- openSUSE Updates

openSUSE-SU-2011:0082-1 (important): tomcat6: fixing a XSS vulnerability (CVE-2010-4172)
by opensuse-security＠opensuse.org 28 Jan '11

28 Jan '11

openSUSE Security Update: tomcat6: fixing a XSS vulnerability (CVE-2010-4172) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0082-1 Rating: important References: #655440 Cross-References: CVE-2010-4172 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a cross-site scripting vulnerability that affects the session list screen. This can be used to steal session cookies because tomcat 6 does not use the httpOnly flag for its cookies. (CVE-2010-4172) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch tomcat6-3849 - openSUSE 11.2: zypper in -t patch tomcat6-3849 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch): tomcat6-6.0.24-5.8.2 tomcat6-admin-webapps-6.0.24-5.8.2 tomcat6-docs-webapp-6.0.24-5.8.2 tomcat6-el-1_0-api-6.0.24-5.8.2 tomcat6-javadoc-6.0.24-5.8.2 tomcat6-jsp-2_1-api-6.0.24-5.8.2 tomcat6-lib-6.0.24-5.8.2 tomcat6-servlet-2_5-api-6.0.24-5.8.2 tomcat6-webapps-6.0.24-5.8.2 - openSUSE 11.2 (noarch): tomcat6-6.0.20-24.27.2 tomcat6-admin-webapps-6.0.20-24.27.2 tomcat6-docs-webapp-6.0.20-24.27.2 tomcat6-javadoc-6.0.20-24.27.2 tomcat6-jsp-2_1-api-6.0.20-24.27.2 tomcat6-lib-6.0.20-24.27.2 tomcat6-servlet-2_5-api-6.0.20-24.27.2 tomcat6-webapps-6.0.20-24.27.2 References: http://support.novell.com/security/cve/CVE-2010-4172.html https://bugzilla.novell.com/655440

1 0

openSUSE-RU-2011:0081-1 (low): exiv2: Fix crash on reading some files
by maintenance＠opensuse.org 28 Jan '11

28 Jan '11

openSUSE Recommended Update: exiv2: Fix crash on reading some files ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0081-1 Rating: low References: #661016 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides a crash fix for opening certain frequently occuring crashes when opening exif image files(bnc#661016). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch exiv2-3884 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): exiv2-0.19-5.3.1 libexiv2-6-0.19-5.3.1 libexiv2-devel-0.19-5.3.1 - openSUSE 11.3 (x86_64): libexiv2-6-32bit-0.19-5.3.1 - openSUSE 11.3 (noarch): exiv2-lang-0.19-5.3.1 References: https://bugzilla.novell.com/661016

1 0

openSUSE-RU-2011:0077-1 (low): tracker: Plug file descriptor leaks. Fixed by this update.
by maintenance＠opensuse.org 25 Jan '11

25 Jan '11

openSUSE Recommended Update: tracker: Plug file descriptor leaks. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0077-1 Rating: low References: #617425 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Due to leaks in the gstreamer and xmp extractors in tracker, resources were not being appropriately freed. This update fixes this problem. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch evolution-tracker-3848 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): evolution-tracker-0.8.5-3.5.1 libtracker-client-0_8-0-0.8.5-3.5.1 libtracker-extract-0_8-0-0.8.5-3.5.1 libtracker-miner-0_8-0-0.8.5-3.5.1 nautilus-tracker-0.8.5-3.5.1 tracker-0.8.5-3.5.1 tracker-applet-0.8.5-3.5.1 tracker-devel-0.8.5-3.5.1 tracker-gui-0.8.5-3.5.1 - openSUSE 11.3 (noarch): tracker-lang-0.8.5-3.5.1 References: https://bugzilla.novell.com/617425

1 0

openSUSE-SU-2011:0068-1 (moderate): hplip security update (CVE-2010-4267)
by opensuse-security＠opensuse.org 21 Jan '11

21 Jan '11

openSUSE Security Update: hplip security update (CVE-2010-4267) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0068-1 Rating: moderate References: #336658 Cross-References: CVE-2010-4267 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted SNMP replies could cause a buffer overflow in hplip's sane backend (CVE-2010-4267). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch hplip-3814 - openSUSE 11.2: zypper in -t patch hplip-3814 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): hplip-3.10.2-2.3.1 hplip-hpijs-3.10.2-2.3.1 - openSUSE 11.2 (i586 x86_64): hplip-3.9.8-3.6.1 hplip-hpijs-3.9.8-3.6.1 References: http://support.novell.com/security/cve/CVE-2010-4267.html https://bugzilla.novell.com/336658

1 0

openSUSE-SU-2011:0064-1 (important): perl: fixed multiple header injection problems in CGI module (CVE-2010-2761, CVE-2010-4410,CVE-2010-4411).
by opensuse-security＠opensuse.org 20 Jan '11

20 Jan '11

openSUSE Security Update: perl: fixed multiple header injection problems in CGI module (CVE-2010-2761, CVE-2010-4410,CVE-2010-4411). ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0064-1 Rating: important References: #657343 Cross-References: CVE-2010-2761 CVE-2010-3172 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses. CVE-2010-2761, CVE-2010-4410 and CVE-2010-4411 have been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch perl-3806 - openSUSE 11.2: zypper in -t patch perl-3806 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): perl-5.12.1-2.3.1 perl-base-5.12.1-2.3.1 - openSUSE 11.3 (x86_64): perl-32bit-5.12.1-2.3.1 perl-base-32bit-5.12.1-2.3.1 - openSUSE 11.3 (noarch): perl-doc-5.12.1-2.3.1 - openSUSE 11.2 (i586 x86_64): perl-5.10.0-72.9.1 perl-base-5.10.0-72.9.1 perl-doc-5.10.0-72.9.1 - openSUSE 11.2 (x86_64): perl-32bit-5.10.0-72.9.1 perl-base-32bit-5.10.0-72.9.1 References: http://support.novell.com/security/cve/CVE-2010-2761.html http://support.novell.com/security/cve/CVE-2010-3172.html https://bugzilla.novell.com/657343

1 0

openSUSE-RU-2011:0063-1 (low): spamassassin: Update configuration enhancements
by maintenance＠opensuse.org 20 Jan '11

20 Jan '11

openSUSE Recommended Update: spamassassin: Update configuration enhancements ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0063-1 Rating: low References: #650645 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update adds a daily cron job run for calling sa-update. In addition, it removes a warning in spamd (bnc#650645) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch perl-Mail-SpamAssassin-3837 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): perl-Mail-SpamAssassin-3.3.1-3.3.1 perl-Mail-SpamAssassin-Plugin-iXhash-1.5.5-3.3.1 spamassassin-3.3.1-3.3.1 References: https://bugzilla.novell.com/650645

1 0

openSUSE-SU-2011:0058-1 (low): sssd: local denial of service (CVE-2010-4341)
by opensuse-security＠opensuse.org 19 Jan '11

19 Jan '11

openSUSE Security Update: sssd: local denial of service (CVE-2010-4341) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0058-1 Rating: low References: #660481 Cross-References: CVE-2010-4341 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a local denial-of-service attack that stops other users from logging in. The bug existed in the pam_parse_in_data_v2() function. (CVE-2010-4341: CVSS v2 Base Score: 2.1) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libcollection-devel-3829 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libcollection-devel-0.4.0-2.3.1 libcollection1-0.4.0-2.3.1 libdhash-devel-0.4.0-2.3.1 libdhash1-0.4.0-2.3.1 libini_config-devel-0.4.0-2.3.1 libini_config1-0.4.0-2.3.1 python-sssd-config-1.1.0-2.3.1 sssd-1.1.0-2.3.1 sssd-ipa-provider-1.1.0-2.3.1 sssd-tools-1.1.0-2.3.1 - openSUSE 11.3 (x86_64): sssd-32bit-1.1.0-2.3.1 References: http://support.novell.com/security/cve/CVE-2010-4341.html https://bugzilla.novell.com/660481

1 0

openSUSE-SU-2011:0057-1 (moderate): java-1_6_0-openjdk: security update for JNLPSecurityManager
by opensuse-security＠opensuse.org 19 Jan '11

19 Jan '11

openSUSE Security Update: java-1_6_0-openjdk: security update for JNLPSecurityManager ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0057-1 Rating: moderate References: #635365 #664298 Cross-References: CVE-2010-4351 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of java-1_6_0-openjdk improves the return value handling of JNLPSecurityManager. Prior to this update the JNLPSecurityManager silently returns in some cases when a permission was denied. (CVE-2010-4351) Additionally the java path was fixed to make java work with firefox again. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch java-1_6_0-openjdk-3827 - openSUSE 11.2: zypper in -t patch java-1_6_0-openjdk-3827 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b20.1.9.4-1.2.1 java-1_6_0-openjdk-devel-1.6.0.0_b20.1.9.4-1.2.1 java-1_6_0-openjdk-plugin-1.6.0.0_b20.1.9.4-1.2.1 - openSUSE 11.3 (noarch): java-1_6_0-openjdk-demo-1.6.0.0_b20.1.9.4-1.2.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b20.1.9.4-1.2.1 java-1_6_0-openjdk-src-1.6.0.0_b20.1.9.4-1.2.1 - openSUSE 11.2 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b20.1.9.4-1.2.1 java-1_6_0-openjdk-devel-1.6.0.0_b20.1.9.4-1.2.1 java-1_6_0-openjdk-plugin-1.6.0.0_b20.1.9.4-1.2.1 - openSUSE 11.2 (noarch): java-1_6_0-openjdk-demo-1.6.0.0_b20.1.9.4-1.2.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b20.1.9.4-1.2.1 java-1_6_0-openjdk-src-1.6.0.0_b20.1.9.4-1.2.1 References: http://support.novell.com/security/cve/CVE-2010-4351.html https://bugzilla.novell.com/635365 https://bugzilla.novell.com/664298

1 0

openSUSE-YU-2011:0056-1 (important): Software Update Stack Update 2011/01
by maintenance＠opensuse.org 19 Jan '11

19 Jan '11

openSUSE YOU Update: Software Update Stack Update 2011/01 ______________________________________________________________________________ Announcement ID: openSUSE-YU-2011:0056-1 Rating: important References: #431854 #448736 #577118 #593617 #594850 #599154 #607572 #607583 #613304 #619196 #635596 #650822 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has 12 YOU fixes can now be installed. It includes three new package versions. Description: This is a collective update for the SUSE Software Update Stack, including fixes for the following reports: zypper: - 448736: Better error message for non-root search for outdated repo - 619196: Fix zypper's password dialog - 650822: Exit with error if zypper repo modification failed libsatsolver: - updateinfoxml: Correctly parse 'issued date' field. libzypp: - Implement support for patch category "feature" - 431854: Yast2 sw_single and zypper don't handle failed package downloads properly - commit doesn't report an error - 577118: Ignore an update in Software Updater - 593617: Always refresh a repository if last refresh has a date in the future - 594850: Packages From Added Iso Image Are Not Available - 607572: Edition with epoch 0 and without epoch are not treated as being equal. - 607583: Packages built via .drpms may get stored outside or in a wrong package cache. - 613304: libzypp fails to execute uuidgen - 635596: zypper in --download-only doesn't download Special Instructions and Notes: Please reboot the system after installing this update.This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. Patch Instructions: To install this openSUSE YOU Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch softwaremgmt-201101-3745 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64) [New Version: 0.14.18,1.3.11 and 6.34.0]: libsatsolver-demo-0.14.18-0.1.1 libsatsolver-devel-0.14.18-0.1.1 libzypp-6.34.0-0.1.1 libzypp-devel-6.34.0-0.1.1 perl-satsolver-0.14.18-0.1.1 python-satsolver-0.14.18-0.1.1 ruby-satsolver-0.14.18-0.1.1 satsolver-tools-0.14.18-0.1.1 zypper-1.3.11-0.1.1 References: https://bugzilla.novell.com/431854 https://bugzilla.novell.com/448736 https://bugzilla.novell.com/577118 https://bugzilla.novell.com/593617 https://bugzilla.novell.com/594850 https://bugzilla.novell.com/599154 https://bugzilla.novell.com/607572 https://bugzilla.novell.com/607583 https://bugzilla.novell.com/613304 https://bugzilla.novell.com/619196 https://bugzilla.novell.com/635596 https://bugzilla.novell.com/650822

1 0

openSUSE-SU-2011:0050-1 (moderate): sudo: security udpate
by opensuse-security＠opensuse.org 19 Jan '11

19 Jan '11

openSUSE Security Update: sudo: security udpate ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0050-1 Rating: moderate References: #594738 #663881 Cross-References: CVE-2010-1163 CVE-2010-1646 CVE-2011-0010 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update of sudo fixes: - CVE-2011-0010: Does ask for the user password for GID changes now. - CVE-2010-1646: CVSS v2 Base Score: 6.6 (CWE-264): The secure environment option can handle multiple occurrence of PATH now. - CVE-2010-1163: CVSS v2 Base Score: 6.9 (CWE-20): Improved command matching. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch sudo-3811 - openSUSE 11.2: zypper in -t patch sudo-3811 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): sudo-1.7.2p7-2.3.1 - openSUSE 11.2 (i586 x86_64): sudo-1.7.2-2.5.1 References: http://support.novell.com/security/cve/CVE-2010-1163.html http://support.novell.com/security/cve/CVE-2010-1646.html http://support.novell.com/security/cve/CVE-2011-0010.html https://bugzilla.novell.com/594738 https://bugzilla.novell.com/663881

1 0

openSUSE-SU-2011:0049-1 (important): opensc security update
by opensuse-security＠opensuse.org 19 Jan '11

19 Jan '11

openSUSE Security Update: opensc security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0049-1 Rating: important References: #660109 Cross-References: CVE-2010-4523 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted smart cards could cause a buffer overflow in opensc (CVE-2010-4523). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libopensc2-3737 - openSUSE 11.2: zypper in -t patch libopensc2-3737 - openSUSE 11.1: zypper in -t patch libopensc2-3737 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libopensc2-0.11.13-2.3.1 opensc-0.11.13-2.3.1 opensc-devel-0.11.13-2.3.1 - openSUSE 11.3 (x86_64): libopensc2-32bit-0.11.13-2.3.1 opensc-32bit-0.11.13-2.3.1 - openSUSE 11.2 (i586 x86_64): libopensc2-0.11.9-2.3.1 opensc-0.11.9-2.3.1 opensc-devel-0.11.9-2.3.1 - openSUSE 11.2 (x86_64): libopensc2-32bit-0.11.9-2.3.1 opensc-32bit-0.11.9-2.3.1 - openSUSE 11.1 (i586 ppc x86_64): libopensc2-0.11.6-5.3.1 opensc-0.11.6-5.3.1 opensc-devel-0.11.6-5.3.1 - openSUSE 11.1 (x86_64): libopensc2-32bit-0.11.6-5.3.1 opensc-32bit-0.11.6-5.3.1 - openSUSE 11.1 (ppc): libopensc2-64bit-0.11.6-5.3.1 opensc-64bit-0.11.6-5.3.1 References: http://support.novell.com/security/cve/CVE-2010-4523.html https://bugzilla.novell.com/660109

1 0

openSUSE-SU-2011:0048-1 (important): SLE11 SP1
by opensuse-security＠opensuse.org 19 Jan '11

19 Jan '11

openSUSE Security Update: SLE11 SP1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0048-1 Rating: important References: #595215 #602838 #615630 #628180 #636672 #637542 #638258 #639803 #640878 #641105 #641811 #642043 #642313 #642314 #642486 #643173 #643477 #645659 #646226 #646542 #646702 #646908 #647567 #648112 #648701 #649187 #649548 #650067 #650185 #650487 #650748 #651066 #651218 #651596 #652024 #652293 #652563 #652603 #652842 #652939 #652940 #652945 #653148 #653258 #653260 #653266 #653800 #653930 #654150 #654530 #654581 #654701 #654837 #654967 #655027 #655278 #656471 #657324 #657350 #657412 #657415 #657976 #658464 #658829 #659144 Cross-References: CVE-2010-3437 CVE-2010-3861 CVE-2010-3874 CVE-2010-3881 CVE-2010-4072 CVE-2010-4073 CVE-2010-4082 CVE-2010-4083 CVE-2010-4157 CVE-2010-4158 CVE-2010-4160 CVE-2010-4162 CVE-2010-4163 CVE-2010-4164 CVE-2010-4165 CVE-2010-4169 CVE-2010-4175 CVE-2010-4258 Affected Products: SLE 11 SERVER Unsupported Extras ______________________________________________________________________________ An update that solves 18 vulnerabilities and has 47 fixes is now available. Description: The SUSE Linux Enterprise 11 Service Pack 1 kernel was updated to 2.6.32.27 and fixes various bugs and security issues. Following security issues were fixed: CVE-2010-4258: A local attacker could use a Oops (kernel crash) caused by other flaws to write a 0 byte to a attacker controlled address in the kernel. This could lead to privilege escalation together with other issues. CVE-2010-4160: A overflow in sendto() and recvfrom() routines was fixed that could be used by local attackers to potentially crash the kernel using some socket families like L2TP. CVE-2010-4157: A 32bit vs 64bit integer mismatch in gdth_ioctl_alloc could lead to memory corruption in the GDTH driver. CVE-2010-4165: The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel did not properly restrict TCP_MAXSEG (aka MSS) values, which allowed local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer. CVE-2010-4164: A remote (or local) attacker communicating over X.25 could cause a kernel panic by attempting to negotiate malformed facilities. CVE-2010-4175: A local attacker could cause memory overruns in the RDS protocol stack, potentially crashing the kernel. So far it is considered not to be exploitable. CVE-2010-4169: Use-after-free vulnerability in mm/mprotect.c in the Linux kernel allwed local users to cause a denial of service via vectors involving an mprotect system call. CVE-2010-3874: A minor heap overflow in the CAN network module was fixed. Due to nature of the memory allocator it is likely not exploitable. CVE-2010-4158: A memory information leak in berkely packet filter rules allowed local attackers to read uninitialized memory of the kernel stack. CVE-2010-4162: A local denial of service in the blockdevice layer was fixed. CVE-2010-4163: By submitting certain I/O requests with 0 length, a local user could have caused a kernel panic. CVE-2010-3861: The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel did not initialize a certain block of heap memory, which allowed local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value. CVE-2010-3881: arch/x86/kvm/x86.c in the Linux kernel did not initialize certain structure members, which allowed local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device. CVE-2010-3437: A range checking overflow in pktcdvd ioctl was fixed. CVE-2010-4082: The viafb_ioctl_get_viafb_info function in drivers/video/via/ioctl.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call. CVE-2010-4073: The ipc subsystem in the Linux kernel did not initialize certain structures, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in ipc/compat_mq.c. CVE-2010-4072: The copy_shmid_to_user function in ipc/shm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the shmctl system call and the "old shm interface." CVE-2010-4083: The copy_semid_to_user function in ipc/sem.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via a (1) IPC_INFO, (2) SEM_INFO, (3) IPC_STAT, or (4) SEM_STAT command in a semctl system call. Special Instructions and Notes: Please reboot the system after installing this update. Package List: - SLE 11 SERVER Unsupported Extras (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-2.6.32.27-0.2.2 - SLE 11 SERVER Unsupported Extras (i586 x86_64): kernel-xen-extra-2.6.32.27-0.2.2 - SLE 11 SERVER Unsupported Extras (ppc64): kernel-ppc64-extra-2.6.32.27-0.2.2 - SLE 11 SERVER Unsupported Extras (i586): kernel-pae-extra-2.6.32.27-0.2.2 References: http://support.novell.com/security/cve/CVE-2010-3437.html http://support.novell.com/security/cve/CVE-2010-3861.html http://support.novell.com/security/cve/CVE-2010-3874.html http://support.novell.com/security/cve/CVE-2010-3881.html http://support.novell.com/security/cve/CVE-2010-4072.html http://support.novell.com/security/cve/CVE-2010-4073.html http://support.novell.com/security/cve/CVE-2010-4082.html http://support.novell.com/security/cve/CVE-2010-4083.html http://support.novell.com/security/cve/CVE-2010-4157.html http://support.novell.com/security/cve/CVE-2010-4158.html http://support.novell.com/security/cve/CVE-2010-4160.html http://support.novell.com/security/cve/CVE-2010-4162.html http://support.novell.com/security/cve/CVE-2010-4163.html http://support.novell.com/security/cve/CVE-2010-4164.html http://support.novell.com/security/cve/CVE-2010-4165.html http://support.novell.com/security/cve/CVE-2010-4169.html http://support.novell.com/security/cve/CVE-2010-4175.html http://support.novell.com/security/cve/CVE-2010-4258.html https://bugzilla.novell.com/595215 https://bugzilla.novell.com/602838 https://bugzilla.novell.com/615630 https://bugzilla.novell.com/628180 https://bugzilla.novell.com/636672 https://bugzilla.novell.com/637542 https://bugzilla.novell.com/638258 https://bugzilla.novell.com/639803 https://bugzilla.novell.com/640878 https://bugzilla.novell.com/641105 https://bugzilla.novell.com/641811 https://bugzilla.novell.com/642043 https://bugzilla.novell.com/642313 https://bugzilla.novell.com/642314 https://bugzilla.novell.com/642486 https://bugzilla.novell.com/643173 https://bugzilla.novell.com/643477 https://bugzilla.novell.com/645659 https://bugzilla.novell.com/646226 https://bugzilla.novell.com/646542 https://bugzilla.novell.com/646702 https://bugzilla.novell.com/646908 https://bugzilla.novell.com/647567 https://bugzilla.novell.com/648112 https://bugzilla.novell.com/648701 https://bugzilla.novell.com/649187 https://bugzilla.novell.com/649548 https://bugzilla.novell.com/650067 https://bugzilla.novell.com/650185 https://bugzilla.novell.com/650487 https://bugzilla.novell.com/650748 https://bugzilla.novell.com/651066 https://bugzilla.novell.com/651218 https://bugzilla.novell.com/651596 https://bugzilla.novell.com/652024 https://bugzilla.novell.com/652293 https://bugzilla.novell.com/652563 https://bugzilla.novell.com/652603 https://bugzilla.novell.com/652842 https://bugzilla.novell.com/652939 https://bugzilla.novell.com/652940 https://bugzilla.novell.com/652945 https://bugzilla.novell.com/653148 https://bugzilla.novell.com/653258 https://bugzilla.novell.com/653260 https://bugzilla.novell.com/653266 https://bugzilla.novell.com/653800 https://bugzilla.novell.com/653930 https://bugzilla.novell.com/654150 https://bugzilla.novell.com/654530 https://bugzilla.novell.com/654581 https://bugzilla.novell.com/654701 https://bugzilla.novell.com/654837 https://bugzilla.novell.com/654967 https://bugzilla.novell.com/655027 https://bugzilla.novell.com/655278 https://bugzilla.novell.com/656471 https://bugzilla.novell.com/657324 https://bugzilla.novell.com/657350 https://bugzilla.novell.com/657412 https://bugzilla.novell.com/657415 https://bugzilla.novell.com/657976 https://bugzilla.novell.com/658464 https://bugzilla.novell.com/658829 https://bugzilla.novell.com/659144

