January 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2015:0097-1: moderate: tigervnc
by maintenance＠opensuse.org 21 Jan '15

21 Jan '15

openSUSE Recommended Update: tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0097-1 Rating: moderate References: #911577 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This reommended update provides the current version 1.4.1 for tigervnc and 1.16.1 for X server with various fixes and improvements. - boo#911577: fixed unresolved symbol in libvnc - For a detailed changelog please see https://github.com/TigerVNC/tigervnc/releases Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-46 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): tigervnc-1.4.1-6.18.1 tigervnc-debuginfo-1.4.1-6.18.1 tigervnc-debugsource-1.4.1-6.18.1 xorg-x11-Xvnc-1.4.1-6.18.1 xorg-x11-Xvnc-debuginfo-1.4.1-6.18.1 References: https://bugzilla.suse.com/show_bug.cgi?id=911577

1 0

openSUSE-RU-2015:0091-1: moderate: rpm
by maintenance＠opensuse.org 20 Jan '15

20 Jan '15

openSUSE Recommended Update: rpm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0091-1 Rating: moderate References: #911228 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended udpate for rpm fixes the following issue: - boo#911228: fix noglob patch, which broke files with spaces Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-45 - openSUSE 13.1: zypper in -t patch openSUSE-2015-45 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): python3-rpm-4.11.3-8.1 python3-rpm-debuginfo-4.11.3-8.1 python3-rpm-debugsource-4.11.3-8.1 rpm-4.11.3-8.1 rpm-build-4.11.3-8.1 rpm-build-debuginfo-4.11.3-8.1 rpm-debuginfo-4.11.3-8.1 rpm-debugsource-4.11.3-8.1 rpm-devel-4.11.3-8.1 rpm-python-4.11.3-8.1 rpm-python-debuginfo-4.11.3-8.1 rpm-python-debugsource-4.11.3-8.1 - openSUSE 13.2 (x86_64): rpm-32bit-4.11.3-8.1 rpm-debuginfo-32bit-4.11.3-8.1 - openSUSE 13.1 (i586 x86_64): python3-rpm-4.11.1-6.13.1 python3-rpm-debuginfo-4.11.1-6.13.1 python3-rpm-debugsource-4.11.1-6.13.1 rpm-4.11.1-6.13.1 rpm-build-4.11.1-6.13.1 rpm-build-debuginfo-4.11.1-6.13.1 rpm-debuginfo-4.11.1-6.13.1 rpm-debugsource-4.11.1-6.13.1 rpm-devel-4.11.1-6.13.1 rpm-python-4.11.1-6.13.1 rpm-python-debuginfo-4.11.1-6.13.1 rpm-python-debugsource-4.11.1-6.13.1 - openSUSE 13.1 (x86_64): rpm-32bit-4.11.1-6.13.1 rpm-debuginfo-32bit-4.11.1-6.13.1 References: https://bugzilla.suse.com/show_bug.cgi?id=911228

1 0

openSUSE-RU-2015:0090-1: findutils
by maintenance＠opensuse.org 20 Jan '15

20 Jan '15

openSUSE Recommended Update: findutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0090-1 Rating: low References: Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This recommended update for findutils fixes the following issues: - Add upstream patch to fix 'oldfind' which skipped all files starting with ".." (e.g. "..file"). - Add BuildRequires:dejagnu - otherwise only a very limited set of the tests was run by 'make check'. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-43 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): findutils-4.5.14-2.4.1 findutils-debuginfo-4.5.14-2.4.1 findutils-debugsource-4.5.14-2.4.1 - openSUSE 13.2 (noarch): findutils-lang-4.5.14-2.4.1 References:

1 0

openSUSE-RU-2015:0089-1: fonts-config
by maintenance＠opensuse.org 20 Jan '15

20 Jan '15

openSUSE Recommended Update: fonts-config ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0089-1 Rating: low References: #912279 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for fonts-config fixes the following issues: - Run fonts-config whenever sysconfig variable is changed via yast sysconfig module. - bnc#912279: added Command "metadata" to relevant sysconfig variables Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-44 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): fonts-config-20140604-3.5.1 References: https://bugzilla.suse.com/show_bug.cgi?id=912279

