- openSUSE Updates

openSUSE-RU-2010:0449-1 (low): build: Version upgrade to build-2010.02.11
by maintenance＠opensuse.org 30 Jul '10

30 Jul '10

openSUSE Recommended Update: build: Version upgrade to build-2010.02.11 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0449-1 Rating: low References: #586176 #591618 Affected Products: openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. It includes one version update. Description: This update brings the build package to the 2010-02-11 version. It contains many fixes for kiwi image building. Furthermore, it fixes the default distribution link which was set to a wrong value with the last update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch build-2517 - openSUSE 11.1: zypper in -t patch build-2517 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (noarch src) [New Version: 2010.02.11]: build-2010.02.11-0.1.1 - openSUSE 11.1 (noarch src) [New Version: 2010.02.11]: build-2010.02.11-0.1.1 References: https://bugzilla.novell.com/586176 https://bugzilla.novell.com/591618

1 0

openSUSE-RU-2010:0447-1 (low): bundle-lang-common-gnome: Updated to match current update state
by maintenance＠opensuse.org 29 Jul '10

29 Jul '10

openSUSE Recommended Update: bundle-lang-common-gnome: Updated to match current update state ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0447-1 Rating: low References: #593309 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update brings new GNOME language bundles to match released updates: - #593309: need to update bundle-lang-common Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch bundle-lang-gnome-2788 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (noarch): bundle-lang-gnome-ar-11.2-20.23.5 bundle-lang-gnome-ca-11.2-20.23.5 bundle-lang-gnome-cs-11.2-20.23.5 bundle-lang-gnome-da-11.2-20.23.5 bundle-lang-gnome-de-11.2-20.23.5 bundle-lang-gnome-en-11.2-20.23.5 bundle-lang-gnome-es-11.2-20.23.5 bundle-lang-gnome-extras-ar-11.2-20.23.1 bundle-lang-gnome-extras-ca-11.2-20.23.1 bundle-lang-gnome-extras-cs-11.2-20.23.1 bundle-lang-gnome-extras-da-11.2-20.23.1 bundle-lang-gnome-extras-de-11.2-20.23.1 bundle-lang-gnome-extras-en-11.2-20.23.1 bundle-lang-gnome-extras-es-11.2-20.23.1 bundle-lang-gnome-extras-fi-11.2-20.23.1 bundle-lang-gnome-extras-fr-11.2-20.23.1 bundle-lang-gnome-extras-hu-11.2-20.23.1 bundle-lang-gnome-extras-it-11.2-20.23.1 bundle-lang-gnome-extras-ja-11.2-20.23.1 bundle-lang-gnome-extras-ko-11.2-20.23.1 bundle-lang-gnome-extras-nb-11.2-20.23.1 bundle-lang-gnome-extras-nl-11.2-20.23.1 bundle-lang-gnome-extras-pl-11.2-20.23.1 bundle-lang-gnome-extras-pt-11.2-20.23.1 bundle-lang-gnome-extras-ru-11.2-20.23.1 bundle-lang-gnome-extras-sv-11.2-20.23.1 bundle-lang-gnome-extras-zh-11.2-20.23.1 bundle-lang-gnome-fi-11.2-20.23.5 bundle-lang-gnome-fr-11.2-20.23.5 bundle-lang-gnome-hu-11.2-20.23.5 bundle-lang-gnome-it-11.2-20.23.5 bundle-lang-gnome-ja-11.2-20.23.5 bundle-lang-gnome-ko-11.2-20.23.5 bundle-lang-gnome-nb-11.2-20.23.5 bundle-lang-gnome-nl-11.2-20.23.5 bundle-lang-gnome-pl-11.2-20.23.5 bundle-lang-gnome-pt-11.2-20.23.5 bundle-lang-gnome-ru-11.2-20.23.5 bundle-lang-gnome-sv-11.2-20.23.5 bundle-lang-gnome-zh-11.2-20.23.5 - openSUSE 11.2 (src): bundle-lang-gnome-11.2-20.23.5 bundle-lang-gnome-extras-11.2-20.23.1 References: https://bugzilla.novell.com/593309

1 0

openSUSE-RU-2010:0446-1 (low): digiKam, gwenview: Failed to rotate image. Fixed by this update.
by maintenance＠opensuse.org 29 Jul '10

29 Jul '10

openSUSE Recommended Update: digiKam, gwenview: Failed to rotate image. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0446-1 Rating: low References: #611983 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The lossless JPEG rotate feature was broken by a runtime incompatibility with the new libjpeg8 that is resolved by this patch. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch kipi-plugins-2784 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): kipi-plugins-1.2.0-6.1.1 - openSUSE 11.3 (i586 x86_64): kipi-plugins-acquireimage-1.2.0-6.1.1 kipi-plugins-doc-1.2.0-6.1.1 - openSUSE 11.3 (noarch): kipi-plugins-lang-1.2.0-6.1.1 References: https://bugzilla.novell.com/611983

1 0

openSUSE-RU-2010:0445-1 (low): gtkglext: This update fixes the gtkglext library to not reference non-existing symbols
by maintenance＠opensuse.org 29 Jul '10

29 Jul '10

openSUSE Recommended Update: gtkglext: This update fixes the gtkglext library to not reference non-existing symbols ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0445-1 Rating: low References: #617677 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the gtkglext library to not reference non-existing symbols: Can't link gtkglext application: undefined reference to `GTK_WIDGET_REALIZED' Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gtkglext-2786 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): gtkglext-1.2.0-183.1.1 - openSUSE 11.3 (i586 x86_64): gtkglext-devel-1.2.0-183.1.1 gtkglext-doc-1.2.0-183.1.1 - openSUSE 11.3 (x86_64): gtkglext-32bit-1.2.0-183.1.1 References: https://bugzilla.novell.com/617677

1 0

openSUSE-SU-2010:0430-3 (important): MozillaFirefox: Update to 3.6.8 security release
by opensuse-security＠opensuse.org 29 Jul '10

29 Jul '10

openSUSE Security Update: MozillaFirefox: Update to 3.6.8 security release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0430-3 Rating: important References: #622506 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes four new package versions. Description: This update brings Mozilla Firefox to the 3.6.8 security release. It fixes following security bugs: MFSA 2010-34 / CVE-2010-1211 / CVE-2010-1212: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-35 / CVE-2010-1208: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an error in the DOM attribute cloning routine where under certain circumstances an event attribute node can be deleted while another object still contains a reference to it. This reference could subsequently be accessed, potentially causing the execution of attacker controlled memory. MFSA 2010-36 / CVE-2010-1209: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an error in Mozilla's implementation of NodeIterator in which a malicious NodeFilter could be created which would detach nodes from the DOM tree while it was being traversed. The use of a detached and subsequently deleted node could result in the execution of attacker-controlled memory. MFSA 2010-37 / CVE-2010-1214: Security researcher J23 reported via TippingPoint's Zero Day Initiative an error in the code used to store the names and values of plugin parameter elements. A malicious page could embed plugin content containing a very large number of parameter elements which would cause an overflow in the integer value counting them. This integer is later used in allocating a memory buffer used to store the plugin parameters. Under such conditions, too small a buffer would be created and attacker-controlled data could be written past the end of the buffer, potentially resulting in code execution. MFSA 2010-38 / CVE-2010-1215: Mozilla security researcher moz_bug_r_a4 reported that when content script which is running in a chrome context accesses a content object via SJOW, the content code can gain access to an object from the chrome scope and use that object to run arbitrary JavaScript with chrome privileges. Firefox 3.5 and other Mozilla products built from Gecko 1.9.1 were not affected by this issue. MFSA 2010-39 / CVE-2010-2752: Security researcher J23 reported via TippingPoint's Zero Day Initiative that an array class used to store CSS values contained an integer overflow vulnerability. The 16 bit integer value used in allocating the size of the array could overflow, resulting in too small a memory buffer being created. When the array was later populated with CSS values data would be written past the end of the buffer potentially resulting in the execution of attacker-controlled memory. MFSA 2010-40 / CVE-2010-2753: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an integer overflow vulnerability in the implementation of the XUL <tree> element's selection attribute. When the size of a new selection is sufficiently large the integer used in calculating the length of the selection can overflow, resulting in a bogus range being marked selected. When adjustSelection is then called on the bogus range the range is deleted leaving dangling references to the ranges which could be used by an attacker to call into deleted memory and run arbitrary code on a victim's computer. MFSA 2010-41 / CVE-2010-1205: OUSPG researcher Aki Helin reported a buffer overflow in Mozilla graphics code which consumes image data processed by libpng. A malformed PNG file could be created which would cause libpng to incorrectly report the size of the image to downstream consumers. When the dimensions of such images are underreported, the Mozilla code responsible for displaying the graphic will allocate too small a memory buffer to contain the image data and will wind up writing data past the end of the buffer. This could result in the execution of attacker-controlled memory. MFSA 2010-42 / CVE-2010-1213: Security researcher Yosuke Hasegawa reported that the Web Worker method importScripts can read and parse resources from other domains even when the content is not valid JavaScript. This is a violation of the same-origin policy and could be used by an attacker to steal information from other sites. MFSA 2010-43 / CVE-2010-1207: Mozilla developer Vladimir Vukicevic reported that a canvas element can be used to read data from another site, violating the same-origin policy. The read restriction placed on a canvas element which has had cross-origin data rendered into it can be bypassed by retaining a reference to the canvas element's context and deleting the associated canvas node from the DOM. MFSA 2010-44 / CVE-2010-1210: Security researcher O. Andersen reported that undefined positions within various 8 bit character encodings are mapped to the sequence U+FFFD which when displayed causes the immediately following character to disappear from the text run. This could potentially contribute to XSS problems on sites which expected extra characters to be present within strings being sanitized on the server. MFSA 2010-45 / CVE-2010-1206: Google security researcher Michal Zalewski reported two methods for spoofing the contents of the location bar. The first method works by opening a new window containing a resource that responds with an HTTP 204 (no content) and then using the reference to the new window to insert HTML content into the blank document. The second location bar spoofing method does not require that the resource opened in a new window respond with 204, as long as the opener calls window.stop() before the document is loaded. In either case a user could be mislead as to the correct location of the document they are currently viewing. MFSA 2010-45 / CVE-2010-2751: Security researcher Jordi Chancel reported that the location bar could be spoofed to look like a secure page when the current document was served via plaintext. The vulnerability is triggered by a server by first redirecting a request for a plaintext resource to another resource behind a valid SSL/TLS certificate. A second request made to the original plaintext resource which is responded to not with a redirect but with JavaScript containing history.back() and history.forward() will result in the plaintext resource being displayed with valid SSL/TLS badging in the location bar. References MFSA 2010-46 / CVE-2010-0654: Google security researcher Chris Evans reported that data can be read across domains by injecting bogus CSS selectors into a target site and then retrieving the data using JavaScript APIs. If an attacker can inject opening and closing portions of a CSS selector into points A and B of a target page, then the region between the two injection points becomes readable to JavaScript through, for example, the getComputedStyle() API. MFSA 2010-47 / CVE-2010-2754: Security researcher Soroush Dalili reported that potentially sensitive URL parameters could be leaked across domains upon script errors when the script filename and line number is included in the error message. MFSA 2010-48 / CVE-2010-2755: Mozilla developer Daniel Holbert reported that the fix to the plugin parameter array crash that was fixed in Firefox 3.6.7 caused a crash showing signs of memory corruption. In certain circumstances, properties in the plugin instance's parameter array could be freed prematurely leaving a dangling pointer that the plugin could execute, potentially calling into attacker-controlled memory. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch MozillaFirefox-2807 mozilla-xulrunner191-2779 - openSUSE 11.2: zypper in -t patch MozillaFirefox-2774 - openSUSE 11.1: zypper in -t patch MozillaFirefox-2774 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64) [New Version: 1.9.1.11,1.9.2.8 and 3.6.8]: MozillaFirefox-3.6.8-0.1.1 mozilla-xulrunner191-1.9.1.11-0.1.1 mozilla-xulrunner192-1.9.2.8-0.1.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.9.1.11,1.9.2.8 and 3.6.8]: MozillaFirefox-branding-upstream-3.6.8-0.1.1 MozillaFirefox-translations-common-3.6.8-0.1.1 MozillaFirefox-translations-other-3.6.8-0.1.1 mozilla-js192-1.9.2.8-0.1.1 mozilla-xulrunner191-devel-1.9.1.11-0.1.1 mozilla-xulrunner191-gnomevfs-1.9.1.11-0.1.1 mozilla-xulrunner191-translations-common-1.9.1.11-0.1.1 mozilla-xulrunner191-translations-other-1.9.1.11-0.1.1 mozilla-xulrunner192-buildsymbols-1.9.2.8-0.1.1 mozilla-xulrunner192-devel-1.9.2.8-0.1.1 mozilla-xulrunner192-gnome-1.9.2.8-0.1.1 mozilla-xulrunner192-translations-common-1.9.2.8-0.1.1 mozilla-xulrunner192-translations-other-1.9.2.8-0.1.1 python-xpcom191-1.9.1.11-0.1.1 - openSUSE 11.3 (x86_64) [New Version: 1.9.1.11 and 1.9.2.8]: mozilla-js192-32bit-1.9.2.8-0.1.1 mozilla-xulrunner191-32bit-1.9.1.11-0.1.1 mozilla-xulrunner191-gnomevfs-32bit-1.9.1.11-0.1.1 mozilla-xulrunner192-32bit-1.9.2.8-0.1.1 mozilla-xulrunner192-gnome-32bit-1.9.2.8-0.1.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.8-0.1.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.8-0.1.1 - openSUSE 11.2 (i586 src x86_64) [New Version: 1.9.1.11 and 3.5.11]: MozillaFirefox-3.5.11-0.1.1 mozilla-xulrunner191-1.9.1.11-0.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.9.1.11 and 3.5.11]: MozillaFirefox-branding-upstream-3.5.11-0.1.1 MozillaFirefox-translations-common-3.5.11-0.1.1 MozillaFirefox-translations-other-3.5.11-0.1.1 mozilla-xulrunner191-devel-1.9.1.11-0.1.1 mozilla-xulrunner191-gnomevfs-1.9.1.11-0.1.1 mozilla-xulrunner191-translations-common-1.9.1.11-0.1.1 mozilla-xulrunner191-translations-other-1.9.1.11-0.1.1 python-xpcom191-1.9.1.11-0.1.1 - openSUSE 11.2 (x86_64) [New Version: 1.9.1.11]: mozilla-xulrunner191-32bit-1.9.1.11-0.1.1 mozilla-xulrunner191-gnomevfs-32bit-1.9.1.11-0.1.1 - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 1.9.1.11 and 3.5.11]: MozillaFirefox-3.5.11-0.1.1 mozilla-xulrunner191-1.9.1.11-0.1.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 1.9.1.11 and 3.5.11]: MozillaFirefox-branding-upstream-3.5.11-0.1.1 MozillaFirefox-translations-common-3.5.11-0.1.1 MozillaFirefox-translations-other-3.5.11-0.1.1 mozilla-xulrunner191-devel-1.9.1.11-0.1.1 mozilla-xulrunner191-gnomevfs-1.9.1.11-0.1.1 mozilla-xulrunner191-translations-common-1.9.1.11-0.1.1 mozilla-xulrunner191-translations-other-1.9.1.11-0.1.1 python-xpcom191-1.9.1.11-0.1.1 - openSUSE 11.1 (x86_64) [New Version: 1.9.1.11]: mozilla-xulrunner191-32bit-1.9.1.11-0.1.1 mozilla-xulrunner191-gnomevfs-32bit-1.9.1.11-0.1.1 References: https://bugzilla.novell.com/622506

1 0

openSUSE-RU-2010:0442-1 (low): k3b: Update to 2.0 final
by maintenance＠opensuse.org 27 Jul '10

27 Jul '10

openSUSE Recommended Update: k3b: Update to 2.0 final ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0442-1 Rating: low References: #619731 #623399 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. It includes one version update. Description: Update to 2.0 final. It updates only translations and fixes some bugs. - Fix freeze while ripping CD audio (bko#235466) - Fix drag and drop from file managers to k3b project (bko#242745) - Install app icons in hicolor - Fixing missing icon when Oxygen icons not used for desktop (bnc#619731) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch k3b-2785 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64) [New Version: 2.0.0]: k3b-2.0.0-1.1.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.0.0]: k3b-devel-2.0.0-1.1.1 - openSUSE 11.3 (noarch) [New Version: 2.0.0]: k3b-lang-2.0.0-1.1.1 References: https://bugzilla.novell.com/619731 https://bugzilla.novell.com/623399

1 0

openSUSE-RU-2010:0441-1 (low): wine: Update from 1.2-rc6 to 1.2 release
by maintenance＠opensuse.org 27 Jul '10

27 Jul '10

openSUSE Recommended Update: wine: Update from 1.2-rc6 to 1.2 release ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0441-1 Rating: low References: #623394 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update brings Wine from the 1.2 release candidate 6 to the final 1.2 release. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch wine-2756 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): wine-1.2-0.1.1 - openSUSE 11.3 (i586 x86_64): wine-devel-1.2-0.1.1 - openSUSE 11.3 (i586): wine-32bit-1.2-0.1.1 References: https://bugzilla.novell.com/623394

1 0

openSUSE-SU-2010:0430-2 (important): MozillaThunderbird: Update to 3.0.6 security release
by opensuse-security＠opensuse.org 27 Jul '10

27 Jul '10

openSUSE Security Update: MozillaThunderbird: Update to 3.0.6 security release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0430-2 Rating: important References: #622506 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes two new package versions. Description: This update brings Mozilla Thunderbird to the 3.0.6 security release. It fixes following security bugs: MFSA 2010-34 / CVE-2010-1211: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Jesse Ruderman, Ehsan Akhgari, Mats Palmgren, Igor Bukanov, Gary Kwong, Tobias Markus and Daniel Holbert reported memory safety problems that affected Firefox 3.6 and Firefox 3.5. MFSA 2010-39 / CVE-2010-2752: Security researcher J23 reported via TippingPoint's Zero Day Initiative that an array class used to store CSS values contained an integer overflow vulnerability. The 16 bit integer value used in allocating the size of the array could overflow, resulting in too small a memory buffer being created. When the array was later populated with CSS values data would be written past the end of the buffer potentially resulting in the execution of attacker-controlled memory. MFSA 2010-40 / CVE-2010-2753: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an integer overflow vulnerability in the implementation of the XUL <tree> element's selection attribute. When the size of a new selection is sufficiently large the integer used in calculating the length of the selection can overflow, resulting in a bogus range being marked selected. When adjustSelection is then called on the bogus range the range is deleted leaving dangling references to the ranges which could be used by an attacker to call into deleted memory and run arbitrary code on a victim's computer. MFSA 2010-41 / CVE-2010-1205: OUSPG researcher Aki Helin reported a buffer overflow in Mozilla graphics code which consumes image data processed by libpng. A malformed PNG file could be created which would cause libpng to incorrectly report the size of the image to downstream consumers. When the dimensions of such images are underreported, the Mozilla code responsible for displaying the graphic will allocate too small a memory buffer to contain the image data and will wind up writing data past the end of the buffer. This could result in the execution of attacker-controlled memory. MFSA 2011-42 / CVE-2010-1213: Security researcher Yosuke Hasegawa reported that the Web Worker method importScripts can read and parse resources from other domains even when the content is not valid JavaScript. This is a violation of the same-origin policy and could be used by an attacker to steal information from other sites. MFSA 2010-46 / CVE-2010-0654: Google security researcher Chris Evans reported that data can be read across domains by injecting bogus CSS selectors into a target site and then retrieving the data using JavaScript APIs. If an attacker can inject opening and closing portions of a CSS selector into points A and B of a target page, then the region between the two injection points becomes readable to JavaScript through, for example, the getComputedStyle() API. MFSA 2010-47 / CVE-2010-2754: Security researcher Soroush Dalili reported that potentially sensitive URL parameters could be leaked across domains upon script errors when the script filename and line number is included in the error message. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch MozillaThunderbird-2755 - openSUSE 11.2: zypper in -t patch MozillaThunderbird-2755 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64) [New Version: 3.0.6]: MozillaThunderbird-3.0.6-0.1.1 - openSUSE 11.3 (i586 x86_64) [New Version: 3.0.6]: MozillaThunderbird-devel-3.0.6-0.1.1 MozillaThunderbird-translations-common-3.0.6-0.1.1 MozillaThunderbird-translations-other-3.0.6-0.1.1 enigmail-1.0.1-3.1.1 - openSUSE 11.2 (i586 src x86_64) [New Version: 3.0.6]: MozillaThunderbird-3.0.6-0.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.0.1 and 3.0.6]: MozillaThunderbird-devel-3.0.6-0.1.1 MozillaThunderbird-translations-common-3.0.6-0.1.1 MozillaThunderbird-translations-other-3.0.6-0.1.1 enigmail-1.0.1-1.1.1 References: https://bugzilla.novell.com/622506