1 0

openSUSE-SU-2011:0045-1 (moderate): Fixing evince DVI font parser vulnerabilities (CVE-2010-2640 - CVE-2010-2643).
by opensuse-security＠opensuse.org 19 Jan '11

19 Jan '11

openSUSE Security Update: Fixing evince DVI font parser vulnerabilities (CVE-2010-2640 - CVE-2010-2643). ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0045-1 Rating: moderate References: #660555 Cross-References: CVE-2010-2640 CVE-2010-2641 CVE-2010-2642 CVE-2010-2643 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: Multiple font parser vulnerabilities in the DVI backend of evince have been fixed. CVE-2010-2640 - CVE-2010-2643 have been assigned to these issues. Special Instructions and Notes: This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch evince-3774 - openSUSE 11.2: zypper in -t patch evince-3774 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): evince-2.30.1-3.3.1 evince-devel-2.30.1-3.3.1 nautilus-evince-2.30.1-3.3.1 - openSUSE 11.3 (noarch): evince-lang-2.30.1-3.3.1 - openSUSE 11.2 (i586 x86_64) [New Version: 2.28.2]: evince-2.28.2-0.3.1 evince-devel-2.28.2-0.3.1 - openSUSE 11.2 (noarch) [New Version: 2.28.2]: evince-lang-2.28.2-0.3.1 References: http://support.novell.com/security/cve/CVE-2010-2640.html http://support.novell.com/security/cve/CVE-2010-2641.html http://support.novell.com/security/cve/CVE-2010-2642.html http://support.novell.com/security/cve/CVE-2010-2643.html https://bugzilla.novell.com/660555

1 0

openSUSE-RU-2011:0043-1 (moderate): NetworkManager-kde4: Fix handling of BSSID
by maintenance＠opensuse.org 19 Jan '11

19 Jan '11

openSUSE Recommended Update: NetworkManager-kde4: Fix handling of BSSID ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0043-1 Rating: moderate References: #653514 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update adds fixes to handle BSSID settings correctly (bko238046,bnc#653514,bnc#653515). Special Instructions and Notes: This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch NetworkManager-kde4-3798 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): NetworkManager-kde4-0.9.svn1057339-5.3.1 NetworkManager-kde4-libs-0.9.svn1057339-5.3.1 NetworkManager-novellvpn-kde4-0.9.svn1057339-5.3.1 NetworkManager-openvpn-kde4-0.9.svn1057339-5.3.1 NetworkManager-pptp-kde4-0.9.svn1057339-5.3.1 NetworkManager-vpnc-kde4-0.9.svn1057339-5.3.1 plasmoid-networkmanagement-0.9.svn1057339-5.3.1 - openSUSE 11.3 (noarch): NetworkManager-kde4-lang-0.9.svn1057339-5.3.1 References: https://bugzilla.novell.com/653514

1 0

openSUSE-RU-2011:0032-1 (low): tar: This update fixes an endless loop if unpacking symbolic links with -k.
by maintenance＠opensuse.org 13 Jan '11

13 Jan '11

openSUSE Recommended Update: tar: This update fixes an endless loop if unpacking symbolic links with -k. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0032-1 Rating: low References: #662408 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: When using "tar -k" to unpack a tarball which contains symbolic links to a directory, where the symbolic link already exists, tar gets into an endless loop and has to be killed. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch tar-3790 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): tar-1.23-2.5.1 tar-backup-scripts-1.23-2.5.1 - openSUSE 11.3 (noarch): tar-lang-1.23-2.5.1 References: https://bugzilla.novell.com/662408

1 0

openSUSE-RU-2011:0031-1 (moderate): sysconfig: Collective update fixing several bugs.
by maintenance＠opensuse.org 13 Jan '11

13 Jan '11

openSUSE Recommended Update: sysconfig: Collective update fixing several bugs. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0031-1 Rating: moderate References: #630434 #660774 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This collective update provides corrections for the following sysconfig issues: #630434: Fix for udevmountd to allow mounting of multipath devices. With this and the corresponding multipath-tools patch, iscsi mounting works as advertised, both multipathed and non-multipathed. #660774: Fixed ifup-bonding to fail and remove bond when there are no active slaves at the end and not on first enslave failure. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch sysconfig-3803 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): sysconfig-0.73.7-2.5.1 References: https://bugzilla.novell.com/630434 https://bugzilla.novell.com/660774

1 0

openSUSE-RU-2011:0027-1 (moderate): Xen: Collective Update 2011/01
by maintenance＠opensuse.org 12 Jan '11

12 Jan '11

openSUSE Recommended Update: Xen: Collective Update 2011/01 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0027-1 Rating: moderate References: #497149 #552115 #583568 #603371 #615206 #618087 #628701 #628719 #628729 #629022 #635380 #636231 #638465 #639546 #640370 #640773 #640874 #641144 #641859 #642078 #643477 #647681 #649277 #649864 #650871 #652935 #656245 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has 27 recommended fixes can now be installed. It includes one version update. Description: Collective Xen Update, fixing the following reports: Xen Hypervisor and Tools - 628729 - [xm command]xm list performance is not good - 652935 - Corrupted display when booting xen kernel - 649864 - automatic numa cpu placement of xen conflicts with cpupools - 641144 - FV Xen VM running windows or linux cannot write to virtual floppy drive - 552115 - Remove target discovery in block-iscsi - 649277 - Fix pci passthru in xend interface used by libvirt - 642078 - xm snapshot-create causes qemu-dm to SEGV - 647681 - L3: Passthrough of certain PCI device broken after SLES 11 to SP1 upgrade - 650871 - Regression in Xen PCI Passthrough - 497149 - SLES11 64bit Xen - SLES11 64bit HVM guest has corrupt text console - 640370 - VM graphic console in VNC is corrupted - 583568 - Xen kernel is not booting - 615206 - Xen kernel fails to boot with IO-APIC problem - 640773 - Xen kernel crashing right after grub - 643477 - issues with PCI hotplug/hotunplug to Xen driver domain - 618087 - VNC view won't stay connected to fully virtualized Linux Xen VMs - 639546 - Dom-U deleted after introduction of the parameter "change_home_server False" in the VM configuration - 641859 - block-dmmd script does not handle the configuration when only MD is used - 640773 - Xen kernel crashing right after grub - 628719 - improve check_device_status to handle HA cases - 636231 - XEN: Unable to disconnect/remove CDROM drive from VM - 638465 - hypervisor panic in memory handling - 635380 - Fix pygrub Grub2 support - 628701 - Improve performance when activate/deactivate dmmd devices - 628701 - Fix qemu-dm handling of dmmd devices - 651822 - Fix xm snapshot-xxx scripts lead to an chkdsk - 656245 - Fix application or kernel in any pv domain able to crash Xen - 658163 - Fix boot on Nehalem systems - 659085 - Fix reboot for unknown reason (disable regression causing patch) - 659070 - Revert keyboard fixes Virtual Machine Installer (vm-install) - 640874 - vm-install not creating guest with proper qcow2 disk image format - 629022 - [vm-install]max nics when create VM (Allow up to 8 nics instead of 3.) - 603371 - In KVM SVVP HAL timer tests (HCT) are failing (Disable hpet for windows guests on KVM.) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch xen-201101-3779 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 0.4.27]: vm-install-0.4.27-2.1.2 xen-4.0.1_21326_02-0.5.1 xen-devel-4.0.1_21326_02-0.5.1 xen-doc-html-4.0.1_21326_02-0.5.1 xen-doc-pdf-4.0.1_21326_02-0.5.1 xen-kmp-default-4.0.1_21326_02_k2.6.34.7_0.7-0.5.1 xen-kmp-desktop-4.0.1_21326_02_k2.6.34.7_0.7-0.5.1 xen-libs-4.0.1_21326_02-0.5.1 xen-tools-4.0.1_21326_02-0.5.1 xen-tools-domU-4.0.1_21326_02-0.5.1 - openSUSE 11.3 (i586): xen-kmp-pae-4.0.1_21326_02_k2.6.34.7_0.7-0.5.1 References: https://bugzilla.novell.com/497149 https://bugzilla.novell.com/552115 https://bugzilla.novell.com/583568 https://bugzilla.novell.com/603371 https://bugzilla.novell.com/615206 https://bugzilla.novell.com/618087 https://bugzilla.novell.com/628701 https://bugzilla.novell.com/628719 https://bugzilla.novell.com/628729 https://bugzilla.novell.com/629022 https://bugzilla.novell.com/635380 https://bugzilla.novell.com/636231 https://bugzilla.novell.com/638465 https://bugzilla.novell.com/639546 https://bugzilla.novell.com/640370 https://bugzilla.novell.com/640773 https://bugzilla.novell.com/640874 https://bugzilla.novell.com/641144 https://bugzilla.novell.com/641859 https://bugzilla.novell.com/642078 https://bugzilla.novell.com/643477 https://bugzilla.novell.com/647681 https://bugzilla.novell.com/649277 https://bugzilla.novell.com/649864 https://bugzilla.novell.com/650871 https://bugzilla.novell.com/652935 https://bugzilla.novell.com/656245

1 0

openSUSE-RU-2011:0026-1 (low): yast2: Fix for YaST2 module list from command line invocation
by maintenance＠opensuse.org 12 Jan '11

12 Jan '11

openSUSE Recommended Update: yast2: Fix for YaST2 module list from command line invocation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0026-1 Rating: low References: #621848 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This patch fixes bash completion in invoking yast, in particular listing of YaST modules, which missed some modules Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch yast2-3786 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.19.14]: yast2-2.19.14-0.3.1 yast2-devel-doc-2.19.14-0.3.1 References: https://bugzilla.novell.com/621848

1 0

openSUSE-SU-2011:0024-1 (important): Fixing various bugs in webkit.
by opensuse-security＠opensuse.org 12 Jan '11

12 Jan '11

1 0

openSUSE-SU-2011:0010-2 (important): wireshark security update
by opensuse-security＠opensuse.org 12 Jan '11

12 Jan '11

openSUSE Security Update: wireshark security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0010-2 Rating: important References: #603251 #613487 #630599 #643078 #655448 Cross-References: CVE-2010-1455 CVE-2010-2283 CVE-2010-2284 CVE-2010-2285 CVE-2010-2286 CVE-2010-2287 CVE-2010-2992 CVE-2010-2993 CVE-2010-2994 CVE-2010-2995 CVE-2010-3445 CVE-2010-4300 CVE-2010-4301 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. It includes one version update. Description: Wireshark version 1.4.2 fixes several security issues that allowed attackers to crash wireshark or potentially even execute arbitrary code (CVE-2010-1455, CVE-2010-2283, CVE-2010-2284, CVE-2010-2285, CVE-2010-2286, CVE-2010-2287, CVE-2010-2992, CVE-2010-2993, CVE-2010-2994, CVE-2010-2995, CVE-2010-3445, CVE-2010-4300, CVE-2010-4301) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch wireshark-3738 - openSUSE 11.2: zypper in -t patch wireshark-3738 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 1.4.2]: wireshark-1.4.2-1.1.2 wireshark-devel-1.4.2-1.1.2 - openSUSE 11.2 (i586 x86_64) [New Version: 1.4.2]: wireshark-1.4.2-1.1.1 wireshark-devel-1.4.2-1.1.1 References: http://support.novell.com/security/cve/CVE-2010-1455.html http://support.novell.com/security/cve/CVE-2010-2283.html http://support.novell.com/security/cve/CVE-2010-2284.html http://support.novell.com/security/cve/CVE-2010-2285.html http://support.novell.com/security/cve/CVE-2010-2286.html http://support.novell.com/security/cve/CVE-2010-2287.html http://support.novell.com/security/cve/CVE-2010-2992.html http://support.novell.com/security/cve/CVE-2010-2993.html http://support.novell.com/security/cve/CVE-2010-2994.html http://support.novell.com/security/cve/CVE-2010-2995.html http://support.novell.com/security/cve/CVE-2010-3445.html http://support.novell.com/security/cve/CVE-2010-4300.html http://support.novell.com/security/cve/CVE-2010-4301.html https://bugzilla.novell.com/603251 https://bugzilla.novell.com/613487 https://bugzilla.novell.com/630599 https://bugzilla.novell.com/643078 https://bugzilla.novell.com/655448

1 0

openSUSE-RU-2011:0022-1 (moderate): java-1_6_0-sun: Update to Java SE 6 Update 23
by maintenance＠opensuse.org 12 Jan '11

12 Jan '11

openSUSE Recommended Update: java-1_6_0-sun: Update to Java SE 6 Update 23 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0022-1 Rating: moderate References: #662459 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: Java SE 6u23 contains enhancements for your Java applications: * Improved performance and stability * Enhanced support for right-to-left languages * Java SE 6u23 contains Olson time zone data version 2010l. For more information, refer to Timezone Data Versions in the JRE Software . ## Java Hotspot VM 19.0 Java SE 6u23 includes version 19.0 of the Java HotSpot Virtual Machine with improvements to overall performance and reliability. ## Java VisualVM 1.3.1 Java VisualVM based on VisualVM 1.3.1 is included in Java SE 6u23. This release introduces the following features and enhancements: ## Menu Item Corrections for Right-to-Left Languages Several bugs in the non-default alignment and text orientation for the menu items in Swing have been fixed, as this is particularly important for right-to-left languages such as Arabic. Another issue corrected is the position of the icon and the text. For the non-default positions the text used to overlap the icon in a menu item, this is no longer the case. All platform Look and Feel configurations will now handle menu items in right-to-left language situations. These fixes have been tested through their inclusion in the JDK 7 development release, but this is the first time they have been available via JDK 6. ## Additional Languages Support in Linux Systems Added support for SuSE Linux Enterprise Server 10 and 11 on Chinese (Simplified), Chinese (Traditional), Japanese, and Korean locales. ## Bug Fixes Java SE 6u23 does not contain any additional fixes for security vulnerabilities to its previous release, Java SE 6u22. Users who have Java SE 6u22 have the latest security fixes and do not need to upgrade to this release to be current on security fixes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch java-1_6_0-sun-3784 - openSUSE 11.2: zypper in -t patch java-1_6_0-sun-3784 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 1.6.0.u23]: java-1_6_0-sun-1.6.0.u23-0.2.1 java-1_6_0-sun-alsa-1.6.0.u23-0.2.1 java-1_6_0-sun-devel-1.6.0.u23-0.2.1 java-1_6_0-sun-jdbc-1.6.0.u23-0.2.1 java-1_6_0-sun-plugin-1.6.0.u23-0.2.1 java-1_6_0-sun-src-1.6.0.u23-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.6.0.u23]: java-1_6_0-sun-1.6.0.u23-0.2.1 java-1_6_0-sun-alsa-1.6.0.u23-0.2.1 java-1_6_0-sun-demo-1.6.0.u23-0.2.1 java-1_6_0-sun-devel-1.6.0.u23-0.2.1 java-1_6_0-sun-jdbc-1.6.0.u23-0.2.1 java-1_6_0-sun-plugin-1.6.0.u23-0.2.1 java-1_6_0-sun-src-1.6.0.u23-0.2.1 References: https://bugzilla.novell.com/662459

1 0

openSUSE-SU-2011:0021-1 (moderate): Fixed NULL pointer dereference in pidgin (CVE-2010-4528).
by opensuse-security＠opensuse.org 10 Jan '11

10 Jan '11

openSUSE Security Update: Fixed NULL pointer dereference in pidgin (CVE-2010-4528). ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0021-1 Rating: moderate References: #661497 Cross-References: CVE-2010-4528 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: A NULL pointer dereference DoS has been fixed in pidgin. CVE-2010-4528 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch finch-3783 - openSUSE 11.2: zypper in -t patch finch-3783 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.7.9]: finch-2.7.9-1.2.1 finch-devel-2.7.9-1.2.1 libpurple-2.7.9-1.2.1 libpurple-devel-2.7.9-1.2.1 libpurple-meanwhile-2.7.9-1.2.1 libpurple-mono-2.7.9-1.2.1 libpurple-tcl-2.7.9-1.2.1 pidgin-2.7.9-1.2.1 pidgin-devel-2.7.9-1.2.1 pidgin-otr-3.2.0-146.1.2 - openSUSE 11.3 (noarch) [New Version: 2.7.9]: libpurple-lang-2.7.9-1.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 2.7.9]: finch-2.7.9-1.2.2 finch-devel-2.7.9-1.2.2 libpurple-2.7.9-1.2.2 libpurple-devel-2.7.9-1.2.2 libpurple-meanwhile-2.7.9-1.2.2 libpurple-mono-2.7.9-1.2.2 libpurple-tcl-2.7.9-1.2.2 pidgin-2.7.9-1.2.2 pidgin-devel-2.7.9-1.2.2 pidgin-otr-3.2.0-142.4.5 - openSUSE 11.2 (noarch) [New Version: 2.7.9]: libpurple-lang-2.7.9-1.2.2 References: http://support.novell.com/security/cve/CVE-2010-4528.html https://bugzilla.novell.com/661497

1 0

openSUSE-SU-2011:0020-1 (important): perl-CGI-Simple: Fixed a header injection problem (CVE-2010-2761).
by opensuse-security＠opensuse.org 10 Jan '11

10 Jan '11

openSUSE Security Update: perl-CGI-Simple: Fixed a header injection problem (CVE-2010-2761). ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0020-1 Rating: important References: #657731 Cross-References: CVE-2010-2761 CVE-2010-3172 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: A HTTP header injection attack was fixed in perl-CGI-Simple. CVE-2010-2761 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch perl-CGI-Simple-3785 - openSUSE 11.2: zypper in -t patch perl-CGI-Simple-3785 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): perl-CGI-Simple-1.112-7.3.1 - openSUSE 11.2 (i586 x86_64): perl-CGI-Simple-1.112-2.3.1 References: http://support.novell.com/security/cve/CVE-2010-2761.html http://support.novell.com/security/cve/CVE-2010-3172.html https://bugzilla.novell.com/657731

1 0

openSUSE-RU-2011:0018-1 (low): pam_apparmor: support for enabling/disabling
by maintenance＠opensuse.org 10 Jan '11

10 Jan '11

openSUSE Recommended Update: pam_apparmor: support for enabling/disabling ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0018-1 Rating: low References: #623246 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Added support for enabling/disabling the module automatically during installation/removal (bnc#623246) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch pam_apparmor-3756 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): pam_apparmor-2.3-58.3.1 - openSUSE 11.3 (x86_64): pam_apparmor-32bit-2.3-58.3.1 References: https://bugzilla.novell.com/623246

1 0

openSUSE-SU-2011:0017-1 (low): ed: Fixed security update regression
by opensuse-security＠opensuse.org 07 Jan '11

07 Jan '11

openSUSE Security Update: ed: Fixed security update regression ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0017-1 Rating: low References: #661417 Affected Products: openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The previous ed security update fixing commandline overflow issues caused ed without any arguments to crash. This is fixed by this update. - #661417: updated /bin/ed - segmentation violation Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch ed-3777 - openSUSE 11.1: zypper in -t patch ed-3777 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): ed-0.2-1003.5.1 - openSUSE 11.1 (i586 ppc x86_64): ed-0.2-1001.15.1 References: https://bugzilla.novell.com/661417

1 0

openSUSE-SU-2011:0014-1 (low): openssl security update
by opensuse-security＠opensuse.org 05 Jan '11