1 0

openSUSE-RU-2015:0085-1: moderate: recommended softwarestack-update for openSUSE 13.2
by maintenance＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Recommended Update: recommended softwarestack-update for openSUSE 13.2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0085-1 Rating: moderate References: #848054 #892431 #899510 #899781 #901590 #901691 #903675 #904737 #906549 #908135 #908345 #908976 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has 12 recommended fixes can now be installed. Description: This recommended softwarestack-update for openSUSE fixes the following issues: - zypper: + Warn about repositories with 'gpgcheck=0' (bnc#848054) + search: fix --verbose implies --details + Enhance 'Digest verification failed' dialog (FATE#315008) + Summary: quote names including spaces (bnc#903675) + Provide missing man pages + Create man pages from asciidoc + Warn if legacy CLI options are used (bnc#899781) + Update translations - libzypp: + Adapt to gpg-2.1 (bnc#908135) + rpm: do not obsolete yast2-packagemanager-devel by libzypp-devel-doc + replaceAll: fix endless loop on empty search string + Do not provide/obsolete yast2-packagemanager-devel by the -doc package: the -devel package already does that. + Call rpm with '--noglob' (bnc#892431) + Downloader: unify workflow downloading a (signed) master index file + Fix iostream includes + Explicitly call libsolv:pool_setdisttype + doc: add hint to code 12 pattern packages + MediaCurl: Fix URL path concatenation (bnc#901590) + Move doxygen html doc to libzypp-devel-doc (bnc#901691) + Remove non-breaking spaces from changes file + Control lifetime of downloaded mirrorlist + Store baseurls in list as order expresses preference + Support parsing multiple baseurls from a repo file (bnc#899510) + Fix handling local mirrorlist= files in .repo (bnc#899510) + Provide missing man pages + Enable building autodocs, translations and test per default on debian + Fix several typos in output messages and comments + Make the include dir path configurable + Update translations - libzypp-bindings + Adapt to libzypp changes Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-42 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): PackageKit-1.0.3-7.1 PackageKit-backend-zypp-1.0.3-7.1 PackageKit-backend-zypp-debuginfo-1.0.3-7.1 PackageKit-browser-plugin-1.0.3-7.1 PackageKit-browser-plugin-debuginfo-1.0.3-7.1 PackageKit-debuginfo-1.0.3-7.1 PackageKit-debugsource-1.0.3-7.1 PackageKit-devel-1.0.3-7.1 PackageKit-devel-debuginfo-1.0.3-7.1 PackageKit-gstreamer-plugin-1.0.3-7.1 PackageKit-gstreamer-plugin-debuginfo-1.0.3-7.1 PackageKit-gtk3-module-1.0.3-7.1 PackageKit-gtk3-module-debuginfo-1.0.3-7.1 libpackagekit-glib2-18-1.0.3-7.1 libpackagekit-glib2-18-debuginfo-1.0.3-7.1 libpackagekit-glib2-devel-1.0.3-7.1 libyui-gtk-pkg-debugsource-2.43.2-2.3.2 libyui-gtk-pkg-devel-2.43.2-2.3.2 libyui-gtk-pkg6-2.43.2-2.3.2 libyui-gtk-pkg6-debuginfo-2.43.2-2.3.2 libyui-ncurses-pkg-debugsource-2.46.1-2.3.2 libyui-ncurses-pkg-devel-2.46.1-2.3.2 libyui-ncurses-pkg6-2.46.1-2.3.2 libyui-ncurses-pkg6-debuginfo-2.46.1-2.3.2 libyui-qt-pkg-debugsource-2.44.7-3.2 libyui-qt-pkg-devel-2.44.7-3.2 libyui-qt-pkg6-2.44.7-3.2 libyui-qt-pkg6-debuginfo-2.44.7-3.2 libzypp-14.32.0-5.3 libzypp-bindings-debugsource-0.6.4-6.1 libzypp-debuginfo-14.32.0-5.3 libzypp-debugsource-14.32.0-5.3 libzypp-devel-14.32.0-5.3 libzypp-devel-doc-14.32.0-5.3 perl-zypp-0.6.4-6.1 perl-zypp-debuginfo-0.6.4-6.1 python-zypp-0.6.4-6.1 python-zypp-debuginfo-0.6.4-6.1 ruby-zypp-0.6.4-6.1 ruby-zypp-debuginfo-0.6.4-6.1 typelib-1_0-PackageKitGlib-1_0-1.0.3-7.1 yast2-pkg-bindings-3.1.20-3.2 yast2-pkg-bindings-debuginfo-3.1.20-3.2 yast2-pkg-bindings-debugsource-3.1.20-3.2 zypper-1.11.17-5.1 zypper-debuginfo-1.11.17-5.1 zypper-debugsource-1.11.17-5.1 - openSUSE 13.2 (x86_64): libpackagekit-glib2-18-32bit-1.0.3-7.1 libpackagekit-glib2-18-debuginfo-32bit-1.0.3-7.1 libpackagekit-glib2-devel-32bit-1.0.3-7.1 - openSUSE 13.2 (noarch): PackageKit-branding-openSUSE-13.2-2.4.1 PackageKit-branding-upstream-1.0.3-7.1 PackageKit-lang-1.0.3-7.1 libyui-gtk-pkg-doc-2.43.2-2.3.2 libyui-ncurses-pkg-doc-2.46.1-2.3.2 libyui-qt-pkg-doc-2.44.7-3.2 yast2-pkg-bindings-devel-doc-3.1.20-3.2 zypper-aptitude-1.11.17-5.1 zypper-log-1.11.17-5.1 References: https://bugzilla.suse.com/show_bug.cgi?id=848054 https://bugzilla.suse.com/show_bug.cgi?id=892431 https://bugzilla.suse.com/show_bug.cgi?id=899510 https://bugzilla.suse.com/show_bug.cgi?id=899781 https://bugzilla.suse.com/show_bug.cgi?id=901590 https://bugzilla.suse.com/show_bug.cgi?id=901691 https://bugzilla.suse.com/show_bug.cgi?id=903675 https://bugzilla.suse.com/show_bug.cgi?id=904737 https://bugzilla.suse.com/show_bug.cgi?id=906549 https://bugzilla.suse.com/show_bug.cgi?id=908135 https://bugzilla.suse.com/show_bug.cgi?id=908345 https://bugzilla.suse.com/show_bug.cgi?id=908976