1 0

openSUSE-SU-2010:0439-1 (moderate): bogofilter: heap corruption overrun in bogofilter/bogolexer
by opensuse-security＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Security Update: bogofilter: heap corruption overrun in bogofilter/bogolexer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0439-1 Rating: moderate References: #619847 Cross-References: CVE-2010-2494 Affected Products: openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of bogofilter/bogolexer fixes a heap based buffer underflow vulnerability which could be exploited to cause a denial of service or potentially execute arbitrary code (CVE-2010-2494). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch bogofilter-2668 - openSUSE 11.1: zypper in -t patch bogofilter-2668 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): bogofilter-1.2.0-2.5.1 - openSUSE 11.1 (i586 ppc src x86_64): bogofilter-1.1.1-174.18.1 References: http://support.novell.com/security/cve/CVE-2010-2494.html https://bugzilla.novell.com/619847

1 0

openSUSE-RU-2010:0438-1 (moderate): unscd: Fixed unscd does not start issue
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: unscd: Fixed unscd does not start issue ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0438-1 Rating: moderate References: #622910 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a non starting unscd issue. - bnc#622910: unscd does not start, rpm verify does not show error :-( Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch unscd-2752 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): unscd-0.45-6.1.1 References: https://bugzilla.novell.com/622910

1 0

openSUSE-RU-2010:0437-1 (low): release-notes-openSUSE: Various additions and translations
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: release-notes-openSUSE: Various additions and translations ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0437-1 Rating: low References: #617092 #619193 #621469 #621890 #623179 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has 5 recommended fixes can now be installed. It includes one version update. Description: Enhancements to the openSUSE release notes. It adds and updates some translations. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch release-notes-openSUSE-2793 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch src) [New Version: 11.3.6]: release-notes-openSUSE-11.3.6-0.1.1 References: https://bugzilla.novell.com/617092 https://bugzilla.novell.com/619193 https://bugzilla.novell.com/621469 https://bugzilla.novell.com/621890 https://bugzilla.novell.com/623179

1 0

openSUSE-RU-2010:0436-1 (low): gnome-panel: Fix newly created panels to be visible
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: gnome-panel: Fix newly created panels to be visible ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0436-1 Rating: low References: #620418 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes an issue in Gnome Panel: - bnc#620418: New Panel failed Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch gnome-panel-2743 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): gnome-panel-2.30.0-5.1.1 - openSUSE 11.3 (i586 x86_64): gnome-panel-devel-2.30.0-5.1.1 gnome-panel-doc-2.30.0-5.1.1 gnome-panel-extras-2.30.0-5.1.1 libpanel-applet-2-0-2.30.0-5.1.1 - openSUSE 11.3 (x86_64): libpanel-applet-2-0-32bit-2.30.0-5.1.1 - openSUSE 11.3 (noarch): gnome-panel-lang-2.30.0-5.1.1 References: https://bugzilla.novell.com/620418

1 0

openSUSE-RU-2010:0435-1 (low): lvm2: Fixed lvcreate --snapshot .. results in scary messages to console and /var/log/messages
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: lvm2: Fixed lvcreate --snapshot .. results in scary messages to console and /var/log/messages ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0435-1 Rating: low References: #556177 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes an issue in lvm2: - bnc#556177: lvcreate --snapshot .. results in scary messages to console and /var/log/messages Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch device-mapper-2746 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): device-mapper-1.02.31-11.3.1 lvm2-2.02.45-11.3.1 lvm2-clvm-2.02.45-11.3.1 - openSUSE 11.2 (i586 x86_64): device-mapper-devel-1.02.31-11.3.1 - openSUSE 11.2 (x86_64): device-mapper-32bit-1.02.31-11.3.1 References: https://bugzilla.novell.com/556177

1 0

openSUSE-RU-2010:0434-1 (low): postfix: Chrooted mysql.sock lost on mysql restart. Fixed by this update.
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: postfix: Chrooted mysql.sock lost on mysql restart. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0434-1 Rating: low References: #606251 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This updates fixes several problems with postfix: - using my_print_defaults command for parsing of /etc/my.cnf - using quotation marks: "$PF_CHROOT" - adding sysconfig option POSTFIX_MYSQL_CONN=(socket,tcp) - MYSQL_SOCK_DIR is mounted with '-o bind' to postfix CHROOT now Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch postfix-2737 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): postfix-2.7.1-2.1.1 - openSUSE 11.3 (i586 x86_64): postfix-devel-2.7.1-2.1.1 postfix-mysql-2.7.1-2.1.1 postfix-postgresql-2.7.1-2.1.1 - openSUSE 11.3 (noarch): postfix-doc-2.7.1-2.1.1 References: https://bugzilla.novell.com/606251

1 0

openSUSE-RU-2010:0433-1 (low): udisks: Fixed ejecting usb-drives or disks as normal user
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: udisks: Fixed ejecting usb-drives or disks as normal user ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0433-1 Rating: low References: #618955 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: A problem in udisks was fixed: - bnc#618955: Cannot eject usb-drives or disks as normal user Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch udisks-2741 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): udisks-1.0.1-2.1.1 - openSUSE 11.3 (i586 x86_64): udisks-devel-1.0.1-2.1.1 References: https://bugzilla.novell.com/618955

1 0

openSUSE-RU-2010:0432-1 (moderate): yast2-gtk: updated to version 2.21.68 fixing bnc#609778 and bnc#620513
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: yast2-gtk: updated to version 2.21.68 fixing bnc#609778 and bnc#620513 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0432-1 Rating: moderate References: #609778 #620513 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. It includes one version update. Description: yast2-gtk was updated to fix the following bugs bnc#609778 - yast software management (qt,gtk,ncurses): configuration > online from menubar does not work as expected. Partly fixed by this update for the gtk interface by omitting online-update configuration menu item when not running online-update. bnc#620513 - sw_single (gtk): freeze when opening the Dependencies box. Fixes were also made to make the Versions box for a selected package more prominent. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch yast2-gtk-2745 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64) [New Version: 2.21.68]: yast2-gtk-2.21.68-0.1.1 References: https://bugzilla.novell.com/609778 https://bugzilla.novell.com/620513

1 0

openSUSE-RU-2010:0431-1 (low): NetworkManager-NovellVPN: Fix for NovellVPN Connection Requires to Accept Advanced Options to Work
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: NetworkManager-NovellVPN: Fix for NovellVPN Connection Requires to Accept Advanced Options to Work ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0431-1 Rating: low References: #622854 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes: - bnc#622854: NovellVPN Connection Requires to Accept Advanced Options to Work Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch NetworkManager-novellvpn-2775 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): NetworkManager-novellvpn-0.7.2.r1138-7.1.1 - openSUSE 11.3 (i586 x86_64): NetworkManager-novellvpn-gnome-0.7.2.r1138-7.1.1 References: https://bugzilla.novell.com/622854

1 0

openSUSE-SU-2010:0430-1 (important): seamonkey: Update to 2.0.6 security release
by opensuse-security＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Security Update: seamonkey: Update to 2.0.6 security release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0430-1 Rating: important References: #622506 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: This update brings Mozilla Seamonkey to the 2.0.6 security release. It fixes following security bugs: MFSA 2010-34 / CVE-2010-1211: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Jesse Ruderman, Ehsan Akhgari, Mats Palmgren, Igor Bukanov, Gary Kwong, Tobias Markus and Daniel Holbert reported memory safety problems that affected Firefox 3.6 and Firefox 3.5. MFSA 2010-35 / CVE-2010-1208: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an error in the DOM attribute cloning routine where under certain circumstances an event attribute node can be deleted while another object still contains a reference to it. This reference could subsequently be accessed, potentially causing the execution of attacker controlled memory. MFSA 2010-36 / CVE-2010-1209: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an error in Mozilla's implementation of NodeIterator in which a malicious NodeFilter could be created which would detach nodes from the DOM tree while it was being traversed. The use of a detached and subsequently deleted node could result in the execution of attacker-controlled memory. MFSA 2010-37 / CVE-2010-1214: Security researcher J23 reported via TippingPoint's Zero Day Initiative an error in the code used to store the names and values of plugin parameter elements. A malicious page could embed plugin content containing a very large number of parameter elements which would cause an overflow in the integer value counting them. This integer is later used in allocating a memory buffer used to store the plugin parameters. Under such conditions, too small a buffer would be created and attacker-controlled data could be written past the end of the buffer, potentially resulting in code execution. MFSA 2010-39 / CVE-2010-2752: Security researcher J23 reported via TippingPoint's Zero Day Initiative that an array class used to store CSS values contained an integer overflow vulnerability. The 16 bit integer value used in allocating the size of the array could overflow, resulting in too small a memory buffer being created. When the array was later populated with CSS values data would be written past the end of the buffer potentially resulting in the execution of attacker-controlled memory. MFSA 2010-40 / CVE-2010-2753: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative an integer overflow vulnerability in the implementation of the XUL <tree> element's selection attribute. When the size of a new selection is sufficiently large the integer used in calculating the length of the selection can overflow, resulting in a bogus range being marked selected. When adjustSelection is then called on the bogus range the range is deleted leaving dangling references to the ranges which could be used by an attacker to call into deleted memory and run arbitrary code on a victim's computer. MFSA 2010-41 / CVE-2010-1205: OUSPG researcher Aki Helin reported a buffer overflow in Mozilla graphics code which consumes image data processed by libpng. A malformed PNG file could be created which would cause libpng to incorrectly report the size of the image to downstream consumers. When the dimensions of such images are underreported, the Mozilla code responsible for displaying the graphic will allocate too small a memory buffer to contain the image data and will wind up writing data past the end of the buffer. This could result in the execution of attacker-controlled memory. MFSA 2011-42 / CVE-2010-1213: Security researcher Yosuke Hasegawa reported that the Web Worker method importScripts can read and parse resources from other domains even when the content is not valid JavaScript. This is a violation of the same-origin policy and could be used by an attacker to steal information from other sites. MFSA 2010-45 / CVE-2010-1206: Google security researcher Michal Zalewski reported two methods for spoofing the contents of the location bar. The first method works by opening a new window containing a resource that responds with an HTTP 204 (no content) and then using the reference to the new window to insert HTML content into the blank document. The second location bar spoofing method does not require that the resource opened in a new window respond with 204, as long as the opener calls window.stop() before the document is loaded. In either case a user could be mislead as to the correct location of the document they are currently viewing. MFSA 2010-45 / CVE-2010-2751: Security researcher Jordi Chancel reported that the location bar could be spoofed to look like a secure page when the current document was served via plaintext. The vulnerability is triggered by a server by first redirecting a request for a plaintext resource to another resource behind a valid SSL/TLS certificate. A second request made to the original plaintext resource which is responded to not with a redirect but with JavaScript containing history.back() and history.forward() will result in the plaintext resource being displayed with valid SSL/TLS badging in the location bar. References MFSA 2010-46 / CVE-2010-0654: Google security researcher Chris Evans reported that data can be read across domains by injecting bogus CSS selectors into a target site and then retrieving the data using JavaScript APIs. If an attacker can inject opening and closing portions of a CSS selector into points A and B of a target page, then the region between the two injection points becomes readable to JavaScript through, for example, the getComputedStyle() API. MFSA 2010-47 / CVE-2010-2754: Security researcher Soroush Dalili reported that potentially sensitive URL parameters could be leaked across domains upon script errors when the script filename and line number is included in the error message. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch seamonkey-2754 - openSUSE 11.2: zypper in -t patch seamonkey-2754 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64) [New Version: 2.0.6]: seamonkey-2.0.6-0.1.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.0.6]: seamonkey-dom-inspector-2.0.6-0.1.1 seamonkey-irc-2.0.6-0.1.1 seamonkey-translations-common-2.0.6-0.1.1 seamonkey-translations-other-2.0.6-0.1.1 seamonkey-venkman-2.0.6-0.1.1 - openSUSE 11.2 (i586 src x86_64) [New Version: 2.0.6]: seamonkey-2.0.6-0.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 2.0.6]: seamonkey-dom-inspector-2.0.6-0.1.1 seamonkey-irc-2.0.6-0.1.1 seamonkey-venkman-2.0.6-0.1.1 References: https://bugzilla.novell.com/622506

1 0

openSUSE-RU-2010:0429-1 (low): openSUSE 11.0 security and bugfix support is discontinued
by maintenance＠opensuse.org 26 Jul '10

26 Jul '10

openSUSE Recommended Update: openSUSE 11.0 security and bugfix support is discontinued ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0429-1 Rating: low References: #624993 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This patch concludes the openSUSE 11.0 security and bugfix support cycle after 2 years. No more updates will be published after this one. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch openSUSE-release-2805 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): openSUSE-release-11.0-47.3 - openSUSE 11.0 (i586 ppc x86_64): openSUSE-release-dvd-11.0-47.3 openSUSE-release-live-11.0-47.3 References: https://bugzilla.novell.com/624993

1 0

openSUSE-SU-2010:0428-1 (low): rpm: Fix security problem where we miss to clear the SUID/SGID bits during package updates.
by opensuse-security＠opensuse.org 24 Jul '10

24 Jul '10

openSUSE Security Update: rpm: Fix security problem where we miss to clear the SUID/SGID bits during package updates. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0428-1 Rating: low References: #536256 #610941 Cross-References: CVE-2010-2059 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update fixes the problem where RPM misses to clear the SUID/SGID bit of old files during package updates. (CVE-2010-2059) Also the following bug was fixed: do not use glibc for passwd/group lookups when --root is used [bnc#536256] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch popt-2527 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): rpm-4.4.2-199.3 - openSUSE 11.0 (i586 ppc x86_64): popt-1.7-427.3 popt-devel-1.7-427.3 rpm-devel-4.4.2-199.3 - openSUSE 11.0 (x86_64): popt-32bit-1.7-427.3 - openSUSE 11.0 (ppc): popt-64bit-1.7-427.3 References: http://support.novell.com/security/cve/CVE-2010-2059.html https://bugzilla.novell.com/536256 https://bugzilla.novell.com/610941

1 0

openSUSE-SU-2010:0427-1 (moderate): openldap: fixed MODRDN DoS, replicating inconsistencies and \0 character-DoS
by opensuse-security＠opensuse.org 24 Jul '10

24 Jul '10

openSUSE Security Update: openldap: fixed MODRDN DoS, replicating inconsistencies and \0 character-DoS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0427-1 Rating: moderate References: #612430 Cross-References: CVE-2010-0211 CVE-2010-0212 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The following issues have been fixed in OpenLDAP: specially crafted MODRDN operations can crash the OpenLDAP server (CVE-2010-0211 and CVE-2010-0212). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch openldap2-2727 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): openldap2-2.4.9-7.8 openldap2-client-2.4.9-7.8 - openSUSE 11.0 (i586 ppc x86_64): openldap2-back-meta-2.4.9-7.8 openldap2-back-perl-2.4.9-7.8 openldap2-devel-2.4.9-7.8 - openSUSE 11.0 (x86_64): openldap2-client-32bit-2.4.9-7.8 openldap2-devel-32bit-2.4.9-7.8 - openSUSE 11.0 (ppc): openldap2-client-64bit-2.4.9-7.8 openldap2-devel-64bit-2.4.9-7.8 References: http://support.novell.com/security/cve/CVE-2010-0211.html http://support.novell.com/security/cve/CVE-2010-0212.html https://bugzilla.novell.com/612430

1 0

openSUSE-SU-2010:0426-1 (moderate): lxsession security update
by opensuse-security＠opensuse.org 23 Jul '10

23 Jul '10

openSUSE Security Update: lxsession security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0426-1 Rating: moderate References: #622083 #623192 Cross-References: CVE-2010-2532 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: lxsession-logout did not properly lock the screen before suspending, hibernating and switching between users which could allow attackers with physical access to take control of the system to obtain sensitive information and / or execute arbitrary code in the context of the user who is currently logged in (CVE-2010-2532). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch lxsession-2776 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): lxsession-0.4.4-3.1.1 References: http://support.novell.com/security/cve/CVE-2010-2532.html https://bugzilla.novell.com/622083 https://bugzilla.novell.com/623192

1 0

openSUSE-SU-2010:0425-1 (important): ghostscript security update
by opensuse-security＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Security Update: ghostscript security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0425-1 Rating: important References: #559122 #605043 #608071 Cross-References: CVE-2009-4270 CVE-2009-4897 CVE-2010-1628 CVE-2010-1869 CVE-2010-2055 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: Specially crafted postscript (.ps) files could cause buffer overflows in ghostscript that could potentially be exploited to execute arbitrary code (CVE-2010-1628, CVE-2010-1869, CVE-2009-4270) ghostscript by default read some initialization files from the current working directory. Local attackers could potentially exploit that to have other users execute arbitrary commands by placing such files e.g. in /tmp (CVE-2010-2055). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch ghostscript-devel-2705 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): ghostscript-library-8.62-17.8 - openSUSE 11.0 (i586 ppc x86_64): ghostscript-devel-8.62-17.8 ghostscript-fonts-other-8.62-17.8 ghostscript-fonts-rus-8.62-17.8 ghostscript-fonts-std-8.62-17.8 ghostscript-ijs-devel-8.62-17.8 ghostscript-omni-8.62-17.8 ghostscript-x11-8.62-17.8 libgimpprint-4.2.7-258.8 libgimpprint-devel-4.2.7-258.8 References: http://support.novell.com/security/cve/CVE-2009-4270.html http://support.novell.com/security/cve/CVE-2009-4897.html http://support.novell.com/security/cve/CVE-2010-1628.html http://support.novell.com/security/cve/CVE-2010-1869.html http://support.novell.com/security/cve/CVE-2010-2055.html https://bugzilla.novell.com/559122 https://bugzilla.novell.com/605043 https://bugzilla.novell.com/608071

1 0

openSUSE-OU-2010:0424-1 (low): Download and Install Microsoft(r) TrueType Core Fonts
by maintenance＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Optional Update: Download and Install Microsoft(r) TrueType Core Fonts ______________________________________________________________________________ Announcement ID: openSUSE-OU-2010:0424-1 Rating: low References: #621540 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: Installing this update will download install the Core TrueType fonts to your system. For legal reasons we can't include the Microsoft(R) TrueType Core Fonts in our product. This patch downloads these fonts and installs them on your system. Please note that about 4 MByte data are downloaded additionality to this patch. The License for the fonts will be installed as /usr/share/doc/corefonts/EULA.html Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch flash-player-2713 pullin-msttf-fonts-2712 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch src): fetchmsttfonts-11.3-1.1.5 pullin-msttf-fonts-11.3.1-1.3.1 - openSUSE 11.3 (i586 src): flash-player-10.1.53.64-2.1.1 References: https://bugzilla.novell.com/621540

1 0

openSUSE-SU-2010:0423-1 (moderate): vte security update
by opensuse-security＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Security Update: vte security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0423-1 Rating: moderate References: #621097 Cross-References: CVE-2010-2713 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: VTE was vulnerable to an old title set+query attack which could be used by remote attackers to execute arbitrary code (CVE-2010-2713). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch vte-2729 - openSUSE 11.2: zypper in -t patch vte-2729 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): vte-0.24.1-2.1.1 - openSUSE 11.3 (i586 x86_64): vte-devel-0.24.1-2.1.1 - openSUSE 11.3 (noarch): vte-lang-0.24.1-2.1.1 - openSUSE 11.2 (i586 src x86_64) [New Version: 0.22.5]: vte-0.22.5-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 0.22.5]: vte-devel-0.22.5-0.2.1 - openSUSE 11.2 (noarch) [New Version: 0.22.5]: vte-lang-0.22.5-0.2.1 References: http://support.novell.com/security/cve/CVE-2010-2713.html https://bugzilla.novell.com/621097

1 0

openSUSE-SU-2010:0422-1 (moderate): opera: cross-origin loading of CSS stylesheets
by opensuse-security＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Security Update: opera: cross-origin loading of CSS stylesheets ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0422-1 Rating: moderate References: #583620 #607823 #615942 Cross-References: CVE-2010-0653 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. It includes one version update. Description: Opera was upgraded to the 10.60 release. It brings lots of new features, bugfixes and security fixes. Security fixes include: CVE-2010-0653: Opera permits cross-origin loading of CSS style sheets even when the style sheet download has an incorrect MIME type and the style sheet document is malformed, which allows remote HTTP servers to obtain sensitive information via a crafted document. CVE-2010-1993: Opera 9.52 does not properly handle an IFRAME element with a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (resource consumption) via an HTML document with many IFRAME elements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch opera-2681 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 10.60]: opera-10.60-0.1.1 References: http://support.novell.com/security/cve/CVE-2010-0653.html https://bugzilla.novell.com/583620 https://bugzilla.novell.com/607823 https://bugzilla.novell.com/615942

1 0

openSUSE-RU-2010:0421-1 (low): smolt: Trigger smolt run
by maintenance＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Recommended Update: smolt: Trigger smolt run ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0421-1 Rating: low References: #621540 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Installing this update will trigger the updater applets to ask about submitting the hardware information to smolts.org. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch pullin-flash-player-2715 smolt-2714 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): pullin-flash-player-11.3.1-2.1.1 - openSUSE 11.3 (noarch src): smolt-1.4.2.2-3.1.1 - openSUSE 11.3 (noarch): smolt-gui-1.4.2.2-3.1.1 References: https://bugzilla.novell.com/621540

