August 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:1058-1: moderate: libgcrypt: Remediation for side-channel attack on Elgamal encryption subkeys
by opensuse-security＠opensuse.org 23 Aug '14

23 Aug '14

openSUSE Security Update: libgcrypt: Remediation for side-channel attack on Elgamal encryption subkeys ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1058-1 Rating: moderate References: #891018 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: libgcrypt was updated to 1.5.4 to prevent a side-channel attack on Elgamal encryption subkeys. Besides that the following issues were resolved: - Improved performance of RSA, DSA, and Elgamal by using a new exponentiation algorithm. - Fixed a subtle bug in mpi_set_bit which could set spurious bits. - Fixed a bug in an internal division function. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-512 - openSUSE 12.3: zypper in -t patch openSUSE-2014-512 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libgcrypt-debugsource-1.5.4-2.4.1 libgcrypt-devel-1.5.4-2.4.1 libgcrypt-devel-debuginfo-1.5.4-2.4.1 libgcrypt11-1.5.4-2.4.1 libgcrypt11-debuginfo-1.5.4-2.4.1 - openSUSE 13.1 (x86_64): libgcrypt-devel-32bit-1.5.4-2.4.1 libgcrypt-devel-debuginfo-32bit-1.5.4-2.4.1 libgcrypt11-32bit-1.5.4-2.4.1 libgcrypt11-debuginfo-32bit-1.5.4-2.4.1 - openSUSE 12.3 (i586 x86_64): libgcrypt-debugsource-1.5.4-12.8.1 libgcrypt-devel-1.5.4-12.8.1 libgcrypt-devel-debuginfo-1.5.4-12.8.1 libgcrypt11-1.5.4-12.8.1 libgcrypt11-debuginfo-1.5.4-12.8.1 - openSUSE 12.3 (x86_64): libgcrypt-devel-32bit-1.5.4-12.8.1 libgcrypt-devel-debuginfo-32bit-1.5.4-12.8.1 libgcrypt11-32bit-1.5.4-12.8.1 libgcrypt11-debuginfo-32bit-1.5.4-12.8.1 References: https://bugzilla.novell.com/891018

1 0

openSUSE-SU-2014:1052-1: moderate: update for openssl
by opensuse-security＠opensuse.org 21 Aug '14

21 Aug '14

openSUSE Security Update: update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1052-1 Rating: moderate References: #890764 #890765 #890766 #890767 #890768 #890769 #890770 #890771 #890772 Cross-References: CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 CVE-2014-3509 CVE-2014-3510 CVE-2014-3511 CVE-2014-3512 CVE-2014-5139 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This openssl update fixes the following security issues: - openssl 1.0.1i * Information leak in pretty printing functions (CVE-2014-3508) * Crash with SRP ciphersuite in Server Hello message (CVE-2014-5139) * Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509) * Double Free when processing DTLS packets (CVE-2014-3505) * DTLS memory exhaustion (CVE-2014-3506) * DTLS memory leak from zero-length fragments (CVE-2014-3507) * OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510) * OpenSSL TLS protocol downgrade attack (CVE-2014-3511) * SRP buffer overrun (CVE-2014-3512) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-509 - openSUSE 12.3: zypper in -t patch openSUSE-2014-509 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1i-11.52.1 libopenssl1_0_0-1.0.1i-11.52.1 libopenssl1_0_0-debuginfo-1.0.1i-11.52.1 openssl-1.0.1i-11.52.1 openssl-debuginfo-1.0.1i-11.52.1 openssl-debugsource-1.0.1i-11.52.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1i-11.52.1 libopenssl1_0_0-32bit-1.0.1i-11.52.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-11.52.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1i-11.52.1 - openSUSE 12.3 (i586 x86_64): libopenssl-devel-1.0.1i-1.64.1 libopenssl1_0_0-1.0.1i-1.64.1 libopenssl1_0_0-debuginfo-1.0.1i-1.64.1 openssl-1.0.1i-1.64.1 openssl-debuginfo-1.0.1i-1.64.1 openssl-debugsource-1.0.1i-1.64.1 - openSUSE 12.3 (x86_64): libopenssl-devel-32bit-1.0.1i-1.64.1 libopenssl1_0_0-32bit-1.0.1i-1.64.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-1.64.1 - openSUSE 12.3 (noarch): openssl-doc-1.0.1i-1.64.1 References: http://support.novell.com/security/cve/CVE-2014-3505.html http://support.novell.com/security/cve/CVE-2014-3506.html http://support.novell.com/security/cve/CVE-2014-3507.html http://support.novell.com/security/cve/CVE-2014-3508.html http://support.novell.com/security/cve/CVE-2014-3509.html http://support.novell.com/security/cve/CVE-2014-3510.html http://support.novell.com/security/cve/CVE-2014-3511.html http://support.novell.com/security/cve/CVE-2014-3512.html http://support.novell.com/security/cve/CVE-2014-5139.html https://bugzilla.novell.com/890764 https://bugzilla.novell.com/890765 https://bugzilla.novell.com/890766 https://bugzilla.novell.com/890767 https://bugzilla.novell.com/890768 https://bugzilla.novell.com/890769 https://bugzilla.novell.com/890770 https://bugzilla.novell.com/890771 https://bugzilla.novell.com/890772

