September 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2014:1254-1: critical: bash
by opensuse-security＠opensuse.org 29 Sep '14

29 Sep '14

openSUSE Security Update: bash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1254-1 Rating: critical References: #895475 #896776 Cross-References: CVE-2014-6271 CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: bash was updated to fix command injection via environment variables. (CVE-2014-6271,CVE-2014-7169) Also a hardening patch was applied that only imports functions over BASH_FUNC_ prefixed environment variables. Also fixed: CVE-2014-7186, CVE-2014-7187: bad handling of HERE documents and for loop issue Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-567 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): bash-4.2-75.4.1 bash-debuginfo-4.2-75.4.1 bash-debugsource-4.2-75.4.1 bash-devel-4.2-75.4.1 bash-loadables-4.2-75.4.1 bash-loadables-debuginfo-4.2-75.4.1 libreadline6-6.2-75.4.1 libreadline6-debuginfo-6.2-75.4.1 readline-devel-6.2-75.4.1 - openSUSE 13.2 (x86_64): bash-debuginfo-32bit-4.2-75.4.1 libreadline6-32bit-6.2-75.4.1 libreadline6-debuginfo-32bit-6.2-75.4.1 readline-devel-32bit-6.2-75.4.1 - openSUSE 13.2 (noarch): bash-doc-4.2-75.4.1 bash-lang-4.2-75.4.1 readline-doc-6.2-75.4.1 References: http://support.novell.com/security/cve/CVE-2014-6271.html http://support.novell.com/security/cve/CVE-2014-7169.html http://support.novell.com/security/cve/CVE-2014-7186.html http://support.novell.com/security/cve/CVE-2014-7187.html https://bugzilla.suse.com/show_bug.cgi?id=895475 https://bugzilla.suse.com/show_bug.cgi?id=896776

1 0

openSUSE-RU-2014:1253-1: moderate: AutoFS: Update to version 5.0.9
by maintenance＠opensuse.org 29 Sep '14

29 Sep '14

openSUSE Recommended Update: AutoFS: Update to version 5.0.9 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1253-1 Rating: moderate References: #869806 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides AutoFS 5.0.9, the latest stable upstream release, including many fixes and enhancements. - fix bnc#869806 - fix ipv6 link local address handling - fix fix ipv6 libtirpc getport - get_nfs_info() should query portmapper if port is not given - fix rpc_portmap_getport() proto not set - fix protmap not trying proto v2 - fix rpc_getport() when libtirpc is disabled - fix rpc_getrpcbport() when libtirpc is disabled - don't reset errno - extend fix for crash due to thread unsafe use of libldap - fix deadlock in init_ldap_connection - fix options compare - fix negative status being reset on map read - check for existing offset mount before mounting - fix max() declaration - fix symlink fail message in mount_bind.c - fix cache readlock not taken on lookup - pass map_source as function paramter where possible - check for bind onto self in mount_bind.c - fix symlink expire - dont clobber mapent for negative cache - fix macro_addvar() and move init to main thread - change walk_tree() to take ap - add negative cache lookup to hesiod lookup - fix external env configure - make autofs(5) consistent with auto.master(5) - fix map source with type lookup - fix lookup_nss_mount() map lookup - dont ignore null cache entries on multi mount umount - fix inconsistent error returns in handle_packet_missing_direct() - simple coverity fixes - fix fix options compare - use open(2) instead of access(2) to trigger dependent mounts - fix fix map source with type lookup - fixes for samples/auto.master - fix variable substitution description - fix incorrect append options description in README.v5-release - add amd map format parser Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-570 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): autofs-5.0.9-19.12.1 autofs-debuginfo-5.0.9-19.12.1 autofs-debugsource-5.0.9-19.12.1 References: https://bugzilla.suse.com/show_bug.cgi?id=869806

1 0

openSUSE-RU-2014:1252-1: moderate: gnome-disk-utility: bugfix
by maintenance＠opensuse.org 29 Sep '14

29 Sep '14

openSUSE Recommended Update: gnome-disk-utility: bugfix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1252-1 Rating: moderate References: #897530 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the appearance of the gnome-disk-utility org.gnome.Disks config schema. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-568 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): gnome-disk-utility-3.10.0-4.1 gnome-disk-utility-debuginfo-3.10.0-4.1 gnome-disk-utility-debugsource-3.10.0-4.1 - openSUSE 13.1 (noarch): gnome-disk-utility-lang-3.10.0-4.1 References: https://bugzilla.suse.com/show_bug.cgi?id=897530