1 0

openSUSE-SU-2010:0420-1 (moderate): libtiff security updates
by opensuse-security＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Security Update: libtiff security updates ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0420-1 Rating: moderate References: #612879 Cross-References: CVE-2010-2067 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: specially crafted tiff images could cause a buffer overflow in libtiff (CVE-2010-2067). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch libtiff-devel-2720 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): tiff-3.9.2-5.1.1 - openSUSE 11.3 (i586 x86_64): libtiff-devel-3.9.2-5.1.1 libtiff3-3.9.2-5.1.1 - openSUSE 11.3 (x86_64): libtiff-devel-32bit-3.9.2-5.1.1 libtiff3-32bit-3.9.2-5.1.1 References: http://support.novell.com/security/cve/CVE-2010-2067.html https://bugzilla.novell.com/612879

1 0

openSUSE-RU-2010:0419-1 (critical): glibc: initgroups leaves out NIS groups on the second invocation
by maintenance＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Recommended Update: glibc: initgroups leaves out NIS groups on the second invocation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0419-1 Rating: critical References: #623098 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a bug in glibc: - bnc#607064: glibc initgroups leaves out NIS groups on the second invocation Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch glibc-2744 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 i686 src x86_64): glibc-2.11.2-3.1.1 - openSUSE 11.3 (i586 i686 x86_64): glibc-devel-2.11.2-3.1.1 - openSUSE 11.3 (i586 x86_64): glibc-html-2.11.2-3.1.1 glibc-i18ndata-2.11.2-3.1.1 glibc-info-2.11.2-3.1.1 glibc-locale-2.11.2-3.1.1 glibc-obsolete-2.11.2-3.1.1 glibc-profile-2.11.2-3.1.1 nscd-2.11.2-3.1.1 - openSUSE 11.3 (x86_64): glibc-32bit-2.11.2-3.1.1 glibc-devel-32bit-2.11.2-3.1.1 glibc-locale-32bit-2.11.2-3.1.1 glibc-profile-32bit-2.11.2-3.1.1 References: https://bugzilla.novell.com/623098

1 0

openSUSE-SU-2010:0418-1 (moderate): python-mako security update
by opensuse-security＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Security Update: python-mako security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0418-1 Rating: moderate References: #619134 Cross-References: CVE-2010-2480 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Python-mako was prone to a Cross-Site Scripting flaw due to improperly escaped single quotes (CVE-2010-2480). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch python-mako-2728 - openSUSE 11.2: zypper in -t patch python-mako-2728 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch src): python-mako-0.2.5-4.2.1 - openSUSE 11.2 (noarch src): python-mako-0.2.4-2.2.1 References: http://support.novell.com/security/cve/CVE-2010-2480.html https://bugzilla.novell.com/619134

1 0

openSUSE-RU-2010:0417-1 (moderate): spideroak: Update to version 9681
by maintenance＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Recommended Update: spideroak: Update to version 9681 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0417-1 Rating: moderate References: #621581 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This updates SpiderOak to the latest official version, 9681 (bnc#621581). SpiderOak provides an easy, secure and consolidated free online backup, sync, sharing, access & storage solution. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch spideroak-9681-2748 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64) [New Version: 9681]: python-transaction-1.0a1-2.1.1 spideroak-9681-0.1.1 - openSUSE 11.3 (i586 x86_64): python-bsddb3-5.0.0-1.1 python-crypto-2.1.0-1.9 python-curl-7.19.0-3.2 python-louie-1.1-1.2 python-nose-0.11.1-1.2 python-zconfig-3.6.0-1.2 python-zodb3-3.6.0-1.2 python-zope-event-3.5.0-2.2 python-zope-proxy-3.6.0-1.2 - openSUSE 11.3 (noarch): python-asn1-0.0.11-1.2 python-cerealizer-0.7-1.2 python-concurrentloghandler-0.8.4-1.2 python-zc-lockfile-1.0.0-2.1 python-zdaemon-2.0.4-1.2 References: https://bugzilla.novell.com/621581

1 0

openSUSE-SU-2010:0416-1 (moderate): exim: fixes two local issues;CVE-2010-2023 and CVE-2010-2024
by opensuse-security＠opensuse.org 22 Jul '10

22 Jul '10

openSUSE Security Update: exim: fixes two local issues;CVE-2010-2023 and CVE-2010-2024 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0416-1 Rating: moderate References: #612549 Cross-References: CVE-2010-2023 CVE-2010-2024 Affected Products: openSUSE 11.3 openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Two local vulnerabilities have been fixed in the exim MTA which allowed attackers to create arbitrary files or to change ownership of arbitrary files. CVE-2010-2023 and CVE-2010-2024 have been assigned to these issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch exim-2750 - openSUSE 11.2: zypper in -t patch exim-2750 - openSUSE 11.1: zypper in -t patch exim-2750 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): exim-4.71-4.1.1 - openSUSE 11.3 (i586 x86_64): eximon-4.71-4.1.1 eximstats-html-4.71-4.1.1 - openSUSE 11.2 (i586 src x86_64): exim-4.69-72.4.1 - openSUSE 11.2 (i586 x86_64): eximon-4.69-72.4.1 eximstats-html-4.69-72.4.1 - openSUSE 11.1 (i586 ppc src x86_64): exim-4.69-70.14.1 - openSUSE 11.1 (i586 ppc x86_64): eximon-4.69-70.14.1 eximstats-html-4.69-70.14.1 References: http://support.novell.com/security/cve/CVE-2010-2023.html http://support.novell.com/security/cve/CVE-2010-2024.html https://bugzilla.novell.com/612549

1 0

openSUSE-SU-2010:0414-1 (low): clamav: remote denial of service
by opensuse-security＠opensuse.org 21 Jul '10

21 Jul '10

openSUSE Security Update: clamav: remote denial of service ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0414-1 Rating: low References: #608188 Cross-References: CVE-2010-1639 CVE-2010-1640 CVE-2010-2077 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes one version update. Description: This update fixes a off-by-one buffer overflow (CVE-2010-1640) and a crash while parsing PDFs (CVE-2010-1639, CVE-2010-2077) in clamav that can be used as a remote denial of service attack. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch clamav-2478 - openSUSE 11.1: zypper in -t patch clamav-2478 - openSUSE 11.0: zypper in -t patch clamav-2478 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 0.96.1]: clamav-0.96.1-0.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 0.96.1]: clamav-db-0.96.1-0.1.1 - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 0.96.1]: clamav-0.96.1-0.1.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 0.96.1]: clamav-db-0.96.1-0.1.1 - openSUSE 11.0 (i586 ppc src x86_64) [New Version: 0.96.1]: clamav-0.96.1-0.1 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 0.96.1]: clamav-db-0.96.1-0.1 References: http://support.novell.com/security/cve/CVE-2010-1639.html http://support.novell.com/security/cve/CVE-2010-1640.html http://support.novell.com/security/cve/CVE-2010-2077.html https://bugzilla.novell.com/608188

1 0

openSUSE-RU-2010:0410-1 (moderate): spideroak: Update to version 9681
by maintenance＠opensuse.org 20 Jul '10

20 Jul '10

openSUSE Recommended Update: spideroak: Update to version 9681 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0410-1 Rating: moderate References: #621581 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This updates SpiderOak to the latest official version, 9681 (bnc#621581). SpiderOak provides an easy, secure and consolidated free online backup, sync, sharing, access & storage solution. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch spideroak-9681-2748 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64) [New Version: 9681]: python-transaction-1.0a1-2.1.1 spideroak-9681-0.1.1 - openSUSE 11.3 (i586 x86_64): python-bsddb3-5.0.0-1.1 python-crypto-2.1.0-1.9 python-curl-7.19.0-3.2 python-louie-1.1-1.2 python-nose-0.11.1-1.2 python-zconfig-3.6.0-1.2 python-zodb3-3.6.0-1.2 python-zope-event-3.5.0-2.2 python-zope-proxy-3.6.0-1.2 - openSUSE 11.3 (noarch): python-asn1-0.0.11-1.2 python-cerealizer-0.7-1.2 python-concurrentloghandler-0.8.4-1.2 python-zc-lockfile-1.0.0-2.1 python-zdaemon-2.0.4-1.2 References: https://bugzilla.novell.com/621581

1 0

openSUSE-SU-2010:0404-1 (moderate): vte security update
by opensuse-security＠opensuse.org 20 Jul '10

20 Jul '10

openSUSE Security Update: vte security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0404-1 Rating: moderate References: #621097 Cross-References: CVE-2010-2713 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: VTE was vulnerable to an old title set+query attack which could be used by remote attackers to execute arbitrary code (CVE-2010-2713). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch vte-2729 - openSUSE 11.2: zypper in -t patch vte-2729 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): vte-0.24.1-2.1.1 - openSUSE 11.3 (i586 x86_64): vte-devel-0.24.1-2.1.1 - openSUSE 11.3 (noarch): vte-lang-0.24.1-2.1.1 - openSUSE 11.2 (i586 src x86_64) [New Version: 0.22.5]: vte-0.22.5-0.2.1 - openSUSE 11.2 (i586 x86_64) [New Version: 0.22.5]: vte-devel-0.22.5-0.2.1 - openSUSE 11.2 (noarch) [New Version: 0.22.5]: vte-lang-0.22.5-0.2.1 References: http://support.novell.com/security/cve/CVE-2010-2713.html https://bugzilla.novell.com/621097

1 0

openSUSE-RU-2010:0402-1 (critical): glibc: initgroups leaves out NIS groups on the second invocation
by maintenance＠opensuse.org 20 Jul '10

20 Jul '10

openSUSE Recommended Update: glibc: initgroups leaves out NIS groups on the second invocation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0402-1 Rating: critical References: #623098 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes a bug in glibc: - bnc#607064: glibc initgroups leaves out NIS groups on the second invocation Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch glibc-2744 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 i686 src x86_64): glibc-2.11.2-3.1.1 - openSUSE 11.3 (x86_64): glibc-32bit-2.11.2-3.1.1 References: https://bugzilla.novell.com/623098

1 0

openSUSE-SU-2010:0397-1 (important): Linux Kernel: Security/Bugfix update to 2.6.27.48
by opensuse-security＠opensuse.org 19 Jul '10

19 Jul '10

openSUSE Security Update: Linux Kernel: Security/Bugfix update to 2.6.27.48 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0397-1 Rating: important References: #465707 #543480 #557710 #559111 #567376 #569916 #574006 #577967 #583677 #584216 #590415 #591371 #591556 #593881 #596113 #596462 #597337 #599213 #599955 #600774 #601283 #602969 #604183 #608366 #608576 #608933 #609134 #610296 #612213 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.48 fixing various bugs and security issues. CVE-2010-1641: The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS ioctl request. CVE-2010-1087: The nfs_wait_on_request function in fs/nfs/pagelist.c in the Linux kernel allows attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an operation that is not interruptible. CVE-2010-1643: mm/shmem.c in the Linux kernel, when strict overcommit is enabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. CVE-2010-1437: Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function. CVE-2010-1446: arch/powerpc/mm/fsl_booke_mmu.c in KGDB in the Linux kernel, when running on PowerPC, does not properly perform a security check for access to a kernel page, which allows local users to overwrite arbitrary kernel memory, related to Fsl booke. CVE-2010-1162: The release_one_tty function in drivers/char/tty_io.c in the Linux kernel omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors. CVE-2009-4537: drivers/net/r8169.c in the r8169 driver in the Linux kernel does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters, related to the value of the status register and erroneous behavior associated with the RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch kernel-2695 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 2.6.27.48]: kernel-source-2.6.27.48-0.1.1 kernel-syms-2.6.27.48-0.1.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 2.6.27.48]: kernel-default-2.6.27.48-0.1.1 kernel-default-base-2.6.27.48-0.1.1 kernel-default-extra-2.6.27.48-0.1.1 kernel-vanilla-2.6.27.48-0.1.1 - openSUSE 11.1 (i586 x86_64) [New Version: 2.6.27.48]: kernel-debug-2.6.27.48-0.1.1 kernel-debug-base-2.6.27.48-0.1.1 kernel-debug-extra-2.6.27.48-0.1.1 kernel-trace-2.6.27.48-0.1.1 kernel-trace-base-2.6.27.48-0.1.1 kernel-trace-extra-2.6.27.48-0.1.1 kernel-xen-2.6.27.48-0.1.1 kernel-xen-base-2.6.27.48-0.1.1 kernel-xen-extra-2.6.27.48-0.1.1 - openSUSE 11.1 (noarch src): kernel-docs-2.6.3-3.13.109 - openSUSE 11.1 (i586) [New Version: 2.6.27.48]: kernel-pae-2.6.27.48-0.1.1 kernel-pae-base-2.6.27.48-0.1.1 kernel-pae-extra-2.6.27.48-0.1.1 - openSUSE 11.1 (ppc) [New Version: 2.6.27.48]: kernel-kdump-2.6.27.48-0.1.1 kernel-ppc64-2.6.27.48-0.1.1 kernel-ppc64-base-2.6.27.48-0.1.1 kernel-ppc64-extra-2.6.27.48-0.1.1 kernel-ps3-2.6.27.48-0.1.1 References: https://bugzilla.novell.com/465707 https://bugzilla.novell.com/543480 https://bugzilla.novell.com/557710 https://bugzilla.novell.com/559111 https://bugzilla.novell.com/567376 https://bugzilla.novell.com/569916 https://bugzilla.novell.com/574006 https://bugzilla.novell.com/577967 https://bugzilla.novell.com/583677 https://bugzilla.novell.com/584216 https://bugzilla.novell.com/590415 https://bugzilla.novell.com/591371 https://bugzilla.novell.com/591556 https://bugzilla.novell.com/593881 https://bugzilla.novell.com/596113 https://bugzilla.novell.com/596462 https://bugzilla.novell.com/597337 https://bugzilla.novell.com/599213 https://bugzilla.novell.com/599955 https://bugzilla.novell.com/600774 https://bugzilla.novell.com/601283 https://bugzilla.novell.com/602969 https://bugzilla.novell.com/604183 https://bugzilla.novell.com/608366 https://bugzilla.novell.com/608576 https://bugzilla.novell.com/608933 https://bugzilla.novell.com/609134 https://bugzilla.novell.com/610296 https://bugzilla.novell.com/612213

1 0

openSUSE-SU-2010:0393-1 (low): w3m security update (CVE-2010-2074) to handle 0 characters in x509 certificates properly.
by opensuse-security＠opensuse.org 19 Jul '10

19 Jul '10

openSUSE Security Update: w3m security update (CVE-2010-2074) to handle 0 characters in x509 certificates properly. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0393-1 Rating: low References: #609451 Cross-References: CVE-2010-2074 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: w3m did not handle embedded nul characters in the common name and in subject alternative names of x509 certificates. CVE-2010-2074 has been assigned to this issue. This update also turns on verification of x509 certificates by default which was not the case before. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch w3m-2559 - openSUSE 11.1: zypper in -t patch w3m-2559 - openSUSE 11.0: zypper in -t patch w3m-2559 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): w3m-0.5.2-132.2.1 - openSUSE 11.2 (i586 x86_64): w3m-inline-image-0.5.2-132.2.1 - openSUSE 11.1 (i586 ppc src x86_64): w3m-0.5.2-128.7.1 - openSUSE 11.1 (i586 ppc x86_64): w3m-inline-image-0.5.2-128.7.1 - openSUSE 11.0 (i586 ppc src x86_64): w3m-0.5.2-90.2 - openSUSE 11.0 (i586 ppc x86_64): w3m-inline-image-0.5.2-90.2 References: http://support.novell.com/security/cve/CVE-2010-2074.html https://bugzilla.novell.com/609451

1 0

openSUSE-RU-2010:0392-1 (low): libQtWebKit: Update to QtWebKit from 4.5.3
by maintenance＠opensuse.org 19 Jul '10

19 Jul '10

openSUSE Recommended Update: libQtWebKit: Update to QtWebKit from 4.5.3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0392-1 Rating: low References: #600468 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides an update of QtWebKit rendering engine to the one shipped in Qt 4.5.3, which fixes: Canvas (r40546, r41221 r41355, r42996, r43645) Memory (r41527, r43764, r43828, r43830) JavaScript (r39882, r40086, r40131, r40133) Rendering (r41285, r41296, r41659, r42887) Network (r41664, r42516, r42747) Plugins (r41346, r43550, r43915, r43917, r43923) Clipboard (r41360) SVG (r43590, r43795) * Backported various security fixes (r41262, r41568, r41741, r41854, r42081, r42216, r42223, r42333, r42365, r42532, r42533, r44010) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch libQtWebKit-devel-2660 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): libQtWebKit-devel-4.4.0-12.8 - openSUSE 11.0 (i586 ppc x86_64): libQtWebKit4-4.4.0-12.8 libqt4-devel-doc-4.4.0-12.8 qt4-x11-tools-4.4.0-12.8 References: https://bugzilla.novell.com/600468

1 0

openSUSE-SU-2010:0387-1 (moderate): libtiff security updates
by opensuse-security＠opensuse.org 16 Jul '10

16 Jul '10

openSUSE Security Update: libtiff security updates ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0387-1 Rating: moderate References: #612879 Cross-References: CVE-2010-2067 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: specially crafted tiff images could cause a buffer overflow in libtiff (CVE-2010-2067). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch tiff-2720 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): tiff-3.9.2-5.1.1 References: http://support.novell.com/security/cve/CVE-2010-2067.html https://bugzilla.novell.com/612879

1 0

openSUSE-SU-2010:0386-1 (important): OpenOffice: security update to fix python macro execution
by opensuse-security＠opensuse.org 16 Jul '10

16 Jul '10

openSUSE Security Update: OpenOffice: security update to fix python macro execution ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0386-1 Rating: important References: #607095 Cross-References: CVE-2010-0395 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of OpenOffice_org does not allow macros written in Python to be executed without permission, CVE-2010-0395. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch OpenOffice_org-base-drivers-postgresql-2578 - openSUSE 11.1: zypper in -t patch OpenOffice_org-base-drivers-postgresql-2578 - openSUSE 11.0: zypper in -t patch OpenOffice_org-2581 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): OpenOffice_org-libs-core-3.1.1.4-1.3.1 - openSUSE 11.2 (i586 x86_64): OpenOffice_org-base-drivers-postgresql-3.1.1.4-1.3.1 OpenOffice_org-gnome-3.1.1.4-1.3.1 OpenOffice_org-kde-3.1.1.4-1.3.1 OpenOffice_org-kde4-3.1.1.4-1.3.1 OpenOffice_org-libs-core-devel-3.1.1.4-1.3.1 OpenOffice_org-libs-core-l10n-prebuilt-3.1.1.4-1.3.1 OpenOffice_org-mailmerge-3.1.1.4-1.3.1 - openSUSE 11.1 (i586 ppc src x86_64): OpenOffice_org-libs-core-3.0.0.9-1.12.1 - openSUSE 11.1 (i586 ppc x86_64): OpenOffice_org-base-drivers-postgresql-3.0.0.9-1.12.1 OpenOffice_org-gnome-3.0.0.9-1.12.1 OpenOffice_org-kde-3.0.0.9-1.12.1 OpenOffice_org-libs-core-devel-3.0.0.9-1.12.1 OpenOffice_org-libs-core-l10n-prebuilt-3.0.0.9-1.12.1 OpenOffice_org-mailmerge-3.0.0.9-1.12.1 - openSUSE 11.0 (i586 ppc src x86_64): OpenOffice_org-2.4.0.14-1.8 - openSUSE 11.0 (i586 ppc x86_64): OpenOffice_org-base-2.4.0.14-1.8 OpenOffice_org-branding-upstream-2.4.0.14-1.8 OpenOffice_org-calc-2.4.0.14-1.8 OpenOffice_org-devel-2.4.0.14-1.8 OpenOffice_org-draw-2.4.0.14-1.8 OpenOffice_org-filters-2.4.0.14-1.8 OpenOffice_org-gnome-2.4.0.14-1.8 OpenOffice_org-icon-themes-prebuilt-2.4.0.14-1.8 OpenOffice_org-impress-2.4.0.14-1.8 OpenOffice_org-kde-2.4.0.14-1.8 OpenOffice_org-mailmerge-2.4.0.14-1.8 OpenOffice_org-math-2.4.0.14-1.8 OpenOffice_org-mono-2.4.0.14-1.8 OpenOffice_org-officebean-2.4.0.14-1.8 OpenOffice_org-pyuno-2.4.0.14-1.8 OpenOffice_org-sdk-2.4.0.14-1.8 OpenOffice_org-sdk-doc-2.4.0.14-1.8 OpenOffice_org-testtool-2.4.0.14-1.8 OpenOffice_org-writer-2.4.0.14-1.8 References: http://support.novell.com/security/cve/CVE-2010-0395.html https://bugzilla.novell.com/607095