1 0

openSUSE-SU-2014:1051-1: moderate: - Update to version neutron-2013.2.4.dev84.gbe0c1d1:
by opensuse-security＠opensuse.org 21 Aug '14

21 Aug '14

openSUSE Security Update: - Update to version neutron-2013.2.4.dev84.gbe0c1d1: ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1051-1 Rating: moderate References: #874757 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: - Update to version neutron-2013.2.4.dev84.gbe0c1d1: * Fix get_vif_port_by_id to only return relevant ports - Update to version neutron-2013.2.4.dev82.gd1a9a9d: * LBaaS add missing rootwrap filter for route * NVP plugin:fix delete sec group when backend is out of sync * Kill 'Skipping unknown group key: firewall_driver' log trace - Update to version neutron-2013.2.4.dev76.g0397e59: * Added missing plugin .ini files to setup.cfg - Update to version neutron-2013.2.4.dev75.g1859a5a: * OVS lib defer apply doesn't handle concurrency * Fixed floating IP logic in PLUMgrid plugin * tests/unit: Initialize core plugin in TestL3GwModeMixin - Update to version neutron-2013.2.4.dev69.ge5fed48: * Install SNAT rules for ipv4 only - Update to version neutron-2013.2.4.dev68.ge075c5f: * Optionally delete namespaces when they are no longer needed - Update to version neutron-2013.2.4.dev66.g208667b: * l2-population : send flooding entries when the last port goes down * l2-population/lb/vxlan : ip neigh add command failed - Update to version neutron-2013.2.4.dev62.g93a43a6: * Fixes the Hyper-V agent individual ports metrics - Update to version neutron-2013.2.4.dev60.ge312dc7: Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-510 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): python-greenlet-0.4.2-3.4.1 python-greenlet-debuginfo-0.4.2-3.4.1 python-greenlet-debugsource-0.4.2-3.4.1 - openSUSE 13.1 (noarch): openstack-neutron-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-dhcp-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-doc-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-ha-tool-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-hyperv-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-l3-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-lbaas-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-linuxbridge-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-metadata-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-metering-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-mlnx-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-nec-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-openvswitch-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-plugin-cisco-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-ryu-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-server-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-test-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-vmware-agent-2013.2.4.dev86.gb4b09a6-4.1 openstack-neutron-vpn-agent-2013.2.4.dev86.gb4b09a6-4.1 python-eventlet-0.14.0-2.4.1 python-eventlet-doc-0.14.0-2.4.1 python-greenlet-devel-0.4.2-3.4.1 python-iso8601-0.1.10-6.4.1 python-neutron-2013.2.4.dev86.gb4b09a6-4.1 python-neutronclient-2.3.4-6.1 python-neutronclient-test-2.3.4-6.1 python-py-1.4.22-2.4.1 python-pytest-2.6.0-2.4.1 References: https://bugzilla.novell.com/874757