1 0

openSUSE-RU-2014:1251-1: moderate: libqt4: fix cirrus driver issues
by maintenance＠opensuse.org 29 Sep '14

29 Sep '14

openSUSE Recommended Update: libqt4: fix cirrus driver issues ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1251-1 Rating: moderate References: #847880 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: libqt4 was updated to fix the following bug: When extracting a region of a QRasterPixmapData an optimization was using the wrong bit depth for some calculations thus copying a different section of the image than requested. This breaks specially the oxygen kde theme under qemu when using a cirrus driver. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-569 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libqt4-4.8.5-5.13.1 libqt4-debuginfo-4.8.5-5.13.1 libqt4-debugsource-4.8.5-5.13.1 libqt4-devel-4.8.5-5.13.1 libqt4-devel-debuginfo-4.8.5-5.13.1 libqt4-devel-doc-4.8.5-5.13.2 libqt4-devel-doc-debuginfo-4.8.5-5.13.2 libqt4-devel-doc-debugsource-4.8.5-5.13.2 libqt4-linguist-4.8.5-5.13.1 libqt4-linguist-debuginfo-4.8.5-5.13.1 libqt4-private-headers-devel-4.8.5-5.13.1 libqt4-qt3support-4.8.5-5.13.1 libqt4-qt3support-debuginfo-4.8.5-5.13.1 libqt4-sql-4.8.5-5.13.1 libqt4-sql-debuginfo-4.8.5-5.13.1 libqt4-sql-mysql-4.8.5-5.13.1 libqt4-sql-mysql-debuginfo-4.8.5-5.13.1 libqt4-sql-plugins-debugsource-4.8.5-5.13.1 libqt4-sql-postgresql-4.8.5-5.13.1 libqt4-sql-postgresql-debuginfo-4.8.5-5.13.1 libqt4-sql-sqlite-4.8.5-5.13.1 libqt4-sql-sqlite-debuginfo-4.8.5-5.13.1 libqt4-sql-unixODBC-4.8.5-5.13.1 libqt4-sql-unixODBC-debuginfo-4.8.5-5.13.1 libqt4-x11-4.8.5-5.13.1 libqt4-x11-debuginfo-4.8.5-5.13.1 qt4-x11-tools-4.8.5-5.13.2 qt4-x11-tools-debuginfo-4.8.5-5.13.2 - openSUSE 13.1 (x86_64): libqt4-32bit-4.8.5-5.13.1 libqt4-debuginfo-32bit-4.8.5-5.13.1 libqt4-qt3support-32bit-4.8.5-5.13.1 libqt4-qt3support-debuginfo-32bit-4.8.5-5.13.1 libqt4-sql-32bit-4.8.5-5.13.1 libqt4-sql-debuginfo-32bit-4.8.5-5.13.1 libqt4-sql-mysql-32bit-4.8.5-5.13.1 libqt4-sql-mysql-debuginfo-32bit-4.8.5-5.13.1 libqt4-sql-postgresql-32bit-4.8.5-5.13.1 libqt4-sql-postgresql-debuginfo-32bit-4.8.5-5.13.1 libqt4-sql-sqlite-32bit-4.8.5-5.13.1 libqt4-sql-sqlite-debuginfo-32bit-4.8.5-5.13.1 libqt4-sql-unixODBC-32bit-4.8.5-5.13.1 libqt4-sql-unixODBC-debuginfo-32bit-4.8.5-5.13.1 libqt4-x11-32bit-4.8.5-5.13.1 libqt4-x11-debuginfo-32bit-4.8.5-5.13.1 - openSUSE 13.1 (noarch): libqt4-devel-doc-data-4.8.5-5.13.2 References: https://bugzilla.suse.com/show_bug.cgi?id=847880

1 0

openSUSE-SU-2014:1250-1: moderate: srtp
by opensuse-security＠opensuse.org 29 Sep '14

29 Sep '14

openSUSE Security Update: srtp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1250-1 Rating: moderate References: #828009 #839475 Cross-References: CVE-2013-2139 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: srtp was updated to fix a buffer overflow flaw that allowed remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions. (CVE-2013-2139). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-565 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libsrtp1-1.4.4-4.4.1 libsrtp1-debuginfo-1.4.4-4.4.1 srtp-debugsource-1.4.4-4.4.1 srtp-devel-1.4.4-4.4.1 References: http://support.novell.com/security/cve/CVE-2013-2139.html https://bugzilla.suse.com/show_bug.cgi?id=828009 https://bugzilla.suse.com/show_bug.cgi?id=839475