05 Jan '11

openSUSE Security Update: openssl security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0014-1 Rating: low References: #657663 Cross-References: CVE-2010-4180 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Malicious clients could downgrade a connection to a low strength cipher suite on session resumption if the server offers such ciphers (CVE-2010-4180). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libopenssl-devel-3660 - openSUSE 11.2: zypper in -t patch libopenssl-devel-3660 - openSUSE 11.1: zypper in -t patch libopenssl-devel-3660 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libopenssl-devel-1.0.0-6.5.1 libopenssl0_9_8-0.9.8m-3.3.1 libopenssl1_0_0-1.0.0-6.5.1 openssl-1.0.0-6.5.1 - openSUSE 11.3 (x86_64): libopenssl0_9_8-32bit-0.9.8m-3.3.1 libopenssl1_0_0-32bit-1.0.0-6.5.1 - openSUSE 11.3 (noarch): openssl-doc-1.0.0-6.5.1 - openSUSE 11.2 (i586 x86_64): libopenssl-devel-0.9.8k-3.12.1 libopenssl0_9_8-0.9.8k-3.12.1 openssl-0.9.8k-3.12.1 openssl-doc-0.9.8k-3.12.1 - openSUSE 11.2 (x86_64): libopenssl0_9_8-32bit-0.9.8k-3.12.1 - openSUSE 11.1 (i586 ppc x86_64): libopenssl-devel-0.9.8h-28.20.1 libopenssl0_9_8-0.9.8h-28.20.1 openssl-0.9.8h-28.20.1 openssl-doc-0.9.8h-28.20.1 - openSUSE 11.1 (x86_64): libopenssl0_9_8-32bit-0.9.8h-28.20.1 - openSUSE 11.1 (ppc): libopenssl0_9_8-64bit-0.9.8h-28.20.1 References: http://support.novell.com/security/cve/CVE-2010-4180.html https://bugzilla.novell.com/657663

1 0

openSUSE-SU-2011:0011-1 (moderate): libsmi security update
by opensuse-security＠opensuse.org 03 Jan '11

03 Jan '11

openSUSE Security Update: libsmi security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0011-1 Rating: moderate References: #649867 Cross-References: CVE-2010-2891 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a buffer overflow the smiGetNode() function in libsmi. It allowed context-dependent attackers to execute arbitrary code via an Object Identifier. CVE-2010-2891: CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libsmi-3520 - openSUSE 11.2: zypper in -t patch libsmi-3520 - openSUSE 11.1: zypper in -t patch libsmi-3520 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libsmi-0.4.5-131.3.1 libsmi-devel-0.4.5-131.3.1 - openSUSE 11.2 (i586 x86_64): libsmi-0.4.5-127.3.1 libsmi-devel-0.4.5-127.3.1 - openSUSE 11.1 (i586 ppc x86_64): libsmi-0.4.5-1.91.2 libsmi-devel-0.4.5-1.91.2 References: http://support.novell.com/security/cve/CVE-2010-2891.html https://bugzilla.novell.com/649867

1 0

openSUSE-SU-2011:0010-1 (important): wireshark security update
by opensuse-security＠opensuse.org 03 Jan '11

03 Jan '11

openSUSE Security Update: wireshark security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0010-1 Rating: important References: #603251 #613487 #630599 #643078 #655448 Cross-References: CVE-2010-1455 CVE-2010-2283 CVE-2010-2284 CVE-2010-2285 CVE-2010-2286 CVE-2010-2287 CVE-2010-2992 CVE-2010-2993 CVE-2010-2994 CVE-2010-2995 CVE-2010-3445 CVE-2010-4300 CVE-2010-4301 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. It includes one version update. Description: Wireshark version 1.4.2 fixes several security issues that allowed attackers to crash wireshark or potentially even execute arbitrary code (CVE-2010-1455, CVE-2010-2283, CVE-2010-2284, CVE-2010-2285, CVE-2010-2286, CVE-2010-2287, CVE-2010-2992, CVE-2010-2993, CVE-2010-2994, CVE-2010-2995, CVE-2010-3445, CVE-2010-4300, CVE-2010-4301) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch wireshark-3731 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64) [New Version: 1.4.2]: wireshark-1.4.2-1.1.1 wireshark-devel-1.4.2-1.1.1 References: http://support.novell.com/security/cve/CVE-2010-1455.html http://support.novell.com/security/cve/CVE-2010-2283.html http://support.novell.com/security/cve/CVE-2010-2284.html http://support.novell.com/security/cve/CVE-2010-2285.html http://support.novell.com/security/cve/CVE-2010-2286.html http://support.novell.com/security/cve/CVE-2010-2287.html http://support.novell.com/security/cve/CVE-2010-2992.html http://support.novell.com/security/cve/CVE-2010-2993.html http://support.novell.com/security/cve/CVE-2010-2994.html http://support.novell.com/security/cve/CVE-2010-2995.html http://support.novell.com/security/cve/CVE-2010-3445.html http://support.novell.com/security/cve/CVE-2010-4300.html http://support.novell.com/security/cve/CVE-2010-4301.html https://bugzilla.novell.com/603251 https://bugzilla.novell.com/613487 https://bugzilla.novell.com/630599 https://bugzilla.novell.com/643078 https://bugzilla.novell.com/655448

1 0

openSUSE-RU-2011:0005-1 (low): sysconfig: Fix log file spamming when ipv6 is disabled
by maintenance＠opensuse.org 03 Jan '11

03 Jan '11

openSUSE Recommended Update: sysconfig: Fix log file spamming when ipv6 is disabled ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0005-1 Rating: low References: #616765 #637183 #644738 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update fixes the check whether ipv6 is enabled or not in /sbin/ifup-dhcp. Also included are fixes for: - Fixed link_wait scriptname check and ping usage (bnc#644738) - Fixed ifplugd-selectif script to use -1 as default carrier (bnc#637183) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch sysconfig-3746 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): sysconfig-0.73.7-2.3.1 References: https://bugzilla.novell.com/616765 https://bugzilla.novell.com/637183 https://bugzilla.novell.com/644738

1 0

openSUSE-SU-2011:0004-1 (important): kernel: security and bugfix update.
by opensuse-security＠opensuse.org 03 Jan '11

03 Jan '11

openSUSE Security Update: kernel: security and bugfix update. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0004-1 Rating: important References: #547887 #584028 #628591 #629901 #629908 #641811 #641983 #642043 #642302 #642311 #642312 #642313 #642484 #642486 #645659 #649187 #650128 #651218 #651626 #652563 #652939 #652940 #652945 #653258 #653260 #653930 #654581 #655215 #655839 #657350 #659076 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: The openSUSE 11.3 kernel was updated to fix various bugs and security issues. Following security issues have been fixed: CVE-2010-4347: A local user could inject ACPI code into the kernel via the world-writable "custom_debug" file, allowing local privilege escalation. CVE-2010-4258: A local attacker could use a Oops (kernel crash) caused by other flaws to write a 0 byte to a attacker controlled address in the kernel. This could lead to privilege escalation together with other issues. CVE-2010-4157: A 32bit vs 64bit integer mismatch in gdth_ioctl_alloc could lead to memory corruption in the GDTH driver. CVE-2010-4165: The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel did not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer. CVE-2010-4164: A remote (or local) attacker communicating over X.25 could cause a kernel panic by attempting to negotiate malformed facilities. CVE-2010-4175: A local attacker could cause memory overruns in the RDS protocol stack, potentially crashing the kernel. So far it is considered not to be exploitable. CVE-2010-4169: Use-after-free vulnerability in mm/mprotect.c in the Linux kernel allwed local users to cause a denial of service via vectors involving an mprotect system call. CVE-2010-3874: A minor heap overflow in the CAN network module was fixed. Due to nature of the memory allocator it is likely not exploitable. CVE-2010-4158: A memory information leak in berkely packet filter rules allowed local attackers to read uninitialized memory of the kernel stack. CVE-2010-4162: A local denial of service in the blockdevice layer was fixed. CVE-2010-4163: By submitting certain I/O requests with 0 length, a local user could have caused a kernel panic. CVE-2010-0435: The Hypervisor in KVM 83, when the Intel VT-x extension is enabled, allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via vectors related to instruction emulation. CVE-2010-3861: The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel did not initialize a certain block of heap memory, which allowed local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value. CVE-2010-3442: Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel allowed local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call. CVE-2010-3437: A range checking overflow in pktcdvd ioctl was fixed. CVE-2010-4078: The sisfb_ioctl function in drivers/video/sis/sis_main.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call. CVE-2010-4080: The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call. CVE-2010-4081: The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call. CVE-2010-4082: The viafb_ioctl_get_viafb_info function in drivers/video/via/ioctl.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call. CVE-2010-4073: The ipc subsystem in the Linux kernel did not initialize certain structures, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in ipc/compat_mq.c. CVE-2010-4072: The copy_shmid_to_user function in ipc/shm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the shmctl system call and the "old shm interface." CVE-2010-4083: The copy_semid_to_user function in ipc/sem.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via a (1) IPC_INFO, (2) SEM_INFO, (3) IPC_STAT, or (4) SEM_STAT command in a semctl system call. CVE-2010-3432: The sctp_packet_config function in net/sctp/output.c in the Linux kernel performed extraneous initializations of packet data structures, which allowed remote attackers to cause a denial of service (panic) via a certain sequence of SCTP traffic. CVE-2010-3067: Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel allowed local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call. CVE-2010-3865: A iovec integer overflow in RDS sockets was fixed which could lead to local attackers gaining kernel privileges. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch kernel-3709 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.6.34.7]: kernel-debug-2.6.34.7-0.7.1 kernel-debug-base-2.6.34.7-0.7.1 kernel-debug-devel-2.6.34.7-0.7.1 kernel-default-2.6.34.7-0.7.1 kernel-default-base-2.6.34.7-0.7.1 kernel-default-devel-2.6.34.7-0.7.1 kernel-desktop-2.6.34.7-0.7.1 kernel-desktop-base-2.6.34.7-0.7.1 kernel-desktop-devel-2.6.34.7-0.7.1 kernel-ec2-2.6.34.7-0.7.1 kernel-ec2-base-2.6.34.7-0.7.1 kernel-ec2-devel-2.6.34.7-0.7.1 kernel-ec2-extra-2.6.34.7-0.7.1 kernel-syms-2.6.34.7-0.7.1 kernel-trace-2.6.34.7-0.7.1 kernel-trace-base-2.6.34.7-0.7.1 kernel-trace-devel-2.6.34.7-0.7.1 kernel-vanilla-2.6.34.7-0.7.1 kernel-vanilla-base-2.6.34.7-0.7.1 kernel-vanilla-devel-2.6.34.7-0.7.1 kernel-xen-2.6.34.7-0.7.1 kernel-xen-base-2.6.34.7-0.7.1 kernel-xen-devel-2.6.34.7-0.7.1 preload-kmp-default-1.1_k2.6.34.7_0.7-19.1.11 preload-kmp-desktop-1.1_k2.6.34.7_0.7-19.1.11 - openSUSE 11.3 (noarch) [New Version: 2.6.34.7]: kernel-devel-2.6.34.7-0.7.1 kernel-source-2.6.34.7-0.7.1 kernel-source-vanilla-2.6.34.7-0.7.1 - openSUSE 11.3 (i586) [New Version: 2.6.34.7]: kernel-pae-2.6.34.7-0.7.1 kernel-pae-base-2.6.34.7-0.7.1 kernel-pae-devel-2.6.34.7-0.7.1 kernel-vmi-2.6.34.7-0.7.1 kernel-vmi-base-2.6.34.7-0.7.1 kernel-vmi-devel-2.6.34.7-0.7.1 References: https://bugzilla.novell.com/547887 https://bugzilla.novell.com/584028 https://bugzilla.novell.com/628591 https://bugzilla.novell.com/629901 https://bugzilla.novell.com/629908 https://bugzilla.novell.com/641811 https://bugzilla.novell.com/641983 https://bugzilla.novell.com/642043 https://bugzilla.novell.com/642302 https://bugzilla.novell.com/642311 https://bugzilla.novell.com/642312 https://bugzilla.novell.com/642313 https://bugzilla.novell.com/642484 https://bugzilla.novell.com/642486 https://bugzilla.novell.com/645659 https://bugzilla.novell.com/649187 https://bugzilla.novell.com/650128 https://bugzilla.novell.com/651218 https://bugzilla.novell.com/651626 https://bugzilla.novell.com/652563 https://bugzilla.novell.com/652939 https://bugzilla.novell.com/652940 https://bugzilla.novell.com/652945 https://bugzilla.novell.com/653258 https://bugzilla.novell.com/653260 https://bugzilla.novell.com/653930 https://bugzilla.novell.com/654581 https://bugzilla.novell.com/655215 https://bugzilla.novell.com/655839 https://bugzilla.novell.com/657350 https://bugzilla.novell.com/659076

1 0

openSUSE-SU-2011:0003-1 (important): Linux Kernel: security and bugfix update
by opensuse-security＠opensuse.org 03 Jan '11

03 Jan '11

openSUSE Security Update: Linux Kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0003-1 Rating: important References: #642043 #642302 #642311 #642313 #642484 #642486 #645659 #649187 #650128 #651218 #652563 #652939 #652940 #652945 #653258 #653260 #654581 #657350 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: This update of the openSUSE 11.2 kernel fixes various bugs and lots of security issues. Following security issues have been fixed: CVE-2010-4258: A local attacker could use a Oops (kernel crash) caused by other flaws to write a 0 byte to a attacker controlled address in the kernel. This could lead to privilege escalation together with other issues. CVE-2010-4160: A overflow in sendto() and recvfrom() routines was fixed that could be used by local attackers to potentially crash the kernel using some socket families like L2TP. CVE-2010-4157: A 32bit vs 64bit integer mismatch in gdth_ioctl_alloc could lead to memory corruption in the GDTH driver. CVE-2010-4165: The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel did not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer. CVE-2010-4164: A remote (or local) attacker communicating over X.25 could cause a kernel panic by attempting to negotiate malformed facilities. CVE-2010-4175: A local attacker could cause memory overruns in the RDS protocol stack, potentially crashing the kernel. So far it is considered not to be exploitable. CVE-2010-3874: A minor heap overflow in the CAN network module was fixed. Due to nature of the memory allocator it is likely not exploitable. CVE-2010-3874: A minor heap overflow in the CAN network module was fixed. Due to nature of the memory allocator it is likely not exploitable. CVE-2010-4158: A memory information leak in berkely packet filter rules allowed local attackers to read uninitialized memory of the kernel stack. CVE-2010-4162: A local denial of service in the blockdevice layer was fixed. CVE-2010-4163: By submitting certain I/O requests with 0 length, a local user could have caused a kernel panic. CVE-2010-3861: The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel did not initialize a certain block of heap memory, which allowed local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value. CVE-2010-3442: Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel allowed local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call. CVE-2010-3437: A range checking overflow in pktcdvd ioctl was fixed. CVE-2010-4078: The sisfb_ioctl function in drivers/video/sis/sis_main.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call. CVE-2010-4080: The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call. CVE-2010-4081: The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call. CVE-2010-4082: The viafb_ioctl_get_viafb_info function in drivers/video/via/ioctl.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call. CVE-2010-3067: Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel allowed local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call. CVE-2010-3865: A iovec integer overflow in RDS sockets was fixed which could lead to local attackers gaining kernel privileges. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch kernel-debug-3706 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64) [New Version: 2.6.31.14]: kernel-debug-2.6.31.14-0.6.1 kernel-debug-base-2.6.31.14-0.6.1 kernel-debug-devel-2.6.31.14-0.6.1 kernel-default-2.6.31.14-0.6.1 kernel-default-base-2.6.31.14-0.6.1 kernel-default-devel-2.6.31.14-0.6.1 kernel-desktop-2.6.31.14-0.6.1 kernel-desktop-base-2.6.31.14-0.6.1 kernel-desktop-devel-2.6.31.14-0.6.1 kernel-syms-2.6.31.14-0.6.1 kernel-trace-2.6.31.14-0.6.1 kernel-trace-base-2.6.31.14-0.6.1 kernel-trace-devel-2.6.31.14-0.6.1 kernel-vanilla-2.6.31.14-0.6.1 kernel-vanilla-base-2.6.31.14-0.6.1 kernel-vanilla-devel-2.6.31.14-0.6.1 kernel-xen-2.6.31.14-0.6.1 kernel-xen-base-2.6.31.14-0.6.1 kernel-xen-devel-2.6.31.14-0.6.1 preload-kmp-default-1.1_2.6.31.14_0.6-6.9.39 preload-kmp-desktop-1.1_2.6.31.14_0.6-6.9.39 - openSUSE 11.2 (noarch) [New Version: 2.6.31.14]: kernel-source-2.6.31.14-0.6.1 kernel-source-vanilla-2.6.31.14-0.6.1 - openSUSE 11.2 (i586) [New Version: 2.6.31.14]: kernel-pae-2.6.31.14-0.6.1 kernel-pae-base-2.6.31.14-0.6.1 kernel-pae-devel-2.6.31.14-0.6.1 References: https://bugzilla.novell.com/642043 https://bugzilla.novell.com/642302 https://bugzilla.novell.com/642311 https://bugzilla.novell.com/642313 https://bugzilla.novell.com/642484 https://bugzilla.novell.com/642486 https://bugzilla.novell.com/645659 https://bugzilla.novell.com/649187 https://bugzilla.novell.com/650128 https://bugzilla.novell.com/651218 https://bugzilla.novell.com/652563 https://bugzilla.novell.com/652939 https://bugzilla.novell.com/652940 https://bugzilla.novell.com/652945 https://bugzilla.novell.com/653258 https://bugzilla.novell.com/653260 https://bugzilla.novell.com/654581 https://bugzilla.novell.com/657350

1 0

openSUSE-RU-2011:0002-1 (low): gnome-control-center: Sometimes touchpad is not detect correctly. Fixed by this update.
by maintenance＠opensuse.org 03 Jan '11

03 Jan '11

openSUSE Recommended Update: gnome-control-center: Sometimes touchpad is not detect correctly. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2011:0002-1 Rating: low References: #626974 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Synaptics touchpad detection in gnome-mouse-properties was not working in some laptop configurations (bnc#626974). Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnome-control-center-3750 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): gnome-control-center-2.30.1-2.3.1 gnome-control-center-devel-2.30.1-2.3.1 libgnome-window-settings-devel-2.30.1-2.3.1 libgnome-window-settings1-2.30.1-2.3.1 - openSUSE 11.3 (noarch): gnome-control-center-lang-2.30.1-2.3.1 References: https://bugzilla.novell.com/626974

1 0

openSUSE-SU-2010:1094-1 (moderate): opera security update
by opensuse-security＠opensuse.org 23 Dec '10

23 Dec '10

openSUSE Security Update: opera security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1094-1 Rating: moderate References: #659882 Cross-References: CVE-2010-4508 CVE-2010-4579 CVE-2010-4580 CVE-2010-4581 CVE-2010-4582 CVE-2010-4583 CVE-2010-4584 CVE-2010-4585 CVE-2010-4586 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. It includes one version update. Description: opera 11.00 fixes among other things several security vulnerabilities. Please refer opera's site for more information: http://www.opera.com/docs/changelogs/unix/1100/ (CVE-2010-4508, CVE-2010-4579, CVE-2010-4580, CVE-2010-4581, CVE-2010-4582, CVE-2010-4583, CVE-2010-4584, CVE-2010-4585, CVE-2010-4586) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch opera-3730 - openSUSE 11.2: zypper in -t patch opera-3730 - openSUSE 11.1: zypper in -t patch opera-3732 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 11.00]: opera-11.00-1.2.1 opera-gtk-11.00-1.2.1 opera-kde4-11.00-1.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 11.00]: opera-11.00-1.2.1 opera-gtk-11.00-1.2.1 opera-kde4-11.00-1.2.1 - openSUSE 11.1 (i586 x86_64) [New Version: 11.00]: opera-11.00-1.1.1 opera-gtk-11.00-1.1.1 opera-kde4-11.00-1.1.1 References: http://support.novell.com/security/cve/CVE-2010-4508.html http://support.novell.com/security/cve/CVE-2010-4579.html http://support.novell.com/security/cve/CVE-2010-4580.html http://support.novell.com/security/cve/CVE-2010-4581.html http://support.novell.com/security/cve/CVE-2010-4582.html http://support.novell.com/security/cve/CVE-2010-4583.html http://support.novell.com/security/cve/CVE-2010-4584.html http://support.novell.com/security/cve/CVE-2010-4585.html http://support.novell.com/security/cve/CVE-2010-4586.html https://bugzilla.novell.com/659882

1 0

openSUSE-SU-2010:1091-1 (important): xpdf security update
by opensuse-security＠opensuse.org 22 Dec '10

22 Dec '10

openSUSE Security Update: xpdf security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1091-1 Rating: important References: #644112 Cross-References: CVE-2010-3702 CVE-2010-3703 CVE-2010-3704 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: specially crafted PDF files could crash xpdf or potentially even cause execution of arbitrary code (CVE-2010-3702, CVE-2010-3703, CVE-2010-3704) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch xpdf-3329 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): xpdf-3.02-97.83.1 xpdf-tools-3.02-97.83.1 References: http://support.novell.com/security/cve/CVE-2010-3702.html http://support.novell.com/security/cve/CVE-2010-3703.html http://support.novell.com/security/cve/CVE-2010-3704.html https://bugzilla.novell.com/644112

1 0

openSUSE-SU-2010:1025-2 (moderate): gnutls: fixing SSL-renegotiation "authentication gap" testing code
by opensuse-security＠opensuse.org 22 Dec '10