1 0

openSUSE-SU-2014:1047-1: moderate: update for apache2-mod_security2
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for apache2-mod_security2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1047-1 Rating: moderate References: #871309 Cross-References: CVE-2013-5705 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This is apache2-mod_security2 update fixes the following security issue: - Specially drafted chunked http requests allow to bypass filters configured in mod_security2. This vulnerability is known as CVE-2013-5705 and was handled in bnc#871309. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-501 - openSUSE 12.3: zypper in -t patch openSUSE-2014-501 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-mod_security2-2.8.0-4.4.1 apache2-mod_security2-debuginfo-2.8.0-4.4.1 apache2-mod_security2-debugsource-2.8.0-4.4.1 - openSUSE 12.3 (i586 x86_64): apache2-mod_security2-2.7.5-2.10.1 apache2-mod_security2-debuginfo-2.7.5-2.10.1 apache2-mod_security2-debugsource-2.7.5-2.10.1 References: http://support.novell.com/security/cve/CVE-2013-5705.html https://bugzilla.novell.com/871309

1 0

openSUSE-SU-2014:1046-1: moderate: update for python
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1046-1 Rating: moderate References: #885882 Cross-References: CVE-2014-4650 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python update fixes the following security and non security issues: - CGIHTTPServer file disclosure and directory traversal through URL-encoded characters (CVE-2014-4650, bnc#885882) - remove link count optimizations that are incorrect on btrfs (and possibly other filesystems) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-504 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libpython2_7-1_0-2.7.3-10.20.1 libpython2_7-1_0-debuginfo-2.7.3-10.20.1 python-2.7.3-10.20.1 python-base-2.7.3-10.20.1 python-base-debuginfo-2.7.3-10.20.1 python-base-debugsource-2.7.3-10.20.1 python-curses-2.7.3-10.20.1 python-curses-debuginfo-2.7.3-10.20.1 python-debuginfo-2.7.3-10.20.1 python-debugsource-2.7.3-10.20.1 python-demo-2.7.3-10.20.1 python-devel-2.7.3-10.20.1 python-gdbm-2.7.3-10.20.1 python-gdbm-debuginfo-2.7.3-10.20.1 python-idle-2.7.3-10.20.1 python-tk-2.7.3-10.20.1 python-tk-debuginfo-2.7.3-10.20.1 python-xml-2.7.3-10.20.1 python-xml-debuginfo-2.7.3-10.20.1 - openSUSE 12.3 (x86_64): libpython2_7-1_0-32bit-2.7.3-10.20.1 libpython2_7-1_0-debuginfo-32bit-2.7.3-10.20.1 python-32bit-2.7.3-10.20.1 python-base-32bit-2.7.3-10.20.1 python-base-debuginfo-32bit-2.7.3-10.20.1 python-debuginfo-32bit-2.7.3-10.20.1 - openSUSE 12.3 (noarch): python-doc-2.7-10.20.1 python-doc-pdf-2.7-10.20.1 References: http://support.novell.com/security/cve/CVE-2014-4650.html https://bugzilla.novell.com/885882