1 0

openSUSE-SU-2014:1249-1: moderate: wireshark: update to 1.10.10 security release
by opensuse-security＠opensuse.org 29 Sep '14

29 Sep '14

openSUSE Security Update: wireshark: update to 1.10.10 security release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1249-1 Rating: moderate References: #889899 #889900 #889901 #889906 #897055 Cross-References: CVE-2014-5161 CVE-2014-5162 CVE-2014-5163 CVE-2014-5164 CVE-2014-5165 CVE-2014-6421 CVE-2014-6422 CVE-2014-6423 CVE-2014-6424 CVE-2014-6427 CVE-2014-6428 CVE-2014-6429 CVE-2014-6430 CVE-2014-6431 CVE-2014-6432 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: Wireshark was update to 1.10.10 [bnc#897055] On openSUSE 12.3, the package was upgraded to 1.10.x from 1.8.x as it was discontinued. This update fixes vulnerabilities in Wireshark that could allow an attacker to crash Wireshark or make it become unresponsive by sending specific packages onto the network or have it loaded via a capture file while the dissectors are running. It also contains a number of other bug fixes. * RTP dissector crash wnpa-sec-2014-12 CVE-2014-6421 CVE-2014-6422 * MEGACO dissector infinite loop wnpa-sec-2014-13 CVE-2014-6423 * Netflow dissector crash wnpa-sec-2014-14 CVE-2014-6424 * RTSP dissector crash wnpa-sec-2014-17 CVE-2014-6427 * SES dissector crash wnpa-sec-2014-18 CVE-2014-6428 * Sniffer file parser crash wnpa-sec-2014-19 CVE-2014-6429 CVE-2014-6430 CVE-2014-6431 CVE-2014-6432 - Further bug fixes as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.10.10.html - includes changes from 1.10.9: fixes several crashes triggered by malformed protocol packages - vulnerabilities fixed: * The Catapult DCT2000 and IrDA dissectors could underrun a buffer wnpa-sec-2014-08 CVE-2014-5161 CVE-2014-5162 (bnc#889901) * The GSM Management dissector could crash wnpa-sec-2014-09 CVE-2014-5163 (bnc#889906) * The RLC dissector could crash wnpa-sec-2014-10 CVE-2014-5164 (bnc#889900) * The ASN.1 BER dissector could crash wnpa-sec-2014-11 CVE-2014-5165 (bnc#889899) - Further bug fixes as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.10.9.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-566 - openSUSE 12.3: zypper in -t patch openSUSE-2014-566 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): wireshark-1.10.10-24.1 wireshark-debuginfo-1.10.10-24.1 wireshark-debugsource-1.10.10-24.1 wireshark-devel-1.10.10-24.1 - openSUSE 12.3 (i586 x86_64): wireshark-1.10.10-1.44.1 wireshark-debuginfo-1.10.10-1.44.1 wireshark-debugsource-1.10.10-1.44.1 wireshark-devel-1.10.10-1.44.1 References: http://support.novell.com/security/cve/CVE-2014-5161.html http://support.novell.com/security/cve/CVE-2014-5162.html http://support.novell.com/security/cve/CVE-2014-5163.html http://support.novell.com/security/cve/CVE-2014-5164.html http://support.novell.com/security/cve/CVE-2014-5165.html http://support.novell.com/security/cve/CVE-2014-6421.html http://support.novell.com/security/cve/CVE-2014-6422.html http://support.novell.com/security/cve/CVE-2014-6423.html http://support.novell.com/security/cve/CVE-2014-6424.html http://support.novell.com/security/cve/CVE-2014-6427.html http://support.novell.com/security/cve/CVE-2014-6428.html http://support.novell.com/security/cve/CVE-2014-6429.html http://support.novell.com/security/cve/CVE-2014-6430.html http://support.novell.com/security/cve/CVE-2014-6431.html http://support.novell.com/security/cve/CVE-2014-6432.html https://bugzilla.suse.com/show_bug.cgi?id=889899 https://bugzilla.suse.com/show_bug.cgi?id=889900 https://bugzilla.suse.com/show_bug.cgi?id=889901 https://bugzilla.suse.com/show_bug.cgi?id=889906 https://bugzilla.suse.com/show_bug.cgi?id=897055