1 0

openSUSE-RU-2015:0081-1: moderate: Recommended update for polkit
by maintenance＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Recommended Update: Recommended update for polkit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0081-1 Rating: moderate References: #912889 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The polkit library was updated to fix a memory leak that was exposed by the KDE PowerDevil application. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-41 - openSUSE 13.1: zypper in -t patch openSUSE-2015-41 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libpolkit0-0.112-3.5.1 libpolkit0-debuginfo-0.112-3.5.1 polkit-0.112-3.5.1 polkit-debuginfo-0.112-3.5.1 polkit-debugsource-0.112-3.5.1 polkit-devel-0.112-3.5.1 polkit-devel-debuginfo-0.112-3.5.1 typelib-1_0-Polkit-1_0-0.112-3.5.1 - openSUSE 13.2 (x86_64): libpolkit0-32bit-0.112-3.5.1 libpolkit0-debuginfo-32bit-0.112-3.5.1 - openSUSE 13.2 (noarch): polkit-doc-0.112-3.5.1 - openSUSE 13.1 (i586 x86_64): libpolkit0-0.112-6.1 libpolkit0-debuginfo-0.112-6.1 polkit-0.112-6.1 polkit-debuginfo-0.112-6.1 polkit-debugsource-0.112-6.1 polkit-devel-0.112-6.1 polkit-devel-debuginfo-0.112-6.1 typelib-1_0-Polkit-1_0-0.112-6.1 - openSUSE 13.1 (x86_64): libpolkit0-32bit-0.112-6.1 libpolkit0-debuginfo-32bit-0.112-6.1 - openSUSE 13.1 (noarch): polkit-doc-0.112-6.1 References: https://bugzilla.suse.com/show_bug.cgi?id=912889

1 0

openSUSE-SU-2015:0077-2: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0077-2 Rating: important References: #908892 #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox was updated to version 35.0 (bnc#910669) Notable features: * Firefox Hello with new rooms-based conversations model * Implemented HTTP Public Key Pinning Extension (for enhanced authentication of encrypted connections) Security fixes: * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses * MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio * MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape * MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension * MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - obsolete tracker-miner-firefox < 0.15 because it leads to startup crashes (bnc#908892) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-40 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaFirefox-35.0-9.1 MozillaFirefox-branding-upstream-35.0-9.1 MozillaFirefox-buildsymbols-35.0-9.1 MozillaFirefox-debuginfo-35.0-9.1 MozillaFirefox-debugsource-35.0-9.1 MozillaFirefox-devel-35.0-9.1 MozillaFirefox-translations-common-35.0-9.1 MozillaFirefox-translations-other-35.0-9.1 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html http://support.novell.com/security/cve/CVE-2014-8642.html http://support.novell.com/security/cve/CVE-2014-8643.html https://bugzilla.suse.com/show_bug.cgi?id=908892 https://bugzilla.suse.com/show_bug.cgi?id=910669

