February 2015 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2015:0248-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 10 Feb '15

10 Feb '15

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0248-1 Rating: moderate References: #901924 #911363 Cross-References: CVE-2014-3707 CVE-2014-8150 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: was updated to version 7.40.0 to fix two security issues. These security issues were fixed: - CVE-2014-8150: CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allowed remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL (bnc#911363). - CVE-2014-3707: The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, did not properly copy HTTP POST data for an easy handle, which triggered an out-of-bounds read that allowed remote web servers to read sensitive memory information (bnc#901924). These non-security issues were fixed: - http_digest: Added support for Windows SSPI based authentication - version info: Added Kerberos V5 to the supported features - Makefile: Added VC targets for WinIDN - SSL: Add PEM format support for public key pinning - smtp: Added support for the conversion of Unix newlines during mail send - smb: Added initial support for the SMB/CIFS protocol - Added support for HTTP over unix domain sockets, - via CURLOPT_UNIX_SOCKET_PATH and --unix-socket - sasl: Added support for GSS-API based Kerberos V5 authentication Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-125=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-125=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): curl-7.40.0-4.1 curl-debuginfo-7.40.0-4.1 curl-debugsource-7.40.0-4.1 libcurl-devel-7.40.0-4.1 libcurl4-7.40.0-4.1 libcurl4-debuginfo-7.40.0-4.1 - openSUSE 13.2 (x86_64): libcurl4-32bit-7.40.0-4.1 libcurl4-debuginfo-32bit-7.40.0-4.1 - openSUSE 13.1 (i586 x86_64): curl-7.40.0-2.35.1 curl-debuginfo-7.40.0-2.35.1 curl-debugsource-7.40.0-2.35.1 libcurl-devel-7.40.0-2.35.1 libcurl4-7.40.0-2.35.1 libcurl4-debuginfo-7.40.0-2.35.1 - openSUSE 13.1 (x86_64): libcurl4-32bit-7.40.0-2.35.1 libcurl4-debuginfo-32bit-7.40.0-2.35.1 References: http://support.novell.com/security/cve/CVE-2014-3707.html http://support.novell.com/security/cve/CVE-2014-8150.html https://bugzilla.suse.com/show_bug.cgi?id=901924 https://bugzilla.suse.com/show_bug.cgi?id=911363

1 0

openSUSE-SU-2015:0247-1: moderate: Security update for openvas-manager
by opensuse-security＠opensuse.org 10 Feb '15

10 Feb '15

openSUSE Security Update: Security update for openvas-manager ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0247-1 Rating: moderate References: #908427 Cross-References: CVE-2014-9220 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: openvas-manager was updated to fix one security issue. This security issue was fixed: * CVE-2014-9220: SQL injection vulnerability (bnc#908427) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-123=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): openvas-manager-4.0.4-6.4.1 openvas-manager-debuginfo-4.0.4-6.4.1 openvas-manager-debugsource-4.0.4-6.4.1 References: http://support.novell.com/security/cve/CVE-2014-9220.html https://bugzilla.suse.com/show_bug.cgi?id=908427

1 0

openSUSE-SU-2015:0245-1: moderate: Security update for llvm
by opensuse-security＠opensuse.org 09 Feb '15

09 Feb '15

openSUSE Security Update: Security update for llvm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0245-1 Rating: moderate References: #874798 Cross-References: CVE-2014-2893 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: llvm was updated to fix one security issue. This security issue was fixed: - Insecure temporary file handling in clang's scan-build utility (CVE-2014-2893). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-122=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libLLVM-3.3-6.7.1 libLLVM-debuginfo-3.3-6.7.1 libclang-3.3-6.7.1 libclang-debuginfo-3.3-6.7.1 llvm-3.3-6.7.1 llvm-clang-3.3-6.7.1 llvm-clang-debuginfo-3.3-6.7.1 llvm-clang-devel-3.3-6.7.1 llvm-debuginfo-3.3-6.7.1 llvm-debugsource-3.3-6.7.1 llvm-devel-3.3-6.7.1 llvm-devel-debuginfo-3.3-6.7.1 llvm-vim-plugins-3.3-6.7.1 - openSUSE 13.1 (x86_64): libLLVM-32bit-3.3-6.7.1 libLLVM-debuginfo-32bit-3.3-6.7.1 References: http://support.novell.com/security/cve/CVE-2014-2893.html https://bugzilla.suse.com/show_bug.cgi?id=874798