1 0

openSUSE-SU-2014:1248-1: important: update for bash
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: update for bash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1248-1 Rating: important References: #896776 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for bash completely disables the importing of shell functions from the environment and thereby remove the exposure of the parser from untrusted/harmful environment. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2014-90 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): bash-4.1-20.35.1 bash-debuginfo-4.1-20.35.1 bash-debugsource-4.1-20.35.1 bash-devel-4.1-18.35.1 bash-loadables-4.1-18.35.1 bash-loadables-debuginfo-4.1-18.35.1 libreadline6-6.1-18.35.1 libreadline6-debuginfo-6.1-18.35.1 readline-devel-6.1-18.35.1 - openSUSE Evergreen 11.4 (x86_64): bash-debuginfo-32bit-4.1-20.35.1 libreadline6-32bit-6.1-18.35.1 libreadline6-debuginfo-32bit-6.1-18.35.1 readline-devel-32bit-6.1-18.35.1 - openSUSE Evergreen 11.4 (noarch): bash-doc-4.1-18.35.1 bash-lang-4.1-20.35.1 readline-doc-6.1-18.35.1 - openSUSE Evergreen 11.4 (ia64): bash-debuginfo-x86-4.1-20.35.1 bash-x86-4.1-20.35.1 libreadline6-debuginfo-x86-6.1-18.35.1 libreadline6-x86-6.1-18.35.1 References: https://bugzilla.suse.com/show_bug.cgi?id=896776