22 Dec '10

openSUSE Security Update: gnutls: fixing SSL-renegotiation "authentication gap" testing code ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1025-2 Rating: moderate References: #554084 Cross-References: CVE-2009-3555 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes the safe renegotiation testing code which was missing in the previous update for CVE-2009-3555. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnutls-3647 - openSUSE 11.2: zypper in -t patch gnutls-3647 - openSUSE 11.1: zypper in -t patch gnutls-3647 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): gnutls-2.8.6-2.5.1 libgnutls-devel-2.8.6-2.5.1 libgnutls-extra-devel-2.8.6-2.5.1 libgnutls-extra26-2.8.6-2.5.1 libgnutls26-2.8.6-2.5.1 - openSUSE 11.3 (x86_64): libgnutls26-32bit-2.8.6-2.5.1 - openSUSE 11.2 (i586 x86_64): gnutls-2.4.1-26.8.1 libgnutls-devel-2.4.1-26.8.1 libgnutls-extra-devel-2.4.1-26.8.1 libgnutls-extra26-2.4.1-26.8.1 libgnutls26-2.4.1-26.8.1 - openSUSE 11.2 (x86_64): libgnutls26-32bit-2.4.1-26.8.1 - openSUSE 11.1 (i586 ppc x86_64): gnutls-2.4.1-24.10.1 libgnutls-devel-2.4.1-24.10.1 libgnutls-extra-devel-2.4.1-24.10.1 libgnutls-extra26-2.4.1-24.10.1 libgnutls26-2.4.1-24.10.1 - openSUSE 11.1 (x86_64): libgnutls26-32bit-2.4.1-24.10.1 - openSUSE 11.1 (ppc): libgnutls26-64bit-2.4.1-24.10.1 References: http://support.novell.com/security/cve/CVE-2009-3555.html https://bugzilla.novell.com/554084

1 0

openSUSE-RU-2010:1088-1 (low): apparmor-dbus: Fix permissions to work with auditd
by maintenance＠opensuse.org 22 Dec '10

22 Dec '10

openSUSE Recommended Update: apparmor-dbus: Fix permissions to work with auditd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1088-1 Rating: low References: #641695 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the permissions of installed binaries so that they work properly with auditd(bnc#641695). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch apparmor-dbus-3715 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): apparmor-dbus-2.3-58.3.1 References: https://bugzilla.novell.com/641695

1 0

openSUSE-RU-2010:1087-1 (low): apparmor: Collective fixes
by maintenance＠opensuse.org 22 Dec '10

22 Dec '10

openSUSE Recommended Update: apparmor: Collective fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1087-1 Rating: low References: #436262 #539401 #634801 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update provides various fixes for apparmor, including fixes for apparmor profiles: - 436262: Firefox profiles do not work with current Firefox - 539401: AppArmor lets cupsd fail to start - 634801: /etc/apparmor.d/usr.sbin.ntpd broken for chroot Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch apparmor-profiles-parser-3710 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): apparmor-parser-2.3.1-22.3.1 - openSUSE 11.3 (noarch): apparmor-profiles-2.3-57.3.1 References: https://bugzilla.novell.com/436262 https://bugzilla.novell.com/539401 https://bugzilla.novell.com/634801

1 0

openSUSE-SU-2010:1085-1 (moderate): kdenetwork: security update
by opensuse-security＠opensuse.org 21 Dec '10

21 Dec '10

openSUSE Security Update: kdenetwork: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1085-1 Rating: moderate References: #516347 #525528 #653852 Cross-References: CVE-2008-4776 CVE-2010-1000 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update of kdenetwork fixes several bugs, the security related issues are: - CVE-2008-4776: CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P): CWE-119 The included libgadu version allowed remote servers to cause a denial of service (crash) via a buffer over-read. Non-security issues: - bnc#653852: kopete: ICQ login broken; login server changed - bnc#516347: kopete cant connect to yahoo Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch kdenetwork3-3559 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): kdenetwork3-3.5.10-12.11.1 kdenetwork3-IRC-3.5.10-12.11.1 kdenetwork3-InstantMessenger-3.5.10-12.11.1 kdenetwork3-devel-3.5.10-12.11.1 kdenetwork3-dialup-3.5.10-12.11.1 kdenetwork3-lan-3.5.10-12.11.1 kdenetwork3-lisa-3.5.10-12.11.1 kdenetwork3-news-3.5.10-12.11.1 kdenetwork3-query-3.5.10-12.11.1 kdenetwork3-vnc-3.5.10-12.11.1 kdenetwork3-wireless-3.5.10-12.11.1 References: http://support.novell.com/security/cve/CVE-2008-4776.html http://support.novell.com/security/cve/CVE-2010-1000.html https://bugzilla.novell.com/516347 https://bugzilla.novell.com/525528 https://bugzilla.novell.com/653852

1 0

openSUSE-SU-2010:1084-1 (moderate): ed: heap-based buffer overflow
by opensuse-security＠opensuse.org 21 Dec '10

21 Dec '10

openSUSE Security Update: ed: heap-based buffer overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1084-1 Rating: moderate References: #474587 Cross-References: CVE-2008-3916 Affected Products: openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a heap-based buffer overflow in ed which can be exploited remotely only with user-assistance. CVE-2008-3916: CVSS v2 Base Score: 9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C): Buffer Errors (CWE-119) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch ed-3599 - openSUSE 11.1: zypper in -t patch ed-3599 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): ed-0.2-1003.3.1 - openSUSE 11.1 (i586 ppc x86_64): ed-0.2-1001.15.1 References: http://support.novell.com/security/cve/CVE-2008-3916.html https://bugzilla.novell.com/474587

1 0

openSUSE-RU-2010:1083-1 (low): Inkscape: fixed installation in 11.4 milestone
by maintenance＠opensuse.org 21 Dec '10

21 Dec '10

openSUSE Recommended Update: Inkscape: fixed installation in 11.4 milestone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1083-1 Rating: low References: #660437 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Fixed: - #660437: openSUSE 11.4 Milestone failed to install Inkscape. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch inkscape-3721 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): inkscape-0.48.0-17.1 References: https://bugzilla.novell.com/660437

1 0

openSUSE-RU-2010:1082-1 (low): spamassassin: Fixed failure because of directory permission changes
by maintenance＠opensuse.org 21 Dec '10

21 Dec '10

openSUSE Recommended Update: spamassassin: Fixed failure because of directory permission changes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1082-1 Rating: low References: #660431 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The previous update caused regressions in spamassassin fails because of a unintentially moved directory and a permission change. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch perl-spamassassin-3722 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): perl-spamassassin-3.2.5-26.12.1 spamassassin-3.2.5-26.12.1 References: https://bugzilla.novell.com/660431

1 0

openSUSE-SU-2010:1054-2 (important): mpzilla-xulrunner191: 1.9.1.16 update fixes security issues
by opensuse-security＠opensuse.org 20 Dec '10

20 Dec '10

openSUSE Security Update: mpzilla-xulrunner191: 1.9.1.16 update fixes security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1054-2 Rating: important References: #657016 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes three new package versions. Description: Mozilla XULRunner 1.9.1 was updated to update 1.9.1.16 fixing several security issues. MFSA 2010-74: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Jesee Ruderman, Andreas Gal, Nils, and Brian Hackett reported memory safety problems that affected Firefox 3.6 and Firefox 3.5. (CVE-2010-3776) Igor Bukanov reported a memory safety problem that was fixed in Firefox 3.6 only. (CVE-2010-3777) Jesse Ruderman reported a crash which affected Firefox 3.5 only. (CVE-2010-3778) MFSA 2010-75 / CVE-2010-3769: Dirk Heinrich reported that on Windows platforms when document.write() was called with a very long string a buffer overflow was caused in line breaking routines attempting to process the string for display. Such cases triggered an invalid read past the end of an array causing a crash which an attacker could potentially use to run arbitrary code on a victim's computer. MFSA 2010-76 / CVE-2010-3771: Security researcher echo reported that a web page could open a window with an about:blank location and then inject an <isindex> element into that page which upon submission would redirect to a chrome: document. The effect of this defect was that the original page would wind up with a reference to a chrome-privileged object, the opened window, which could be leveraged for privilege escalation attacks. Mozilla security researcher moz_bug_r_a4 provided proof-of-concept code demonstrating how the above vulnerability could be used to run arbitrary code with chrome privileges. MFSA 2010-77 / CVE-2010-3772: Security researcher wushi of team509 reported that when a XUL tree had an HTML <div> element nested inside a <treechildren> element then code attempting to display content in the XUL tree would incorrectly treat the <div> element as a parent node to tree content underneath it resulting in incorrect indexes being calculated for the child content. These incorrect indexes were used in subsequent array operations which resulted in writing data past the end of an allocated buffer. An attacker could use this issue to crash a victim's browser and run arbitrary code on their machine. MFSA 2010-78 / CVE-2010-3768: Mozilla added the OTS font sanitizing library to prevent downloadable fonts from exposing vulnerabilities in the underlying OS font code. This library mitigates against several issues independently reported by Red Hat Security Response Team member Marc Schoenefeld and Mozilla security researcher Christoph Diehl. MFSA 2010-79 / CVE-2010-3775: Security researcher Gregory Fleischer reported that when a Java LiveConnect script was loaded via a data: URL which redirects via a meta refresh, then the resulting plugin object was created with the wrong security principal and thus received elevated privileges such as the abilities to read local files, launch processes, and create network connections. MFSA 2010-80 / CVE-2010-3766: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that a nsDOMAttribute node can be modified without informing the iterator object responsible for various DOM traversals. This flaw could lead to a inconsistent state where the iterator points to an object it believes is part of the DOM but actually points to some other object. If such an object had been deleted and its memory reclaimed by the system, then the iterator could be used to call into attacker-controlled memory. MFSA 2010-81 / CVE-2010-3767: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that JavaScript arrays were vulnerable to an integer overflow vulnerability. The report demonstrated that an array could be constructed containing a very large number of items such that when memory was allocated to store the array items, the integer value used to calculate the buffer size would overflow resulting in too small a buffer being allocated. Subsequent use of the array object could then result in data being written past the end of the buffer and causing memory corruption. MFSA 2010-82 / CVE-2010-3773: Mozilla security researcher moz_bug_r_a4 reported that the fix for CVE-2010-0179 could be circumvented permitting the execution of arbitrary JavaScript with chrome privileges. MFSA 2010-83 / CVE-2010-3774: Google security researcher Michal Zalewski reported that when a window was opened to a site resulting in a network or certificate error page, the opening site could access the document inside the opened window and inject arbitrary content. An attacker could use this bug to spoof the location bar and trick a user into thinking they were on a different site than they actually were. MFSA 2010-84 / CVE-2010-3770: Security researchers Yosuke Hasegawa and Masatoshi Kimura reported that the x-mac-arabic, x-mac-farsi and x-mac-hebrew character encodings are vulnerable to XSS attacks due to some characters being converted to angle brackets when displayed by the rendering engine. Sites using these character encodings would thus be potentially vulnerable to script injection attacks if their script filtering code fails to strip out these specific characters. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch MozillaFirefox-3688 mozilla-xulrunner191-3689 - openSUSE 11.2: zypper in -t patch MozillaFirefox-3688 mozilla-xulrunner191-3689 - openSUSE 11.1: zypper in -t patch MozillaFirefox-3688 mozilla-xulrunner191-3689 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 1.9.1.16,1.9.2.13 and 3.6.13]: MozillaFirefox-3.6.13-0.2.1 MozillaFirefox-branding-upstream-3.6.13-0.2.1 MozillaFirefox-translations-common-3.6.13-0.2.1 MozillaFirefox-translations-other-3.6.13-0.2.1 mozilla-js192-1.9.2.13-0.2.1 mozilla-xulrunner191-1.9.1.16-0.2.1 mozilla-xulrunner191-devel-1.9.1.16-0.2.1 mozilla-xulrunner191-gnomevfs-1.9.1.16-0.2.1 mozilla-xulrunner191-translations-common-1.9.1.16-0.2.1 mozilla-xulrunner191-translations-other-1.9.1.16-0.2.1 mozilla-xulrunner192-1.9.2.13-0.2.1 mozilla-xulrunner192-buildsymbols-1.9.2.13-0.2.1 mozilla-xulrunner192-devel-1.9.2.13-0.2.1 mozilla-xulrunner192-gnome-1.9.2.13-0.2.1 mozilla-xulrunner192-translations-common-1.9.2.13-0.2.1 mozilla-xulrunner192-translations-other-1.9.2.13-0.2.1 python-xpcom191-1.9.1.16-0.2.1 - openSUSE 11.3 (x86_64) [New Version: 1.9.1.16 and 1.9.2.13]: mozilla-js192-32bit-1.9.2.13-0.2.1 mozilla-xulrunner191-32bit-1.9.1.16-0.2.1 mozilla-xulrunner191-gnomevfs-32bit-1.9.1.16-0.2.1 mozilla-xulrunner192-32bit-1.9.2.13-0.2.1 mozilla-xulrunner192-gnome-32bit-1.9.2.13-0.2.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.13-0.2.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.13-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.9.1.16,1.9.2.13 and 3.6.13]: MozillaFirefox-3.6.13-0.2.1 MozillaFirefox-branding-upstream-3.6.13-0.2.1 MozillaFirefox-translations-common-3.6.13-0.2.1 MozillaFirefox-translations-other-3.6.13-0.2.1 mozilla-js192-1.9.2.13-0.2.1 mozilla-xulrunner191-1.9.1.16-0.2.1 mozilla-xulrunner191-devel-1.9.1.16-0.2.1 mozilla-xulrunner191-gnomevfs-1.9.1.16-0.2.1 mozilla-xulrunner191-translations-common-1.9.1.16-0.2.1 mozilla-xulrunner191-translations-other-1.9.1.16-0.2.1 mozilla-xulrunner192-1.9.2.13-0.2.1 mozilla-xulrunner192-buildsymbols-1.9.2.13-0.2.1 mozilla-xulrunner192-devel-1.9.2.13-0.2.1 mozilla-xulrunner192-gnome-1.9.2.13-0.2.1 mozilla-xulrunner192-translations-common-1.9.2.13-0.2.1 mozilla-xulrunner192-translations-other-1.9.2.13-0.2.1 python-xpcom191-1.9.1.16-0.2.1 - openSUSE 11.2 (x86_64) [New Version: 1.9.1.16 and 1.9.2.13]: mozilla-js192-32bit-1.9.2.13-0.2.1 mozilla-xulrunner191-32bit-1.9.1.16-0.2.1 mozilla-xulrunner191-gnomevfs-32bit-1.9.1.16-0.2.1 mozilla-xulrunner192-32bit-1.9.2.13-0.2.1 mozilla-xulrunner192-gnome-32bit-1.9.2.13-0.2.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.13-0.2.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.13-0.2.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 1.9.1.16,1.9.2.13 and 3.6.13]: MozillaFirefox-3.6.13-0.1.1 MozillaFirefox-branding-upstream-3.6.13-0.1.1 MozillaFirefox-translations-common-3.6.13-0.1.1 MozillaFirefox-translations-other-3.6.13-0.1.1 mozilla-js192-1.9.2.13-0.1.1 mozilla-xulrunner191-1.9.1.16-0.1.1 mozilla-xulrunner191-devel-1.9.1.16-0.1.1 mozilla-xulrunner191-gnomevfs-1.9.1.16-0.1.1 mozilla-xulrunner191-translations-common-1.9.1.16-0.1.1 mozilla-xulrunner191-translations-other-1.9.1.16-0.1.1 mozilla-xulrunner192-1.9.2.13-0.1.1 mozilla-xulrunner192-devel-1.9.2.13-0.1.1 mozilla-xulrunner192-translations-common-1.9.2.13-0.1.1 mozilla-xulrunner192-translations-other-1.9.2.13-0.1.1 python-xpcom191-1.9.1.16-0.1.1 - openSUSE 11.1 (i586 x86_64) [New Version: 1.9.2.13]: mozilla-xulrunner192-buildsymbols-1.9.2.13-0.1.1 mozilla-xulrunner192-gnome-1.9.2.13-0.1.1 - openSUSE 11.1 (x86_64) [New Version: 1.9.1.16 and 1.9.2.13]: mozilla-js192-32bit-1.9.2.13-0.1.1 mozilla-xulrunner191-32bit-1.9.1.16-0.1.1 mozilla-xulrunner191-gnomevfs-32bit-1.9.1.16-0.1.1 mozilla-xulrunner192-32bit-1.9.2.13-0.1.1 mozilla-xulrunner192-gnome-32bit-1.9.2.13-0.1.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.13-0.1.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.13-0.1.1 References: https://bugzilla.novell.com/657016

1 0

openSUSE-SU-2010:1077-1 (moderate): kdenetwork: security update
by opensuse-security＠opensuse.org 17 Dec '10

17 Dec '10

openSUSE Security Update: kdenetwork: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1077-1 Rating: moderate References: #516347 #525528 #604709 #653852 Cross-References: CVE-2008-4776 CVE-2010-1000 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update of kdenetwork fixes several bugs, the security related issues are: - CVE-2010-1000: CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N): CWE-22 The "name" attribute of the "file" element of metalink files is not properly sanitised this can be exploited to download files to arbitrary directories. - CVE-2008-4776: CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P): CWE-119 The included libgadu version allowed remote servers to cause a denial of service (crash) via a buffer over-read. Non-security issues: - bnc#653852: kopete: ICQ login broken; login server changed - bnc#516347: kopete cant connect to yahoo Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch kde4-kdnssd-3561 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): kde4-kdnssd-4.1.3-4.15.1 kde4-kget-4.1.3-4.15.1 kde4-knewsticker-4.1.3-4.15.1 kde4-kopete-4.1.3-4.15.1 kde4-kopete-devel-4.1.3-4.15.1 kde4-kppp-4.1.3-4.15.1 kde4-krdc-4.1.3-4.15.1 kde4-krfb-4.1.3-4.15.1 kdenetwork4-4.1.3-4.15.1 kdenetwork4-filesharing-4.1.3-4.15.1 References: http://support.novell.com/security/cve/CVE-2008-4776.html http://support.novell.com/security/cve/CVE-2010-1000.html https://bugzilla.novell.com/516347 https://bugzilla.novell.com/525528 https://bugzilla.novell.com/604709 https://bugzilla.novell.com/653852

1 0

openSUSE-SU-2010:1076-1 (moderate): kdenetwork: security update
by opensuse-security＠opensuse.org 17 Dec '10

17 Dec '10

openSUSE Security Update: kdenetwork: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1076-1 Rating: moderate References: #604709 #653852 Cross-References: CVE-2008-4776 CVE-2010-1000 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: This update of kdenetwork fixes several bugs, the security related issues are: - CVE-2010-1000: CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N): CWE-22 The "name" attribute of the "file" element of metalink files is not properly sanitised this can be exploited to download files to arbitrary directories. Non-security issues: - bnc#653852: kopete: ICQ login broken; login server changed Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch kdenetwork4-3560 - openSUSE 11.2: zypper in -t patch kdenetwork4-3560 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): kdenetwork4-4.4.4-2.3.1 kdenetwork4-filesharing-4.4.4-2.3.1 kdnssd-4.4.4-2.3.1 kget-4.4.4-2.3.1 kopete-4.4.4-2.3.1 kopete-devel-4.4.4-2.3.1 kppp-4.4.4-2.3.1 krdc-4.4.4-2.3.1 krfb-4.4.4-2.3.1 - openSUSE 11.2 (i586 x86_64) [New Version: 4.3.5]: kdenetwork4-4.3.5-0.4.1 kdenetwork4-filesharing-4.3.5-0.4.1 kdnssd-4.3.5-0.4.1 kget-4.3.5-0.4.1 kopete-4.3.5-0.4.1 kopete-devel-4.3.5-0.4.1 kppp-4.3.5-0.4.1 krdc-4.3.5-0.4.1 krfb-4.3.5-0.4.1 References: http://support.novell.com/security/cve/CVE-2008-4776.html http://support.novell.com/security/cve/CVE-2010-1000.html https://bugzilla.novell.com/604709 https://bugzilla.novell.com/653852

1 0

openSUSE-RU-2010:1073-1 (low): spamassassin: It still uses openwhois tests, a squatted domain. This unnecessary test is removed by this update.
by maintenance＠opensuse.org 16 Dec '10

16 Dec '10

openSUSE Recommended Update: spamassassin: It still uses openwhois tests, a squatted domain. This unnecessary test is removed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1073-1 Rating: low References: #606231 Affected Products: openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Spamassassin still uses openwhois tests, a squatted domain. Users were reporting false-positive issues, where every message checked by SpamAssassin would receive a score of 2.43. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch perl-spamassassin-3341 - openSUSE 11.1: zypper in -t patch perl-spamassassin-3341 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): perl-spamassassin-3.2.5-28.7.1 spamassassin-3.2.5-28.7.1 - openSUSE 11.1 (i586 ppc x86_64): perl-spamassassin-3.2.5-26.10.1 spamassassin-3.2.5-26.10.1 References: https://bugzilla.novell.com/606231

1 0

openSUSE-RU-2010:1068-1 (low): gnome-icon-theme: Missing GNOME-icons are added by this update.
by maintenance＠opensuse.org 15 Dec '10

15 Dec '10

openSUSE Recommended Update: gnome-icon-theme: Missing GNOME-icons are added by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1068-1 Rating: low References: #632602 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Some SVG files used as icons by GNOME are missing, causing blurry icons to be sometime displayed. This packages fixes this issue.q Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnome-icon-theme-3663 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch): gnome-icon-theme-2.30.2.1-2.3.1 References: https://bugzilla.novell.com/632602