1 0

openSUSE-RU-2010:0384-1 (low): ksh: Collective update for ksh
by maintenance＠opensuse.org 16 Jul '10

16 Jul '10

openSUSE Recommended Update: ksh: Collective update for ksh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0384-1 Rating: low References: #502622 #520598 #523212 #548558 #555938 #561405 #564967 #585244 #591248 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that has 9 recommended fixes can now be installed. It includes one version update. Description: Collective update for ksh version 93t, including the following fixes: - #502622: ksh: assigning to SECONDS in a subshell causes corruption/crash - #520598: memory leak in ksh - #523212: ksh error when "~user" is used and NIS is enabled - #555938: ksh cursor position regression - #561405: ksh JM 93t+ 2009-01-20 bug - #564967: Trap does not work on signals over 16 in ksh - #585244: regression: ksh not detecting exit status correctly - #591248: Unreliable results in ksh when trapping SIGCHILD Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch ksh-2299 - openSUSE 11.1: zypper in -t patch ksh-2299 - openSUSE 11.0: zypper in -t patch ksh-2299 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): ksh-93t-165.3.1 - openSUSE 11.2 (i586 x86_64): ksh-devel-93t-165.3.1 - openSUSE 11.1 (i586 ppc src x86_64): ksh-93t-6.6.1 - openSUSE 11.1 (i586 ppc x86_64): ksh-devel-93t-6.6.1 - openSUSE 11.0 (i586 ppc src x86_64) [New Version: 93t]: ksh-93t-22.1 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 93t]: ksh-devel-93t-22.1 References: https://bugzilla.novell.com/502622 https://bugzilla.novell.com/520598 https://bugzilla.novell.com/523212 https://bugzilla.novell.com/548558 https://bugzilla.novell.com/555938 https://bugzilla.novell.com/561405 https://bugzilla.novell.com/564967 https://bugzilla.novell.com/585244 https://bugzilla.novell.com/591248

1 0

openSUSE-SU-2010:0383-1 (moderate): python-mako security update
by opensuse-security＠opensuse.org 16 Jul '10

16 Jul '10

openSUSE Security Update: python-mako security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0383-1 Rating: moderate References: #619134 Cross-References: CVE-2010-2480 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Python-mako was prone to a Cross-Site Scripting flaw due to improperly escaped single quotes (CVE-2010-2480). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch python-mako-2728 - openSUSE 11.2: zypper in -t patch python-mako-2728 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch src): python-mako-0.2.5-4.2.1 - openSUSE 11.2 (noarch src): python-mako-0.2.4-2.2.1 References: http://support.novell.com/security/cve/CVE-2010-2480.html https://bugzilla.novell.com/619134

1 0

openSUSE-OU-2010:0373-2 (low): Download and Install Microsoft(r) TrueType Core Fonts
by maintenance＠opensuse.org 15 Jul '10

15 Jul '10

openSUSE Optional Update: Download and Install Microsoft(r) TrueType Core Fonts ______________________________________________________________________________ Announcement ID: openSUSE-OU-2010:0373-2 Rating: low References: #621540 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: Installing this update will download install the Core TrueType fonts to your system. For legal reasons we can't include the Microsoft(R) TrueType Core Fonts in our product. This patch downloads these fonts and installs them on your system. Please note that about 4 MByte data are downloaded additionality to this patch. The License for the fonts will be installed as /usr/share/doc/corefonts/EULA.html Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch pullin-msttf-fonts-2712 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (noarch src): fetchmsttfonts-11.3-1.1.5 pullin-msttf-fonts-11.3.1-1.3.1 References: https://bugzilla.novell.com/621540

1 0

openSUSE-OU-2010:0373-1 (low): flash-player: openSUSE maintained Flash Player 10.1
by maintenance＠opensuse.org 14 Jul '10

14 Jul '10

openSUSE Optional Update: flash-player: openSUSE maintained Flash Player 10.1 ______________________________________________________________________________ Announcement ID: openSUSE-OU-2010:0373-1 Rating: low References: #621540 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This patch adds an openSUSE maintained Adobe Flash Player to openSUSE 11.3. Patch Instructions: To install this openSUSE Optional Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch flash-player-2713 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src): flash-player-10.1.53.64-2.1.1 References: https://bugzilla.novell.com/621540

1 0

openSUSE-RU-2010:0372-1 (low): smolt: Trigger smolt run
by maintenance＠opensuse.org 14 Jul '10

14 Jul '10

openSUSE Recommended Update: smolt: Trigger smolt run ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0372-1 Rating: low References: #621540 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Installing this update will trigger the updater applets to ask about submitting the hardware information to smolts.org. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch pullin-flash-player-2715 smolt-2714 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 src x86_64): pullin-flash-player-11.3.1-2.1.1 - openSUSE 11.3 (noarch src): smolt-1.4.2.2-3.1.1 References: https://bugzilla.novell.com/621540

1 0

openSUSE-SU-2010:0371-1 (moderate): postgresql: security update to fix four vulnerabilities
by opensuse-security＠opensuse.org 13 Jul '10

13 Jul '10

openSUSE Security Update: postgresql: security update to fix four vulnerabilities ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0371-1 Rating: moderate References: #588996 #605845 #605926 #607778 Cross-References: CVE-2010-0733 CVE-2010-1169 CVE-2010-1170 CVE-2010-1975 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes two new package versions. Description: This update of postgresql was pblished to fix several minor security vulnerabilities: - CVE-2010-1975: postgresql does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings. - CVE-2010-1170: The PL/Tcl implementation in postgresql loads Tcl code from the pltcl_modules table regardless of the table's ownership and permissions, which allows remote authenticated users, with database-creation privileges, to execute arbitrary Tcl code. - CVE-2010-1169: Postgresql does not properly restrict PL/perl procedures, which allows remote authenticated users, with database-creation privileges, to execute arbitrary Perl code via a crafted script. - CVE-2010-0733: An integer overflow in postgresql allows remote authenticated users to crash the daemon via a SELECT statement. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch postgresql-2472 - openSUSE 11.1: zypper in -t patch postgresql-2472 - openSUSE 11.0: zypper in -t patch postgresql-2472 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 8.4.4]: postgresql-8.4.4-0.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 8.4.4]: postgresql-contrib-8.4.4-0.1.1 postgresql-devel-8.4.4-0.1.1 postgresql-docs-8.4.4-0.1.1 postgresql-libs-8.4.4-0.1.1 postgresql-plperl-8.4.4-0.1.1 postgresql-plpython-8.4.4-0.1.1 postgresql-pltcl-8.4.4-0.1.1 postgresql-server-8.4.4-0.1.1 - openSUSE 11.2 (x86_64) [New Version: 8.4.4]: postgresql-libs-32bit-8.4.4-0.1.1 - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 8.3.11]: postgresql-8.3.11-0.1.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 8.3.11]: postgresql-contrib-8.3.11-0.1.1 postgresql-devel-8.3.11-0.1.1 postgresql-docs-8.3.11-0.1.1 postgresql-libs-8.3.11-0.1.1 postgresql-plperl-8.3.11-0.1.1 postgresql-plpython-8.3.11-0.1.1 postgresql-pltcl-8.3.11-0.1.1 postgresql-server-8.3.11-0.1.1 - openSUSE 11.1 (x86_64) [New Version: 8.3.11]: postgresql-libs-32bit-8.3.11-0.1.1 - openSUSE 11.1 (ppc) [New Version: 8.3.11]: postgresql-libs-64bit-8.3.11-0.1.1 - openSUSE 11.0 (i586 ppc ppc64 src x86_64) [New Version: 8.3.11]: postgresql-8.3.11-0.1 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 8.3.11]: postgresql-contrib-8.3.11-0.1 postgresql-devel-8.3.11-0.1 postgresql-docs-8.3.11-0.1 postgresql-libs-8.3.11-0.1 postgresql-plperl-8.3.11-0.1 postgresql-plpython-8.3.11-0.1 postgresql-pltcl-8.3.11-0.1 postgresql-server-8.3.11-0.1 - openSUSE 11.0 (x86_64) [New Version: 8.3.11]: postgresql-libs-32bit-8.3.11-0.1 - openSUSE 11.0 (ppc) [New Version: 8.3.11]: postgresql-libs-64bit-8.3.11-0.1 References: http://support.novell.com/security/cve/CVE-2010-0733.html http://support.novell.com/security/cve/CVE-2010-1169.html http://support.novell.com/security/cve/CVE-2010-1170.html http://support.novell.com/security/cve/CVE-2010-1975.html https://bugzilla.novell.com/588996 https://bugzilla.novell.com/605845 https://bugzilla.novell.com/605926 https://bugzilla.novell.com/607778

1 0

openSUSE-SU-2010:0370-1 (moderate): opera: cross-origin loading of CSS stylesheets
by opensuse-security＠opensuse.org 13 Jul '10

13 Jul '10

openSUSE Security Update: opera: cross-origin loading of CSS stylesheets ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0370-1 Rating: moderate References: #583620 #607823 #615942 Cross-References: CVE-2010-0653 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. It includes one version update. Description: Opera was upgraded to the 10.60 release. It brings lots of new features, bugfixes and security fixes. Security fixes include: CVE-2010-0653: Opera permits cross-origin loading of CSS style sheets even when the style sheet download has an incorrect MIME type and the style sheet document is malformed, which allows remote HTTP servers to obtain sensitive information via a crafted document. CVE-2010-1993: Opera 9.52 does not properly handle an IFRAME element with a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (resource consumption) via an HTML document with many IFRAME elements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch opera-2681 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 10.60]: opera-10.60-0.1.1 References: http://support.novell.com/security/cve/CVE-2010-0653.html https://bugzilla.novell.com/583620 https://bugzilla.novell.com/607823 https://bugzilla.novell.com/615942

1 0

openSUSE-SU-2010:0368-1 (moderate): opera: Upgrade to 10.60 release
by opensuse-security＠opensuse.org 13 Jul '10

13 Jul '10

openSUSE Security Update: opera: Upgrade to 10.60 release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0368-1 Rating: moderate References: #583620 #607823 #615942 Cross-References: CVE-2010-0653 CVE-2010-1993 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. It includes one version update. Description: Opera was upgraded to the 10.60 release. It brings lots of new features, bugfixes and security fixes. Security fixes include: CVE-2010-0653: Opera permits cross-origin loading of CSS style sheets even when the style sheet download has an incorrect MIME type and the style sheet document is malformed, which allows remote HTTP servers to obtain sensitive information via a crafted document. CVE-2010-1993: Opera 9.52 does not properly handle an IFRAME element with a mailto: URL in its SRC attribute, which allows remote attackers to cause a denial of service (resource consumption) via an HTML document with many IFRAME elements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch opera-2673 - openSUSE 11.1: zypper in -t patch opera-2673 - openSUSE 11.0: zypper in -t patch opera-2673 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64) [New Version: 10.60]: opera-10.60-0.1.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 10.60]: opera-10.60-0.1.1 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 10.60]: opera-10.60-0.1 References: http://support.novell.com/security/cve/CVE-2010-0653.html http://support.novell.com/security/cve/CVE-2010-1993.html https://bugzilla.novell.com/583620 https://bugzilla.novell.com/607823 https://bugzilla.novell.com/615942

1 0

openSUSE-SU-2010:0366-1 (important): otrs: Fixed a vulnerability in OTRS-Core that allowed SQL-Injection
by opensuse-security＠opensuse.org 13 Jul '10

13 Jul '10

openSUSE Security Update: otrs: Fixed a vulnerability in OTRS-Core that allowed SQL-Injection ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0366-1 Rating: important References: #576066 Cross-References: CVE-2010-0438 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: OTRS was prone to multiple SQL-injection vulnerabilities which could allow remote authenticated attackers to execute arbitrary SQL code via unspecified vectors.(CVE-2010-0438). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch otrs-2702 - openSUSE 11.1: zypper in -t patch otrs-2702 - openSUSE 11.0: zypper in -t patch otrs-2702 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): otrs-2.2.6-46.3.1 - openSUSE 11.1 (i586 ppc src x86_64): otrs-2.2.6-45.18.1 - openSUSE 11.0 (i586 ppc src x86_64): otrs-2.2.6-15.3 References: http://support.novell.com/security/cve/CVE-2010-0438.html https://bugzilla.novell.com/576066

1 0

openSUSE-SU-2010:0365-1 (moderate): moodle security update
by opensuse-security＠opensuse.org 12 Jul '10

12 Jul '10

openSUSE Security Update: moodle security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0365-1 Rating: moderate References: #616186 Cross-References: CVE-2010-2228 CVE-2010-2229 CVE-2010-2230 CVE-2010-2231 Affected Products: openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: Moodle was prone to several Cross-Site Scripting (XSS) vulnerabilities (CVE-2010-2228, CVE-2010-2229, CVE-2010-2230, CVE-2010-2231). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch moodle-2691 - openSUSE 11.0: zypper in -t patch moodle-2691 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (noarch src) [New Version: 1.9.9]: moodle-1.9.9-0.1.1 - openSUSE 11.1 (noarch) [New Version: 1.9.9]: moodle-af-1.9.9-0.1.1 moodle-ar-1.9.9-0.1.1 moodle-be-1.9.9-0.1.1 moodle-bg-1.9.9-0.1.1 moodle-bs-1.9.9-0.1.1 moodle-ca-1.9.9-0.1.1 moodle-cs-1.9.9-0.1.1 moodle-da-1.9.9-0.1.1 moodle-de-1.9.9-0.1.1 moodle-de_du-1.9.9-0.1.1 moodle-el-1.9.9-0.1.1 moodle-es-1.9.9-0.1.1 moodle-et-1.9.9-0.1.1 moodle-eu-1.9.9-0.1.1 moodle-fa-1.9.9-0.1.1 moodle-fi-1.9.9-0.1.1 moodle-fr-1.9.9-0.1.1 moodle-ga-1.9.9-0.1.1 moodle-gl-1.9.9-0.1.1 moodle-he-1.9.9-0.1.1 moodle-hi-1.9.9-0.1.1 moodle-hr-1.9.9-0.1.1 moodle-hu-1.9.9-0.1.1 moodle-id-1.9.9-0.1.1 moodle-is-1.9.9-0.1.1 moodle-it-1.9.9-0.1.1 moodle-ja-1.9.9-0.1.1 moodle-ka-1.9.9-0.1.1 moodle-km-1.9.9-0.1.1 moodle-kn-1.9.9-0.1.1 moodle-ko-1.9.9-0.1.1 moodle-lt-1.9.9-0.1.1 moodle-lv-1.9.9-0.1.1 moodle-mi_tn-1.9.9-0.1.1 moodle-ms-1.9.9-0.1.1 moodle-nl-1.9.9-0.1.1 moodle-nn-1.9.9-0.1.1 moodle-no-1.9.9-0.1.1 moodle-pl-1.9.9-0.1.1 moodle-pt-1.9.9-0.1.1 moodle-ro-1.9.9-0.1.1 moodle-ru-1.9.9-0.1.1 moodle-sk-1.9.9-0.1.1 moodle-sl-1.9.9-0.1.1 moodle-so-1.9.9-0.1.1 moodle-sq-1.9.9-0.1.1 moodle-sr-1.9.9-0.1.1 moodle-sv-1.9.9-0.1.1 moodle-th-1.9.9-0.1.1 moodle-tl-1.9.9-0.1.1 moodle-tr-1.9.9-0.1.1 moodle-uk-1.9.9-0.1.1 moodle-vi-1.9.9-0.1.1 moodle-zh_cn-1.9.9-0.1.1 - openSUSE 11.0 (noarch src) [New Version: 1.9.9]: moodle-1.9.9-0.1 - openSUSE 11.0 (noarch) [New Version: 1.9.9]: moodle-af-1.9.9-0.1 moodle-ar-1.9.9-0.1 moodle-be-1.9.9-0.1 moodle-bg-1.9.9-0.1 moodle-bs-1.9.9-0.1 moodle-ca-1.9.9-0.1 moodle-cs-1.9.9-0.1 moodle-da-1.9.9-0.1 moodle-de-1.9.9-0.1 moodle-de_du-1.9.9-0.1 moodle-el-1.9.9-0.1 moodle-es-1.9.9-0.1 moodle-et-1.9.9-0.1 moodle-eu-1.9.9-0.1 moodle-fa-1.9.9-0.1 moodle-fi-1.9.9-0.1 moodle-fr-1.9.9-0.1 moodle-ga-1.9.9-0.1 moodle-gl-1.9.9-0.1 moodle-he-1.9.9-0.1 moodle-hi-1.9.9-0.1 moodle-hr-1.9.9-0.1 moodle-hu-1.9.9-0.1 moodle-id-1.9.9-0.1 moodle-is-1.9.9-0.1 moodle-it-1.9.9-0.1 moodle-ja-1.9.9-0.1 moodle-ka-1.9.9-0.1 moodle-km-1.9.9-0.1 moodle-kn-1.9.9-0.1 moodle-ko-1.9.9-0.1 moodle-lt-1.9.9-0.1 moodle-lv-1.9.9-0.1 moodle-mi_tn-1.9.9-0.1 moodle-ms-1.9.9-0.1 moodle-nl-1.9.9-0.1 moodle-nn-1.9.9-0.1 moodle-no-1.9.9-0.1 moodle-pl-1.9.9-0.1 moodle-pt-1.9.9-0.1 moodle-ro-1.9.9-0.1 moodle-ru-1.9.9-0.1 moodle-sk-1.9.9-0.1 moodle-sl-1.9.9-0.1 moodle-so-1.9.9-0.1 moodle-sq-1.9.9-0.1 moodle-sr-1.9.9-0.1 moodle-sv-1.9.9-0.1 moodle-th-1.9.9-0.1 moodle-tl-1.9.9-0.1 moodle-tr-1.9.9-0.1 moodle-uk-1.9.9-0.1 moodle-vi-1.9.9-0.1 moodle-zh_cn-1.9.9-0.1 References: http://support.novell.com/security/cve/CVE-2010-2228.html http://support.novell.com/security/cve/CVE-2010-2229.html http://support.novell.com/security/cve/CVE-2010-2230.html http://support.novell.com/security/cve/CVE-2010-2231.html https://bugzilla.novell.com/616186

1 0

openSUSE-SU-2010:0359-1 (critical): acroread: Update to security fix release 9.3.3
by opensuse-security＠opensuse.org 08 Jul '10

08 Jul '10

openSUSE Security Update: acroread: Update to security fix release 9.3.3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0359-1 Rating: critical References: #612064 Cross-References: CVE-2010-1240 CVE-2010-1285 CVE-2010-1295 CVE-2010-1297 CVE-2010-2168 CVE-2010-2201 CVE-2010-2202 CVE-2010-2203 CVE-2010-2204 CVE-2010-2205 CVE-2010-2206 CVE-2010-2207 CVE-2010-2208 CVE-2010-2209 CVE-2010-2210 CVE-2010-2211 CVE-2010-2212 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. It includes one version update. Description: Specially crafted PDF documents could crash acroread or lead to execution of arbitrary code (CVE-2010-1297, CVE-2010-1240, CVE-2010-1285, CVE-2010-1295, CVE-2010-2168, CVE-2010-2201, CVE-2010-2202, CVE-2010-2203, CVE-2010-2204, CVE-2010-2205, CVE-2010-2206, CVE-2010-2207, CVE-2010-2208, CVE-2010-2209, CVE-2010-2210, CVE-2010-2211, CVE-2010-2212). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch acroread-2664 - openSUSE 11.1: zypper in -t patch acroread-2664 - openSUSE 11.0: zypper in -t patch acroread-2664 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (noarch) [New Version: 9.3.3]: acroread-cmaps-9.3.3-2.1.1 acroread-fonts-ja-9.3.3-2.1.1 acroread-fonts-ko-9.3.3-2.1.1 acroread-fonts-zh_CN-9.3.3-2.1.1 acroread-fonts-zh_TW-9.3.3-2.1.1 - openSUSE 11.2 (i586) [New Version: 9.3.3]: acroread-9.3.3-2.1.1 - openSUSE 11.1 (noarch) [New Version: 9.3.3]: acroread-cmaps-9.3.3-2.1.1 acroread-fonts-ja-9.3.3-2.1.1 acroread-fonts-ko-9.3.3-2.1.1 acroread-fonts-zh_CN-9.3.3-2.1.1 acroread-fonts-zh_TW-9.3.3-2.1.1 - openSUSE 11.1 (i586) [New Version: 9.3.3]: acroread-9.3.3-2.1.1 - openSUSE 11.0 (noarch) [New Version: 9.3.3]: acroread-cmaps-9.3.3-2.1 acroread-fonts-ja-9.3.3-2.1 acroread-fonts-ko-9.3.3-2.1 acroread-fonts-zh_CN-9.3.3-2.1 acroread-fonts-zh_TW-9.3.3-2.1 - openSUSE 11.0 (i586) [New Version: 9.3.3]: acroread-9.3.3-2.1 References: http://support.novell.com/security/cve/CVE-2010-1240.html http://support.novell.com/security/cve/CVE-2010-1285.html http://support.novell.com/security/cve/CVE-2010-1295.html http://support.novell.com/security/cve/CVE-2010-1297.html http://support.novell.com/security/cve/CVE-2010-2168.html http://support.novell.com/security/cve/CVE-2010-2201.html http://support.novell.com/security/cve/CVE-2010-2202.html http://support.novell.com/security/cve/CVE-2010-2203.html http://support.novell.com/security/cve/CVE-2010-2204.html http://support.novell.com/security/cve/CVE-2010-2205.html http://support.novell.com/security/cve/CVE-2010-2206.html http://support.novell.com/security/cve/CVE-2010-2207.html http://support.novell.com/security/cve/CVE-2010-2208.html http://support.novell.com/security/cve/CVE-2010-2209.html http://support.novell.com/security/cve/CVE-2010-2210.html http://support.novell.com/security/cve/CVE-2010-2211.html http://support.novell.com/security/cve/CVE-2010-2212.html https://bugzilla.novell.com/612064