1 0

openSUSE-SU-2015:0079-1: Security update for vsftpd
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for vsftpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0079-1 Rating: low References: #900326 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for vsftpd fixes the following security issue: - Fixed deny_file parsing to do more what is expected. bnc#900326 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-38 - openSUSE 13.1: zypper in -t patch openSUSE-2015-38 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): vsftpd-3.0.2-14.5.1 vsftpd-debuginfo-3.0.2-14.5.1 vsftpd-debugsource-3.0.2-14.5.1 - openSUSE 13.1 (i586 x86_64): vsftpd-3.0.2-10.8.1 vsftpd-debuginfo-3.0.2-10.8.1 vsftpd-debugsource-3.0.2-10.8.1 References: https://bugzilla.suse.com/show_bug.cgi?id=900326

1 0

openSUSE-SU-2015:0078-1: moderate: Security Update for openstack-dashboard
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security Update for openstack-dashboard ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0078-1 Rating: moderate References: #852175 #869696 #871855 #885588 #891815 #908199 Cross-References: CVE-2013-6858 CVE-2014-0157 CVE-2014-3473 CVE-2014-3474 CVE-2014-3475 CVE-2014-3594 CVE-2014-8124 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: OpenStack Dashboard was updated to fix bugs and security issues. Full changes: - Update to version horizon-2013.2.5.dev2.g9ee7273: * fix Horizon login page DOS attack (bnc#908199, CVE-2014-8124) * update version to 2013.2.5 * Updated from global requirements * Pin docutils to 0.9.1 * Set python hash seed to 0 in tox.ini * Check host is not none in each availability zone * Fix XSS issue with the unordered_list filter (bnc#891815, CVE-2014-3594) + 0001-Use-default_project_id-for-v3-users.patch (manually) * Replace UserManager with None in tests * Update test-requirements to fix sphinx build_doc * Fix multiple Cross-Site Scripting (XSS) vulnerabilities (bnc#885588, CVE-2014-3473, CVE-2014-3474, CVE-2014-3475) * Fix issues with importing the Login form Bug 869696 - Admin password injection on Horizon Dashboard is broken. - Update to version horizon-2013.2.4.dev8.g07c097f: * Bug fix on neutron's API to return the correct target ID * Fix display of images in Rebuild Instance * Get instance networking information from Neutron * Bump stable/havana next version to 2013.2.4 * Do not release FIP on disassociate action * Introduces escaping in Horizon/Orchestration 2013.2.3 (bnc#871855, CVE-2014-0157) - Update to version horizon-2013.2.3.dev8.g3d04c3c: * Reduce number of novaclient calls * Don't copy the flavorid when updating flavors * Allow snapshots of paused and suspended instances * Fixing tests to work with keystoneclient 0.6.0 * Bump stable/havana next version to 2013.2.3 + Use upstream URL as source (enables verification) + Import translations for Havana 2013.2.2 udpate - Update to version 2013.2.2.dev29.g96bd650: + Update Transifex resource name for havana + Fix inappropriate logouts on load-balanced Horizon - Update to version 2013.2.2.dev25.g6508afd: + disable volume creation, when cinder is disabled + Bad workflow-steps check: has_required_fields + Specify tenant_id when retrieving LBaaS/VPNaaS resource - Update to version 2013.2.2.dev19.g7a8eadc: + Give HealthMonitor a proper display name - Update to version 2013.2.2.dev17.gaa55b24: + Common keystone version fallback - Move settings.py (default settings) to branding-upstream subpackage: a branding package might want to change some default settings. - add 0001-Common-keystone-version-fallback.patch, 0001-Use-default_project_id-for-v3-users.patch - Update to version 2013.2.2.dev15.g2b6dfa7: + fix help text in "Create An image" window + Change how scrollShift is calculated + unify keypair name handling - Add 0001-Give-no-background-color-to-the-pie-charts.patch: do not give a background color to pie charts. - Update to version 2013.2.2.dev9.gc6d38a1: + Wrong marker sent to keystone - Update to version 2013.2.2.dev7.g2e11482: + Adding management_url to test mock client - add 0001-Bad-workflow-steps-check-has_required_fields.patch - Make python-horizon require the 2013.2 version of python-horizon-branding (and not the 2013.2.xyz version). This makes it easier to create non-upstream branding; we already do this for the other branding subpackage. - Update to version 2013.2.2.dev6.g2c1f1f3: + Add check for BlockDeviceMappingV2 nova extension + Gracefully handle Users with no email attribute + Import install_venv from oslo + Bump stable/havana next