1 0

openSUSE-SU-2014:1246-1: moderate: kernel update for Evergreen 11.4, fixes 18 CVE issues
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: kernel update for Evergreen 11.4, fixes 18 CVE issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1246-1 Rating: moderate References: #846404 #854722 #864464 #866911 #870173 #870576 #871676 #871797 #871854 #872634 #873374 #876590 #877257 #878115 #878509 #879921 #880484 #881051 #882804 #883724 #883795 #885422 #885725 #886474 #889173 #889324 Cross-References: CVE-2013-6463 CVE-2014-0055 CVE-2014-0077 CVE-2014-1739 CVE-2014-2706 CVE-2014-2851 CVE-2014-3144 CVE-2014-3145 CVE-2014-3917 CVE-2014-4508 CVE-2014-4652 CVE-2014-4653 CVE-2014-4654 CVE-2014-4655 CVE-2014-4656 CVE-2014-4667 CVE-2014-4699 CVE-2014-5077 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that solves 18 vulnerabilities and has 8 fixes is now available. Description: kernel update for Evergreen 11.4, fixes 18 CVE issues (see the changelog for list) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2014-89 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): kernel-debug-3.0.101-91.1 kernel-debug-base-3.0.101-91.1 kernel-debug-base-debuginfo-3.0.101-91.1 kernel-debug-debuginfo-3.0.101-91.1 kernel-debug-debugsource-3.0.101-91.1 kernel-debug-devel-3.0.101-91.1 kernel-debug-devel-debuginfo-3.0.101-91.1 kernel-debug-hmac-3.0.101-91.1 kernel-default-3.0.101-91.1 kernel-default-base-3.0.101-91.1 kernel-default-base-debuginfo-3.0.101-91.1 kernel-default-debuginfo-3.0.101-91.1 kernel-default-debugsource-3.0.101-91.1 kernel-default-devel-3.0.101-91.1 kernel-default-devel-debuginfo-3.0.101-91.1 kernel-default-hmac-3.0.101-91.1 kernel-desktop-3.0.101-91.1 kernel-desktop-base-3.0.101-91.1 kernel-desktop-base-debuginfo-3.0.101-91.1 kernel-desktop-debuginfo-3.0.101-91.1 kernel-desktop-debugsource-3.0.101-91.1 kernel-desktop-devel-3.0.101-91.1 kernel-desktop-devel-debuginfo-3.0.101-91.1 kernel-desktop-hmac-3.0.101-91.1 kernel-ec2-3.0.101-91.1 kernel-ec2-base-3.0.101-91.1 kernel-ec2-base-debuginfo-3.0.101-91.1 kernel-ec2-debuginfo-3.0.101-91.1 kernel-ec2-debugsource-3.0.101-91.1 kernel-ec2-devel-3.0.101-91.1 kernel-ec2-devel-debuginfo-3.0.101-91.1 kernel-ec2-extra-3.0.101-91.1 kernel-ec2-extra-debuginfo-3.0.101-91.1 kernel-ec2-hmac-3.0.101-91.1 kernel-source-3.0.101-91.1 kernel-source-vanilla-3.0.101-91.1 kernel-syms-3.0.101-91.1 kernel-trace-3.0.101-91.1 kernel-trace-base-3.0.101-91.1 kernel-trace-base-debuginfo-3.0.101-91.1 kernel-trace-debuginfo-3.0.101-91.1 kernel-trace-debugsource-3.0.101-91.1 kernel-trace-devel-3.0.101-91.1 kernel-trace-devel-debuginfo-3.0.101-91.1 kernel-trace-hmac-3.0.101-91.1 kernel-vanilla-3.0.101-91.1 kernel-vanilla-base-3.0.101-91.1 kernel-vanilla-base-debuginfo-3.0.101-91.1 kernel-vanilla-debuginfo-3.0.101-91.1 kernel-vanilla-debugsource-3.0.101-91.1 kernel-vanilla-devel-3.0.101-91.1 kernel-vanilla-devel-debuginfo-3.0.101-91.1 kernel-vanilla-hmac-3.0.101-91.1 kernel-xen-3.0.101-91.1 kernel-xen-base-3.0.101-91.1 kernel-xen-base-debuginfo-3.0.101-91.1 kernel-xen-debuginfo-3.0.101-91.1 kernel-xen-debugsource-3.0.101-91.1 kernel-xen-devel-3.0.101-91.1 kernel-xen-devel-debuginfo-3.0.101-91.1 kernel-xen-hmac-3.0.101-91.1 