1 0

openSUSE-SU-2010:0358-2 (important): MozillaFirefox: Security update to version 3.5.10
by opensuse-security＠opensuse.org 08 Jul '10

08 Jul '10

openSUSE Security Update: MozillaFirefox: Security update to version 3.5.10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0358-2 Rating: important References: #603356 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes two new package versions. Description: Mozilla Firefox was updated to version 3.5.10, fixing various bugs and security issues. MFSA 2010-33 / CVE-2008-5913: Security researcher Amit Klein reported that it was possible to reverse engineer the value used to seed Math.random(). Since the pseudo-random number generator was only seeded once per browsing session, this seed value could be used as a unique token to identify and track users across different web sites. MFSA 2010-32 / CVE-2010-1197: Security researcher Ilja van Sprundel of IOActive reported that the Content-Disposition: attachment HTTP header was ignored when Content-Type: multipart was also present. This issue could potentially lead to XSS problems in sites that allow users to upload arbitrary files and specify a Content-Type but rely on Content-Disposition: attachment to prevent the content from being displayed inline. MFSA 2010-31 / CVE-2010-1125: Google security researcher Michal Zalewski reported that focus() could be used to change a user's cursor focus while they are typing, potentially directing their keyboard input to an unintended location. This behaviour was also present across origins when content from one domain was embedded within another via an iframe. A malicious web page could use this behaviour to steal keystrokes from a victim while they were typing sensitive information such as a password. MFSA 2010-30 / CVE-2010-1199: Security researcher Martin Barbella reported via TippingPoint's Zero Day Initiative that an XSLT node sorting routine contained an integer overflow vulnerability. In cases where one of the nodes to be sorted contained a very large text value, the integer used to allocate a memory buffer to store its value would overflow, resulting in too small a buffer being created. An attacker could use this vulnerability to write data past the end of the buffer, causing the browser to crash and potentially running arbitrary code on a victim's computer. MFSA 2010-29 / CVE-2010-1196: Security researcher Nils of MWR InfoSecurity reported that the routine for setting the text value for certain types of DOM nodes contained an integer overflow vulnerability. When a very long string was passed to this routine, the integer value used in creating a new memory buffer to hold the string would overflow, resulting in too small a buffer being allocated. An attacker could use this vulnerability to write data past the end of the buffer, causing a crash and potentially running arbitrary code on a victim's computer. MFSA 2010-28 / CVE-2010-1198: Microsoft Vulnerability Research reported that two plugin instances could interact in a way in which one plugin gets a reference to an object owned by a second plugin and continues to hold that reference after the second plugin is unloaded and its object is destroyed. In these cases, the first plugin would contain a pointer to freed memory which, if accessed, could be used by an attacker to execute arbitrary code on a victim's computer. MFSA 2010-27 / CVE-2010-0183: Security researcher wushi of team509 reported that the frame construction process for certain types of menus could result in a menu containing a pointer to a previously freed menu item. During the cycle collection process, this freed item could be accessed, resulting in the execution of a section of code potentially controlled by an attacker. MFSA 2010-26 / CVE-2010-1200 / CVE-2010-1201 / CVE-2010-1202 / CVE-2010-1203: Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2010-25 / CVE-2010-1121: A memory corruption flaw leading to code execution was reported by security researcher Nils of MWR InfoSecurity during the 2010 Pwn2Own contest sponsored by TippingPoint's Zero Day Initiative. By moving DOM nodes between documents Nils found a case where the moved node incorrectly retained its old scope. If garbage collection could be triggered at the right time then Firefox would later use this freed object. The contest winning exploit only affects Firefox 3.6 and not earlier versions. Updated (June 22, 2010): Firefox 3.5, SeaMonkey 2.0, and Thunderbird 3.0 based on earlier versions of the browser engine were patched just in case there is an alternate way of triggering the underlying flaw. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch MozillaFirefox-2595 - openSUSE 11.1: zypper in -t patch MozillaFirefox-2595 - openSUSE 11.0: zypper in -t patch MozillaFirefox-2595 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 1.9.1.10 and 3.5.10]: MozillaFirefox-3.5.10-0.1.1 mozilla-xulrunner191-1.9.1.10-0.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.9.1.10 and 3.5.10]: MozillaFirefox-branding-upstream-3.5.10-0.1.1 MozillaFirefox-translations-common-3.5.10-0.1.1 MozillaFirefox-translations-other-3.5.10-0.1.1 mozilla-xulrunner191-devel-1.9.1.10-0.1.1 mozilla-xulrunner191-gnomevfs-1.9.1.10-0.1.1 mozilla-xulrunner191-translations-common-1.9.1.10-0.1.1 mozilla-xulrunner191-translations-other-1.9.1.10-0.1.1 python-xpcom191-1.9.1.10-0.1.1 - openSUSE 11.2 (x86_64) [New Version: 1.9.1.10]: mozilla-xulrunner191-32bit-1.9.1.10-0.1.1 mozilla-xulrunner191-gnomevfs-32bit-1.9.1.10-0.1.1 - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 1.9.1.10 and 3.5.10]: MozillaFirefox-3.5.10-0.1.2 mozilla-xulrunner191-1.9.1.10-0.1.2 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 1.9.1.10 and 3.5.10]: MozillaFirefox-branding-upstream-3.5.10-0.1.2 MozillaFirefox-translations-common-3.5.10-0.1.2 MozillaFirefox-translations-other-3.5.10-0.1.2 mozilla-xulrunner191-devel-1.9.1.10-0.1.2 mozilla-xulrunner191-gnomevfs-1.9.1.10-0.1.2 mozilla-xulrunner191-translations-common-1.9.1.10-0.1.2 mozilla-xulrunner191-translations-other-1.9.1.10-0.1.2 python-xpcom191-1.9.1.10-0.1.2 - openSUSE 11.1 (x86_64) [New Version: 1.9.1.10]: mozilla-xulrunner191-32bit-1.9.1.10-0.1.2 mozilla-xulrunner191-gnomevfs-32bit-1.9.1.10-0.1.2 - openSUSE 11.0 (i586 ppc src x86_64) [New Version: 1.9.1.10 and 3.5.10]: MozillaFirefox-3.5.10-0.1 mozilla-xulrunner191-1.9.1.10-0.1 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 1.9.1.10 and 3.5.10]: MozillaFirefox-branding-upstream-3.5.10-0.1 MozillaFirefox-translations-common-3.5.10-0.1 MozillaFirefox-translations-other-3.5.10-0.1 mozilla-xulrunner191-devel-1.9.1.10-0.1 mozilla-xulrunner191-gnomevfs-1.9.1.10-0.1 mozilla-xulrunner191-translations-common-1.9.1.10-0.1 mozilla-xulrunner191-translations-other-1.9.1.10-0.1 python-xpcom191-1.9.1.10-0.1 - openSUSE 11.0 (x86_64) [New Version: 1.9.1.10]: mozilla-xulrunner191-32bit-1.9.1.10-0.1 mozilla-xulrunner191-gnomevfs-32bit-1.9.1.10-0.1 - openSUSE 11.0 (ppc) [New Version: 1.9.1.10]: mozilla-xulrunner191-64bit-1.9.1.10-0.1 mozilla-xulrunner191-gnomevfs-64bit-1.9.1.10-0.1 References: https://bugzilla.novell.com/603356

1 0

openSUSE-SU-2010:0358-1 (important): MozillaThunderbird: Update to 3.0.5
by opensuse-security＠opensuse.org 07 Jul '10

07 Jul '10

openSUSE Security Update: MozillaThunderbird: Update to 3.0.5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0358-1 Rating: important References: #603356 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes two new package versions. Description: Mozilla Thunderbird was updated to version 3.0.5, fixing lots of security issues. Mozilla has so far not communicated what vulnerabilities were fixed, the list will appear on: http://www.mozilla.org/security/known-vulnerabilities/thunde rbird30.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch MozillaThunderbird-2580 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 3.0.5]: MozillaThunderbird-3.0.5-1.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 1.0.1 and 3.0.5]: MozillaThunderbird-devel-3.0.5-1.1.1 MozillaThunderbird-translations-common-3.0.5-1.1.1 MozillaThunderbird-translations-other-3.0.5-1.1.1 enigmail-1.0.1-1.1.1 References: https://bugzilla.novell.com/603356

1 0

openSUSE-RU-2010:0357-1 (low): python: This update fixes problems caused by using "osc build"
by maintenance＠opensuse.org 06 Jul '10

06 Jul '10

openSUSE Recommended Update: python: This update fixes problems caused by using "osc build" ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0357-1 Rating: low References: #612305 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Some calls in python's subprocess module were not properly guarded against interruptions, resulting in exceptions when using "osc build". This update adds the necessary guards. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libpython2_6-1_0-2565 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): python-2.6.2-6.5.1 python-base-2.6.2-6.5.1 - openSUSE 11.2 (i586 x86_64): libpython2_6-1_0-2.6.2-6.5.1 python-curses-2.6.2-6.5.1 python-demo-2.6.2-6.5.1 python-devel-2.6.2-6.5.1 python-gdbm-2.6.2-6.5.1 python-idle-2.6.2-6.5.1 python-tk-2.6.2-6.5.1 python-xml-2.6.2-6.5.1 - openSUSE 11.2 (x86_64): libpython2_6-1_0-32bit-2.6.2-6.5.1 python-32bit-2.6.2-6.5.1 python-base-32bit-2.6.2-6.5.1 References: https://bugzilla.novell.com/612305

1 0

openSUSE-SU-2010:0354-1 (important): KVIrc: format string and directory traversal vulnerability
by opensuse-security＠opensuse.org 05 Jul '10

05 Jul '10

openSUSE Security Update: KVIrc: format string and directory traversal vulnerability ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0354-1 Rating: important References: #613163 Cross-References: CVE-2010-2451 CVE-2010-2452 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of KVirc fixes a remotely exploitable format string and directory traversal vulnerability (CVE-2010-2451, CVE-2010-2452). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch kvirc-2642 - openSUSE 11.1: zypper in -t patch kvirc-2642 - openSUSE 11.0: zypper in -t patch kvirc-2642 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): kvirc-3.4.2-4.6.1 - openSUSE 11.2 (i586 x86_64): kvirc-devel-3.4.2-4.6.1 - openSUSE 11.1 (i586 ppc src x86_64): kvirc-3.4.2-2.25.1 - openSUSE 11.1 (i586 ppc x86_64): kvirc-devel-3.4.2-2.25.1 - openSUSE 11.0 (i586 ppc src x86_64): kvirc-3.2.6-186.2 - openSUSE 11.0 (i586 ppc x86_64): kvirc-devel-3.2.6-186.2 References: http://support.novell.com/security/cve/CVE-2010-2451.html http://support.novell.com/security/cve/CVE-2010-2452.html https://bugzilla.novell.com/613163

1 0

openSUSE-SU-2010:0351-1 (moderate): libvorbis: memory corruption while parsing ogg files
by opensuse-security＠opensuse.org 02 Jul '10

02 Jul '10

openSUSE Security Update: libvorbis: memory corruption while parsing ogg files ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0351-1 Rating: moderate References: #608192 Cross-References: CVE-2009-2663 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of libvorbis fixes a memory corruption while parsing OGG files. This bug was exploitable by remote attackers to cause an application crash and could probably be exploited to execute arbitrary code. CVE-2009-2663: CVSS v2 Base Score: 6.8 (important) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Resource Management Errors (CWE-399) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libvorbis-2492 - openSUSE 11.1: zypper in -t patch libvorbis-2492 - openSUSE 11.0: zypper in -t patch libvorbis-2492 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): libvorbis-1.2.0-83.3.1 - openSUSE 11.2 (i586 x86_64): libvorbis-devel-1.2.0-83.3.1 libvorbis-doc-1.2.0-83.3.1 - openSUSE 11.2 (x86_64): libvorbis-32bit-1.2.0-83.3.1 - openSUSE 11.1 (i586 ppc src x86_64): libvorbis-1.2.0-78.17.1 - openSUSE 11.1 (i586 ppc x86_64): libvorbis-devel-1.2.0-78.17.1 libvorbis-doc-1.2.0-78.17.1 - openSUSE 11.1 (x86_64): libvorbis-32bit-1.2.0-78.17.1 - openSUSE 11.1 (ppc): libvorbis-64bit-1.2.0-78.17.1 - openSUSE 11.0 (i586 ppc src x86_64): libvorbis-1.2.0-53.3 - openSUSE 11.0 (i586 ppc x86_64): libvorbis-devel-1.2.0-53.3 libvorbis-doc-1.2.0-53.3 - openSUSE 11.0 (x86_64): libvorbis-32bit-1.2.0-53.3 - openSUSE 11.0 (ppc): libvorbis-64bit-1.2.0-53.3 References: http://support.novell.com/security/cve/CVE-2009-2663.html https://bugzilla.novell.com/608192

1 0

openSUSE-SU-2010:0346-1 (important): samba: Fixed various security issues
by opensuse-security＠opensuse.org 29 Jun '10

29 Jun '10

openSUSE Security Update: samba: Fixed various security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0346-1 Rating: important References: #550002 #577868 #605935 #606947 #611927 Cross-References: CVE-2010-2063 Affected Products: openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. It includes two new package versions. Description: This update of the Samba server package fixes security issues and bugs. Following security issues were fixed: CVE-2010-2063: A buffer overrun was possible in chain_reply code in 3.3.x and below, which could be used to crash the samba server or potentially execute code. CVE-2010-0787: Take extra care that a mount point of mount.cifs isn't changed during mount. Also the following bugs were fixed: - Honor "interfaces" list in net ad dns register. (bnc#606947) - An uninitialized variable read could cause an smbd crash; (bso#7254); (bnc#605935). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch cifs-mount-2543 - openSUSE 11.0: zypper in -t patch cifs-mount-2543 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 3.2.7]: samba-3.2.7-11.7.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 3.2.7]: cifs-mount-3.2.7-11.7.1 ldapsmb-1.34b-6.7.1 libnetapi-devel-3.2.7-11.7.1 libnetapi0-3.2.7-11.7.1 libsmbclient-devel-3.2.7-11.7.1 libsmbclient0-3.2.7-11.7.1 libsmbsharemodes-devel-3.2.7-11.7.1 libsmbsharemodes0-3.2.7-11.7.1 libtalloc-devel-3.2.7-11.7.1 libtalloc1-3.2.7-11.7.1 libtdb-devel-3.2.7-11.7.1 libtdb1-3.2.7-11.7.1 libwbclient-devel-3.2.7-11.7.1 libwbclient0-3.2.7-11.7.1 samba-client-3.2.7-11.7.1 samba-devel-3.2.7-11.7.1 samba-krb-printing-3.2.7-11.7.1 samba-vscan-0.3.6b-6.7.1 samba-winbind-3.2.7-11.7.1 - openSUSE 11.1 (x86_64) [New Version: 3.2.7]: libsmbclient0-32bit-3.2.7-11.7.1 libtalloc1-32bit-3.2.7-11.7.1 libtdb1-32bit-3.2.7-11.7.1 libwbclient0-32bit-3.2.7-11.7.1 samba-32bit-3.2.7-11.7.1 samba-client-32bit-3.2.7-11.7.1 samba-winbind-32bit-3.2.7-11.7.1 - openSUSE 11.1 (ppc) [New Version: 3.2.7]: libsmbclient0-64bit-3.2.7-11.7.1 libtalloc1-64bit-3.2.7-11.7.1 libtdb1-64bit-3.2.7-11.7.1 libwbclient0-64bit-3.2.7-11.7.1 samba-64bit-3.2.7-11.7.1 samba-client-64bit-3.2.7-11.7.1 samba-winbind-64bit-3.2.7-11.7.1 - openSUSE 11.0 (i586 ppc src x86_64) [New Version: 3.2.4]: samba-3.2.4-4.12 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 3.2.4]: cifs-mount-3.2.4-4.12 ldapsmb-1.34b-195.17 libnetapi-devel-3.2.4-4.12 libnetapi0-3.2.4-4.12 libsmbclient-devel-3.2.4-4.12 libsmbclient0-3.2.4-4.12 libsmbsharemodes-devel-3.2.4-4.12 libsmbsharemodes0-3.2.4-4.12 libtalloc-devel-3.2.4-4.12 libtalloc1-3.2.4-4.12 libtdb-devel-3.2.4-4.12 libtdb1-3.2.4-4.12 libwbclient-devel-3.2.4-4.12 libwbclient0-3.2.4-4.12 samba-client-3.2.4-4.12 samba-devel-3.2.4-4.12 samba-krb-printing-3.2.4-4.12 samba-winbind-3.2.4-4.12 - openSUSE 11.0 (x86_64) [New Version: 3.2.4]: libsmbclient0-32bit-3.2.4-4.12 libtalloc1-32bit-3.2.4-4.12 libtdb1-32bit-3.2.4-4.12 libwbclient0-32bit-3.2.4-4.12 samba-32bit-3.2.4-4.12 samba-client-32bit-3.2.4-4.12 samba-winbind-32bit-3.2.4-4.12 - openSUSE 11.0 (ppc) [New Version: 3.2.4]: libsmbclient0-64bit-3.2.4-4.12 libtalloc1-64bit-3.2.4-4.12 libtdb1-64bit-3.2.4-4.12 libwbclient0-64bit-3.2.4-4.12 samba-64bit-3.2.4-4.12 samba-client-64bit-3.2.4-4.12 samba-winbind-64bit-3.2.4-4.12 References: http://support.novell.com/security/cve/CVE-2010-2063.html https://bugzilla.novell.com/550002 https://bugzilla.novell.com/577868 https://bugzilla.novell.com/605935 https://bugzilla.novell.com/606947 https://bugzilla.novell.com/611927

1 0

openSUSE-SU-2010:0342-1 (moderate): mono security update
by opensuse-security＠opensuse.org 29 Jun '10

29 Jun '10

openSUSE Security Update: mono security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0342-1 Rating: moderate References: #592428 Cross-References: CVE-2010-1459 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Mono's ASP.NET implementation did not set the 'EnableViewStateMac' property by default. Attackers could exploit that to conduct cross-site-scripting (XSS) attacks. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch bytefx-data-mysql-2384 - openSUSE 11.1: zypper in -t patch bytefx-data-mysql-2384 - openSUSE 11.0: zypper in -t patch bytefx-data-mysql-2384 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): mono-core-2.4.2.3-2.7.1 - openSUSE 11.2 (i586 x86_64): bytefx-data-mysql-2.4.2.3-2.7.1 ibm-data-db2-2.4.2.3-2.7.1 mono-complete-2.4.2.3-2.7.1 mono-data-2.4.2.3-2.7.1 mono-data-firebird-2.4.2.3-2.7.1 mono-data-oracle-2.4.2.3-2.7.1 mono-data-postgresql-2.4.2.3-2.7.1 mono-data-sqlite-2.4.2.3-2.7.1 mono-data-sybase-2.4.2.3-2.7.1 mono-devel-2.4.2.3-2.7.1 mono-extras-2.4.2.3-2.7.1 mono-jscript-2.4.2.3-2.7.1 mono-locale-extras-2.4.2.3-2.7.1 mono-nunit-2.4.2.3-2.7.1 mono-wcf-2.4.2.3-2.7.1 mono-web-2.4.2.3-2.7.1 mono-winforms-2.4.2.3-2.7.1 monodoc-core-2.4.2.3-2.7.1 - openSUSE 11.1 (i586 ppc src x86_64): mono-core-2.0.1-1.23.1 - openSUSE 11.1 (i586 ppc x86_64): bytefx-data-mysql-2.0.1-1.23.1 ibm-data-db2-2.0.1-1.23.1 mono-complete-2.0.1-1.23.1 mono-data-2.0.1-1.23.1 mono-data-firebird-2.0.1-1.23.1 mono-data-oracle-2.0.1-1.23.1 mono-data-postgresql-2.0.1-1.23.1 mono-data-sqlite-2.0.1-1.23.1 mono-data-sybase-2.0.1-1.23.1 mono-devel-2.0.1-1.23.1 mono-extras-2.0.1-1.23.1 mono-jscript-2.0.1-1.23.1 mono-locale-extras-2.0.1-1.23.1 mono-nunit-2.0.1-1.23.1 mono-web-2.0.1-1.23.1 mono-winforms-2.0.1-1.23.1 - openSUSE 11.1 (noarch src): monodoc-core-2.0-1.42.1 - openSUSE 11.1 (x86_64): mono-core-32bit-2.0.1-1.23.1 - openSUSE 11.0 (i586 ppc src x86_64): mono-core-1.9.1-6.8 - openSUSE 11.0 (i586 ppc x86_64): bytefx-data-mysql-1.9.1-6.8 ibm-data-db2-1.9.1-6.8 mono-complete-1.9.1-6.8 mono-data-1.9.1-6.8 mono-data-firebird-1.9.1-6.8 mono-data-oracle-1.9.1-6.8 mono-data-postgresql-1.9.1-6.8 mono-data-sqlite-1.9.1-6.8 mono-data-sybase-1.9.1-6.8 mono-devel-1.9.1-6.8 mono-extras-1.9.1-6.8 mono-jscript-1.9.1-6.8 mono-locale-extras-1.9.1-6.8 mono-nunit-1.9.1-6.8 mono-web-1.9.1-6.8 mono-winforms-1.9.1-6.8 - openSUSE 11.0 (noarch src): monodoc-core-1.9-18.1 - openSUSE 11.0 (x86_64): mono-core-32bit-1.9.1-6.8 References: http://support.novell.com/security/cve/CVE-2010-1459.html https://bugzilla.novell.com/592428