1 0

openSUSE-SU-2015:0243-1: moderate: Security update for grep
by opensuse-security＠opensuse.org 09 Feb '15

09 Feb '15

openSUSE Security Update: Security update for grep ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0243-1 Rating: moderate References: #914695 Cross-References: CVE-2015-1345 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: grep was updated to fix one security issue. This security issue was fixed: - Heap buffer overrun with a carefully crafted combination of input and regexp (CVE-2015-1345). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-121=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): grep-2.20-2.4.1 grep-debuginfo-2.20-2.4.1 grep-debugsource-2.20-2.4.1 References: http://support.novell.com/security/cve/CVE-2015-1345.html https://bugzilla.suse.com/show_bug.cgi?id=914695

1 0

openSUSE-SU-2015:0240-1: moderate: Security update for unzip
by opensuse-security＠opensuse.org 09 Feb '15

09 Feb '15

openSUSE Security Update: Security update for unzip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0240-1 Rating: moderate References: #909214 Cross-References: CVE-2014-8139 CVE-2014-8140 CVE-2014-8141 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: unzip was updated to fix security issues. The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification (CVE-2014-8139), the test_compr_eb() (CVE-2014-8140) and the getZip64Data() functions (CVE-2014-8141). The input errors may result in in arbitrary code execution. More info can be found in the oCert announcement: http://seclists.org/oss-sec/2014/q4/1127 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-119=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-119=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): unzip-6.00-26.4.1 unzip-debuginfo-6.00-26.4.1 unzip-debugsource-6.00-26.4.1 unzip-doc-6.00-26.4.1 unzip-rcc-6.00-26.4.1 unzip-rcc-debuginfo-6.00-26.4.1 unzip-rcc-debugsource-6.00-26.4.1 - openSUSE 13.1 (i586 x86_64): unzip-6.00-24.4.1 unzip-debuginfo-6.00-24.4.1 unzip-debugsource-6.00-24.4.1 unzip-doc-6.00-24.4.1 unzip-rcc-6.00-24.4.1 unzip-rcc-debuginfo-6.00-24.4.1 unzip-rcc-debugsource-6.00-24.4.1 References: http://support.novell.com/security/cve/CVE-2014-8139.html http://support.novell.com/security/cve/CVE-2014-8140.html http://support.novell.com/security/cve/CVE-2014-8141.html https://bugzilla.suse.com/show_bug.cgi?id=909214

1 0

openSUSE-SU-2015:0238-1: critical: update for flash-player
by opensuse-security＠opensuse.org 07 Feb '15

