation to fix regression with the latest libnl3 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-480 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): NetworkManager-0.9.8.8-4.1 NetworkManager-debuginfo-0.9.8.8-4.1 NetworkManager-debugsource-0.9.8.8-4.1 NetworkManager-devel-0.9.8.8-4.1 libnm-glib-vpn1-0.9.8.8-4.1 libnm-glib-vpn1-debuginfo-0.9.8.8-4.1 libnm-glib4-0.9.8.8-4.1 libnm-glib4-debuginfo-0.9.8.8-4.1 libnm-util2-0.9.8.8-4.1 libnm-util2-debuginfo-0.9.8.8-4.1 typelib-1_0-NMClient-1_0-0.9.8.8-4.1 typelib-1_0-NetworkManager-1_0-0.9.8.8-4.1 - openSUSE 13.1 (x86_64): NetworkManager-devel-32bit-0.9.8.8-4.1 libnm-glib-vpn1-32bit-0.9.8.8-4.1 libnm-glib-vpn1-debuginfo-32bit-0.9.8.8-4.1 libnm-glib4-32bit-0.9.8.8-4.1 libnm-glib4-debuginfo-32bit-0.9.8.8-4.1 libnm-util2-32bit-0.9.8.8-4.1 libnm-util2-debuginfo-32bit-0.9.8.8-4.1 - openSUSE 13.1 (noarch): NetworkManager-lang-0.9.8.8-4.1 References: https://bugzilla.novell.com/888210

1 0

openSUSE-RU-2014:0962-1: at: Introduce switch to specify time format for atq
by maintenance＠opensuse.org 05 Aug '14

05 Aug '14

openSUSE Recommended Update: at: Introduce switch to specify time format for atq ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0962-1 Rating: low References: #879402 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with at: -bnc#879402: Introduced -o switch for atq to specify strftime-like format for displayed list of tasks Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-479 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): at-3.1.13-5.8.1 at-debuginfo-3.1.13-5.8.1 at-debugsource-3.1.13-5.8.1 References: https://bugzilla.novell.com/879402

1 0

openSUSE-SU-2014:0957-1: important: kernel: security and bugfix update
by opensuse-security＠opensuse.org 01 Aug '14