1 0

openSUSE-RU-2010:0341-1 (low): nagios-nrpe-client: Writes on installation to /etc/services without dependency of netcfg. Fixed by this update.
by maintenance＠opensuse.org 29 Jun '10

29 Jun '10

openSUSE Recommended Update: nagios-nrpe-client: Writes on installation to /etc/services without dependency of netcfg. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0341-1 Rating: low References: #608164 Affected Products: openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: nagios-nrpe-client writes to /etc/services without having an dependency on netcfg. As result the file /etc/services can sometimes be nearly empty if nagios-nrpe-client is installed before netcfg. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch nagios-nrpe-client-2582 - openSUSE 11.1: zypper in -t patch nagios-nrpe-client-2582 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): nagios-nrpe-client-2.12-4.6.1 - openSUSE 11.2 (src): nagios-nrpe-2.12-4.6.1 - openSUSE 11.1 (i586 ppc x86_64): nagios-nrpe-client-2.12-3.3.1 - openSUSE 11.1 (src): nagios-nrpe-2.12-3.3.1 References: https://bugzilla.novell.com/608164

1 0

openSUSE-SU-2010:0338-1 (important): aria2: Update to 1.9.3 to fix a metalink name Directory Traversal Vulnerability
by opensuse-security＠opensuse.org 24 Jun '10

24 Jun '10

openSUSE Security Update: aria2: Update to 1.9.3 to fix a metalink name Directory Traversal Vulnerability ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0338-1 Rating: important References: #605937 Cross-References: CVE-2010-1512 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This aria2 update to 1.9.3 fixes a metalink name Directory Traversal issue (CVE-2010-1512). The version was also bumped from 1.8.2 to 1.9.3 to fix lots of bugs. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch aria2-2515 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 1.9.3]: aria2-1.9.3-0.1.1 References: http://support.novell.com/security/cve/CVE-2010-1512.html https://bugzilla.novell.com/605937

1 0

openSUSE-RU-2010:0335-1 (moderate): NetworkManager-gnome: It crash when a profile is edit. Fixed by this update.
by maintenance＠opensuse.org 22 Jun '10

22 Jun '10

openSUSE Recommended Update: NetworkManager-gnome: It crash when a profile is edit. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0335-1 Rating: moderate References: #611630 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: A crash occurs if a profile is edit by the user. This bug is fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch NetworkManager-gnome-2516 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): NetworkManager-gnome-0.7.1-5.5.1 References: https://bugzilla.novell.com/611630

1 0

openSUSE-SU-2010:0334-1 (important): lftp: fixed a http client unexpected download filename vulnerability
by opensuse-security＠opensuse.org 21 Jun '10

21 Jun '10

openSUSE Security Update: lftp: fixed a http client unexpected download filename vulnerability ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0334-1 Rating: important References: #606319 Cross-References: CVE-2010-2251 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of lftp improves the filename handling of downloaded files to avoid downloading arbitrary content to unexpected locations (like .login). (CVE-2010-2251) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch lftp-2534 - openSUSE 11.1: zypper in -t patch lftp-2534 - openSUSE 11.0: zypper in -t patch lftp-2534 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): lftp-3.6.3-58.2.1 - openSUSE 11.1 (i586 ppc src x86_64): lftp-3.6.3-5.68.1 - openSUSE 11.0 (i586 ppc src x86_64): lftp-3.6.3-28.2 References: http://support.novell.com/security/cve/CVE-2010-2251.html https://bugzilla.novell.com/606319

1 0

openSUSE-RU-2010:0331-1 (low): unzip: Encoding of Cyrillic filenames in zip archive, created under Windows, is incorrect. Fixed by this update.
by maintenance＠opensuse.org 17 Jun '10

17 Jun '10

openSUSE Recommended Update: unzip: Encoding of Cyrillic filenames in zip archive, created under Windows, is incorrect. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0331-1 Rating: low References: #540598 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update adds the use of librcc0 to unzip. So from now unzip can correctly encode Cyrillic and Czech file names. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch librcc-devel-2496 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): librcc0-0.2.9-1.1.1 librcd0-0.1.13-1.1.1 unzip-5.52-143.5.1 - openSUSE 11.2 (i586 x86_64): librcc-devel-0.2.9-1.1.1 librcd-devel-0.1.13-1.1.1 rcc-runtime-0.2.9-1.1.1 References: https://bugzilla.novell.com/540598

1 0

openSUSE-RU-2010:0330-1 (moderate): viewvc: Fix exceptions on various cases
by maintenance＠opensuse.org 17 Jun '10

17 Jun '10

openSUSE Recommended Update: viewvc: Fix exceptions on various cases ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0330-1 Rating: moderate References: #612090 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes two new package versions. Description: This updates viewvc to version 1.1.6: * add rudimentary support for WSGI-based deployments * fix exception caused by trying to HTML-escape non-string data * fix incorrect RSS feed Content-Type header * fix RSS <title> encoding problem * allow 'svndbadmin purge' to work on missing repositories Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch viewvc-2523 - openSUSE 11.1: zypper in -t patch viewvc-2522 - openSUSE 11.0: zypper in -t patch viewvc-2522 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (noarch src) [New Version: 1.1.6]: viewvc-1.1.6-0.1.1 - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 1.0.12]: viewvc-1.0.12-0.1.1 - openSUSE 11.0 (i586 ppc src x86_64) [New Version: 1.0.12]: viewvc-1.0.12-0.1 References: https://bugzilla.novell.com/612090

1 0

openSUSE-SU-2010:0324-1 (important): libtiff: integer overflow can lead to corrupted heap
by opensuse-security＠opensuse.org 14 Jun '10

14 Jun '10

openSUSE Security Update: libtiff: integer overflow can lead to corrupted heap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0324-1 Rating: important References: #605837 Cross-References: CVE-2010-1411 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of libtiff fixes several integer overflows that could lead to a corrupted heap memory. This bug can be exploited remotely with a crafted TIFF file to cause an application crash or probably to execute arbitrary code. (CVE-2010-1411) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libtiff-devel-2477 - openSUSE 11.1: zypper in -t patch libtiff-devel-2477 - openSUSE 11.0: zypper in -t patch libtiff-devel-2477 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): tiff-3.8.2-145.4.1 - openSUSE 11.2 (i586 x86_64): libtiff-devel-3.8.2-145.4.1 libtiff3-3.8.2-145.4.1 - openSUSE 11.2 (x86_64): libtiff-devel-32bit-3.8.2-145.4.1 libtiff3-32bit-3.8.2-145.4.1 - openSUSE 11.1 (i586 ppc src x86_64): tiff-3.8.2-133.39.1 - openSUSE 11.1 (i586 ppc x86_64): libtiff-devel-3.8.2-133.39.1 libtiff3-3.8.2-133.39.1 - openSUSE 11.1 (x86_64): libtiff-devel-32bit-3.8.2-133.39.1 libtiff3-32bit-3.8.2-133.39.1 - openSUSE 11.1 (ppc): libtiff-devel-64bit-3.8.2-133.39.1 libtiff3-64bit-3.8.2-133.39.1 - openSUSE 11.0 (i586 ppc src x86_64): tiff-3.8.2-108.9 - openSUSE 11.0 (i586 ppc x86_64): libtiff-devel-3.8.2-108.9 libtiff3-3.8.2-108.9 - openSUSE 11.0 (x86_64): libtiff-devel-32bit-3.8.2-108.9 libtiff3-32bit-3.8.2-108.9 - openSUSE 11.0 (ppc): libtiff-devel-64bit-3.8.2-108.9 libtiff3-64bit-3.8.2-108.9 References: http://support.novell.com/security/cve/CVE-2010-1411.html https://bugzilla.novell.com/605837

1 0

openSUSE-SU-2010:0321-1 (important): flash-player: Fixed remote code execution
by opensuse-security＠opensuse.org 11 Jun '10

11 Jun '10

openSUSE Security Update: flash-player: Fixed remote code execution ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0321-1 Rating: important References: #612063 Cross-References: CVE-2008-4546 CVE-2009-3793 CVE-2010-1297 CVE-2010-2160 CVE-2010-2161 CVE-2010-2162 CVE-2010-2163 CVE-2010-2164 CVE-2010-2165 CVE-2010-2166 CVE-2010-2167 CVE-2010-2169 CVE-2010-2170 CVE-2010-2171 CVE-2010-2172 CVE-2010-2173 CVE-2010-2174 CVE-2010-2175 CVE-2010-2176 CVE-2010-2177 CVE-2010-2178 CVE-2010-2179 CVE-2010-2180 CVE-2010-2181 CVE-2010-2182 CVE-2010-2183 CVE-2010-2184 CVE-2010-2185 CVE-2010-2186 CVE-2010-2187 CVE-2010-2188 CVE-2010-2189 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes 32 vulnerabilities is now available. It includes one version update. Description: This Flash Player update fixes multiple critical security vulnerabilities which allow an attacker to remotely execute arbitrary code or to cause a denial of service. The following CVE numbers have been assigned: CVE-2008-4546, CVE-2009-3793, CVE-2010-1297, CVE-2010-2160, CVE-2010-2161, CVE-2010-2162, CVE-2010-2163, CVE-2010-2164, CVE-2010-2165, CVE-2010-2166, CVE-2010-2167, CVE-2010-2169, CVE-2010-2170, CVE-2010-2171, CVE-2010-2172, CVE-2010-2173, CVE-2010-2174, CVE-2010-2175, CVE-2010-2176, CVE-2010-2177, CVE-2010-2178, CVE-2010-2179, CVE-2010-2180, CVE-2010-2181, CVE-2010-2182, CVE-2010-2183, CVE-2010-2184, CVE-2010-2185, CVE-2010-2186, CVE-2010-2187, CVE-2010-2188, CVE-2010-2189 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch flash-player-2542 - openSUSE 11.1: zypper in -t patch flash-player-2542 - openSUSE 11.0: zypper in -t patch flash-player-2542 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src) [New Version: 10.1.53.64]: flash-player-10.1.53.64-1.1.1 - openSUSE 11.1 (i586 src) [New Version: 10.1.53.64]: flash-player-10.1.53.64-1.1.1 - openSUSE 11.0 (i586 src) [New Version: 10.1.53.64]: flash-player-10.1.53.64-1.1 References: http://support.novell.com/security/cve/CVE-2008-4546.html http://support.novell.com/security/cve/CVE-2009-3793.html http://support.novell.com/security/cve/CVE-2010-1297.html http://support.novell.com/security/cve/CVE-2010-2160.html http://support.novell.com/security/cve/CVE-2010-2161.html http://support.novell.com/security/cve/CVE-2010-2162.html http://support.novell.com/security/cve/CVE-2010-2163.html http://support.novell.com/security/cve/CVE-2010-2164.html http://support.novell.com/security/cve/CVE-2010-2165.html http://support.novell.com/security/cve/CVE-2010-2166.html http://support.novell.com/security/cve/CVE-2010-2167.html http://support.novell.com/security/cve/CVE-2010-2169.html http://support.novell.com/security/cve/CVE-2010-2170.html http://support.novell.com/security/cve/CVE-2010-2171.html http://support.novell.com/security/cve/CVE-2010-2172.html http://support.novell.com/security/cve/CVE-2010-2173.html http://support.novell.com/security/cve/CVE-2010-2174.html http://support.novell.com/security/cve/CVE-2010-2175.html http://support.novell.com/security/cve/CVE-2010-2176.html http://support.novell.com/security/cve/CVE-2010-2177.html http://support.novell.com/security/cve/CVE-2010-2178.html http://support.novell.com/security/cve/CVE-2010-2179.html http://support.novell.com/security/cve/CVE-2010-2180.html http://support.novell.com/security/cve/CVE-2010-2181.html http://support.novell.com/security/cve/CVE-2010-2182.html http://support.novell.com/security/cve/CVE-2010-2183.html http://support.novell.com/security/cve/CVE-2010-2184.html http://support.novell.com/security/cve/CVE-2010-2185.html http://support.novell.com/security/cve/CVE-2010-2186.html http://support.novell.com/security/cve/CVE-2010-2187.html http://support.novell.com/security/cve/CVE-2010-2188.html http://support.novell.com/security/cve/CVE-2010-2189.html https://bugzilla.novell.com/612063

1 0

openSUSE-RU-2010:0318-1 (low): graphviz: 'tred' from package graphviz is broken. Fixed by this update.
by maintenance＠opensuse.org 08 Jun '10

08 Jun '10

openSUSE Recommended Update: graphviz: 'tred' from package graphviz is broken. Fixed by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0318-1 Rating: low References: #590743 #609404 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: 'tred' of the package graphviz in 11.2 is broken and produces no sensible output. This update fixes it and also a minor issue in gvpr. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch graphviz-2512 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): graphviz-2.20.2-45.4.1 - openSUSE 11.2 (i586 x86_64): graphviz-devel-2.20.2-45.4.1 References: https://bugzilla.novell.com/590743 https://bugzilla.novell.com/609404

1 0

openSUSE-SU-2010:0306-1 (low): puppet security update
by opensuse-security＠opensuse.org 01 Jun '10

01 Jun '10

openSUSE Security Update: puppet security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0306-1 Rating: low References: #585402 Cross-References: CVE-2010-0156 Affected Products: openSUSE 11.2 openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: pupped created temporary files with fixed names. Local attacks could exploit that to install symlinks that overwrite files of the victim (CVE-2010-0156). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch puppet-2101 - openSUSE 11.1: zypper in -t patch puppet-2101 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): puppet-0.24.8-2.2.1 - openSUSE 11.2 (i586 x86_64): puppet-server-0.24.8-2.2.1 - openSUSE 11.1 (i586 ppc src x86_64): puppet-0.24.5-1.32.1 - openSUSE 11.1 (i586 ppc x86_64): puppet-server-0.24.5-1.32.1 References: http://support.novell.com/security/cve/CVE-2010-0156.html https://bugzilla.novell.com/585402

1 0

openSUSE-SU-2010:0303-1 (moderate): memcached DoS
by opensuse-security＠opensuse.org 27 May '10

27 May '10

openSUSE Security Update: memcached DoS ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0303-1 Rating: moderate References: #595117 Cross-References: CVE-2010-1152 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Remote attackers that are allowed to connect to memcached could crash memcached by sending invalid input (CVE-2010-1152). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch memcached-2271 - openSUSE 11.1: zypper in -t patch memcached-2271 - openSUSE 11.0: zypper in -t patch memcached-2271 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): memcached-1.2.8-2.2.1 - openSUSE 11.1 (i586 ppc src x86_64): memcached-1.2.6-5.8.1 - openSUSE 11.0 (i586 ppc src x86_64): memcached-1.2.2-49.4 References: http://support.novell.com/security/cve/CVE-2010-1152.html https://bugzilla.novell.com/595117

1 0

openSUSE-RU-2010:0299-1 (low): sysconfig: This update improves the handling of huge zebra routing tables
by maintenance＠opensuse.org 26 May '10

26 May '10

openSUSE Recommended Update: sysconfig: This update improves the handling of huge zebra routing tables ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0299-1 Rating: low References: #572205 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update addresses the following sysconfig issue: #572205: Added route proto filter to ifstatus-route to evaluate only routes that may have been set by ifup-route and skip routes added e.g. by zebra to not to waste CPU for huge zebra routing tables. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch sysconfig-2158 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): sysconfig-0.72.6-2.6.1 References: https://bugzilla.novell.com/572205

1 0

openSUSE-SU-2010:0293-1 (moderate): Xen: Collective bugfix update (2010/04)
by opensuse-security＠opensuse.org 25 May '10

25 May '10

openSUSE Security Update: Xen: Collective bugfix update (2010/04) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0293-1 Rating: moderate References: #481592 #529195 #537370 #541945 #542525 #545470 #547590 #548438 #548443 #548852 #550397 #553631 #553633 #555152 #561912 #564750 #572691 #573748 #576832 Cross-References: CVE-2009-3525 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that solves one vulnerability and has 18 fixes is now available. It includes one version update. Description: Collective Xen 2010/04 Update, containing fixes for the following issues: bnc#576832 - pygrub, reiserfs: Fix on-disk structure definition bnc#537370 - Xen on SLES 11 does not boot - endless loop in ATA detection bnc#561912 - xend leaks memory bnc#564750 - Keyboard Caps Lock key works abnormal under SLES11 xen guest OS. bnc#548443 - keymap setting not preserved bnc#555152 - "NAME" column in xentop (SLES11) output limited to 10 characters unlike SLES10 bnc#553631 - L3: diskpart will not run on windows 2008 bnc#548852 - DL585G2 - plug-in PCI cards fail in IO-APIC mode bnc#529195 - xend: disallow ! as a sxp separator bnc#550397 - xend: bootable flag of VBD not always of type int bnc#545470 - Xen vifname parameter is ignored when using type=ioemu in guest configuration file bnc#541945 - xm create -x command does not work in SLES 10 SP2 or SLES 11 bnc#542525 - VUL-1: xen pygrub vulnerability bnc#481592 and fate#306125 - Virtual machines are not able to boot from CD to allow upgrade to OES2SP1 (sle10 bug) bnc#553633 - Update breaks menu access keys in virt-viewer and still misses some key sequences. (sle10 bug) fate#306720: xen: virt-manager cdrom handling. bnc#547590 - L3: virt-manager is unable of displaying VNC console on remote hosts bnc#572691 - libvird segfaults when trying to create a kvm guest bnc#573748 - L3: Virsh gives error Device 51712 not connected after updating libvirt modules bnc#548438 - libcmpiutil / libvirt-cim does not properly handle CIM_ prefixed bnc#513921 - Xen doesn't work get an eror when starting the install processes or starting a pervious installed DomU bnc#526855 - Cannot set MAC address for PV guest in vm-install Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch xen-201004-2445 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc src x86_64): libcmpiutil-0.5-15.18.1 libvirt-0.4.6-11.16.26 libvirt-cim-0.5.2-4.22.92 - openSUSE 11.1 (i586 ppc x86_64): libcmpiutil-devel-0.5-15.18.1 libvirt-devel-0.4.6-11.16.26 libvirt-doc-0.4.6-11.16.26 libvirt-python-0.4.6-11.16.26 - openSUSE 11.1 (i586 src x86_64) [New Version: 0.3.27]: virt-manager-0.5.3-64.26.26 virt-viewer-0.0.3-3.30.27 vm-install-0.3.27-0.1.13 xen-3.3.1_18546_24-0.4.13 - openSUSE 11.1 (i586 x86_64): xen-devel-3.3.1_18546_24-0.4.13 xen-doc-html-3.3.1_18546_24-0.4.13 xen-doc-pdf-3.3.1_18546_24-0.4.13 xen-kmp-debug-3.3.1_18546_24_2.6.27.45_0.2-0.4.13 xen-kmp-default-3.3.1_18546_24_2.6.27.45_0.2-0.4.13 xen-kmp-trace-3.3.1_18546_24_2.6.27.45_0.2-0.4.13 xen-libs-3.3.1_18546_24-0.4.13 xen-tools-3.3.1_18546_24-0.4.13 xen-tools-domU-3.3.1_18546_24-0.4.13 - openSUSE 11.1 (x86_64): xen-libs-32bit-3.3.1_18546_24-0.4.13 - openSUSE 11.1 (i586): xen-kmp-pae-3.3.1_18546_24_2.6.27.45_0.2-0.4.13 References: http://support.novell.com/security/cve/CVE-2009-3525.html https://bugzilla.novell.com/481592 https://bugzilla.novell.com/529195 https://bugzilla.novell.com/537370 https://bugzilla.novell.com/541945 https://bugzilla.novell.com/542525 https://bugzilla.novell.com/545470 https://bugzilla.novell.com/547590 https://bugzilla.novell.com/548438 https://bugzilla.novell.com/548443 https://bugzilla.novell.com/548852 https://bugzilla.novell.com/550397 https://bugzilla.novell.com/553631 https://bugzilla.novell.com/553633 https://bugzilla.novell.com/555152 https://bugzilla.novell.com/561912 https://bugzilla.novell.com/564750 https://bugzilla.novell.com/572691 https://bugzilla.novell.com/573748 https://bugzilla.novell.com/576832