preload-1.2-6.69.2 preload-debuginfo-1.2-6.69.2 preload-debugsource-1.2-6.69.2 preload-kmp-default-1.2_3.0.101_91-6.69.2 preload-kmp-default-debuginfo-1.2_3.0.101_91-6.69.2 preload-kmp-desktop-1.2_3.0.101_91-6.69.2 preload-kmp-desktop-debuginfo-1.2_3.0.101_91-6.69.2 - openSUSE Evergreen 11.4 (noarch): kernel-docs-3.0.101-91.2 - openSUSE Evergreen 11.4 (i586): kernel-pae-3.0.101-91.1 kernel-pae-base-3.0.101-91.1 kernel-pae-base-debuginfo-3.0.101-91.1 kernel-pae-debuginfo-3.0.101-91.1 kernel-pae-debugsource-3.0.101-91.1 kernel-pae-devel-3.0.101-91.1 kernel-pae-devel-debuginfo-3.0.101-91.1 kernel-pae-hmac-3.0.101-91.1 kernel-vmi-3.0.101-91.1 kernel-vmi-base-3.0.101-91.1 kernel-vmi-base-debuginfo-3.0.101-91.1 kernel-vmi-debuginfo-3.0.101-91.1 kernel-vmi-debugsource-3.0.101-91.1 kernel-vmi-devel-3.0.101-91.1 kernel-vmi-devel-debuginfo-3.0.101-91.1 kernel-vmi-hmac-3.0.101-91.1 References: http://support.novell.com/security/cve/CVE-2013-6463.html http://support.novell.com/security/cve/CVE-2014-0055.html http://support.novell.com/security/cve/CVE-2014-0077.html http://support.novell.com/security/cve/CVE-2014-1739.html http://support.novell.com/security/cve/CVE-2014-2706.html http://support.novell.com/security/cve/CVE-2014-2851.html http://support.novell.com/security/cve/CVE-2014-3144.html http://support.novell.com/security/cve/CVE-2014-3145.html http://support.novell.com/security/cve/CVE-2014-3917.html http://support.novell.com/security/cve/CVE-2014-4508.html http://support.novell.com/security/cve/CVE-2014-4652.html http://support.novell.com/security/cve/CVE-2014-4653.html http://support.novell.com/security/cve/CVE-2014-4654.html http://support.novell.com/security/cve/CVE-2014-4655.html http://support.novell.com/security/cve/CVE-2014-4656.html http://support.novell.com/security/cve/CVE-2014-4667.html http://support.novell.com/security/cve/CVE-2014-4699.html http://support.novell.com/security/cve/CVE-2014-5077.html https://bugzilla.suse.com/show_bug.cgi?id=846404 https://bugzilla.suse.com/show_bug.cgi?id=854722 https://bugzilla.suse.com/show_bug.cgi?id=864464 https://bugzilla.suse.com/show_bug.cgi?id=866911 https://bugzilla.suse.com/show_bug.cgi?id=870173 https://bugzilla.suse.com/show_bug.cgi?id=870576 https://bugzilla.suse.com/show_bug.cgi?id=871676 https://bugzilla.suse.com/show_bug.cgi?id=871797 https://bugzilla.suse.com/show_bug.cgi?id=871854 https://bugzilla.suse.com/show_bug.cgi?id=872634 https://bugzilla.suse.com/show_bug.cgi?id=873374 https://bugzilla.suse.com/show_bug.cgi?id=876590 https://bugzilla.suse.com/show_bug.cgi?id=877257 https://bugzilla.suse.com/show_bug.cgi?id=878115 https://bugzilla.suse.com/show_bug.cgi?id=878509 https://bugzilla.suse.com/show_bug.cgi?id=879921 https://bugzilla.suse.com/show_bug.cgi?id=880484 https://bugzilla.suse.com/show_bug.cgi?id=881051 https://bugzilla.suse.com/show_bug.cgi?id=882804 https://bugzilla.suse.com/show_bug.cgi?id=883724 https://bugzilla.suse.com/show_bug.cgi?id=883795 https://bugzilla.suse.com/show_bug.cgi?id=885422 https://bugzilla.suse.com/show_bug.cgi?id=885725 https://bugzilla.suse.com/show_bug.cgi?id=886474 https://bugzilla.suse.com/show_bug.cgi?id=889173 https://bugzilla.suse.com/show_bug.cgi?id=889324