version to 2013.2.2 - Update to version 2013.2.1.dev41.g9668e80: + Updated from global requirements - put everything under /srv/www/openstack-dashboard - Update to version 2013.2.1.dev40.g852e5c8: + Import translations for Havana 2013.2.1 udpate + Deleting statistics tables from resource usage page + Allow "Working" in spinner to be translatable + lbaas/horizon - adds tcp protocol choice when create lb + Fix a bug some optional field in LBaaS are mandatory + Fix bug so that escaped html is not shown in volume detach dialog + Role name should not be translated in Domain Groups dialog + Fix incomplete translation of "Update members" widget + Fix translatable string for "Injected File Path Bytes" + Add extra extension file to makemessage command line + Add contextual markers to BatchAction messages + Logging user out after self password change + Add logging configuration for iso8601 module + Ensure all compute meters are listed in dropdown + Fix bug by escaping strings from Nova before displaying them (bnc#852175, CVE-2013-6858) - add/use generic openstack-branding provides - Update to version 2013.2.1.dev9.g842ba5f: + Fix default port of MS SQL in security group template + Provide missing hover hints for instance:<type> meters + translate text: "subnet"/"subnet details" + Change "Tenant" to "Project" + Avoid discarding precision of metering data - Use Django's signed_cookies session backend like upstream and drop the usage of cache_db - No need to set SECRET_KEY anymore, upstream learned it too python-django_openstack_auth was updated to 1.1.3: - Various i18n fixes - Revoke tokens when logging out or changing the tenant - Run tests locally, therefore merge test package back into main - Properly build HTML documentation and install it - Add pt_BR locale - Updated (build) requirements - Add django_openstack_auth-hacking-requires.patch: hacking dep is nonsense - include tests runner - add -test subpackage Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-39 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): openstack-dashboard-2013.2.5.dev2.g9ee7273-4.1 openstack-dashboard-branding-upstream-2013.2.5.dev2.g9ee7273-4.1 openstack-dashboard-test-2013.2.5.dev2.g9ee7273-4.1 python-django_openstack_auth-1.1.3-4.1 python-horizon-2013.2.5.dev2.g9ee7273-4.1 python-horizon-branding-upstream-2013.2.5.dev2.g9ee7273-4.1 References: http://support.novell.com/security/cve/CVE-2013-6858.html http://support.novell.com/security/cve/CVE-2014-0157.html http://support.novell.com/security/cve/CVE-2014-3473.html http://support.novell.com/security/cve/CVE-2014-3474.html http://support.novell.com/security/cve/CVE-2014-3475.html http://support.novell.com/security/cve/CVE-2014-3594.html http://support.novell.com/security/cve/CVE-2014-8124.html https://bugzilla.suse.com/show_bug.cgi?id=852175 https://bugzilla.suse.com/show_bug.cgi?id=869696 https://bugzilla.suse.com/show_bug.cgi?id=871855 https://bugzilla.suse.com/show_bug.cgi?id=885588 https://bugzilla.suse.com/show_bug.cgi?id=891815 https://bugzilla.suse.com/show_bug.cgi?id=908199

1 0

openSUSE-SU-2015:0077-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0077-1 Rating: important References: #908892 #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox was updated to version 35.0 (bnc#910669) Notable features: * Firefox Hello with new rooms-based conversations model * Implemented HTTP Public Key Pinning Extension (for enhanced authentication of encrypted connections) Security fixes: * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses * MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio * MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape * MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension * MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - obsolete tracker-miner-firefox < 0.15 because it leads to startup crashes (bnc#908892) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-40 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-35.0-54.2 MozillaFirefox-branding-upstream-35.0-54.2 MozillaFirefox-buildsymbols-35.0-54.2 MozillaFirefox-debuginfo-35.0-54.2 MozillaFirefox-debugsource-35.0-54.2 MozillaFirefox-devel-35.0-54.2 MozillaFirefox-translations-common-35.0-54.2 MozillaFirefox-translations-other-35.0-54.2 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html http://support.novell.com/security/cve/CVE-2014-8642.html http://support.novell.com/security/cve/CVE-2014-8643.html https://bugzilla.suse.com/show_bug.cgi?id=908892 https://bugzilla.suse.com/show_bug.cgi?id=910669

1 0