1 0

openSUSE-RU-2010:1067-1 (low): SDL: This update fixes an segmentation fault when pressing some keys on a D-pad.
by maintenance＠opensuse.org 15 Dec '10

15 Dec '10

openSUSE Recommended Update: SDL: This update fixes an segmentation fault when pressing some keys on a D-pad. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1067-1 Rating: low References: #632271 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: All programs using SDL (usually games) will crash when user presses a button on D-Pad controller. This is caused by structure size change in new kernel releases. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch SDL-3671 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libSDL-1_2-0-1.2.14-6.3.1 libSDL-devel-1.2.14-6.3.1 - openSUSE 11.3 (x86_64): libSDL-1_2-0-32bit-1.2.14-6.3.1 libSDL-devel-32bit-1.2.14-6.3.1 References: https://bugzilla.novell.com/632271

1 0

openSUSE-RU-2010:1066-1 (low): nautilus-sendto: Is broken in gnome-main-menu. Fixed by this update.
by maintenance＠opensuse.org 15 Dec '10

15 Dec '10

openSUSE Recommended Update: nautilus-sendto: Is broken in gnome-main-menu. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1066-1 Rating: low References: #647263 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Using send-to action by right-click on documents in gnome-main-menu was not working properly. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnome-main-menu-3677 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): gnome-main-menu-0.9.14-4.3.1 nautilus-gnome-main-menu-0.9.14-4.3.1 - openSUSE 11.3 (noarch): gnome-main-menu-lang-0.9.14-4.3.1 References: https://bugzilla.novell.com/647263

1 0

openSUSE-SU-2010:1062-1 (critical): moonlight security update
by opensuse-security＠opensuse.org 15 Dec '10

15 Dec '10

openSUSE Security Update: moonlight security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1062-1 Rating: critical References: #655847 Cross-References: CVE-2010-4254 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Untrusted Moonlight apps could bypass constraints on methods which potentially allowed attackers to execute arbitrary code (CVE-2010-4254). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libmoon-devel-3672 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libmoon-devel-2.2-4.3.1 libmoon0-2.2-4.3.1 moonlight-desktop-2.2-4.3.1 moonlight-desktop-devel-2.2-4.3.1 moonlight-plugin-2.2-4.3.1 moonlight-tools-2.2-4.3.1 moonlight-web-devel-2.2-4.3.1 References: http://support.novell.com/security/cve/CVE-2010-4254.html https://bugzilla.novell.com/655847

1 0

openSUSE-SU-2010:1061-1 (moderate): otrs security update
by opensuse-security＠opensuse.org 15 Dec '10

15 Dec '10

openSUSE Security Update: otrs security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1061-1 Rating: moderate References: #640729 #640830 Cross-References: CVE-2010-2080 CVE-2010-3476 CVE-2010-4071 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes two new package versions. Description: OTRS version 2.4.9 fixes among other things two cross-site-scripting and a denial of service vulnerability (CVE-2010-2080, CVE-2010-3476, CVE-2010-4071). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch otrs-3695 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch) [New Version: 2.1.1 and 2.4.9]: otrs-2.4.9-0.3.1 otrs-doc-2.4.9-0.3.1 otrs-itsm-2.1.1-0.3.1 References: http://support.novell.com/security/cve/CVE-2010-2080.html http://support.novell.com/security/cve/CVE-2010-3476.html http://support.novell.com/security/cve/CVE-2010-4071.html https://bugzilla.novell.com/640729 https://bugzilla.novell.com/640830

1 0

openSUSE-RU-2010:1058-1 (low): hamster-applet: This updates adds a missing dependency for python-xdg
by maintenance＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Recommended Update: hamster-applet: This updates adds a missing dependency for python-xdg ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1058-1 Rating: low References: #653578 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: hamster-applet package was missing a dependency on python-xdg package, which could prevent the application to start properly. This package fixes this issue. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch hamster-applet-3669 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): hamster-applet-2.30.1-2.3.1 - openSUSE 11.3 (noarch): hamster-applet-lang-2.30.1-2.3.1 References: https://bugzilla.novell.com/653578

1 0

openSUSE-RU-2010:1057-1 (low): libpixman: This update prevents Xvnc from aborting by using different VNC versions.
by maintenance＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Recommended Update: libpixman: This update prevents Xvnc from aborting by using different VNC versions. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1057-1 Rating: low References: #597424 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This pixman update prevents Xvnc from aborting in the case different version are used on server and client site. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libpixman-1-0-3658 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): libpixman-1-0-0.16.0-1.3.1 libpixman-1-0-devel-0.16.0-1.3.1 - openSUSE 11.2 (x86_64): libpixman-1-0-32bit-0.16.0-1.3.1 References: https://bugzilla.novell.com/597424

1 0

openSUSE-RU-2010:1056-1 (low): gnome-do: It is auto-started under KDE4 by default. Fixed by this update.
by maintenance＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Recommended Update: gnome-do: It is auto-started under KDE4 by default. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1056-1 Rating: low References: #629385 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: gnome-do was incorrectly auto-started under KDE4 by default, causing tracker to be started in addition to KDE Nepomuk. This package fixes this issue Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnome-do-3668 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): gnome-do-0.8.3-4.3.1 - openSUSE 11.3 (noarch): gnome-do-lang-0.8.3-4.3.1 References: https://bugzilla.novell.com/629385

1 0

openSUSE-RU-2010:1055-1 (low): gnome-keyring: Better handling of non-ASCII keyring name
by maintenance＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Recommended Update: gnome-keyring: Better handling of non-ASCII keyring name ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1055-1 Rating: low References: #635743 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a bug in gnome-keyring / libgnome-keyring that could prevent keyring creation with a non-ASCII name. Special Instructions and Notes: Please log out and log in again after installing this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnome-keyring-3652 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): gnome-keyring-2.30.1-3.3.1 gnome-keyring-pam-2.30.1-3.3.1 libgcr-devel-2.30.1-3.3.1 libgcr0-2.30.1-3.3.1 libgnome-keyring-devel-2.30.1-2.3.1 libgnome-keyring0-2.30.1-2.3.1 libgp11-0-2.30.1-3.3.1 libgp11-devel-2.30.1-3.3.1 libgp11-modules-2.30.1-3.3.1 - openSUSE 11.3 (x86_64): gnome-keyring-pam-32bit-2.30.1-3.3.1 libgcr0-32bit-2.30.1-3.3.1 libgnome-keyring0-32bit-2.30.1-2.3.1 libgp11-0-32bit-2.30.1-3.3.1 - openSUSE 11.3 (noarch): gnome-keyring-lang-2.30.1-3.3.1 libgnome-keyring-lang-2.30.1-2.3.1 References: https://bugzilla.novell.com/635743

1 0

openSUSE-SU-2010:1054-1 (important): MozillaThunderbird: 3.0.11 update fixes security issues
by opensuse-security＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Security Update: MozillaThunderbird: 3.0.11 update fixes security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1054-1 Rating: important References: #657016 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes three new package versions. Description: Mozilla Thunderbird 3.0 was updated to update 3.0.11 fixing several security issues. MFSA 2010-74: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Jesee Ruderman, Andreas Gal, Nils, and Brian Hackett reported memory safety problems that affected Firefox 3.6 and Firefox 3.5. (CVE-2010-3776) Igor Bukanov reported a memory safety problem that was fixed in Firefox 3.6 only. (CVE-2010-3777) Jesse Ruderman reported a crash which affected Firefox 3.5 only. (CVE-2010-3778) MFSA 2010-75 / CVE-2010-3769: Dirk Heinrich reported that on Windows platforms when document.write() was called with a very long string a buffer overflow was caused in line breaking routines attempting to process the string for display. Such cases triggered an invalid read past the end of an array causing a crash which an attacker could potentially use to run arbitrary code on a victim's computer. MFSA 2010-76 / CVE-2010-3771: Security researcher echo reported that a web page could open a window with an about:blank location and then inject an <isindex> element into that page which upon submission would redirect to a chrome: document. The effect of this defect was that the original page would wind up with a reference to a chrome-privileged object, the opened window, which could be leveraged for privilege escalation attacks. Mozilla security researcher moz_bug_r_a4 provided proof-of-concept code demonstrating how the above vulnerability could be used to run arbitrary code with chrome privileges. MFSA 2010-77 / CVE-2010-3772: Security researcher wushi of team509 reported that when a XUL tree had an HTML <div> element nested inside a <treechildren> element then code attempting to display content in the XUL tree would incorrectly treat the <div> element as a parent node to tree content underneath it resulting in incorrect indexes being calculated for the child content. These incorrect indexes were used in subsequent array operations which resulted in writing data past the end of an allocated buffer. An attacker could use this issue to crash a victim's browser and run arbitrary code on their machine. MFSA 2010-78 / CVE-2010-3768: Mozilla added the OTS font sanitizing library to prevent downloadable fonts from exposing vulnerabilities in the underlying OS font code. This library mitigates against several issues independently reported by Red Hat Security Response Team member Marc Schoenefeld and Mozilla security researcher Christoph Diehl. MFSA 2010-79 / CVE-2010-3775: Security researcher Gregory Fleischer reported that when a Java LiveConnect script was loaded via a data: URL which redirects via a meta refresh, then the resulting plugin object was created with the wrong security principal and thus received elevated privileges such as the abilities to read local files, launch processes, and create network connections. MFSA 2010-80 / CVE-2010-3766: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that a nsDOMAttribute node can be modified without informing the iterator object responsible for various DOM traversals. This flaw could lead to a inconsistent state where the iterator points to an object it believes is part of the DOM but actually points to some other object. If such an object had been deleted and its memory reclaimed by the system, then the iterator could be used to call into attacker-controlled memory. MFSA 2010-81 / CVE-2010-3767: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that JavaScript arrays were vulnerable to an integer overflow vulnerability. The report demonstrated that an array could be constructed containing a very large number of items such that when memory was allocated to store the array items, the integer value used to calculate the buffer size would overflow resulting in too small a buffer being allocated. Subsequent use of the array object could then result in data being written past the end of the buffer and causing memory corruption. MFSA 2010-82 / CVE-2010-3773: Mozilla security researcher moz_bug_r_a4 reported that the fix for CVE-2010-0179 could be circumvented permitting the execution of arbitrary JavaScript with chrome privileges. MFSA 2010-83 / CVE-2010-3774: Google security researcher Michal Zalewski reported that when a window was opened to a site resulting in a network or certificate error page, the opening site could access the document inside the opened window and inject arbitrary content. An attacker could use this bug to spoof the location bar and trick a user into thinking they were on a different site than they actually were. MFSA 2010-84 / CVE-2010-3770: Security researchers Yosuke Hasegawa and Masatoshi Kimura reported that the x-mac-arabic, x-mac-farsi and x-mac-hebrew character encodings are vulnerable to XSS attacks due to some characters being converted to angle brackets when displayed by the rendering engine. Sites using these character encodings would thus be potentially vulnerable to script injection attacks if their script filtering code fails to strip out these specific characters. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch MozillaThunderbird-3687 seamonkey-3690 - openSUSE 11.2: zypper in -t patch MozillaThunderbird-3687 seamonkey-3690 - openSUSE 11.1: zypper in -t patch MozillaThunderbird-3687 seamonkey-3690 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.0.11 and 3.0.11]: MozillaThunderbird-3.0.11-0.5.1 MozillaThunderbird-devel-3.0.11-0.5.1 MozillaThunderbird-translations-common-3.0.11-0.5.1 MozillaThunderbird-translations-other-3.0.11-0.5.1 enigmail-1.0.1-4.5.1 seamonkey-2.0.11-0.2.1 seamonkey-dom-inspector-2.0.11-0.2.1 seamonkey-irc-2.0.11-0.2.1 seamonkey-translations-common-2.0.11-0.2.1 seamonkey-translations-other-2.0.11-0.2.1 seamonkey-venkman-2.0.11-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.0.1,2.0.11 and 3.0.11]: MozillaThunderbird-3.0.11-0.5.1 MozillaThunderbird-devel-3.0.11-0.5.1 MozillaThunderbird-translations-common-3.0.11-0.5.1 MozillaThunderbird-translations-other-3.0.11-0.5.1 enigmail-1.0.1-3.5.1 seamonkey-2.0.11-0.2.1 seamonkey-dom-inspector-2.0.11-0.2.1 seamonkey-irc-2.0.11-0.2.1 seamonkey-venkman-2.0.11-0.2.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 2.0.11 and 3.0.11]: MozillaThunderbird-3.0.11-0.6.1 MozillaThunderbird-devel-3.0.11-0.6.1 MozillaThunderbird-translations-common-3.0.11-0.6.1 MozillaThunderbird-translations-other-3.0.11-0.6.1 enigmail-1.0.1-6.6.1 seamonkey-2.0.11-0.1.1 seamonkey-dom-inspector-2.0.11-0.1.1 seamonkey-irc-2.0.11-0.1.1 seamonkey-venkman-2.0.11-0.1.1 References: https://bugzilla.novell.com/657016

1 0

openSUSE-SU-2010:1053-1 (important): krb5: Fixes for multiple remote vulnerabilities in MIT krb5
by opensuse-security＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Security Update: krb5: Fixes for multiple remote vulnerabilities in MIT krb5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1053-1 Rating: important References: #650650 Cross-References: CVE-2010-1323 CVE-2010-1324 CVE-2010-4020 CVE-2010-4021 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Multiple remote vulnerabilities in the MIT krb5 package have been fixed. They affect client as well as server software. CVE-2010-1323, CVE-2010-1324,CVE-2010-4020 and CVE-2010-4021 have been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch krb5-3612 - openSUSE 11.2: zypper in -t patch krb5-3612 - openSUSE 11.1: zypper in -t patch krb5-3612 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): krb5-1.8.1-5.3.1 krb5-client-1.8.1-5.3.1 krb5-devel-1.8.1-5.3.1 krb5-plugin-kdb-ldap-1.8.1-5.3.1 krb5-plugin-preauth-pkinit-1.8.1-5.3.1 krb5-server-1.8.1-5.3.1 - openSUSE 11.3 (x86_64): krb5-32bit-1.8.1-5.3.1 krb5-devel-32bit-1.8.1-5.3.1 - openSUSE 11.2 (i586 x86_64): krb5-1.7-6.8.1 krb5-apps-clients-1.7-6.8.1 krb5-apps-servers-1.7-6.8.1 krb5-client-1.7-6.8.1 krb5-devel-1.7-6.8.1 krb5-plugin-kdb-ldap-1.7-6.8.1 krb5-plugin-preauth-pkinit-1.7-6.8.1 krb5-server-1.7-6.8.1 - openSUSE 11.2 (x86_64): krb5-32bit-1.7-6.8.1 krb5-devel-32bit-1.7-6.8.1 - openSUSE 11.1 (i586 ppc x86_64): krb5-1.6.3-132.10.1 krb5-apps-clients-1.6.3-132.10.1 krb5-apps-servers-1.6.3-132.10.1 krb5-client-1.6.3-132.10.1 krb5-devel-1.6.3-132.10.1 krb5-plugin-kdb-ldap-1.6.3-132.10.1 krb5-plugin-preauth-pkinit-1.6.3-132.10.1 krb5-server-1.6.3-132.10.1 - openSUSE 11.1 (x86_64): krb5-32bit-1.6.3-132.10.1 krb5-devel-32bit-1.6.3-132.10.1 - openSUSE 11.1 (ppc): krb5-64bit-1.6.3-132.10.1 krb5-devel-64bit-1.6.3-132.10.1 References: http://support.novell.com/security/cve/CVE-2010-1323.html http://support.novell.com/security/cve/CVE-2010-1324.html http://support.novell.com/security/cve/CVE-2010-4020.html http://support.novell.com/security/cve/CVE-2010-4021.html https://bugzilla.novell.com/650650

1 0

openSUSE-SU-2010:1052-1 (critical): exim security update
by opensuse-security＠opensuse.org 13 Dec '10

13 Dec '10

openSUSE Security Update: exim security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1052-1 Rating: critical References: #658731 Cross-References: CVE-2010-4344 CVE-2010-4345 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: remote attackers could trick exim into running arbitrary code (CVE-2010-4344). A privilege escalation flaw allowed attackers to gain root access (CVE-2010-4345). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch exim-3680 - openSUSE 11.2: zypper in -t patch exim-3680 - openSUSE 11.1: zypper in -t patch exim-3680 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): exim-4.71-4.3.1 eximon-4.71-4.3.1 eximstats-html-4.71-4.3.1 - openSUSE 11.2 (i586 x86_64): exim-4.69-72.6.1 eximon-4.69-72.6.1 eximstats-html-4.69-72.6.1 - openSUSE 11.1 (i586 ppc x86_64): exim-4.69-70.15.1 eximon-4.69-70.15.1 eximstats-html-4.69-70.15.1 References: http://support.novell.com/security/cve/CVE-2010-4344.html http://support.novell.com/security/cve/CVE-2010-4345.html https://bugzilla.novell.com/658731

1 0

openSUSE-SU-2010:1051-1 (important): python security update
by opensuse-security＠opensuse.org 10 Dec '10

10 Dec '10

openSUSE Security Update: python security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1051-1 Rating: important References: #638233 Cross-References: CVE-2010-3493 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: a race condition in the accept() implementation of smtpd.py could lead to a denial of service (CVE-2010-3493) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libpython2_6-1_0-3488 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libpython2_6-1_0-2.6.5-3.3.1 python-2.6.5-3.3.1 python-base-2.6.5-3.3.1 python-curses-2.6.5-3.3.1 python-demo-2.6.5-3.3.1 python-devel-2.6.5-3.3.1 python-gdbm-2.6.5-3.3.1 python-idle-2.6.5-3.3.1 python-tk-2.6.5-3.3.1 python-xml-2.6.5-3.3.1 - openSUSE 11.3 (x86_64): libpython2_6-1_0-32bit-2.6.5-3.3.1 python-32bit-2.6.5-3.3.1 python-base-32bit-2.6.5-3.3.1 References: http://support.novell.com/security/cve/CVE-2010-3493.html https://bugzilla.novell.com/638233

1 0

openSUSE-SU-2010:1049-1 (important): python security update
by opensuse-security＠opensuse.org 10 Dec '10

10 Dec '10

openSUSE Security Update: python security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1049-1 Rating: important References: #609759 #609761 #638233 Cross-References: CVE-2010-1634 CVE-2010-2089 CVE-2010-3493 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: - a race condition in the accept() implementation of smtpd.py could lead to a denial of service (CVE-2010-3493). - integer overflows and insufficient size checks could crash the audioop module (CVE-2010-2089, CVE-2010-1634). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libpython2_6-1_0-3487 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): libpython2_6-1_0-2.6.2-6.7.1 python-2.6.2-6.7.1 python-base-2.6.2-6.7.1 python-curses-2.6.2-6.7.1 python-demo-2.6.2-6.7.1 python-devel-2.6.2-6.7.1 python-gdbm-2.6.2-6.7.1 python-idle-2.6.2-6.7.1 python-tk-2.6.2-6.7.1 python-xml-2.6.2-6.7.1 - openSUSE 11.2 (x86_64): libpython2_6-1_0-32bit-2.6.2-6.7.1 python-32bit-2.6.2-6.7.1 python-base-32bit-2.6.2-6.7.1 References: http://support.novell.com/security/cve/CVE-2010-1634.html http://support.novell.com/security/cve/CVE-2010-2089.html http://support.novell.com/security/cve/CVE-2010-3493.html https://bugzilla.novell.com/609759 https://bugzilla.novell.com/609761 https://bugzilla.novell.com/638233

1 0

openSUSE-SU-2010:1047-1 (important): Linux Kernel: Security/Bugfix update to fix local privilege escalations
by opensuse-security＠opensuse.org 10 Dec '10