1 0

openSUSE-SU-2010:0292-1 (moderate): krb5: security update for remote denial-of-service vulnerability
by opensuse-security＠opensuse.org 25 May '10

25 May '10

openSUSE Security Update: krb5: security update for remote denial-of-service vulnerability ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0292-1 Rating: moderate References: #596826 Cross-References: CVE-2010-1321 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a denial-of-service vulnerability in kadmind. A remote attack can send a malformed GSS-API token that triggers a NULL pointer dereference. (CVE-2010-1321: CVSS v2 Base Score: 6.8 (MEDIUM) (AV:N/AC:L/Au:S/C:N/I:N/A:C)) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch krb5-2443 - openSUSE 11.1: zypper in -t patch krb5-2443 - openSUSE 11.0: zypper in -t patch krb5-2443 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): krb5-1.7-6.6.1 - openSUSE 11.2 (i586 x86_64): krb5-apps-clients-1.7-6.6.1 krb5-apps-servers-1.7-6.6.1 krb5-client-1.7-6.6.1 krb5-devel-1.7-6.6.1 krb5-plugin-kdb-ldap-1.7-6.6.1 krb5-plugin-preauth-pkinit-1.7-6.6.1 krb5-server-1.7-6.6.1 - openSUSE 11.2 (x86_64): krb5-32bit-1.7-6.6.1 krb5-devel-32bit-1.7-6.6.1 - openSUSE 11.1 (i586 ppc src x86_64): krb5-1.6.3-132.8.1 - openSUSE 11.1 (i586 ppc x86_64): krb5-apps-clients-1.6.3-132.8.1 krb5-apps-servers-1.6.3-132.8.1 krb5-client-1.6.3-132.8.1 krb5-devel-1.6.3-132.8.1 krb5-plugin-kdb-ldap-1.6.3-132.8.1 krb5-plugin-preauth-pkinit-1.6.3-132.8.1 krb5-server-1.6.3-132.8.1 - openSUSE 11.1 (x86_64): krb5-32bit-1.6.3-132.8.1 krb5-devel-32bit-1.6.3-132.8.1 - openSUSE 11.1 (src): krb5-plugins-1.6.3-132.8.1 - openSUSE 11.1 (ppc): krb5-64bit-1.6.3-132.8.1 krb5-devel-64bit-1.6.3-132.8.1 - openSUSE 11.0 (i586 ppc src x86_64): krb5-1.6.3-50.11 - openSUSE 11.0 (i586 ppc x86_64): krb5-apps-clients-1.6.3-50.11 krb5-apps-servers-1.6.3-50.11 krb5-client-1.6.3-50.11 krb5-devel-1.6.3-50.11 krb5-plugin-kdb-ldap-1.6.3-9.8 krb5-plugin-preauth-pkinit-1.6.3-9.8 krb5-server-1.6.3-50.11 - openSUSE 11.0 (x86_64): krb5-32bit-1.6.3-50.11 krb5-devel-32bit-1.6.3-50.11 - openSUSE 11.0 (src): krb5-plugins-1.6.3-9.8 - openSUSE 11.0 (ppc): krb5-64bit-1.6.3-50.11 krb5-devel-64bit-1.6.3-50.11 References: http://support.novell.com/security/cve/CVE-2010-1321.html https://bugzilla.novell.com/596826

1 0

openSUSE-RU-2010:0286-1 (low): valgrind: Collective fixes
by maintenance＠opensuse.org 25 May '10

25 May '10

openSUSE Recommended Update: valgrind: Collective fixes ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0286-1 Rating: low References: #558964 #559061 #599585 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update of valgrind contains the following fixes: - reenable support for register/unregister calls of JIT compilers (e.g. mono-core) - handle inotify_init (bnc#558964) - handle pthreaded apps better (bnc#599585) - prefer CFI for stack unwinding (bnc#559061) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch valgrind-2431 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): valgrind-3.5.0-2.2.1 - openSUSE 11.2 (i586 x86_64): valgrind-devel-3.5.0-2.2.1 References: https://bugzilla.novell.com/558964 https://bugzilla.novell.com/559061 https://bugzilla.novell.com/599585

1 0

openSUSE-RU-2010:0285-1 (low): util-linux: This update fixes an error if "mount -a" is used.
by maintenance＠opensuse.org 25 May '10

25 May '10

openSUSE Recommended Update: util-linux: This update fixes an error if "mount -a" is used. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0285-1 Rating: low References: #509082 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: mount -a silently fails on /proc with nonzero return value, might break scripts. This is fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch util-linux-2421 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc src x86_64): util-linux-2.14.1-10.3.1 - openSUSE 11.1 (i586 ppc x86_64): util-linux-lang-2.14.1-10.3.1 References: https://bugzilla.novell.com/509082

1 0

openSUSE-RU-2010:0284-1 (low): fail2ban: This update fixes the init script which can't restart the service
by maintenance＠opensuse.org 25 May '10

25 May '10

openSUSE Recommended Update: fail2ban: This update fixes the init script which can't restart the service ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0284-1 Rating: low References: #606238 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: This update of fail2ban fixes the following bug: - fail2ban's init script fails to restart the service (bnc#606238) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch fail2ban-2432 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 0.8.4]: fail2ban-0.8.4-1.2.1 References: https://bugzilla.novell.com/606238

1 0

openSUSE-RU-2010:0282-1 (low): tree: Fixed 2GB size and larger files display
by maintenance＠opensuse.org 25 May '10

25 May '10

openSUSE Recommended Update: tree: Fixed 2GB size and larger files display ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0282-1 Rating: low References: #601779 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The following bug was fixed in the tree file browser: - bnc#601779: 32bit 'tree' doesn't show files 2GB and larger Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch tree-2428 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): tree-1.5.2.2-2.2.1 References: https://bugzilla.novell.com/601779

1 0

openSUSE-RU-2010:0278-1 (low): libgnomesu: Translation is fixed when gnome prompts root password.
by maintenance＠opensuse.org 20 May '10

20 May '10

openSUSE Recommended Update: libgnomesu: Translation is fixed when gnome prompts root password. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0278-1 Rating: low References: #477638 #562162 #582085 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update fixes two issues: - #562162: wrong label shown for details when gnome prompts root password in Italian language - Some texts were not translatable. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libgnomesu-2425 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): libgnomesu-1.0.0-314.6.1 - openSUSE 11.2 (i586 x86_64): libgnomesu-devel-1.0.0-314.6.1 libgnomesu0-1.0.0-314.6.1 - openSUSE 11.2 (noarch): libgnomesu-lang-1.0.0-314.6.1 References: https://bugzilla.novell.com/477638 https://bugzilla.novell.com/562162 https://bugzilla.novell.com/582085

1 0

openSUSE-SU-2010:0273-1 (important): seamonkey: 1.1.19 security update
by opensuse-security＠opensuse.org 19 May '10

19 May '10

openSUSE Security Update: seamonkey: 1.1.19 security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0273-1 Rating: important References: #590499 Cross-References: CVE-2009-0689 CVE-2009-2463 CVE-2009-3072 CVE-2009-3075 CVE-2009-3077 CVE-2009-3376 CVE-2009-3385 CVE-2009-3983 CVE-2010-0161 CVE-2010-0163 Affected Products: openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. It includes one version update. Description: This update brings Mozilla Seamonkey to 1.1.19 fixing various bugs and security issues. Following security issues are fixed: MFSA 2010-07: Mozilla developers took fixes from previously fixed memory safety bugs in newer Mozilla-based products and ported them to the Mozilla 1.8.1 branch so they can be utilized by Thunderbird 2 and SeaMonkey 1.1. Paul Fisher reported a crash when joined to an Active Directory server under Vista or Windows 7 and using SSPI authentication. (CVE-2010-0161) Ludovic Hirlimann reported a crash indexing some messages with attachments (CVE-2010-0163) Carsten Book reported a crash in the JavaScript engine (CVE-2009-3075) Josh Soref reported a crash in the BinHex decoder used on non-Mac platforms. (CVE-2009-3072) monarch2000 reported an integer overflow in a base64 decoding function (CVE-2009-2463) MFSA 2009-68 / CVE-2009-3983: Security researcher Takehiro Takahashi of the IBM X-Force reported that Mozilla's NTLM implementation was vulnerable to reflection attacks in which NTLM credentials from one application could be forwarded to another arbitary application via the browser. If an attacker could get a user to visit a web page he controlled he could force NTLM authenticated requests to be forwarded to another application on behalf of the user. MFSA 2009-62 / CVE-2009-3376: Mozilla security researchers Jesse Ruderman and Sid Stamm reported that when downloading a file containing a right-to-left override character (RTL) in the filename, the name displayed in the dialog title bar conflicts with the name of the file shown in the dialog body. An attacker could use this vulnerability to obfuscate the name and file extension of a file to be downloaded and opened, potentially causing a user to run an executable file when they expected to open a non-executable file. MFSA 2009-59 / CVE-2009-0689: Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number conversion routines. Using this vulnerability an attacker could craft some malicious JavaScript code containing a very long string to be converted to a floating point number which would result in improper memory allocation and the execution of an arbitrary memory location. This vulnerability could thus be leveraged by the attacker to run arbitrary code on a victim's computer. Update: The underlying flaw in the dtoa routines used by Mozilla appears to be essentially the same as that reported against the libc gdtoa routine by Maksymilian Arciemowicz. MFSA 2010-06 / CVE-2009-3385: Security researcher Georgi Guninski reported that scriptable plugin content, such as Flash objects, could be loaded and executed in SeaMonkey mail messages by embedding the content in an iframe inside the message. If a user were to reply to or forward such a message, malicious JavaScript embedded in the plugin content could potentially steal the contents of the message or files from the local filesystem. MFSA 2009-49 / CVE-2009-3077: An anonymous security researcher, via TippingPoint's Zero Day Initiative, reported that the columns of a XUL tree element could be manipulated in a particular way which would leave a pointer owned by the column pointing to freed memory. An attacker could potentially use this vulnerability to crash a victim's browser and run arbitrary code on the victim's computer. Please see http://www.mozilla.org/security/known-vulnerabilities/seamon key11.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch seamonkey-2388 - openSUSE 11.0: zypper in -t patch seamonkey-2388 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 1.1.19]: seamonkey-1.1.19-0.1.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 1.1.19]: seamonkey-dom-inspector-1.1.19-0.1.1 seamonkey-irc-1.1.19-0.1.1 seamonkey-mail-1.1.19-0.1.1 seamonkey-spellchecker-1.1.19-0.1.1 seamonkey-venkman-1.1.19-0.1.1 - openSUSE 11.0 (i586 ppc src x86_64) [New Version: 1.1.19]: seamonkey-1.1.19-0.1 - openSUSE 11.0 (i586 ppc x86_64) [New Version: 1.1.19]: seamonkey-dom-inspector-1.1.19-0.1 seamonkey-irc-1.1.19-0.1 seamonkey-mail-1.1.19-0.1 seamonkey-spellchecker-1.1.19-0.1 seamonkey-venkman-1.1.19-0.1 References: http://support.novell.com/security/cve/CVE-2009-0689.html http://support.novell.com/security/cve/CVE-2009-2463.html http://support.novell.com/security/cve/CVE-2009-3072.html http://support.novell.com/security/cve/CVE-2009-3075.html http://support.novell.com/security/cve/CVE-2009-3077.html http://support.novell.com/security/cve/CVE-2009-3376.html http://support.novell.com/security/cve/CVE-2009-3385.html http://support.novell.com/security/cve/CVE-2009-3983.html http://support.novell.com/security/cve/CVE-2010-0161.html http://support.novell.com/security/cve/CVE-2010-0163.html https://bugzilla.novell.com/590499

1 0

openSUSE-SU-2010:0264-1 (low): ncpfs: Fixed several security issues
by opensuse-security＠opensuse.org 18 May '10

18 May '10

openSUSE Security Update: ncpfs: Fixed several security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0264-1 Rating: low References: #550004 #583536 Cross-References: CVE-2010-0788 CVE-2010-0790 CVE-2010-0791 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update fixes three security issues in ncpfs: Fixed a information leakage on mount (CVE-2010-0790 / bnc#583536) Fixed a mtab locking problem (CVE-2010-0791 / bnc#583536) Fixed a race condition in ncpfs mounts (CVE-2010-0788 / bnc#550004) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch ncpfs-2395 - openSUSE 11.1: zypper in -t patch ncpfs-2395 - openSUSE 11.0: zypper in -t patch ncpfs-2395 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): ncpfs-2.2.6-158.5.1 - openSUSE 11.2 (i586 x86_64): ncpfs-devel-2.2.6-158.5.1 - openSUSE 11.2 (x86_64): ncpfs-32bit-2.2.6-158.5.1 - openSUSE 11.1 (i586 ppc src x86_64): ncpfs-2.2.6-147.34.1 - openSUSE 11.1 (i586 ppc x86_64): ncpfs-devel-2.2.6-147.34.1 - openSUSE 11.1 (x86_64): ncpfs-32bit-2.2.6-147.34.1 - openSUSE 11.1 (ppc): ncpfs-64bit-2.2.6-147.34.1 - openSUSE 11.0 (i586 ppc src x86_64): ncpfs-2.2.6-132.4 - openSUSE 11.0 (i586 ppc x86_64): ncpfs-devel-2.2.6-132.4 - openSUSE 11.0 (x86_64): ncpfs-32bit-2.2.6-132.4 - openSUSE 11.0 (ppc): ncpfs-64bit-2.2.6-132.4 References: http://support.novell.com/security/cve/CVE-2010-0788.html http://support.novell.com/security/cve/CVE-2010-0790.html http://support.novell.com/security/cve/CVE-2010-0791.html https://bugzilla.novell.com/550004 https://bugzilla.novell.com/583536

1 0

openSUSE-YU-2010:0259-1 (low): libzypp: Collective update for openSUSE 11.1.
by maintenance＠opensuse.org 17 May '10

17 May '10

openSUSE YOU Update: libzypp: Collective update for openSUSE 11.1. ______________________________________________________________________________ Announcement ID: openSUSE-YU-2010:0259-1 Rating: low References: #552265 #553712 #553895 #558813 #564239 #565050 #565525 #566291 #570623 #572634 #573897 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that has 11 YOU fixes can now be installed. It includes three new package versions. Description: The following bugs are fixed with this update: - support sha256 checksum for repomd and susetags - set repository:toolversion to 1.0 in common_write - disable update rule in noobsoletes case if installed package is to be kept [bnc#564239] - work around rpm bug when --prefix is used [bnc#565525] - add support for sparc architecture [bnc#566291] - Support optionally compressed product(s).xml in rpmmd metadata. - Turn off cookies when retrieving services repoindex.xml (bnc #573897) - Consider pending disable requests when removing service repositories. (bnc #572634) - Remember the enabled state of removed service repositories. This way we are able to restore service repositories correctly after a subscrition expired and gets renewed. (bnc #572634) - Evaluate SolvAttr::repositoryToolVersion to prevent loading outdated solv files. (bnc #570623) - Also parse <product> tag from .prod files <upgrade> section. - Fix chroot execution of update scripts. (bnc #558813) - Fix repository probing and building in presence of productdir. (bnc #553712) - Following https redirections requires the libcurl4 update providing CURLOPT_REDIR_PROTOCOLS to be installed. (bnc #553895) - Fix outdated python examples. - Show patch conflicts instead of requires to provide a hint about patch contents (bnc #565050) - Fix typo in man page. (bnc #552265) Special Instructions and Notes: This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. Patch Instructions: To install this openSUSE YOU Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch updatestack_04_10-2279 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 1.0.14 and 5.30.24]: libzypp-5.30.24-0.1.1 zypper-1.0.14-0.1.2 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 0.13.13 and 5.30.24]: libsatsolver-devel-0.13.13-0.1.1 libzypp-devel-5.30.24-0.1.1 perl-satsolver-0.13.13-0.1.1 perl-zypp-0.4.8-2.1.51 python-satsolver-0.13.13-0.1.1 python-zypp-0.4.8-2.1.51 ruby-satsolver-0.13.13-0.1.1 ruby-zypp-0.4.8-2.1.51 satsolver-tools-0.13.13-0.1.1 - openSUSE 11.1 (src) [New Version: 0.13.13]: libsatsolver-0.13.13-0.1.1 libzypp-bindings-0.4.8-2.1.51 References: https://bugzilla.novell.com/552265 https://bugzilla.novell.com/553712 https://bugzilla.novell.com/553895 https://bugzilla.novell.com/558813 https://bugzilla.novell.com/564239 https://bugzilla.novell.com/565050 https://bugzilla.novell.com/565525 https://bugzilla.novell.com/566291 https://bugzilla.novell.com/570623 https://bugzilla.novell.com/572634 https://bugzilla.novell.com/573897

1 0

openSUSE-SU-2010:0255-2 (low): php5 security update.
by opensuse-security＠opensuse.org 17 May '10

17 May '10

openSUSE Security Update: php5 security update. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0255-2 Rating: low References: #588975 Cross-References: CVE-2010-0397 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Incomplete XML RPC requests could crash the php interpreter (CVE-2010-0397). PHP was updated to version 5.2.12 to fix the problem. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch apache2-mod_php5-2410 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc src x86_64) [New Version: 5.2.13]: php5-5.2.13-0.1.1 - openSUSE 11.1 (i586 ppc x86_64) [New Version: 5.2.13]: apache2-mod_php5-5.2.13-0.1.1 php5-bcmath-5.2.13-0.1.1 php5-bz2-5.2.13-0.1.1 php5-calendar-5.2.13-0.1.1 php5-ctype-5.2.13-0.1.1 php5-curl-5.2.13-0.1.1 php5-dba-5.2.13-0.1.1 php5-dbase-5.2.13-0.1.1 php5-devel-5.2.13-0.1.1 php5-dom-5.2.13-0.1.1 php5-exif-5.2.13-0.1.1 php5-fastcgi-5.2.13-0.1.1 php5-ftp-5.2.13-0.1.1 php5-gd-5.2.13-0.1.1 php5-gettext-5.2.13-0.1.1 php5-gmp-5.2.13-0.1.1 php5-hash-5.2.13-0.1.1 php5-iconv-5.2.13-0.1.1 php5-imap-5.2.13-0.1.1 php5-json-5.2.13-0.1.1 php5-ldap-5.2.13-0.1.1 php5-mbstring-5.2.13-0.1.1 php5-mcrypt-5.2.13-0.1.1 php5-mysql-5.2.13-0.1.1 php5-ncurses-5.2.13-0.1.1 php5-odbc-5.2.13-0.1.1 php5-openssl-5.2.13-0.1.1 php5-pcntl-5.2.13-0.1.1 php5-pdo-5.2.13-0.1.1 php5-pear-5.2.13-0.1.1 php5-pgsql-5.2.13-0.1.1 php5-posix-5.2.13-0.1.1 php5-pspell-5.2.13-0.1.1 php5-readline-5.2.13-0.1.1 php5-shmop-5.2.13-0.1.1 php5-snmp-5.2.13-0.1.1 php5-soap-5.2.13-0.1.1 php5-sockets-5.2.13-0.1.1 php5-sqlite-5.2.13-0.1.1 php5-suhosin-5.2.13-0.1.1 php5-sysvmsg-5.2.13-0.1.1 php5-sysvsem-5.2.13-0.1.1 php5-sysvshm-5.2.13-0.1.1 php5-tidy-5.2.13-0.1.1 php5-tokenizer-5.2.13-0.1.1 php5-wddx-5.2.13-0.1.1 php5-xmlreader-5.2.13-0.1.1 php5-xmlrpc-5.2.13-0.1.1 php5-xmlwriter-5.2.13-0.1.1 php5-xsl-5.2.13-0.1.1 php5-zip-5.2.13-0.1.1 php5-zlib-5.2.13-0.1.1 References: http://support.novell.com/security/cve/CVE-2010-0397.html https://bugzilla.novell.com/588975

1 0

openSUSE-SU-2010:0257-1 (low): libpng: fixed denial of service while decompressing a highly compressed huge ancillary chunk (CVE-2010-0205)
by opensuse-security＠opensuse.org 17 May '10