1 0

openSUSE-SU-2014:1245-1: moderate: update for php5
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1245-1 Rating: moderate References: #893849 #893853 Cross-References: CVE-2014-3597 CVE-2014-5459 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: CVE-2014-5459: It was reported that the pear utility insecurely used the /tmp/ directory for cache data. A local attacker could use this flaw to perform a symbolic link attack against a user (typically the root user) running a pear command, causing an arbitrary file to be overwritten, possibly leading to a denial of service. CVE-2014-3597: Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2014-88 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): apache2-mod_php5-5.3.17-383.1 apache2-mod_php5-debuginfo-5.3.17-383.1 php5-5.3.17-383.1 php5-bcmath-5.3.17-383.1 php5-bcmath-debuginfo-5.3.17-383.1 php5-bz2-5.3.17-383.1 php5-bz2-debuginfo-5.3.17-383.1 php5-calendar-5.3.17-383.1 php5-calendar-debuginfo-5.3.17-383.1 php5-ctype-5.3.17-383.1 php5-ctype-debuginfo-5.3.17-383.1 php5-curl-5.3.17-383.1 php5-curl-debuginfo-5.3.17-383.1 php5-dba-5.3.17-383.1 php5-dba-debuginfo-5.3.17-383.1 php5-debuginfo-5.3.17-383.1 php5-debugsource-5.3.17-383.1 php5-devel-5.3.17-383.1 php5-dom-5.3.17-383.1 php5-dom-debuginfo-5.3.17-383.1 php5-enchant-5.3.17-383.1 php5-enchant-debuginfo-5.3.17-383.1 php5-exif-5.3.17-383.1 php5-exif-debuginfo-5.3.17-383.1 php5-fastcgi-5.3.17-383.1 php5-fastcgi-debuginfo-5.3.17-383.1 php5-fileinfo-5.3.17-383.1 php5-fileinfo-debuginfo-5.3.17-383.1 php5-fpm-5.3.17-383.1 php5-fpm-debuginfo-5.3.17-383.1 php5-ftp-5.3.17-383.1 php5-ftp-debuginfo-5.3.17-383.1 php5-gd-5.3.17-383.1 php5-gd-debuginfo-5.3.17-383.1 php5-gettext-5.3.17-383.1 php5-gettext-debuginfo-5.3.17-383.1 php5-gmp-5.3.17-383.1 php5-gmp-debuginfo-5.3.17-383.1 php5-iconv-5.3.17-383.1 php5-iconv-debuginfo-5.3.17-383.1 php5-imap-5.3.17-383.1 php5-imap-debuginfo-5.3.17-383.1 php5-intl-5.3.17-383.1 php5-intl-debuginfo-5.3.17-383.1 php5-json-5.3.17-383.1 php5-json-debuginfo-5.3.17-383.1 php5-ldap-5.3.17-383.1 php5-ldap-debuginfo-5.3.17-383.1 php5-mbstring-5.3.17-383.1 php5-mbstring-debuginfo-5.3.17-383.1 php5-mcrypt-5.3.17-383.1 php5-mcrypt-debuginfo-5.3.17-383.1 php5-mysql-5.3.17-383.1 php5-mysql-debuginfo-5.3.17-383.1 php5-odbc-5.3.17-383.1 php5-odbc-debuginfo-5.3.17-383.1 php5-openssl-5.3.17-383.1 php5-openssl-debuginfo-5.3.17-383.1 php5-pcntl-5.3.17-383.1 php5-pcntl-debuginfo-5.3.17-383.1 php5-pdo-5.3.17-383.1 php5-pdo-debuginfo-5.3.17-383.1 php5-pear-5.3.17-383.1 php5-pgsql-5.3.17-383.1 php5-pgsql-debuginfo-5.3.17-383.1 php5-phar-5.3.17-383.1 php5-phar-debuginfo-5.3.17-383.1 php5-posix-5.3.17-383.1 php5-posix-debuginfo-5.3.17-383.1 php5-pspell-5.3.17-383.1 php5-pspell-debuginfo-5.3.17-383.1 php5-readline-5.3.17-383.1 php5-readline-debuginfo-5.3.17-383.1 php5-shmop-5.3.17-383.1 php5-shmop-debuginfo-5.3.17-383.1 php5-snmp-5.3.17-383.1 php5-snmp-debuginfo-5.3.17-383.1 php5-soap-5.3.17-383.1 php5-soap-debuginfo-5.3.17-383.1 php5-sockets-5.3.17-383.1 php5-sockets-debuginfo-5.3.17-383.1 php5-sqlite-5.3.17-383.1 php5-sqlite-debuginfo-5.3.17-383.1 php5-suhosin-5.3.17-383.1 php5-suhosin-debuginfo-5.3.17-383.1 php5-sysvmsg-5.3.17-383.1 php5-sysvmsg-debuginfo-5.3.17-383.1 php5-sysvsem-5.3.17-383.1 php5-sysvsem-debuginfo-5.3.17-383.1 php5-sysvshm-5.3.17-383.1 php5-sysvshm-debuginfo-5.3.17-383.1 php5-tidy-5.3.17-383.1 php5-tidy-debuginfo-5.3.17-383.1 php5-tokenizer-5.3.17-383.1 php5-tokenizer-debuginfo-5.3.17-383.1 php5-wddx-5.3.17-383.1 php5-wddx-debuginfo-5.3.17-383.1 php5-xmlreader-5.3.17-383.1 php5-xmlreader-debuginfo-5.3.17-383.1 php5-xmlrpc-5.3.17-383.1 php5-xmlrpc-debuginfo-5.3.17-383.1 php5-xmlwriter-5.3.17-383.1 php5-xmlwriter-debuginfo-5.3.17-383.1 php5-xsl-5.3.17-383.1 php5-xsl-debuginfo-5.3.17-383.1 php5-zip-5.3.17-383.1 php5-zip-debuginfo-5.3.17-383.1 php5-zlib-5.3.17-383.1 php5-zlib-debuginfo-5.3.17-383.1 References: http://support.novell.com/security/cve/CVE-2014-3597.html http://support.novell.com/security/cve/CVE-2014-5459.html https://bugzilla.suse.com/show_bug.cgi?id=893849 https://bugzilla.suse.com/show_bug.cgi?id=893853

1 0

openSUSE-RU-2014:1244-1: Testupdate to refresh the openSUSE 13.2 Update repository
by maintenance＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Recommended Update: Testupdate to refresh the openSUSE 13.2 Update repository ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:1244-1 Rating: low References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This is a testupdate to refresh the openSUSE 13.2 update repository Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-204 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): update-test-affects-package-manager-0-27.1 update-test-feature-0-27.1 update-test-interactive-0-27.1 update-test-optional-0-27.1 update-test-reboot-needed-0-27.1 update-test-relogin-suggested-0-27.1 update-test-security-0-27.1 update-test-trival-0-27.1 References:

1 0