10 Dec '10

openSUSE Security Update: Linux Kernel: Security/Bugfix update to fix local privilege escalations ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1047-1 Rating: important References: #595215 #642302 #642311 #642312 #642313 #642314 #642484 #642486 #643477 #645659 #646045 #651218 #651356 #651626 #652563 #652940 #652945 #653260 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: This security update of the openSUSE 11.1 kernel updates the kernel to 2.6.27.56 and fixes various security issues and other bugs. Following security issues were fixed by this update: CVE-2010-2963: A problem in the compat ioctl handling in video4linux allowed local attackers with a video device plugged in to gain privileges on x86_64 systems. CVE-2010-4157: A 32bit vs 64bit integer mismatch in gdth_ioctl_alloc could lead to memory corruption in the GDTH driver. CVE-2010-4164: A remote (or local) attacker communicating over X.25 could cause a kernel panic by attempting to negotiate malformed facilities. CVE-2010-3874: A minor heap overflow in the CAN network module was fixed. Due to nature of the memory allocator it is likely not exploitable. CVE-2010-4158: A memory information leak in berkely packet filter rules allowed local attackers to read uninitialized memory of the kernel stack. CVE-2010-4162: A local denial of service in the blockdevice layer was fixed. CVE-2010-3437: A range checking overflow in pktcdvd ioctl was fixed. CVE-2010-4078: The sisfb_ioctl function in drivers/video/sis/sis_main.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call. CVE-2010-4082: The viafb_ioctl_get_viafb_info function in drivers/video/via/ioctl.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call. CVE-2010-4073: The ipc subsystem in the Linux kernel did not initialize certain structures, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in ipc/compat_mq.c. CVE-2010-4072: The copy_shmid_to_user function in ipc/shm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via vectors related to the shmctl system call and the "old shm interface." CVE-2010-4083: The copy_semid_to_user function in ipc/sem.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via a (1) IPC_INFO, (2) SEM_INFO, (3) IPC_STAT, or (4) SEM_STAT command in a semctl system call. CVE-2010-3067: Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel allowed local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call. CVE-2010-3442: Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel allowed local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call. CVE-2010-4080: The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call. CVE-2010-4081: The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel did not initialize a certain structure, which allowed local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch kernel-3619 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64) [New Version: 2.6.27.56]: kernel-default-2.6.27.56-0.1.1 kernel-default-base-2.6.27.56-0.1.1 kernel-default-extra-2.6.27.56-0.1.1 kernel-source-2.6.27.56-0.1.1 kernel-syms-2.6.27.56-0.1.1 kernel-vanilla-2.6.27.56-0.1.1 - openSUSE 11.1 (i586 x86_64) [New Version: 2.6.27.56]: kernel-debug-2.6.27.56-0.1.1 kernel-debug-base-2.6.27.56-0.1.1 kernel-debug-extra-2.6.27.56-0.1.1 kernel-trace-2.6.27.56-0.1.1 kernel-trace-base-2.6.27.56-0.1.1 kernel-trace-extra-2.6.27.56-0.1.1 kernel-xen-2.6.27.56-0.1.1 kernel-xen-base-2.6.27.56-0.1.1 kernel-xen-extra-2.6.27.56-0.1.1 - openSUSE 11.1 (noarch): kernel-docs-2.6.3-3.13.135 - openSUSE 11.1 (i586) [New Version: 2.6.27.56]: kernel-pae-2.6.27.56-0.1.1 kernel-pae-base-2.6.27.56-0.1.1 kernel-pae-extra-2.6.27.56-0.1.1 - openSUSE 11.1 (ppc) [New Version: 2.6.27.56]: kernel-kdump-2.6.27.56-0.1.1 kernel-ppc64-2.6.27.56-0.1.1 kernel-ppc64-base-2.6.27.56-0.1.1 kernel-ppc64-extra-2.6.27.56-0.1.1 kernel-ps3-2.6.27.56-0.1.1 References: https://bugzilla.novell.com/595215 https://bugzilla.novell.com/642302 https://bugzilla.novell.com/642311 https://bugzilla.novell.com/642312 https://bugzilla.novell.com/642313 https://bugzilla.novell.com/642314 https://bugzilla.novell.com/642484 https://bugzilla.novell.com/642486 https://bugzilla.novell.com/643477 https://bugzilla.novell.com/645659 https://bugzilla.novell.com/646045 https://bugzilla.novell.com/651218 https://bugzilla.novell.com/651356 https://bugzilla.novell.com/651626 https://bugzilla.novell.com/652563 https://bugzilla.novell.com/652940 https://bugzilla.novell.com/652945 https://bugzilla.novell.com/653260

1 0

openSUSE-SU-2010:1042-1 (moderate): subversion security update
by opensuse-security＠opensuse.org 09 Dec '10

09 Dec '10

openSUSE Security Update: subversion security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1042-1 Rating: moderate References: #649861 Cross-References: CVE-2010-3315 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: when using "SVNPathAuthz short_circuit" mod_dav_svn didn't properly enforce access restrictions (CVE-2010-3315). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libsvn_auth_gnome_keyring-1-0-3423 - openSUSE 11.2: zypper in -t patch libsvn_auth_gnome_keyring-1-0-3423 - openSUSE 11.1: zypper in -t patch libsvn_auth_gnome_keyring-1-0-3423 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.6.9-4.3.1 libsvn_auth_kwallet-1-0-1.6.9-4.3.1 subversion-1.6.9-4.3.1 subversion-devel-1.6.9-4.3.1 subversion-perl-1.6.9-4.3.1 subversion-python-1.6.9-4.3.1 subversion-ruby-1.6.9-4.3.1 subversion-server-1.6.9-4.3.1 subversion-tools-1.6.9-4.3.1 - openSUSE 11.2 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.6.6-1.3.1 libsvn_auth_kwallet-1-0-1.6.6-1.3.1 subversion-1.6.6-1.3.1 subversion-devel-1.6.6-1.3.1 subversion-perl-1.6.6-1.3.1 subversion-python-1.6.6-1.3.1 subversion-ruby-1.6.6-1.3.1 subversion-server-1.6.6-1.3.1 subversion-tools-1.6.6-1.3.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 1.5.7]: subversion-1.5.7-0.2.2 subversion-devel-1.5.7-0.2.2 subversion-perl-1.5.7-0.2.2 subversion-python-1.5.7-0.2.2 subversion-server-1.5.7-0.2.2 subversion-tools-1.5.7-0.2.2 References: http://support.novell.com/security/cve/CVE-2010-3315.html https://bugzilla.novell.com/649861

1 0

openSUSE-SU-2010:1041-1 (moderate): clamav: security vulnerabilities fixed by upgrade to version 0.96.5
by opensuse-security＠opensuse.org 09 Dec '10

09 Dec '10

openSUSE Security Update: clamav: security vulnerabilities fixed by upgrade to version 0.96.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1041-1 Rating: moderate References: #656548 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: Upgrade to version clamav 0.96.5 to fix: - CVE-2010-4260: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P): Denial of service bugs while parsing PDFs. - CVE-2010-4261: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P): Memory corruption due to an off-by-one error within the icon_cb() function. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch clamav-3644 - openSUSE 11.2: zypper in -t patch clamav-3644 - openSUSE 11.1: zypper in -t patch clamav-3644 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 0.96.5]: clamav-0.96.5-0.2.1 - openSUSE 11.3 (noarch) [New Version: 0.96.5]: clamav-db-0.96.5-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 0.96.5]: clamav-0.96.5-0.2.1 clamav-db-0.96.5-0.2.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 0.96.5]: clamav-0.96.5-0.1.1 clamav-db-0.96.5-0.1.1 References: https://bugzilla.novell.com/656548

1 0

openSUSE-RU-2010:1039-1 (important): pidgin: Version update to 2.7.7
by maintenance＠opensuse.org 09 Dec '10

09 Dec '10

openSUSE Recommended Update: pidgin: Version update to 2.7.7 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1039-1 Rating: important References: #655477 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: Pidgin was updated to version 2.7.7 to fix various bugs and bring new features. Especially MSN and ICQ support were fixed. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch finch-3670 - openSUSE 11.2: zypper in -t patch finch-3670 - openSUSE 11.1: zypper in -t patch finch-3670 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.7.7]: finch-2.7.7-1.1.1 finch-devel-2.7.7-1.1.1 libpurple-2.7.7-1.1.1 libpurple-devel-2.7.7-1.1.1 libpurple-meanwhile-2.7.7-1.1.1 libpurple-mono-2.7.7-1.1.1 libpurple-tcl-2.7.7-1.1.1 pidgin-2.7.7-1.1.1 pidgin-devel-2.7.7-1.1.1 pidgin-otr-3.2.0-146.1.1 - openSUSE 11.3 (noarch) [New Version: 2.7.7]: libpurple-lang-2.7.7-1.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 2.7.7]: finch-2.7.7-1.1.2 finch-devel-2.7.7-1.1.2 libpurple-2.7.7-1.1.2 libpurple-devel-2.7.7-1.1.2 libpurple-meanwhile-2.7.7-1.1.2 libpurple-mono-2.7.7-1.1.2 libpurple-tcl-2.7.7-1.1.2 pidgin-2.7.7-1.1.2 pidgin-devel-2.7.7-1.1.2 pidgin-otr-3.2.0-142.4.4 - openSUSE 11.2 (noarch) [New Version: 2.7.7]: libpurple-lang-2.7.7-1.1.2 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 2.7.7]: finch-2.7.7-1.1.3 finch-devel-2.7.7-1.1.3 libpurple-2.7.7-1.1.3 libpurple-devel-2.7.7-1.1.3 libpurple-lang-2.7.7-1.1.3 libpurple-meanwhile-2.7.7-1.1.3 libpurple-mono-2.7.7-1.1.3 pidgin-2.7.7-1.1.3 pidgin-devel-2.7.7-1.1.3 pidgin-otr-3.2.0-1.16.104 References: https://bugzilla.novell.com/655477

1 0

openSUSE-RU-2010:1038-1 (moderate): libtirpc: This updates brings nfs-client to work with portmap
by maintenance＠opensuse.org 09 Dec '10

09 Dec '10

openSUSE Recommended Update: libtirpc: This updates brings nfs-client to work with portmap ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1038-1 Rating: moderate References: #633007 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Without this update, RPC applications linked against libtirpc will fail to register themselves on systems that use portmap instead of rpcbind. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libtirpc-3217 - openSUSE 11.2: zypper in -t patch libtirpc-3217 - openSUSE 11.1: zypper in -t patch libtirpc-3217 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libtirpc-devel-0.2.1-4.1.1 libtirpc1-0.2.1-4.1.1 - openSUSE 11.2 (i586 x86_64): libtirpc-devel-0.1.9-5.1.1 libtirpc1-0.1.9-5.1.1 - openSUSE 11.1 (i586 ppc x86_64): libtirpc-devel-0.1.9-4.8.1 libtirpc1-0.1.9-4.8.1 References: https://bugzilla.novell.com/633007

1 0

openSUSE-SU-2010:1036-1 (important): kdelibs: fixing invalid character reference buffer overflow (CVE-2009-1725)
by opensuse-security＠opensuse.org 08 Dec '10

08 Dec '10

openSUSE Security Update: kdelibs: fixing invalid character reference buffer overflow (CVE-2009-1725) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1036-1 Rating: important References: #512559 #600469 Cross-References: CVE-2009-1725 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: An invalid character reference causing a buffer overflow in khtml has been fixed in the kdelibs package. CVE-2009-1725 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch kdelibs4-3451 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): kdelibs4-4.1.3-4.12.1 kdelibs4-core-4.1.3-4.12.1 kdelibs4-doc-4.1.3-4.12.1 libkde4-4.1.3-4.12.1 libkde4-devel-4.1.3-4.12.1 libkdecore4-4.1.3-4.12.1 libkdecore4-devel-4.1.3-4.12.1 - openSUSE 11.1 (x86_64): libkde4-32bit-4.1.3-4.12.1 libkdecore4-32bit-4.1.3-4.12.1 References: http://support.novell.com/security/cve/CVE-2009-1725.html https://bugzilla.novell.com/512559 https://bugzilla.novell.com/600469

1 0

openSUSE-SU-2010:1035-1 (important): kdegraphics3: fixing various pointer dereferencing vulnerabilities (CVE-2009-1709 and CVE-2009-0945)
by opensuse-security＠opensuse.org 08 Dec '10

08 Dec '10

openSUSE Security Update: kdegraphics3: fixing various pointer dereferencing vulnerabilities (CVE-2009-1709 and CVE-2009-0945) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1035-1 Rating: important References: #512559 #600469 Cross-References: CVE-2009-0945 CVE-2009-1709 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Various pointer dereferencing vulnerabilities in kdegraphics3's KSVG have been fixed. CVE-2009-1709 and CVE-2009-0945 have been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch kdegraphics3-3479 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): kdegraphics3-3.5.10-1.66.1 kdegraphics3-3D-3.5.10-1.66.1 kdegraphics3-devel-3.5.10-1.66.1 kdegraphics3-extra-3.5.10-1.66.1 kdegraphics3-fax-3.5.10-1.66.1 kdegraphics3-imaging-3.5.10-1.66.1 kdegraphics3-kamera-3.5.10-1.66.1 kdegraphics3-pdf-3.5.10-1.66.1 kdegraphics3-postscript-3.5.10-1.66.1 kdegraphics3-scan-3.5.10-1.66.1 kdegraphics3-tex-3.5.10-1.66.1 References: http://support.novell.com/security/cve/CVE-2009-0945.html http://support.novell.com/security/cve/CVE-2009-1709.html https://bugzilla.novell.com/512559 https://bugzilla.novell.com/600469

1 0

openSUSE-SU-2010:1034-1 (important): kdelibs3: Fixing khtml vulnerabilities CVE-2009-1690,CVE-2009-1687 and CVE-2009-1698.
by opensuse-security＠opensuse.org 08 Dec '10

08 Dec '10

openSUSE Security Update: kdelibs3: Fixing khtml vulnerabilities CVE-2009-1690,CVE-2009-1687 and CVE-2009-1698. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1034-1 Rating: important References: #512559 Cross-References: CVE-2009-1687 CVE-2009-1690 CVE-2009-1698 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The following vulnerabilities in kdelibs3's khtml subsystem have been fixed: CVE-2009-1690,CVE-2009-1687 and CVE-2009-1698. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch kdelibs3-3472 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): kdelibs3-3.5.10-21.13.1 kdelibs3-arts-3.5.10-21.13.1 kdelibs3-default-style-3.5.10-21.13.1 kdelibs3-devel-3.5.10-21.13.1 kdelibs3-doc-3.5.10-21.13.1 - openSUSE 11.1 (x86_64): kdelibs3-32bit-3.5.10-21.13.1 kdelibs3-arts-32bit-3.5.10-21.13.1 kdelibs3-default-style-32bit-3.5.10-21.13.1 - openSUSE 11.1 (ppc): kdelibs3-64bit-3.5.10-21.13.1 kdelibs3-arts-64bit-3.5.10-21.13.1 kdelibs3-default-style-64bit-3.5.10-21.13.1 References: http://support.novell.com/security/cve/CVE-2009-1687.html http://support.novell.com/security/cve/CVE-2009-1690.html http://support.novell.com/security/cve/CVE-2009-1698.html https://bugzilla.novell.com/512559

1 0

openSUSE-SU-2010:1031-1 (important): bind security update
by opensuse-security＠opensuse.org 08 Dec '10

08 Dec '10

openSUSE Security Update: bind security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1031-1 Rating: important References: #657102 #657129 Cross-References: CVE-2010-3613 CVE-2010-3614 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes two new package versions. Description: Adding certain types of signed negative responses to cache doesn't clear any matching RRSIG records already in cache. A subsequent lookup of the cached data can cause named to crash (CVE-2010-3613). bind did not properly determine the security status of an NS RRset during a DNSKEY algorithm rollover, which might allow remote attackers to cause a denial of service (DNSSEC validation error) by triggering a rollover (CVE-2010-3614). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch bind-3662 - openSUSE 11.2: zypper in -t patch bind-3662 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 9.7.1P2]: bind-9.7.1P2-0.4.1 bind-chrootenv-9.7.1P2-0.4.1 bind-devel-9.7.1P2-0.4.1 bind-libs-9.7.1P2-0.4.1 bind-utils-9.7.1P2-0.4.1 - openSUSE 11.3 (x86_64) [New Version: 9.7.1P2]: bind-libs-32bit-9.7.1P2-0.4.1 - openSUSE 11.3 (noarch) [New Version: 9.7.1P2]: bind-doc-9.7.1P2-0.4.1 - openSUSE 11.2 (i586 x86_64) [New Version: 9.6.1P3]: bind-9.6.1P3-1.3.1 bind-chrootenv-9.6.1P3-1.3.1 bind-devel-9.6.1P3-1.3.1 bind-doc-9.6.1P3-1.3.1 bind-libs-9.6.1P3-1.3.1 bind-utils-9.6.1P3-1.3.1 - openSUSE 11.2 (x86_64) [New Version: 9.6.1P3]: bind-libs-32bit-9.6.1P3-1.3.1 References: http://support.novell.com/security/cve/CVE-2010-3613.html http://support.novell.com/security/cve/CVE-2010-3614.html https://bugzilla.novell.com/657102 https://bugzilla.novell.com/657129

1 0

openSUSE-SU-2010:1030-1 (important): acroread security update
by opensuse-security＠opensuse.org 07 Dec '10

07 Dec '10

openSUSE Security Update: acroread security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1030-1 Rating: important References: #651232 Cross-References: CVE-2010-3654 CVE-2010-4091 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: This update of acroread fixes two critical vulnerabilities. The first one in referenced by CVE-2010-3654 and exists in the integrated authplay component that may allow remote attackers to take control over a victims system. (CVE-2010-3654: CVSS v2 Base Score: 6.8 (critical) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)) The other issue was disclosed on full-disclosure to demonstrate a denial of service attack, an extend of this attack to execute arbitrary code could be possible. (CVE-2010-4091: CVSS v2 Base Score: 6.8 (critical) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch acroread-3653 - openSUSE 11.2: zypper in -t patch acroread-3653 - openSUSE 11.1: zypper in -t patch acroread-3653 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586) [New Version: 9.4.1]: acroread-9.4.1-0.2.1 - openSUSE 11.2 (noarch) [New Version: 9.4.1]: acroread-cmaps-9.4.1-0.2.1 acroread-fonts-ja-9.4.1-0.2.1 acroread-fonts-ko-9.4.1-0.2.1 acroread-fonts-zh_CN-9.4.1-0.2.1 acroread-fonts-zh_TW-9.4.1-0.2.1 - openSUSE 11.2 (i586) [New Version: 9.4.1]: acroread-9.4.1-0.2.1 - openSUSE 11.1 (noarch) [New Version: 9.4.1]: acroread-cmaps-9.4.1-0.2.1 acroread-fonts-ja-9.4.1-0.2.1 acroread-fonts-ko-9.4.1-0.2.1 acroread-fonts-zh_CN-9.4.1-0.2.1 acroread-fonts-zh_TW-9.4.1-0.2.1 - openSUSE 11.1 (i586) [New Version: 9.4.1]: acroread-9.4.1-0.2.1 References: http://support.novell.com/security/cve/CVE-2010-3654.html http://support.novell.com/security/cve/CVE-2010-4091.html https://bugzilla.novell.com/651232

1 0

openSUSE-SU-2010:1029-1 (moderate): mercurial: security update
by opensuse-security＠opensuse.org 06 Dec '10

06 Dec '10

openSUSE Security Update: mercurial: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1029-1 Rating: moderate References: #645293 Cross-References: CVE-2010-4237: Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of mercurial improves the SSL certificate validation process. CVE-2010-4237: CVSS v2 Base Score: 4.3 (moderate) (AV:N/AC:M/Au:N/C:N/I:P/A:N) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch mercurial-3642 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): mercurial-1.5-4.3.1 References: http://support.novell.com/security/cve/CVE-2010-4237:.html https://bugzilla.novell.com/645293

1 0

openSUSE-SU-2010:1028-1 (low): encfs: security update
by opensuse-security＠opensuse.org 06 Dec '10

06 Dec '10

openSUSE Security Update: encfs: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1028-1 Rating: low References: #637286 Cross-References: CVE-2010-3073 CVE-2010-3074 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of encfs fixes: - CVE-2010-3073: CVSS v2 Base Score: 1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N): Cryptographic Issues (CWE-310): encfs Only 32 bit of file IV used - CVE-2010-3074: CVSS v2 Base Score: 1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N): Cryptographic Issues (CWE-310): encfs Watermarking attack The patch for CVE-2010-3075 (Last block with single byte is insecure) was not applied because upstream disabled it by default, expect for expert mode. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch encfs-3641 - openSUSE 11.2: zypper in -t patch encfs-3641 - openSUSE 11.1: zypper in -t patch encfs-3641 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): encfs-1.6.0-2.3.1 - openSUSE 11.2 (i586 x86_64): encfs-1.5.0-4.3.1 - openSUSE 11.1 (i586 ppc x86_64): encfs-1.5.0-1.17.1 References: http://support.novell.com/security/cve/CVE-2010-3073.html http://support.novell.com/security/cve/CVE-2010-3074.html https://bugzilla.novell.com/637286

1 0

openSUSE-SU-2010:1027-1 (moderate): epiphany security update
by opensuse-security＠opensuse.org 06 Dec '10

06 Dec '10

openSUSE Security Update: epiphany security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1027-1 Rating: moderate References: #640090 Cross-References: CVE-2010-3312 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: epiphany does not support verification of ssl certificates. It nevertheless displayed all https connections as secure (CVE-2010-3312). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch epiphany-3309 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64) [New Version: 2.28.2]: epiphany-2.28.2-0.2.1 epiphany-branding-upstream-2.28.2-0.2.1 epiphany-devel-2.28.2-0.2.1 epiphany-doc-2.28.2-0.2.1 - openSUSE 11.2 (noarch) [New Version: 2.28.2]: epiphany-lang-2.28.2-0.2.1 References: http://support.novell.com/security/cve/CVE-2010-3312.html https://bugzilla.novell.com/640090

1 0

openSUSE-SU-2010:1025-1 (moderate): gnutls: fixing SSL-renegotiation "authentication gap"
by opensuse-security＠opensuse.org 06 Dec '10