07 Feb '15

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0238-1 Rating: critical References: #915918 Cross-References: 2015-0313 2015-0314 2015-0315 2015-0316 2015-0317 2015-0318 2015-0319 2015-0320 2015-0321 2015-0322 2015-0323 2015-0324 2015-0325 2015-0326 2015-0327 2015-0328 2015-0329 2015-0330 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: flash-player was updated to version 11.2.202.442 to fix 18 security issues. These security issues were fixed: - Use-after-free vulnerabilities that could lead to code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322). - Memory corruption vulnerabilities that could lead to code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330). - Type confusion vulnerabilities that could lead to code execution (CVE-2015-0317, CVE-2015-0319). - Heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-0323, CVE-2015-0327). - Buffer overflow vulnerability that could lead to code execution (CVE-2015-0324). - Null pointer dereference issues (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328). More information is available at https://helpx.adobe.com/security/products/flash-player/apsb15-04.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-7=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.442-147.1 flash-player-gnome-11.2.202.442-147.1 flash-player-kde4-11.2.202.442-147.1 References: http://support.novell.com/security/cve/2015-0313.html http://support.novell.com/security/cve/2015-0314.html http://support.novell.com/security/cve/2015-0315.html http://support.novell.com/security/cve/2015-0316.html http://support.novell.com/security/cve/2015-0317.html http://support.novell.com/security/cve/2015-0318.html http://support.novell.com/security/cve/2015-0319.html http://support.novell.com/security/cve/2015-0320.html http://support.novell.com/security/cve/2015-0321.html http://support.novell.com/security/cve/2015-0322.html http://support.novell.com/security/cve/2015-0323.html http://support.novell.com/security/cve/2015-0324.html http://support.novell.com/security/cve/2015-0325.html http://support.novell.com/security/cve/2015-0326.html http://support.novell.com/security/cve/2015-0327.html http://support.novell.com/security/cve/2015-0328.html http://support.novell.com/security/cve/2015-0329.html http://support.novell.com/security/cve/2015-0330.html https://bugzilla.suse.com/show_bug.cgi?id=915918

1 0

openSUSE-SU-2015:0237-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 07 Feb '15

07 Feb '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0237-1 Rating: critical References: #915918 Cross-References: CVE-2015-0313 CVE-2015-0314 CVE-2015-0315 CVE-2015-0316 CVE-2015-0317 CVE-2015-0318 CVE-2015-0319 CVE-2015-0320 CVE-2015-0321 CVE-2015-0322 CVE-2015-0323 CVE-2015-0324 CVE-2015-0325 CVE-2015-0326 CVE-2015-0327 CVE-2015-0328 CVE-2015-0329 CVE-2015-0330 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: flash-player was updated to version 11.2.202.442 to fix 18 security issues. These security issues were fixed: - Use-after-free vulnerabilities that could lead to code execution (CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322). - Memory corruption vulnerabilities that could lead to code execution (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330). - Type confusion vulnerabilities that could lead to code execution (CVE-2015-0317, CVE-2015-0319). - Heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-0323, CVE-2015-0327). - Buffer overflow vulnerability that could lead to code execution (CVE-2015-0324). - Null pointer dereference issues (CVE-2015-0325, CVE-2015-0326, CVE-2015-0328). More information is available at https://helpx.adobe.com/security/products/flash-player/apsb15-04.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-118=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-118=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.442-2.33.1 flash-player-gnome-11.2.202.442-2.33.1 flash-player-kde4-11.2.202.442-2.33.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.442-98.1 flash-player-gnome-11.2.202.442-98.1 flash-player-kde4-11.2.202.442-98.1 References: http://support.novell.com/security/cve/CVE-2015-0313.html http://support.novell.com/security/cve/CVE-2015-0314.html http://support.novell.com/security/cve/CVE-2015-0315.html http://support.novell.com/security/cve/CVE-2015-0316.html http://support.novell.com/security/cve/CVE-2015-0317.html http://support.novell.com/security/cve/CVE-2015-0318.html http://support.novell.com/security/cve/CVE-2015-0319.html http://support.novell.com/security/cve/CVE-2015-0320.html http://support.novell.com/security/cve/CVE-2015-0321.html http://support.novell.com/security/cve/CVE-2015-0322.html http://support.novell.com/security/cve/CVE-2015-0323.html http://support.novell.com/security/cve/CVE-2015-0324.html http://support.novell.com/security/cve/CVE-2015-0325.html http://support.novell.com/security/cve/CVE-2015-0326.html http://support.novell.com/security/cve/CVE-2015-0327.html http://support.novell.com/security/cve/CVE-2015-0328.html http://support.novell.com/security/cve/CVE-2015-0329.html http://support.novell.com/security/cve/CVE-2015-0330.html https://bugzilla.suse.com/show_bug.cgi?id=915918

1 0

openSUSE-RU-2015:0233-1: important: Recommended update for timezone
by maintenance＠opensuse.org 06 Feb '15