1 0

openSUSE-SU-2014:1045-1: moderate: update for apache2
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1045-1 Rating: moderate References: #869105 #869106 #887765 #887768 Cross-References: CVE-2013-6438 CVE-2014-0098 CVE-2014-0226 CVE-2014-0231 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This apache2 update fixes the following security issues: - CRIME types of attack, based on size and timing analysis of compressed content, are now mitigated by the new SSLCompression directive, set to "no" in /etc/apache2/ssl-global.conf - ssl-global.conf: SSLHonorCipherOrder set to on - SSLCipherSuite updates to vhosts.d/vhost-ssl.template and apache2-default-vhost-ssl.conf - new config option CGIDScriptTimeout set to 60s in new file conf.d/cgid-timeout.conf, preventing worker processes hanging forever if a cgi launched from them has stopped reading input from the server. (bnc#887768, CVE-2014-0231) - fix for mod_status race condition in scoreboard handling and consecutive heap overflow and information disclosure if access to mod_status is granted to a potential attacker. (bnc#887765, CVE-2014-0226) - fixed improperly handled whitespace characters in CDATA sections of requests to mod_dav can lead to a crash, resulting in a DoS against the server. (bnc#869105, CVE-2013-6438) - fix for crash in parsing cookie content, resulting in a DoS against the server. (bnc#869106, CVE-2014-0098) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-502 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): apache2-2.2.22-10.12.1 apache2-debuginfo-2.2.22-10.12.1 apache2-debugsource-2.2.22-10.12.1 apache2-devel-2.2.22-10.12.1 apache2-event-2.2.22-10.12.1 apache2-event-debuginfo-2.2.22-10.12.1 apache2-example-pages-2.2.22-10.12.1 apache2-itk-2.2.22-10.12.1 apache2-itk-debuginfo-2.2.22-10.12.1 apache2-prefork-2.2.22-10.12.1 apache2-prefork-debuginfo-2.2.22-10.12.1 apache2-utils-2.2.22-10.12.1 apache2-utils-debuginfo-2.2.22-10.12.1 apache2-worker-2.2.22-10.12.1 apache2-worker-debuginfo-2.2.22-10.12.1 - openSUSE 12.3 (noarch): apache2-doc-2.2.22-10.12.1 References: http://support.novell.com/security/cve/CVE-2013-6438.html http://support.novell.com/security/cve/CVE-2014-0098.html http://support.novell.com/security/cve/CVE-2014-0226.html http://support.novell.com/security/cve/CVE-2014-0231.html https://bugzilla.novell.com/869105 https://bugzilla.novell.com/869106 https://bugzilla.novell.com/887765 https://bugzilla.novell.com/887768

1 0

openSUSE-SU-2014:1044-1: moderate: update for apache2
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1044-1 Rating: moderate References: #869105 #869106 #887765 #887767 #887768 #887771 Cross-References: CVE-2013-4352 CVE-2013-6438 CVE-2014-0098 CVE-2014-0117 CVE-2014-0226 CVE-2014-0231 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This apache2 update fixes the following security issues: - fix for crash in mod_proxy processing specially crafted requests with reverse proxy configurations that results in a crash and a DoS condition for the server. CVE-2014-0117 - new config option CGIDScriptTimeout set to 60s in new file conf.d/cgid-timeout.conf, preventing worker processes hanging forever if a cgi launched from them has stopped reading input from the server (DoS). CVE-2014-0231 - Fix for a NULL pointer dereference in mod_cache that causes a crash in caching forwarding configurations, resulting in a DoS condition. CVE-2013-4352 - fix for crash in parsing cookie content, resulting in a DoS against the server CVE-2014-0098 - fix for mod_status race condition in scoreboard handling and consecutive heap overflow and information disclosure if access to mod_status is granted to a potential attacker. CVE-2014-0226 - fix for improper handling of whitespace characters from CDATA sections to mod_dav, leading to a crash and a DoS condition of the apache server process CVE-2013-6438 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-503 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): apache2-2.4.6-6.27.1 apache2-debuginfo-2.4.6-6.27.1 apache2-debugsource-2.4.6-6.27.1 apache2-devel-2.4.6-6.27.1 apache2-event-2.4.6-6.27.1 apache2-event-debuginfo-2.4.6-6.27.1 apache2-example-pages-2.4.6-6.27.1 apache2-prefork-2.4.6-6.27.1 apache2-prefork-debuginfo-2.4.6-6.27.1 apache2-utils-2.4.6-6.27.1 apache2-utils-debuginfo-2.4.6-6.27.1 apache2-worker-2.4.6-6.27.1 apache2-worker-debuginfo-2.4.6-6.27.1 - openSUSE 13.1 (noarch): apache2-doc-2.4.6-6.27.1 References: http://support.novell.com/security/cve/CVE-2013-4352.html http://support.novell.com/security/cve/CVE-2013-6438.html http://support.novell.com/security/cve/CVE-2014-0098.html http://support.novell.com/security/cve/CVE-2014-0117.html http://support.novell.com/security/cve/CVE-2014-0226.html http://support.novell.com/security/cve/CVE-2014-0231.html https://bugzilla.novell.com/869105 https://bugzilla.novell.com/869106 https://bugzilla.novell.com/887765 https://bugzilla.novell.com/887767 https://bugzilla.novell.com/887768 https://bugzilla.novell.com/887771