06 Dec '10

openSUSE Security Update: gnutls: fixing SSL-renegotiation "authentication gap" ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1025-1 Rating: moderate References: #554084 Cross-References: CVE-2009-3555 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The SSL-renegotiation "authentication gap" has been fixed in gnutls. CVE-2009-3555 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnutls-3388 - openSUSE 11.2: zypper in -t patch gnutls-3388 - openSUSE 11.1: zypper in -t patch gnutls-3388 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): gnutls-2.8.6-2.3.1 libgnutls-devel-2.8.6-2.3.1 libgnutls-extra-devel-2.8.6-2.3.1 libgnutls-extra26-2.8.6-2.3.1 libgnutls26-2.8.6-2.3.1 - openSUSE 11.3 (x86_64): libgnutls26-32bit-2.8.6-2.3.1 - openSUSE 11.2 (i586 x86_64): gnutls-2.4.1-26.6.1 libgnutls-devel-2.4.1-26.6.1 libgnutls-extra-devel-2.4.1-26.6.1 libgnutls-extra26-2.4.1-26.6.1 libgnutls26-2.4.1-26.6.1 - openSUSE 11.2 (x86_64): libgnutls26-32bit-2.4.1-26.6.1 - openSUSE 11.1 (i586 ppc x86_64): gnutls-2.4.1-24.8.1 libgnutls-devel-2.4.1-24.8.1 libgnutls-extra-devel-2.4.1-24.8.1 libgnutls-extra26-2.4.1-24.8.1 libgnutls26-2.4.1-24.8.1 - openSUSE 11.1 (x86_64): libgnutls26-32bit-2.4.1-24.8.1 - openSUSE 11.1 (ppc): libgnutls26-64bit-2.4.1-24.8.1 References: http://support.novell.com/security/cve/CVE-2009-3555.html https://bugzilla.novell.com/554084

1 0

openSUSE-RU-2010:1024-1 (low): tracker: Remove old data from store when stopping indexing
by maintenance＠opensuse.org 06 Dec '10

06 Dec '10

openSUSE Recommended Update: tracker: Remove old data from store when stopping indexing ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1024-1 Rating: low References: #640786 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes tracker to remove old data from the store when stopping the indexing (bnc#640786). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch evolution-tracker-3621 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): evolution-tracker-0.8.5-3.3.1 libtracker-client-0_8-0-0.8.5-3.3.1 libtracker-extract-0_8-0-0.8.5-3.3.1 libtracker-miner-0_8-0-0.8.5-3.3.1 nautilus-tracker-0.8.5-3.3.1 tracker-0.8.5-3.3.1 tracker-applet-0.8.5-3.3.1 tracker-devel-0.8.5-3.3.1 tracker-gui-0.8.5-3.3.1 - openSUSE 11.3 (noarch): tracker-lang-0.8.5-3.3.1 References: https://bugzilla.novell.com/640786

1 0

openSUSE-RU-2010:1023-1 (low): boost: Improve support for gcc 4.5
by maintenance＠opensuse.org 06 Dec '10

06 Dec '10

openSUSE Recommended Update: boost: Improve support for gcc 4.5 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1023-1 Rating: low References: #621140 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides improvements to headers to make it useable with gcc 4.5 (bnc#621140). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch boost-3616 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): boost-devel-1.42.0-7.1.1 libboost_date_time1_42_0-1.42.0-7.1.1 libboost_filesystem1_42_0-1.42.0-7.1.1 libboost_graph1_42_0-1.42.0-7.1.1 libboost_iostreams1_42_0-1.42.0-7.1.1 libboost_math1_42_0-1.42.0-7.1.1 libboost_mpi1_42_0-1.42.0-7.1.1 libboost_program_options1_42_0-1.42.0-7.1.1 libboost_python1_42_0-1.42.0-7.1.1 libboost_regex1_42_0-1.42.0-7.1.1 libboost_serialization1_42_0-1.42.0-7.1.1 libboost_signals1_42_0-1.42.0-7.1.1 libboost_system1_42_0-1.42.0-7.1.1 libboost_test1_42_0-1.42.0-7.1.1 libboost_thread1_42_0-1.42.0-7.1.1 libboost_wave1_42_0-1.42.0-7.1.1 - openSUSE 11.3 (x86_64): boost-devel-32bit-1.42.0-7.1.1 libboost_date_time1_42_0-32bit-1.42.0-7.1.1 libboost_filesystem1_42_0-32bit-1.42.0-7.1.1 libboost_graph1_42_0-32bit-1.42.0-7.1.1 libboost_iostreams1_42_0-32bit-1.42.0-7.1.1 libboost_math1_42_0-32bit-1.42.0-7.1.1 libboost_mpi1_42_0-32bit-1.42.0-7.1.1 libboost_program_options1_42_0-32bit-1.42.0-7.1.1 libboost_python1_42_0-32bit-1.42.0-7.1.1 libboost_regex1_42_0-32bit-1.42.0-7.1.1 libboost_serialization1_42_0-32bit-1.42.0-7.1.1 libboost_signals1_42_0-32bit-1.42.0-7.1.1 libboost_system1_42_0-32bit-1.42.0-7.1.1 libboost_test1_42_0-32bit-1.42.0-7.1.1 libboost_thread1_42_0-32bit-1.42.0-7.1.1 libboost_wave1_42_0-32bit-1.42.0-7.1.1 - openSUSE 11.3 (noarch): boost-doc-html-1.42.0-7.1.1 boost-doc-man-1.42.0-7.1.1 boost-doc-pdf-1.42.0-7.1.1 boost-license1_42_0-1.42.0-7.1.1 References: https://bugzilla.novell.com/621140

1 0

openSUSE-RU-2010:1022-1 (low): nfs-utils: Fix remount of NFS v3 filesystems
by maintenance＠opensuse.org 06 Dec '10

06 Dec '10

openSUSE Recommended Update: nfs-utils: Fix remount of NFS v3 filesystems ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1022-1 Rating: low References: #647292 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes remounting of NFS v3 filesystems (bnc#647292). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch nfs-client-3588 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): nfs-client-1.2.1-8.3.1 nfs-doc-1.2.1-8.3.1 nfs-kernel-server-1.2.1-8.3.1 References: https://bugzilla.novell.com/647292

1 0

openSUSE-RU-2010:1021-1 (low): compiz: Fix Desktop Zoop and Enhanced Desktop Zoom plugins
by maintenance＠opensuse.org 06 Dec '10

06 Dec '10

openSUSE Recommended Update: compiz: Fix Desktop Zoop and Enhanced Desktop Zoom plugins ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1021-1 Rating: low References: #641596 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update removes a conflicting patch that makes Desktop Zoom and Enhanced Desktop Zoom plugins to no longer work (bnc#641596). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch compiz-3617 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): compiz-0.8.6-4.3.1 compiz-branding-openSUSE-0.8.6-4.3.1 compiz-branding-upstream-0.8.6-4.3.1 compiz-devel-0.8.6-4.3.1 compiz-gnome-0.8.6-4.3.1 compiz-kde4-0.8.6-4.3.1 References: https://bugzilla.novell.com/641596

1 0

openSUSE-SU-2010:1018-1 (important): cups: security update
by opensuse-security＠opensuse.org 03 Dec '10

03 Dec '10

openSUSE Security Update: cups: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1018-1 Rating: important References: #649256 Cross-References: CVE-2010-0542 CVE-2010-1748 CVE-2010-2941 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This updates fix several bugs, but only the security fixes are listed here: - CVE-2010-2941: CVSS v2 Base Score: 3.3 (AV:A/AC:L/Au:N/C:N/I:N/A:P): CWE-399 Special IPP requests allow to crashcupsd remotely. - CVE-2010-0542: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P): CWE-264 A NULL pointer dereference exists in the _WriteProlog() function of the texttops image filter. - CVE-2010-1748: CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N): CWE-119 An attacker with access to the web-interface may be able to read some bytes of uninitialized memory. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch cups-3574 - openSUSE 11.2: zypper in -t patch cups-3574 - openSUSE 11.1: zypper in -t patch cups-3574 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): cups-1.4.4-3.3.1 cups-client-1.4.4-3.3.1 cups-ddk-1.4.4-3.3.1 cups-devel-1.4.4-3.3.1 cups-libs-1.4.4-3.3.1 - openSUSE 11.3 (x86_64): cups-libs-32bit-1.4.4-3.3.1 - openSUSE 11.2 (i586 x86_64): cups-1.3.11-4.7.1 cups-client-1.3.11-4.7.1 cups-devel-1.3.11-4.7.1 cups-libs-1.3.11-4.7.1 - openSUSE 11.2 (x86_64): cups-libs-32bit-1.3.11-4.7.1 - openSUSE 11.1 (i586 ppc x86_64): cups-1.3.9-7.10.1 cups-client-1.3.9-7.10.1 cups-devel-1.3.9-7.10.1 cups-libs-1.3.9-7.10.1 - openSUSE 11.1 (x86_64): cups-libs-32bit-1.3.9-7.10.1 - openSUSE 11.1 (ppc): cups-libs-64bit-1.3.9-7.10.1 References: http://support.novell.com/security/cve/CVE-2010-0542.html http://support.novell.com/security/cve/CVE-2010-1748.html http://support.novell.com/security/cve/CVE-2010-2941.html https://bugzilla.novell.com/649256

1 0

openSUSE-SU-2010:1017-1 (important): java-1_6_0-openjdk: security update
by opensuse-security＠opensuse.org 03 Dec '10

03 Dec '10

openSUSE Security Update: java-1_6_0-openjdk: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1017-1 Rating: important References: #656742 Cross-References: CVE-2010-3860 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of IcedTea fixes an information leak in System property via public static. (CVE-2010-3860) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch java-1_6_0-openjdk-3618 - openSUSE 11.2: zypper in -t patch java-1_6_0-openjdk-3618 - openSUSE 11.1: zypper in -t patch java-1_6_0-openjdk-3618 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b20.1.9.2-0.2.1 java-1_6_0-openjdk-devel-1.6.0.0_b20.1.9.2-0.2.1 java-1_6_0-openjdk-plugin-1.6.0.0_b20.1.9.2-0.2.1 - openSUSE 11.3 (noarch): java-1_6_0-openjdk-demo-1.6.0.0_b20.1.9.2-0.2.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b20.1.9.2-0.2.1 java-1_6_0-openjdk-src-1.6.0.0_b20.1.9.2-0.2.1 - openSUSE 11.2 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b20.1.9.2-0.2.1 java-1_6_0-openjdk-devel-1.6.0.0_b20.1.9.2-0.2.1 java-1_6_0-openjdk-plugin-1.6.0.0_b20.1.9.2-0.2.1 - openSUSE 11.2 (noarch): java-1_6_0-openjdk-demo-1.6.0.0_b20.1.9.2-0.2.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b20.1.9.2-0.2.1 java-1_6_0-openjdk-src-1.6.0.0_b20.1.9.2-0.2.1 - openSUSE 11.1 (i586 x86_64): java-1_6_0-openjdk-1.6.0.0_b20.1.9.2-0.1.1 java-1_6_0-openjdk-demo-1.6.0.0_b20.1.9.2-0.1.1 java-1_6_0-openjdk-devel-1.6.0.0_b20.1.9.2-0.1.1 java-1_6_0-openjdk-javadoc-1.6.0.0_b20.1.9.2-0.1.1 java-1_6_0-openjdk-plugin-1.6.0.0_b20.1.9.2-0.1.1 java-1_6_0-openjdk-src-1.6.0.0_b20.1.9.2-0.1.1 References: http://support.novell.com/security/cve/CVE-2010-3860.html https://bugzilla.novell.com/656742

1 0

openSUSE-SU-2010:1012-1 (moderate): php5 security update for CVE-2010-3870 and CVE-2010-3710
by opensuse-security＠opensuse.org 02 Dec '10

02 Dec '10

openSUSE Security Update: php5 security update for CVE-2010-3870 and CVE-2010-3710 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1012-1 Rating: moderate References: #650700 Cross-References: CVE-2010-3710 CVE-2010-3870 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes two new package versions. Description: Insufficient handling of certain character sequences in the utf8_decode() function could be leveraged to conduct cross-site-scripting (XSS) attacks (CVE-2010-3870). php5 could also consume large amounts of memory and crash if a long mail address was passed to filter_var() with parmeter FILTER_VALIDATE_EMAIL (CVE-2010-3710). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch apache2-mod_php5-3485 - openSUSE 11.2: zypper in -t patch apache2-mod_php5-3485 - openSUSE 11.1: zypper in -t patch apache2-mod_php5-3485 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 5.3.3]: apache2-mod_php5-5.3.3-0.7.1 php5-5.3.3-0.7.1 php5-bcmath-5.3.3-0.7.1 php5-bz2-5.3.3-0.7.1 php5-calendar-5.3.3-0.7.1 php5-ctype-5.3.3-0.7.1 php5-curl-5.3.3-0.7.1 php5-dba-5.3.3-0.7.1 php5-devel-5.3.3-0.7.1 php5-dom-5.3.3-0.7.1 php5-enchant-5.3.3-0.7.1 php5-exif-5.3.3-0.7.1 php5-fastcgi-5.3.3-0.7.1 php5-fileinfo-5.3.3-0.7.1 php5-ftp-5.3.3-0.7.1 php5-gd-5.3.3-0.7.1 php5-gettext-5.3.3-0.7.1 php5-gmp-5.3.3-0.7.1 php5-hash-5.3.3-0.7.1 php5-iconv-5.3.3-0.7.1 php5-imap-5.3.3-0.7.1 php5-intl-5.3.3-0.7.1 php5-json-5.3.3-0.7.1 php5-ldap-5.3.3-0.7.1 php5-mbstring-5.3.3-0.7.1 php5-mcrypt-5.3.3-0.7.1 php5-mysql-5.3.3-0.7.1 php5-odbc-5.3.3-0.7.1 php5-openssl-5.3.3-0.7.1 php5-pcntl-5.3.3-0.7.1 php5-pdo-5.3.3-0.7.1 php5-pgsql-5.3.3-0.7.1 php5-phar-5.3.3-0.7.1 php5-posix-5.3.3-0.7.1 php5-pspell-5.3.3-0.7.1 php5-readline-5.3.3-0.7.1 php5-shmop-5.3.3-0.7.1 php5-snmp-5.3.3-0.7.1 php5-soap-5.3.3-0.7.1 php5-sockets-5.3.3-0.7.1 php5-sqlite-5.3.3-0.7.1 php5-suhosin-5.3.3-0.7.1 php5-sysvmsg-5.3.3-0.7.1 php5-sysvsem-5.3.3-0.7.1 php5-sysvshm-5.3.3-0.7.1 php5-tidy-5.3.3-0.7.1 php5-tokenizer-5.3.3-0.7.1 php5-wddx-5.3.3-0.7.1 php5-xmlreader-5.3.3-0.7.1 php5-xmlrpc-5.3.3-0.7.1 php5-xmlwriter-5.3.3-0.7.1 php5-xsl-5.3.3-0.7.1 php5-zip-5.3.3-0.7.1 php5-zlib-5.3.3-0.7.1 - openSUSE 11.3 (noarch) [New Version: 5.3.3]: php5-pear-5.3.3-0.7.1 - openSUSE 11.2 (i586 x86_64) [New Version: 5.3.3]: apache2-mod_php5-5.3.3-0.7.1 php5-5.3.3-0.7.1 php5-bcmath-5.3.3-0.7.1 php5-bz2-5.3.3-0.7.1 php5-calendar-5.3.3-0.7.1 php5-ctype-5.3.3-0.7.1 php5-curl-5.3.3-0.7.1 php5-dba-5.3.3-0.7.1 php5-devel-5.3.3-0.7.1 php5-dom-5.3.3-0.7.1 php5-enchant-5.3.3-0.7.1 php5-exif-5.3.3-0.7.1 php5-fastcgi-5.3.3-0.7.1 php5-fileinfo-5.3.3-0.7.1 php5-ftp-5.3.3-0.7.1 php5-gd-5.3.3-0.7.1 php5-gettext-5.3.3-0.7.1 php5-gmp-5.3.3-0.7.1 php5-hash-5.3.3-0.7.1 php5-iconv-5.3.3-0.7.1 php5-imap-5.3.3-0.7.1 php5-intl-5.3.3-0.7.1 php5-json-5.3.3-0.7.1 php5-ldap-5.3.3-0.7.1 php5-mbstring-5.3.3-0.7.1 php5-mcrypt-5.3.3-0.7.1 php5-mysql-5.3.3-0.7.1 php5-odbc-5.3.3-0.7.1 php5-openssl-5.3.3-0.7.1 php5-pcntl-5.3.3-0.7.1 php5-pdo-5.3.3-0.7.1 php5-pgsql-5.3.3-0.7.1 php5-phar-5.3.3-0.7.1 php5-posix-5.3.3-0.7.1 php5-pspell-5.3.3-0.7.1 php5-readline-5.3.3-0.7.1 php5-shmop-5.3.3-0.7.1 php5-snmp-5.3.3-0.7.1 php5-soap-5.3.3-0.7.1 php5-sockets-5.3.3-0.7.1 php5-sqlite-5.3.3-0.7.1 php5-suhosin-5.3.3-0.7.1 php5-sysvmsg-5.3.3-0.7.1 php5-sysvsem-5.3.3-0.7.1 php5-sysvshm-5.3.3-0.7.1 php5-tidy-5.3.3-0.7.1 php5-tokenizer-5.3.3-0.7.1 php5-wddx-5.3.3-0.7.1 php5-xmlreader-5.3.3-0.7.1 php5-xmlrpc-5.3.3-0.7.1 php5-xmlwriter-5.3.3-0.7.1 php5-xsl-5.3.3-0.7.1 php5-zip-5.3.3-0.7.1 php5-zlib-5.3.3-0.7.1 - openSUSE 11.2 (noarch) [New Version: 5.3.3]: php5-pear-5.3.3-0.7.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 5.2.14]: apache2-mod_php5-5.2.14-0.4.1 php5-5.2.14-0.4.1 php5-bcmath-5.2.14-0.4.1 php5-bz2-5.2.14-0.4.1 php5-calendar-5.2.14-0.4.1 php5-ctype-5.2.14-0.4.1 php5-curl-5.2.14-0.4.1 php5-dba-5.2.14-0.4.1 php5-dbase-5.2.14-0.4.1 php5-devel-5.2.14-0.4.1 php5-dom-5.2.14-0.4.1 php5-exif-5.2.14-0.4.1 php5-fastcgi-5.2.14-0.4.1 php5-ftp-5.2.14-0.4.1 php5-gd-5.2.14-0.4.1 php5-gettext-5.2.14-0.4.1 php5-gmp-5.2.14-0.4.1 php5-hash-5.2.14-0.4.1 php5-iconv-5.2.14-0.4.1 php5-imap-5.2.14-0.4.1 php5-json-5.2.14-0.4.1 php5-ldap-5.2.14-0.4.1 php5-mbstring-5.2.14-0.4.1 php5-mcrypt-5.2.14-0.4.1 php5-mysql-5.2.14-0.4.1 php5-ncurses-5.2.14-0.4.1 php5-odbc-5.2.14-0.4.1 php5-openssl-5.2.14-0.4.1 php5-pcntl-5.2.14-0.4.1 php5-pdo-5.2.14-0.4.1 php5-pear-5.2.14-0.4.1 php5-pgsql-5.2.14-0.4.1 php5-posix-5.2.14-0.4.1 php5-pspell-5.2.14-0.4.1 php5-readline-5.2.14-0.4.1 php5-shmop-5.2.14-0.4.1 php5-snmp-5.2.14-0.4.1 php5-soap-5.2.14-0.4.1 php5-sockets-5.2.14-0.4.1 php5-sqlite-5.2.14-0.4.1 php5-suhosin-5.2.14-0.4.1 php5-sysvmsg-5.2.14-0.4.1 php5-sysvsem-5.2.14-0.4.1 php5-sysvshm-5.2.14-0.4.1 php5-tidy-5.2.14-0.4.1 php5-tokenizer-5.2.14-0.4.1 php5-wddx-5.2.14-0.4.1 php5-xmlreader-5.2.14-0.4.1 php5-xmlrpc-5.2.14-0.4.1 php5-xmlwriter-5.2.14-0.4.1 php5-xsl-5.2.14-0.4.1 php5-zip-5.2.14-0.4.1 php5-zlib-5.2.14-0.4.1 References: http://support.novell.com/security/cve/CVE-2010-3710.html http://support.novell.com/security/cve/CVE-2010-3870.html https://bugzilla.novell.com/650700

1 0

openSUSE-YU-2010:1011-1 (low): This update fixes several bugs in the software management tools.
by maintenance＠opensuse.org 02 Dec '10

02 Dec '10

openSUSE YOU Update: This update fixes several bugs in the software management tools. ______________________________________________________________________________ Announcement ID: openSUSE-YU-2010:1011-1 Rating: low References: #545106 #599154 #613198 #613304 #614362 #619196 #620377 #621649 #623226 #623860 #624320 #631306 #635596 #641328 #646410 #647214 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has 16 YOU fixes can now be installed. It includes 5 new package versions. Description: This update fixes several bugs in the software management tools. Special Instructions and Notes: This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. Patch Instructions: To install this openSUSE YOU Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch softwaremgmt_201011-3551 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 0.15.2,0.5.5,1.4.8,2.19.3 and 7.9.6]: libsatsolver-demo-0.15.2-0.1.1 libsatsolver-devel-0.15.2-0.1.1 libzypp-7.9.6-0.3.1 libzypp-devel-7.9.6-0.3.1 perl-satsolver-0.15.2-0.1.1 perl-zypp-0.5.5-1.1.1 python-satsolver-0.15.2-0.1.1 python-zypp-0.5.5-1.1.1 ruby-satsolver-0.15.2-0.1.1 ruby-zypp-0.5.5-1.1.1 satsolver-tools-0.15.2-0.1.1 yast2-qt-pkg-2.19.3-0.1.3 zypper-1.4.8-0.2.4 References: https://bugzilla.novell.com/545106 https://bugzilla.novell.com/599154 https://bugzilla.novell.com/613198 https://bugzilla.novell.com/613304 https://bugzilla.novell.com/614362 https://bugzilla.novell.com/619196 https://bugzilla.novell.com/620377 https://bugzilla.novell.com/621649 https://bugzilla.novell.com/623226 https://bugzilla.novell.com/623860 https://bugzilla.novell.com/624320 https://bugzilla.novell.com/631306 https://bugzilla.novell.com/635596 https://bugzilla.novell.com/641328 https://bugzilla.novell.com/646410 https://bugzilla.novell.com/647214