06 Feb '15

openSUSE Recommended Update: Recommended update for timezone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2015:0233-1 Rating: important References: #914676 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for timezone provides version 2015a with the following fixes and enhancements: - New positive leap second 2015-06-30 23:59:60 UTC as per IERS Bulletin C 49 (boo#914676) - Mexico state Quintana Roo (America/Cancun) shift from Central Time with DST to Eastern Time without DST on 2015-02-01 02:00. - Chile (America/Santiago) will retain old DST as standard time from April, also Pacific/Easter, and Antarctica/Palmer - Changes affecting past timestamps (Iceland 1837 through 1939) - Some more zones have been turned into links (pre-1970) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-117=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-117=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): timezone-2015a-12.1 timezone-debuginfo-2015a-12.1 timezone-debugsource-2015a-12.1 - openSUSE 13.2 (noarch): timezone-java-2015a-12.1 - openSUSE 13.1 (i586 x86_64): timezone-2015a-16.1 timezone-debuginfo-2015a-16.1 timezone-debugsource-2015a-16.1 - openSUSE 13.1 (noarch): timezone-java-2015a-16.1 References: https://bugzilla.suse.com/show_bug.cgi?id=914676

1 0

openSUSE-SU-2015:0231-1: moderate: Security update for vorbis-tools
by opensuse-security＠opensuse.org 06 Feb '15

06 Feb '15

openSUSE Security Update: Security update for vorbis-tools ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0231-1 Rating: moderate References: #914938 Cross-References: CVE-2014-9640 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: vorbis-tools was updated to fix one security issue. This security issue was fixed: - Segfault when trying to encode trivial raw input (CVE-2014-9640). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-114=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-114=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): vorbis-tools-1.4.0-17.4.1 vorbis-tools-debuginfo-1.4.0-17.4.1 vorbis-tools-debugsource-1.4.0-17.4.1 - openSUSE 13.2 (noarch): vorbis-tools-lang-1.4.0-17.4.1 - openSUSE 13.1 (i586 x86_64): vorbis-tools-1.4.0-14.12.1 vorbis-tools-debuginfo-1.4.0-14.12.1 vorbis-tools-debugsource-1.4.0-14.12.1 - openSUSE 13.1 (noarch): vorbis-tools-lang-1.4.0-14.12.1 References: http://support.novell.com/security/cve/CVE-2014-9640.html https://bugzilla.suse.com/show_bug.cgi?id=914938

1 0

openSUSE-SU-2015:0230-1: moderate: Security update for privoxy
by opensuse-security＠opensuse.org 06 Feb '15

06 Feb '15

openSUSE Security Update: Security update for privoxy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0230-1 Rating: moderate References: #914934 Cross-References: CVE-2015-1380 CVE-2015-1381 CVE-2015-1382 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: privoxy was updated to version 3.0.23 to fix three security issues. These security issues were fixed: - Fixed a DoS issue in case of client requests with incorrect chunk-encoded body. When compiled with assertions enabled (the default) they could previously cause Privoxy to abort() (CVE-2015-1380). - Fixed multiple segmentation faults and memory leaks in the pcrs code. This fix also increases the chances that an invalid pcrs command is rejected as such (CVE-2015-1381). - Client requests with body that can't be delivered no longer cause pipelined requests behind them to be rejected as invalid (CVE-2015-1382). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-115=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-115=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): privoxy-3.0.23-8.8.1 privoxy-debuginfo-3.0.23-8.8.1 privoxy-debugsource-3.0.23-8.8.1 privoxy-doc-3.0.23-8.8.1 - openSUSE 13.1 (i586 x86_64): privoxy-3.0.23-2.20.1 privoxy-debuginfo-3.0.23-2.20.1 privoxy-debugsource-3.0.23-2.20.1 privoxy-doc-3.0.23-2.20.1 References: http://support.novell.com/security/cve/CVE-2015-1380.html http://support.novell.com/security/cve/CVE-2015-1381.html http://support.novell.com/security/cve/CVE-2015-1382.html https://bugzilla.suse.com/show_bug.cgi?id=914934

1 0