1 0

openSUSE-SU-2014:1043-1: moderate: update for krb5, krb5-doc, krb5-mini
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for krb5, krb5-doc, krb5-mini ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1043-1 Rating: moderate References: #891082 Cross-References: CVE-2014-4345 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Thit MIT krb5 update fixes the following security issue: - buffer overrun in kadmind with LDAP backend (bnc#891082, CVE-2014-4345) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-508 - openSUSE 12.3: zypper in -t patch openSUSE-2014-508 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): krb5-1.11.3-3.12.1 krb5-client-1.11.3-3.12.1 krb5-client-debuginfo-1.11.3-3.12.1 krb5-debuginfo-1.11.3-3.12.1 krb5-debugsource-1.11.3-3.12.1 krb5-devel-1.11.3-3.12.1 krb5-doc-1.11.3-3.12.1 krb5-mini-1.11.3-3.12.1 krb5-mini-debuginfo-1.11.3-3.12.1 krb5-mini-debugsource-1.11.3-3.12.1 krb5-mini-devel-1.11.3-3.12.1 krb5-plugin-kdb-ldap-1.11.3-3.12.1 krb5-plugin-kdb-ldap-debuginfo-1.11.3-3.12.1 krb5-plugin-preauth-pkinit-1.11.3-3.12.1 krb5-plugin-preauth-pkinit-debuginfo-1.11.3-3.12.1 krb5-server-1.11.3-3.12.1 krb5-server-debuginfo-1.11.3-3.12.1 - openSUSE 13.1 (x86_64): krb5-32bit-1.11.3-3.12.1 krb5-debuginfo-32bit-1.11.3-3.12.1 krb5-devel-32bit-1.11.3-3.12.1 - openSUSE 12.3 (i586 x86_64): krb5-1.10.2-10.30.1 krb5-client-1.10.2-10.30.1 krb5-client-debuginfo-1.10.2-10.30.1 krb5-debuginfo-1.10.2-10.30.1 krb5-debugsource-1.10.2-10.30.1 krb5-devel-1.10.2-10.30.1 krb5-mini-1.10.2-10.30.1 krb5-mini-debuginfo-1.10.2-10.30.1 krb5-mini-debugsource-1.10.2-10.30.1 krb5-mini-devel-1.10.2-10.30.1 krb5-plugin-kdb-ldap-1.10.2-10.30.1 krb5-plugin-kdb-ldap-debuginfo-1.10.2-10.30.1 krb5-plugin-preauth-pkinit-1.10.2-10.30.1 krb5-plugin-preauth-pkinit-debuginfo-1.10.2-10.30.1 krb5-server-1.10.2-10.30.1 krb5-server-debuginfo-1.10.2-10.30.1 - openSUSE 12.3 (x86_64): krb5-32bit-1.10.2-10.30.1 krb5-debuginfo-32bit-1.10.2-10.30.1 krb5-devel-32bit-1.10.2-10.30.1 - openSUSE 12.3 (noarch): krb5-doc-1.10.2-10.30.2 References: http://support.novell.com/security/cve/CVE-2014-4345.html https://bugzilla.novell.com/891082