1 0

openSUSE-RU-2010:1007-1 (low): yast2-country: After changing the timezone and rebooting the old timezone is still used. Fixed by this update.
by maintenance＠opensuse.org 02 Dec '10

02 Dec '10

openSUSE Recommended Update: yast2-country: After changing the timezone and rebooting the old timezone is still used. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1007-1 Rating: low References: #638128 #638185 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. It includes two new package versions. Description: After changing the timezone (when localtime is used) and rebooting the old timezone is still used. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch yast2-country-3586 - openSUSE 11.2: zypper in -t patch yast2-country-3586 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 2.19.20]: yast2-country-2.19.20-0.2.1 yast2-country-data-2.19.20-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 2.18.21]: yast2-country-2.18.21-0.3.1 yast2-country-data-2.18.21-0.3.1 References: https://bugzilla.novell.com/638128 https://bugzilla.novell.com/638185

1 0

openSUSE-RU-2010:1006-1 (low): doxygen: A segfault when building blender documentation is fixed by this update.
by maintenance＠opensuse.org 02 Dec '10

02 Dec '10

openSUSE Recommended Update: doxygen: A segfault when building blender documentation is fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1006-1 Rating: low References: #650330 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Doxygen-1.6.3-3.2 segfaults when building blender documentation. This bug is fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch doxygen-3577 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): doxygen-1.6.3-4.3.1 References: https://bugzilla.novell.com/650330

1 0

openSUSE-RU-2010:1005-1 (low): cyrus-imapd: Wrong path in cron job is fixed by this update.
by maintenance＠opensuse.org 02 Dec '10

02 Dec '10

openSUSE Recommended Update: cyrus-imapd: Wrong path in cron job is fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:1005-1 Rating: low References: #650919 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The daily cronjob (suse.de-cyrus-imapd) to create automated backups of the mailboxes database did not work correctly because the ctl_mboxlist utility was moved to a different location with openSUSE 11.3. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch cyrus-imapd-3568 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): cyrus-imapd-2.3.16-8.3.1 cyrus-imapd-devel-2.3.16-8.3.1 perl-Cyrus-IMAP-2.3.16-8.3.1 perl-Cyrus-SIEVE-managesieve-2.3.16-8.3.1 References: https://bugzilla.novell.com/650919

1 0

openSUSE-SU-2010:1004-1 (important): libxml2: Fixing invalid memory access in the xpath handling (CVE-2010-4008).
by opensuse-security＠opensuse.org 01 Dec '10

01 Dec '10

openSUSE Security Update: libxml2: Fixing invalid memory access in the xpath handling (CVE-2010-4008). ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1004-1 Rating: important References: #648277 Cross-References: CVE-2010-4008 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libxml2: Invalid memory access in the xpath handling has been fixed. CVE-2010-4008 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libxml2-3459 - openSUSE 11.2: zypper in -t patch libxml2-3459 - openSUSE 11.1: zypper in -t patch libxml2-3459 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libxml2-2.7.7-4.3.1 libxml2-devel-2.7.7-4.3.1 - openSUSE 11.3 (x86_64): libxml2-32bit-2.7.7-4.3.1 libxml2-devel-32bit-2.7.7-4.3.1 - openSUSE 11.3 (noarch): libxml2-doc-2.7.7-4.3.1 - openSUSE 11.2 (i586 x86_64): libxml2-2.7.3-2.3.1 libxml2-devel-2.7.3-2.3.1 libxml2-doc-2.7.3-2.3.1 - openSUSE 11.2 (x86_64): libxml2-32bit-2.7.3-2.3.1 libxml2-devel-32bit-2.7.3-2.3.1 - openSUSE 11.1 (i586 ppc x86_64): libxml2-2.7.1-9.9.1 libxml2-devel-2.7.1-9.9.1 libxml2-doc-2.7.1-9.9.1 - openSUSE 11.1 (x86_64): libxml2-32bit-2.7.1-9.9.1 libxml2-devel-32bit-2.7.1-9.9.1 - openSUSE 11.1 (ppc): libxml2-64bit-2.7.1-9.9.1 libxml2-devel-64bit-2.7.1-9.9.1 References: http://support.novell.com/security/cve/CVE-2010-4008.html https://bugzilla.novell.com/648277

1 0

openSUSE-SU-2010:1001-1 (important): tomboy: security update
by opensuse-security＠opensuse.org 01 Dec '10

01 Dec '10

openSUSE Security Update: tomboy: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:1001-1 Rating: important References: #642830 #649298 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Tomboy security fix CVE-2010-4005 and note data loss with Tomboy sync, for notes created in Gnote. CVE-2010-4005: CVSS v2 Base Score: 3.7 (low) (AV:L/AC:H/Au:N/C:P/I:P/A:P): Code Injection (CWE-94) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch tomboy-3609 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): tomboy-1.2.1-3.3.1 - openSUSE 11.3 (noarch): tomboy-lang-1.2.1-3.3.1 References: https://bugzilla.novell.com/642830 https://bugzilla.novell.com/649298

1 0

openSUSE-RU-2010:0997-1 (moderate): clamav: Update to version 0.96.4
by maintenance＠opensuse.org 30 Nov '10

30 Nov '10

openSUSE Recommended Update: clamav: Update to version 0.96.4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0997-1 Rating: moderate References: #649631 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: clamav version update to 0.96.4 includes several bug fixes and engine improvements. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch clamav-3447 - openSUSE 11.2: zypper in -t patch clamav-3447 - openSUSE 11.1: zypper in -t patch clamav-3447 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 0.96.4]: clamav-0.96.4-0.2.1 - openSUSE 11.3 (noarch) [New Version: 0.96.4]: clamav-db-0.96.4-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 0.96.4]: clamav-0.96.4-0.2.1 clamav-db-0.96.4-0.2.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 0.96.4]: clamav-0.96.4-0.1.1 clamav-db-0.96.4-0.1.1 References: https://bugzilla.novell.com/649631

1 0

openSUSE-SU-2010:0992-1 (moderate): openslp security update
by opensuse-security＠opensuse.org 30 Nov '10

30 Nov '10

openSUSE Security Update: openslp security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0992-1 Rating: moderate References: #642571 Cross-References: CVE-2010-3609 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: the openslp daemon could run into an endless loop when receiving specially crafted packets (CVE-2010-3609). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch openslp-3310 - openSUSE 11.2: zypper in -t patch openslp-3310 - openSUSE 11.1: zypper in -t patch openslp-3310 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): openslp-1.2.0-180.1.1 openslp-devel-1.2.0-180.1.1 openslp-server-1.2.0-180.1.1 - openSUSE 11.3 (x86_64): openslp-32bit-1.2.0-180.1.1 - openSUSE 11.2 (i586 x86_64): openslp-1.2.0-174.3.1 openslp-devel-1.2.0-174.3.1 openslp-server-1.2.0-174.3.1 - openSUSE 11.2 (x86_64): openslp-32bit-1.2.0-174.3.1 - openSUSE 11.1 (i586 ppc x86_64): openslp-1.2.0-168.12.1 openslp-devel-1.2.0-168.12.1 openslp-server-1.2.0-168.12.1 - openSUSE 11.1 (x86_64): openslp-32bit-1.2.0-168.12.1 - openSUSE 11.1 (ppc): openslp-64bit-1.2.0-168.12.1 References: http://support.novell.com/security/cve/CVE-2010-3609.html https://bugzilla.novell.com/642571

1 0

openSUSE-RU-2010:0989-1 (moderate): xinetd: Improve IPv6 handling
by maintenance＠opensuse.org 29 Nov '10

29 Nov '10

openSUSE Recommended Update: xinetd: Improve IPv6 handling ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0989-1 Rating: moderate References: #457903 #598305 Affected Products: openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes xinetd failing to handle ident lookup when the service is bound to ipv6 and USERID is used. It also improves the start script of xinetd to ensure that it successfully started. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch xinetd-3027 - openSUSE 11.1: zypper in -t patch xinetd-3027 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): xinetd-2.3.14-143.3.1 - openSUSE 11.1 (i586 ppc x86_64): xinetd-2.3.14-129.36.1 References: https://bugzilla.novell.com/457903 https://bugzilla.novell.com/598305

1 0

openSUSE-SU-2010:0984-1 (moderate): quagga: security update
by opensuse-security＠opensuse.org 26 Nov '10

26 Nov '10

openSUSE Security Update: quagga: security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0984-1 Rating: moderate References: #634300 Cross-References: CVE-2010-2948 CVE-2010-2949 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: This update of quagga fixes two security issues: - CVE-2010-2948: CVSS v2 Base Score: 6.5 (MEDIUM) (AV:N/AC:L/Au:S/C:P/I:P/A:P) Stack-based buffer overflow while processing malformed Route-Refresh messages. - CVE-2010-2949: CVSS v2 Base Score: 5.0 (MEDIUM) (AV:N/AC:L/Au:N/C:N/I:N/A:P) Denial of service while processing malformed BGP update AS path messages Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch quagga-3508 - openSUSE 11.2: zypper in -t patch quagga-3508 - openSUSE 11.1: zypper in -t patch quagga-3508 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 0.99.17]: quagga-0.99.17-1.3.1 quagga-devel-0.99.17-1.3.1 - openSUSE 11.2 (i586 x86_64) [New Version: 0.99.17]: quagga-0.99.17-1.3.1 quagga-devel-0.99.17-1.3.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 0.99.17]: quagga-0.99.17-1.1.1 quagga-devel-0.99.17-1.1.1 References: http://support.novell.com/security/cve/CVE-2010-2948.html http://support.novell.com/security/cve/CVE-2010-2949.html https://bugzilla.novell.com/634300

1 0

openSUSE-SU-2010:0976-1 (important): poppler: Fixed multiple vulnerabilities
by opensuse-security＠opensuse.org 25 Nov '10

25 Nov '10

openSUSE Security Update: poppler: Fixed multiple vulnerabilities ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0976-1 Rating: important References: #642785 Cross-References: CVE-2010-3702 CVE-2010-3703 CVE-2010-3704 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes one version update. Description: Specially crafted PDF files could crash poppler or potentially even cause execution of arbitrary code (CVE-2010-3702, CVE-2010-3703, CVE-2010-3704) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libpoppler-devel-3335 - openSUSE 11.2: zypper in -t patch libpoppler-devel-3336 - openSUSE 11.1: zypper in -t patch libpoppler-devel-3382 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libpoppler-devel-0.12.3-5.1.1 libpoppler-glib-devel-0.12.3-5.1.1 libpoppler-glib4-0.12.3-5.1.1 libpoppler5-0.12.3-5.1.1 poppler-tools-0.12.3-5.1.1 - openSUSE 11.3 (noarch): libpoppler-doc-0.12.3-5.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 0.12.3]: libpoppler-devel-0.12.3-1.2.1 libpoppler-doc-0.12.3-1.2.1 libpoppler-glib-devel-0.12.3-1.2.1 libpoppler-glib4-0.12.3-1.2.1 libpoppler-qt2-0.12.3-1.2.1 libpoppler-qt3-devel-0.12.3-1.2.1 libpoppler-qt4-3-0.12.3-1.2.1 libpoppler-qt4-devel-0.12.3-1.2.1 libpoppler5-0.12.3-1.2.1 poppler-tools-0.12.3-1.2.1 - openSUSE 11.1 (i586 ppc x86_64): libpoppler-devel-0.10.1-1.9.1 libpoppler-doc-0.10.1-1.9.1 libpoppler-glib-devel-0.10.1-1.9.1 libpoppler-glib4-0.10.1-1.9.1 libpoppler-qt2-0.10.1-1.9.1 libpoppler-qt3-devel-0.10.1-1.9.1 libpoppler-qt4-3-0.10.1-1.9.1 libpoppler-qt4-devel-0.10.1-1.9.1 libpoppler4-0.10.1-1.9.1 poppler-tools-0.10.1-1.9.1 References: http://support.novell.com/security/cve/CVE-2010-3702.html http://support.novell.com/security/cve/CVE-2010-3703.html http://support.novell.com/security/cve/CVE-2010-3704.html https://bugzilla.novell.com/642785

1 0

openSUSE-RU-2010:0973-1 (low): graphviz: It doesn't find libperl.so. Fixed by this update.
by maintenance＠opensuse.org 23 Nov '10

23 Nov '10

openSUSE Recommended Update: graphviz: It doesn't find libperl.so. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0973-1 Rating: low References: #612766 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Because of the way the perl extension was built it lacked the information of where to find the perl runtime library. This is fixed by this update Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch graphviz-3538 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): graphviz-2.20.2-45.6.1 graphviz-devel-2.20.2-45.6.1 graphviz-doc-2.20.2-8.6.1 graphviz-gd-2.20.2-8.6.1 graphviz-gnome-2.20.2-8.6.1 graphviz-guile-2.20.2-8.6.1 graphviz-java-2.20.2-8.6.1 graphviz-lua-2.20.2-8.6.1 graphviz-ocaml-2.20.2-8.6.1 graphviz-perl-2.20.2-8.6.1 graphviz-php-2.20.2-8.6.1 graphviz-python-2.20.2-8.6.1 graphviz-ruby-2.20.2-8.6.1 graphviz-sharp-2.20.2-8.6.1 graphviz-tcl-2.20.2-8.6.1 References: https://bugzilla.novell.com/612766

1 0

openSUSE-RU-2010:0972-1 (low): tar: It segfaults with using --listed-incremental. Fixed by this update.
by maintenance＠opensuse.org 23 Nov '10

23 Nov '10

openSUSE Recommended Update: tar: It segfaults with using --listed-incremental. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0972-1 Rating: low References: #650640 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: tar: listed incremental (--listed-incremental) backup of root directory triggers a segfault. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch tar-3542 - openSUSE 11.2: zypper in -t patch tar-3542 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): tar-1.23-2.3.1 tar-backup-scripts-1.23-2.3.1 - openSUSE 11.3 (noarch): tar-lang-1.23-2.3.1 - openSUSE 11.2 (i586 x86_64): tar-1.21-4.5.1 - openSUSE 11.2 (noarch): tar-lang-1.21-4.5.1 References: https://bugzilla.novell.com/650640

1 0

openSUSE-RU-2010:0971-1 (low): mjpegtools: This update fixes segmentation faults in libquicktime and mjpegtools with libjpeg8.
by maintenance＠opensuse.org 23 Nov '10

23 Nov '10

openSUSE Recommended Update: mjpegtools: This update fixes segmentation faults in libquicktime and mjpegtools with libjpeg8. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0971-1 Rating: low References: #647859 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes segmentation faults in libquicktime and mjpegtools with libjpeg8. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libquicktime-3537 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libquicktime-1.1.5-4.3.1 libquicktime-devel-1.1.5-4.3.1 mjpegtools-1.9.0-9.3.1 mjpegtools-devel-1.9.0-9.3.1 References: https://bugzilla.novell.com/647859

1 0

openSUSE-SU-2010:0969-1 (moderate): gdm security update
by opensuse-security＠opensuse.org 22 Nov '10

22 Nov '10

openSUSE Security Update: gdm security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0969-1 Rating: moderate References: #628607 #633655 Cross-References: CVE-2010-1172 Affected Products: openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. It includes one version update. Description: dbus-glib allowed local users to write properties that were exported read-only via dbus (CVE-2010-1172). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch gdm-3108 - openSUSE 11.1: zypper in -t patch gdm-3108 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64) [New Version: 2.28.2]: gdm-2.28.2-0.2.2 gdm-branding-upstream-2.28.2-0.2.2 - openSUSE 11.2 (noarch) [New Version: 2.28.2]: gdm-lang-2.28.2-0.2.2 - openSUSE 11.1 (i586 ppc x86_64): gdm-2.24.0-15.1.1 gdm-branding-upstream-2.24.0-15.1.1 gdm-lang-2.24.0-15.1.1 References: http://support.novell.com/security/cve/CVE-2010-1172.html https://bugzilla.novell.com/628607 https://bugzilla.novell.com/633655

1 0

openSUSE-SU-2010:0968-1 (moderate): gdm security update
by opensuse-security＠opensuse.org 22 Nov '10

22 Nov '10

openSUSE Security Update: gdm security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0968-1 Rating: moderate References: #628607 #633655 #637069 Cross-References: CVE-2010-1172 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: dbus-glib allowed local users to write properties that were exported read-only via dbus (CVE-2010-1172). Additionally a bug that prevented XDMCP connections was fixed. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gdm-3118 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): gdm-2.30.2-6.1.1 gdm-branding-upstream-2.30.2-6.1.1 gnome-applets-gdm-2.30.2-6.1.1 - openSUSE 11.3 (noarch): gdm-lang-2.30.2-6.1.1 References: http://support.novell.com/security/cve/CVE-2010-1172.html https://bugzilla.novell.com/628607 https://bugzilla.novell.com/633655 https://bugzilla.novell.com/637069

1 0

openSUSE-SU-2010:0965-2 (important): openssl security update
by opensuse-security＠opensuse.org 22 Nov '10

22 Nov '10

openSUSE Security Update: openssl security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0965-2 Rating: important References: #651003 Cross-References: CVE-2010-3864 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Multithreaded OpenSSL servers using the TLS server extension are vulnerable to a buffer overrun attack (CVE-2010-3864). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libopenssl-devel-3562 - openSUSE 11.2: zypper in -t patch libopenssl-devel-3562 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): libopenssl-devel-1.0.0-6.3.1 libopenssl0_9_8-0.9.8m-3.1.2 libopenssl1_0_0-1.0.0-6.3.1 openssl-1.0.0-6.3.1 - openSUSE 11.3 (x86_64): libopenssl0_9_8-32bit-0.9.8m-3.1.2 libopenssl1_0_0-32bit-1.0.0-6.3.1 - openSUSE 11.3 (noarch): openssl-doc-1.0.0-6.3.1 - openSUSE 11.2 (i586 x86_64): libopenssl-devel-0.9.8k-3.10.1 libopenssl0_9_8-0.9.8k-3.10.1 openssl-0.9.8k-3.10.1 openssl-doc-0.9.8k-3.10.1 - openSUSE 11.2 (x86_64): libopenssl0_9_8-32bit-0.9.8k-3.10.1 References: http://support.novell.com/security/cve/CVE-2010-3864.html https://bugzilla.novell.com/651003

1 0

openSUSE-SU-2010:0965-1 (important): openssl security update
by opensuse-security＠opensuse.org 19 Nov '10

19 Nov '10

openSUSE Security Update: openssl security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0965-1 Rating: important References: #651003 Cross-References: CVE-2010-3864 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Multithreaded OpenSSL servers using the TLS server extension are vulnerable to a buffer overrun attack. CVE-2010-3864 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch libopenssl-devel-3507 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc x86_64): libopenssl-devel-0.9.8h-28.18.1 libopenssl0_9_8-0.9.8h-28.18.1 openssl-0.9.8h-28.18.1 openssl-doc-0.9.8h-28.18.1 - openSUSE 11.1 (x86_64): libopenssl0_9_8-32bit-0.9.8h-28.18.1 - openSUSE 11.1 (ppc): libopenssl0_9_8-64bit-0.9.8h-28.18.1 References: http://support.novell.com/security/cve/CVE-2010-3864.html https://bugzilla.novell.com/651003

1 0

openSUSE-RU-2010:0964-1 (moderate): tomcat6: Fix upgrading of tomcat6
by maintenance＠opensuse.org 18 Nov '10

18 Nov '10

openSUSE Recommended Update: tomcat6: Fix upgrading of tomcat6 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0964-1 Rating: moderate References: #625415 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The previous fix for bnc#650130 changed directory /etc/tomcat6/Catalina into a symlink, which is not supported by rpm This update adds a workaround which enables proper upgrade. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch tomcat6-3530 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch): tomcat6-6.0.24-5.4.1 tomcat6-admin-webapps-6.0.24-5.4.1 tomcat6-docs-webapp-6.0.24-5.4.1 tomcat6-el-1_0-api-6.0.24-5.4.1 tomcat6-javadoc-6.0.24-5.4.1 tomcat6-jsp-2_1-api-6.0.24-5.4.1 tomcat6-lib-6.0.24-5.4.1 tomcat6-servlet-2_5-api-6.0.24-5.4.1 tomcat6-webapps-6.0.24-5.4.1 References: https://bugzilla.novell.com/625415

1 0

openSUSE-RU-2010:0963-1 (low): Botan: Fix build issues with monotone
by maintenance＠opensuse.org 18 Nov '10

18 Nov '10

openSUSE Recommended Update: Botan: Fix build issues with monotone ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0963-1 Rating: low References: #548110 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes libbotan-devel to be compatible with what other projects expect (bnc#548110) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch Botan-3522 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): libbotan-1_6_4-1.6.4-4.1.1 libbotan-devel-1.6.4-4.1.1 References: https://bugzilla.novell.com/548110

1 0