01 Aug '14

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0957-1 Rating: important References: #788080 #867531 #867723 #877257 #880484 #882189 #883518 #883724 #883795 #885422 #885725 Cross-References: CVE-2014-0131 CVE-2014-2309 CVE-2014-3144 CVE-2014-3145 CVE-2014-3917 CVE-2014-4014 CVE-2014-4171 CVE-2014-4508 CVE-2014-4652 CVE-2014-4653 CVE-2014-4654 CVE-2014-4655 CVE-2014-4656 CVE-2014-4667 CVE-2014-4699 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: The Linux Kernel was updated to fix various bugs and security issues. CVE-2014-4699: The Linux kernel on Intel processors did not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allowed local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls. CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel did not properly manage a certain backlog value, which allowed remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet. CVE-2014-4171: mm/shmem.c in the Linux kernel did not properly implement the interaction between range notification and hole punching, which allowed local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call. CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. CVE-2014-4656: Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function. CVE-2014-4655: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not properly maintain the user_ctl_count value, which allowed local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls. CVE-2014-4654: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allowed local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call. CVE-2014-4653: sound/core/control.c in the ALSA control implementation in the Linux kernel did not ensure possession of a read/write lock, which allowed local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. CVE-2014-4652: Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. CVE-2014-4014: The capabilities implementation in the Linux kernel did not properly consider that namespaces are inapplicable to inodes, which allowed local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root. CVE-2014-2309: The ip6_route_add function in net/ipv6/route.c in the Linux kernel did not properly count the addition of routes, which allowed remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets. CVE-2014-3917: kernel/auditsc.c in the Linux kernel, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allowed local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number. CVE-2014-0131: Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel allowed attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. CVE-2014-3144: The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel did not check whether a certain length value is sufficiently large, which allowed local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. CVE-2014-3145: The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel used the reverse order in a certain subtraction, which allowed local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced. Additional Bug fixed: - HID: logitech-dj: Fix USB 3.0 issue (bnc#788080). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-478 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): kernel-default-3.7.10-1.40.1 kernel-default-base-3.7.10-1.40.1 kernel-default-base-debuginfo-3.7.10-1.40.1 kernel-default-debuginfo-3.7.10-1.40.1 kernel-default-debugsource-3.7.10-1.40.1 kernel-default-devel-3.7.10-1.40.1 kernel-default-devel-debuginfo-3.7.10-1.40.1 kernel-syms-3.7.10-1.40.1 - openSUSE 12.3 (i686 x86_64): kernel-debug-3.7.10-1.40.1 kernel-debug-base-3.7.10-1.40.1 kernel-debug-base-debuginfo-3.7.10-1.40.1 kernel-debug-debuginfo-3.7.10-1.40.1 kernel-debug-debugsource-3.7.10-1.40.1 kernel-debug-devel-3.7.10-1.40.1 kernel-debug-devel-debuginfo-3.7.10-1.40.1 kernel-desktop-3.7.10-1.40.1 kernel-desktop-base-3.7.10-1.40.1 kernel-desktop-base-debuginfo-3.7.10-1.40.1 kernel-desktop-debuginfo-3.7.10-1.40.1 kernel-desktop-debugsource-3.7.10-1.40.1 kernel-desktop-devel-3.7.10-1.40.1 kernel-desktop-devel-debuginfo-3.7.10-1.40.1 kernel-ec2-3.7.10-1.40.1 kernel-ec2-base-3.7.10-1.40.1 kernel-ec2-base-debuginfo-3.7.10-1.40.1 kernel-ec2-debuginfo-3.7.10-1.40.1 kernel-ec2-debugsource-3.7.10-1.40.1 kernel-ec2-devel-3.7.10-1.40.1 kernel-ec2-devel-debuginfo-3.7.10-1.40.1 kernel-trace-3.7.10-1.40.1 kernel-trace-base-3.7.10-1.40.1 kernel-trace-base-debuginfo-3.7.10-1.40.1 kernel-trace-debuginfo-3.7.10-1.40.1 kernel-trace-debugsource-3.7.10-1.40.1 kernel-trace-devel-3.7.10-1.40.1 kernel-trace-devel-debuginfo-3.7.10-1.40.1 kernel-vanilla-3.7.10-1.40.1 kernel-vanilla-debuginfo-3.7.10-1.40.1 kernel-vanilla-debugsource-3.7.10-1.40.1 kernel-vanilla-devel-3.7.10-1.40.1 kernel-vanilla-devel-debuginfo-3.7.10-1.40.1 kernel-xen-3.7.10-1.40.1 kernel-xen-base-3.7.10-1.40.1 kernel-xen-base-debuginfo-3.7.10-1.40.1 kernel-xen-debuginfo-3.7.10-1.40.1 kernel-xen-debugsource-3.7.10-1.40.1 kernel-xen-devel-3.7.10-1.40.1 kernel-xen-devel-debuginfo-3.7.10-1.40.1 - openSUSE 12.3 (noarch): kernel-devel-3.7.10-1.40.1 kernel-docs-3.7.10-1.40.2 kernel-source-3.7.10-1.40.1 kernel-source-vanilla-3.7.10-1.40.1 - openSUSE 12.3 (i686): kernel-pae-3.7.10-1.40.1 kernel-pae-base-3.7.10-1.40.1 kernel-pae-base-debuginfo-3.7.10-1.40.1 kernel-pae-debuginfo-3.7.10-1.40.1 kernel-pae-debugsource-3.7.10-1.40.1 kernel-pae-devel-3.7.10-1.40.1 kernel-pae-devel-debuginfo-3.7.10-1.40.1 References: http://support.novell.com/security/cve/CVE-2014-0131.html http://support.novell.com/security/cve/CVE-2014-2309.html http://support.novell.com/security/cve/CVE-2014-3144.html http://support.novell.com/security/cve/CVE-2014-3145.html http://support.novell.com/security/cve/CVE-2014-3917.html http://support.novell.com/security/cve/CVE-2014-4014.html http://support.novell.com/security/cve/CVE-2014-4171.html http://support.novell.com/security/cve/CVE-2014-4508.html http://support.novell.com/security/cve/CVE-2014-4652.html http://support.novell.com/security/cve/CVE-2014-4653.html http://support.novell.com/security/cve/CVE-2014-4654.html http://support.novell.com/security/cve/CVE-2014-4655.html http://support.novell.com/security/cve/CVE-2014-4656.html http://support.novell.com/security/cve/CVE-2014-4667.html http://support.novell.com/security/cve/CVE-2014-4699.html https://bugzilla.novell.com/788080 https://bugzilla.novell.com/867531 https://bugzilla.novell.com/867723 https://bugzilla.novell.com/877257 https://bugzilla.novell.com/880484 https://bugzilla.novell.com/882189 https://bugzilla.novell.com/883518 https://bugzilla.novell.com/883724 https://bugzilla.novell.com/883795 https://bugzilla.novell.com/885422 https://bugzilla.novell.com/885725

1 0