1 0

openSUSE-SU-2014:1042-1: moderate: update for python3
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1042-1 Rating: moderate References: #885882 Cross-References: CVE-2014-4650 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python3 update fixes the following security and non security issues: - CGIHTTPServer file disclosure and directory traversal through URL-encoded characters (CVE-2014-4650, bnc#885882) - fix import_failed hook file names Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-506 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libpython3_3m1_0-3.3.5-5.16.1 libpython3_3m1_0-debuginfo-3.3.5-5.16.1 python3-3.3.5-5.16.1 python3-base-3.3.5-5.16.1 python3-base-debuginfo-3.3.5-5.16.1 python3-base-debugsource-3.3.5-5.16.1 python3-curses-3.3.5-5.16.1 python3-curses-debuginfo-3.3.5-5.16.1 python3-dbm-3.3.5-5.16.1 python3-dbm-debuginfo-3.3.5-5.16.1 python3-debuginfo-3.3.5-5.16.1 python3-debugsource-3.3.5-5.16.1 python3-devel-3.3.5-5.16.1 python3-devel-debuginfo-3.3.5-5.16.1 python3-idle-3.3.5-5.16.1 python3-testsuite-3.3.5-5.16.1 python3-testsuite-debuginfo-3.3.5-5.16.1 python3-tk-3.3.5-5.16.1 python3-tk-debuginfo-3.3.5-5.16.1 python3-tools-3.3.5-5.16.1 - openSUSE 13.1 (x86_64): libpython3_3m1_0-32bit-3.3.5-5.16.1 libpython3_3m1_0-debuginfo-32bit-3.3.5-5.16.1 python3-32bit-3.3.5-5.16.1 python3-base-32bit-3.3.5-5.16.1 python3-base-debuginfo-32bit-3.3.5-5.16.1 python3-debuginfo-32bit-3.3.5-5.16.1 - openSUSE 13.1 (noarch): python3-doc-3.3.5-5.16.1 python3-doc-pdf-3.3.5-5.16.1 References: http://support.novell.com/security/cve/CVE-2014-4650.html https://bugzilla.novell.com/885882

1 0

openSUSE-SU-2014:1041-1: moderate: update for python
by opensuse-security＠opensuse.org 20 Aug '14

20 Aug '14

openSUSE Security Update: update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1041-1 Rating: moderate References: #885882 Cross-References: CVE-2014-4650 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python update fixes the following security and no security issues: - CGIHTTPServer file disclosure and directory traversal through URL-encoded characters (CVE-2014-4650, bnc#885882) - remove link count optimizations that are incorrect on btrfs (and possibly other filesystems) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-505 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libpython2_7-1_0-2.7.6-8.14.1 libpython2_7-1_0-debuginfo-2.7.6-8.14.1 python-2.7.6-8.14.1 python-base-2.7.6-8.14.1 python-base-debuginfo-2.7.6-8.14.1 python-base-debugsource-2.7.6-8.14.1 python-curses-2.7.6-8.14.1 python-curses-debuginfo-2.7.6-8.14.1 python-debuginfo-2.7.6-8.14.1 python-debugsource-2.7.6-8.14.1 python-demo-2.7.6-8.14.1 python-devel-2.7.6-8.14.1 python-gdbm-2.7.6-8.14.1 python-gdbm-debuginfo-2.7.6-8.14.1 python-idle-2.7.6-8.14.1 python-tk-2.7.6-8.14.1 python-tk-debuginfo-2.7.6-8.14.1 python-xml-2.7.6-8.14.1 python-xml-debuginfo-2.7.6-8.14.1 - openSUSE 13.1 (x86_64): libpython2_7-1_0-32bit-2.7.6-8.14.1 libpython2_7-1_0-debuginfo-32bit-2.7.6-8.14.1 python-32bit-2.7.6-8.14.1 python-base-32bit-2.7.6-8.14.1 python-base-debuginfo-32bit-2.7.6-8.14.1 python-debuginfo-32bit-2.7.6-8.14.1 - openSUSE 13.1 (noarch): python-doc-2.7.6-8.14.1 python-doc-pdf-2.7.6-8.14.1 References: http://support.novell.com/security/cve/CVE-2014-4650.html https://bugzilla.novell.com/885882

1 0