17 May '10

openSUSE Security Update: libpng: fixed denial of service while decompressing a highly compressed huge ancillary chunk (CVE-2010-0205) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0257-1 Rating: low References: #580484 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Denial of service while decompressing a highly compressed huge ancillary chunk has been fixed in libpng. CVE-2010-0205 has been assigned. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libpng-devel-2159 - openSUSE 11.1: zypper in -t patch libpng-devel-2159 - openSUSE 11.0: zypper in -t patch libpng-devel-2159 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): libpng12-0-1.2.39-2.3.1 - openSUSE 11.2 (i586 x86_64): libpng-devel-1.2.39-2.3.1 libpng3-1.2.39-2.3.1 - openSUSE 11.2 (x86_64): libpng-devel-32bit-1.2.39-2.3.1 libpng12-0-32bit-1.2.39-2.3.1 - openSUSE 11.1 (i586 ppc src x86_64): libpng12-0-1.2.31-4.39.1 - openSUSE 11.1 (i586 ppc x86_64): libpng-devel-1.2.31-4.39.1 libpng3-1.2.31-4.39.1 - openSUSE 11.1 (x86_64): libpng-devel-32bit-1.2.31-4.39.1 libpng12-0-32bit-1.2.31-4.39.1 - openSUSE 11.1 (ppc): libpng-devel-64bit-1.2.31-4.39.1 libpng12-0-64bit-1.2.31-4.39.1 - openSUSE 11.0 (i586 ppc src x86_64): libpng12-0-1.2.26-14.12 - openSUSE 11.0 (i586 ppc x86_64): libpng-devel-1.2.26-14.12 libpng3-1.2.26-14.12 - openSUSE 11.0 (x86_64): libpng-devel-32bit-1.2.26-14.12 libpng12-0-32bit-1.2.26-14.12 - openSUSE 11.0 (ppc): libpng-devel-64bit-1.2.26-14.12 libpng12-0-64bit-1.2.26-14.12 References: https://bugzilla.novell.com/580484

1 0

openSUSE-SU-2010:0255-1 (low): php5 security update
by opensuse-security＠opensuse.org 17 May '10

17 May '10

openSUSE Security Update: php5 security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0255-1 Rating: low References: #588975 Cross-References: CVE-2010-0397 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Incomplete XML RPC requests could crash the php interpreter (CVE-2010-0397). PHP was updated to version 5.3.2 to fix the problem. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch apache2-mod_php5-2409 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 5.3.2]: php5-5.3.2-1.1.1 - openSUSE 11.2 (i586 x86_64) [New Version: 5.3.2]: apache2-mod_php5-5.3.2-1.1.1 php5-bcmath-5.3.2-1.1.1 php5-bz2-5.3.2-1.1.1 php5-calendar-5.3.2-1.1.1 php5-ctype-5.3.2-1.1.1 php5-curl-5.3.2-1.1.1 php5-dba-5.3.2-1.1.1 php5-devel-5.3.2-1.1.1 php5-dom-5.3.2-1.1.1 php5-enchant-5.3.2-1.1.1 php5-exif-5.3.2-1.1.1 php5-fastcgi-5.3.2-1.1.1 php5-fileinfo-5.3.2-1.1.1 php5-ftp-5.3.2-1.1.1 php5-gd-5.3.2-1.1.1 php5-gettext-5.3.2-1.1.1 php5-gmp-5.3.2-1.1.1 php5-hash-5.3.2-1.1.1 php5-iconv-5.3.2-1.1.1 php5-imap-5.3.2-1.1.1 php5-intl-5.3.2-1.1.1 php5-json-5.3.2-1.1.1 php5-ldap-5.3.2-1.1.1 php5-mbstring-5.3.2-1.1.1 php5-mcrypt-5.3.2-1.1.1 php5-mysql-5.3.2-1.1.1 php5-odbc-5.3.2-1.1.1 php5-openssl-5.3.2-1.1.1 php5-pcntl-5.3.2-1.1.1 php5-pdo-5.3.2-1.1.1 php5-pgsql-5.3.2-1.1.1 php5-phar-5.3.2-1.1.1 php5-posix-5.3.2-1.1.1 php5-pspell-5.3.2-1.1.1 php5-readline-5.3.2-1.1.1 php5-shmop-5.3.2-1.1.1 php5-snmp-5.3.2-1.1.1 php5-soap-5.3.2-1.1.1 php5-sockets-5.3.2-1.1.1 php5-sqlite-5.3.2-1.1.1 php5-suhosin-5.3.2-1.1.1 php5-sysvmsg-5.3.2-1.1.1 php5-sysvsem-5.3.2-1.1.1 php5-sysvshm-5.3.2-1.1.1 php5-tidy-5.3.2-1.1.1 php5-tokenizer-5.3.2-1.1.1 php5-wddx-5.3.2-1.1.1 php5-xmlreader-5.3.2-1.1.1 php5-xmlrpc-5.3.2-1.1.1 php5-xmlwriter-5.3.2-1.1.1 php5-xsl-5.3.2-1.1.1 php5-zip-5.3.2-1.1.1 php5-zlib-5.3.2-1.1.1 - openSUSE 11.2 (noarch) [New Version: 5.3.2]: php5-pear-5.3.2-1.1.1 References: http://support.novell.com/security/cve/CVE-2010-0397.html https://bugzilla.novell.com/588975

1 0

openSUSE-SU-2010:0251-1 (low): texlive security update
by opensuse-security＠opensuse.org 14 May '10

14 May '10

openSUSE Security Update: texlive security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0251-1 Rating: low References: #587794 Cross-References: CVE-2010-0739 CVE-2010-0827 CVE-2010-0829 CVE-2010-1440 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Specially crafted dvi files could cause buffer overflows in dvips and dvipng (CVE-2010-0827, CVE-2010-0829, CVE-2010-0739, CVE-2010-1440). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch texlive-2392 - openSUSE 11.1: zypper in -t patch texlive-2392 - openSUSE 11.0: zypper in -t patch texlive-2392 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 x86_64): texlive-bin-2008-13.18.1 - openSUSE 11.2 (noarch src): texlive-2008-13.18.1 - openSUSE 11.2 (noarch): texlive-arab-2008-13.18.1 texlive-cjk-2008-13.18.1 texlive-context-2008-13.18.1 texlive-devel-2008-13.18.1 texlive-doc-2008-13.18.1 texlive-dvilj-2008-13.18.1 texlive-jadetex-2008-13.18.1 texlive-latex-2008-13.18.1 texlive-latex-doc-2008-13.18.1 texlive-metapost-2008-13.18.1 texlive-musictex-2008-13.18.1 texlive-nfs-2008-13.18.1 texlive-omega-2008-13.18.1 texlive-ppower4-2008-13.18.1 texlive-tex4ht-2008-13.18.1 texlive-tools-2008-13.18.1 texlive-xetex-2008-13.18.1 texlive-xmltex-2008-13.18.1 - openSUSE 11.1 (i586 ppc x86_64): texlive-bin-2007-219.7.1 - openSUSE 11.1 (noarch src): texlive-2007-219.7.1 - openSUSE 11.1 (noarch): texlive-arab-2007-219.7.1 texlive-cjk-2007-219.7.1 texlive-context-2007-219.7.1 texlive-devel-2007-219.7.1 texlive-doc-2007-219.7.1 texlive-dvilj-2007-219.7.1 texlive-jadetex-2007-219.7.1 texlive-latex-2007-219.7.1 texlive-latex-doc-2007-219.7.1 texlive-metapost-2007-219.7.1 texlive-musictex-2007-219.7.1 texlive-nfs-2007-219.7.1 texlive-omega-2007-219.7.1 texlive-ppower4-2007-219.7.1 texlive-tex4ht-2007-219.7.1 texlive-tools-2007-219.7.1 texlive-xetex-2007-219.7.1 texlive-xmltex-2007-219.7.1 - openSUSE 11.0 (i586 ppc x86_64): texlive-bin-2007-176.4 - openSUSE 11.0 (noarch src): texlive-2007-177.4 - openSUSE 11.0 (noarch): texlive-arab-2007-177.4 texlive-cjk-2007-177.4 texlive-context-2007-177.4 texlive-devel-2007-177.4 texlive-doc-2007-177.4 texlive-dvilj-2007-177.4 texlive-jadetex-2007-177.4 texlive-latex-2007-177.4 texlive-latex-doc-2007-177.4 texlive-metapost-2007-177.4 texlive-musictex-2007-177.4 texlive-nfs-2007-177.4 texlive-omega-2007-177.4 texlive-ppower4-2007-177.4 texlive-tex4ht-2007-177.4 texlive-tools-2007-177.4 texlive-xetex-2007-177.4 texlive-xmltex-2007-177.4 References: http://support.novell.com/security/cve/CVE-2010-0739.html http://support.novell.com/security/cve/CVE-2010-0827.html http://support.novell.com/security/cve/CVE-2010-0829.html http://support.novell.com/security/cve/CVE-2010-1440.html https://bugzilla.novell.com/587794

1 0

openSUSE-SU-2010:0247-1 (moderate): python: denial of service by proessing malformed XML ("Expat vulnerability")
by opensuse-security＠opensuse.org 14 May '10

14 May '10

openSUSE Security Update: python: denial of service by proessing malformed XML ("Expat vulnerability") ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0247-1 Rating: moderate References: #581765 Cross-References: CVE-2009-2625 CVE-2009-3560 CVE-2009-3720 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update of python has a copy of libxmlrpc that is vulnerable to denial of service bugs that can occur while processing malformed XML input. CVE-2009-2625: CVSS v2 Base Score: 5.0 (moderate) (AV:N/AC:L/Au:N/C:N/I:N/A:P): Permissions, Privileges, and Access Control (CWE-264) CVE-2009-3720: CVSS v2 Base Score: 5.0 (MEDIUM) (AV:N/AC:L/Au:N/C:N/I:N/A:P): Insufficient Information (CWE-noinfo) CVE-2009-3560: CVSS v2 Base Score: 5.0 (MEDIUM) (AV:N/AC:L/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libpython2_6-1_0-2213 - openSUSE 11.1: zypper in -t patch libpython2_6-1_0-2213 - openSUSE 11.0: zypper in -t patch libpython2_6-1_0-2213 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): python-2.6.2-6.4.1 python-base-2.6.2-6.4.1 - openSUSE 11.2 (i586 x86_64): libpython2_6-1_0-2.6.2-6.4.1 python-curses-2.6.2-6.4.1 python-demo-2.6.2-6.4.1 python-devel-2.6.2-6.4.1 python-gdbm-2.6.2-6.4.1 python-idle-2.6.2-6.4.1 python-tk-2.6.2-6.4.1 python-xml-2.6.2-6.4.1 - openSUSE 11.2 (x86_64): libpython2_6-1_0-32bit-2.6.2-6.4.1 python-32bit-2.6.2-6.4.1 python-base-32bit-2.6.2-6.4.1 - openSUSE 11.1 (i586 ppc src x86_64): python-2.6.0-2.23.1 python-base-2.6.0-2.22.23.1 - openSUSE 11.1 (i586 ppc x86_64): libpython2_6-1_0-2.6.0-2.22.23.1 python-curses-2.6.0-2.23.1 python-demo-2.6.0-2.23.1 python-devel-2.6.0-2.22.23.1 python-gdbm-2.6.0-2.23.1 python-idle-2.6.0-2.23.1 python-tk-2.6.0-2.23.1 python-xml-2.6.0-2.22.23.1 - openSUSE 11.1 (x86_64): libpython2_6-1_0-32bit-2.6.0-2.22.23.1 python-32bit-2.6.0-2.23.1 python-base-32bit-2.6.0-2.22.23.1 - openSUSE 11.1 (ppc): libpython2_6-1_0-64bit-2.6.0-2.22.23.1 python-64bit-2.6.0-2.23.1 python-base-64bit-2.6.0-2.22.23.1 - openSUSE 11.0 (i586 ppc src x86_64): python-2.5.2-26.6 - openSUSE 11.0 (i586 ppc x86_64): python-curses-2.5.2-26.6 python-demo-2.5.2-26.6 python-devel-2.5.2-26.6 python-gdbm-2.5.2-26.6 python-idle-2.5.2-26.6 python-tk-2.5.2-26.6 python-xml-2.5.2-26.6 - openSUSE 11.0 (x86_64): python-32bit-2.5.2-26.6 - openSUSE 11.0 (ppc): python-64bit-2.5.2-26.6 References: http://support.novell.com/security/cve/CVE-2009-2625.html http://support.novell.com/security/cve/CVE-2009-3560.html http://support.novell.com/security/cve/CVE-2009-3720.html https://bugzilla.novell.com/581765

1 0

openSUSE-RU-2010:0244-1 (low): fail2ban: A communication error caused by python version incompatibility is fixed with this update.
by maintenance＠opensuse.org 11 May '10

11 May '10

openSUSE Recommended Update: fail2ban: A communication error caused by python version incompatibility is fixed with this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0244-1 Rating: low References: #537239 #600076 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. It includes one version update. Description: This update of fail2ban fixes the following bugs: - socket file preventing startup if fail2ban crashed earlier (bnc#537239) - fail2ban.server: ERROR Unexpected communication error (bnc#600076) - adds a new "ban"-command Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch fail2ban-2394 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 0.8.4]: fail2ban-0.8.4-1.1.1 References: https://bugzilla.novell.com/537239 https://bugzilla.novell.com/600076

1 0

openSUSE-RU-2010:0232-1 (low): open-vm-tools: The file "/etc/modprobe.d/vmnics" is missing in open-vm-tools. It is added by this update.
by maintenance＠opensuse.org 06 May '10

06 May '10

openSUSE Recommended Update: open-vm-tools: The file "/etc/modprobe.d/vmnics" is missing in open-vm-tools. It is added by this update. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0232-1 Rating: low References: #590329 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The file "/etc/modprobe.d/vmnics" is missing in open-vm-tools. It is added by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libvmtools-devel-2382 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): open-vm-tools-2009.07.22-2.5.2 - openSUSE 11.2 (i586 x86_64): libvmtools-devel-2009.07.22-2.5.2 libvmtools0-2009.07.22-2.5.2 open-vm-tools-gui-2009.07.22-2.5.2 vmware-guest-kmp-debug-2009.07.22_2.6.31.12_0.2-2.5.2 vmware-guest-kmp-default-2009.07.22_2.6.31.12_0.2-2.5.2 vmware-guest-kmp-desktop-2009.07.22_2.6.31.12_0.2-2.5.2 - openSUSE 11.2 (i586): vmware-guest-kmp-pae-2009.07.22_2.6.31.12_0.2-2.5.2 References: https://bugzilla.novell.com/590329

1 0

openSUSE-RU-2010:0231-1 (critical): suse-build-key: extend key lifetimes.
by maintenance＠opensuse.org 06 May '10

06 May '10

openSUSE Recommended Update: suse-build-key: extend key lifetimes. ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0231-1 Rating: critical References: #600157 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update extends life time of our default included keys for 4 more years. Updated keys: - 307E3D54 build(a)suse.de "SuSE Package Signing Key" (2014-05-03) - 9C800ACA build(a)suse.de "SuSE Package Signing Key" (2014-05-03) - B37B98A9 support(a)suse.com "SUSE PTF Signing Key" (2014-05-03) - 7E2E3B05 novell-provo-build(a)novell.com "Novell Provo Build" (2014-05-06) Added keys: - 1D061A62 support(a)novell.com "build(a)novell.com (Novell Linux Products)" (2014-05-06) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch openSUSE-build-key-2398 suse-build-key-2399 - openSUSE 11.1: zypper in -t patch openSUSE-build-key-2398 suse-build-key-2399 - openSUSE 11.0: zypper in -t patch suse-build-key-2399 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (noarch src): openSUSE-build-key-1.0-4.6.1 suse-build-key-1.0-909.6.1 - openSUSE 11.1 (noarch src): openSUSE-build-key-1.0-3.19.1 suse-build-key-1.0-907.33.1 - openSUSE 11.0 (noarch src): suse-build-key-1.0-855.2 References: https://bugzilla.novell.com/600157

1 0

openSUSE-YU-2010:0230-1 (low): libzypp: Collective update for openSUSE 11.2.
by maintenance＠opensuse.org 06 May '10

06 May '10

openSUSE YOU Update: libzypp: Collective update for openSUSE 11.2. ______________________________________________________________________________ Announcement ID: openSUSE-YU-2010:0230-1 Rating: low References: #223512 #279045 #377568 #393723 #394396 #462697 #465532 #467106 #467693 #471436 #473834 #495977 #497711 #522223 #523573 #535816 #537870 #538152 #544432 #545106 #545295 #545722 #547354 #549940 #551637 #551744 #551956 #552180 #552265 #553712 #553895 #554480 #557557 #558813 #560496 #561294 #564239 #564816 #565525 #566291 #570623 #570917 #571410 #572634 #573897 #576080 #578052 #578684 #578721 #580571 #581276 #581332 #581926 #584644 #585000 #585082 #585409 #585789 #586303 #588850 #589331 #589333 #589640 #590864 #591760 #593385 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has 66 YOU fixes can now be installed. It includes 6 new package versions. Description: The following bugs are fixed by this update: - Fix parsing port from IPv6 URL [bnc#593385] - Parse an installed products <shortsummary> tag [bnc#586303] - dataiterator: reset parent when jumping to a solvid [bnc#589640] - parse global repository ids. [bnc#377568] - fix pattern parsing in repomd format. [bnc#585000] - fix language code lookup for fallback languages [bnc#584644] - change solvable_lookup_str_lang interface a bit for libzypp - make dup rules work when system repo is not first [bnc#581276] - parse pattern visibility flag in repomd format - speed up createwhatprovides when many solvables provide the same dep - fix choice rule creation for real (bnc#551637) - set repository:toolversion to 1.0 in common_write - disable update rule in noobsoletes case if installed package is to be kept [bnc#564239] - work around rpm bug when --prefix is used [bnc#565525] - add support for sparc architecture [bnc#566291] - Support optionally compressed product(s).xml in rpmmd metadata. - Propagate ZConfig::setTextLocale to pool. (bnc#588850) - Fix guessing package spec to match package names only. (bnc#590864) - Add static Target::distributionLabel to return the baseproducts shortName and summary. Mainlu used for the bootloader menu. (bnc #586303) - Fix broken bit values in enum VendorSupportOption (bnc#589331) - Fix handling of symlinked packages in package cache. (bnc #585409) - Avoiding use of 'guest' if 'credentials' is used when moutning a CIFS share. This caused 'permission denied' error with certain server configurations (bnc #560496). - Check if a downloaded file actually exists even if aria2c returned 0. (bnc #564816) - Made CURLE_PARTIAL_FILE an auto-retry error (bnc #471436) - Turn off cookies when retrieving services repoindex.xml (bnc #573897) - Consider pending disable requests when removing service repositories. (bnc #572634) - RepoManager::cleanCacheDirGarbage added for removing directories which do not belong to any of known repos (bnc #467693) - On SLE aria2 is not required, so conflict with a too old aria2 version installed. (bnc #578052) - Fix package-manager script wrongly escaping UTF-8 chars in path names (bnc #571410) - Remember the enabled state of removed service repositories. This way we are able to restore service repositories correctly after a subscrition expired and gets renewed. (bnc #572634) - Abort aria2c download when the progress callback receives 'false' (bnc #545106) - Evaluate SolvAttr::repositoryToolVersion to prevent loading outdated solv files. (bnc #570623) - Use regex to parse aria2c progress lines (bnc #570917) - Set SignatureFileChecker context even if the key is not known (bnc #495977) - RepoInfoBase::label() added for use in UI messages, plus ZConfig::repoLabelIsAlias() - Fix transaction building in presence of multiversion installable items. - Improve multiversion status handling and installation. (fate #305311) - Don't allow an alias to start with '.' (bnc #473834) - PickList and status interface for handling packages which are installable in multiple versions. (fate #305311) - Add Selectable::highestAvailableVersionObj. Returns the highest available package version, ignoring priorities and policies. (bnc #557557) - Also parse <product> tag from .prod files <upgrade> section. - Fix chroot execution of update scripts. (bnc #558813) - Fixed parsing of download speed from aria2c (bnc #537870) - Add ui::Selecatble interface for picking specific package versions to install or delete if multiversion install is on. - Parse zypp.conf multiversion option and make the setting available in pool and resolver. - Fix repository probing and building in presence of productdir. (bnc #553712) - Raised the limit of redirections from 3 to 6 (bnc #465532) - Following redirections also for https (bnc #545722). - Following https redirections requires at least libcurl4-7.19.4. (bnc #553895) - Do not report cached packages as being downloaded. (bnc #545295) - Per default do not collect and report deleted files outside bin and lib directories for 'zypper ps'. (bnc #554480) - CheckAccessDeleted: Per default do not collect and report deleted files that outside bin and lib directories. 'zypper ps' reporting false positive seems to confuse. (bnc #554480) - Following https redirections requires at least libcurl4-7.19.4. (bnc #553895) - dup: Process drop list only if product actually changes. (bnc #552180) - Selectable: Consider allowed arch/noarch changes when comuting candiadates. - Enhance interface for zypper. (bnc #551956) - CIFS/SMB: Support mountoption 'noguest' to prevent passing 'guest' option to mount. "cifs://server/share/path?mountoptions=noguest,ro" (bnc #547354) - Work around swig not understanding nested class. - Pass py_sitedir macro from .spec file to cmake. - Always print solver problems if solving failed. - Parse and process <upgradeRepo name=REPOALIAS/> - add test cases for UI testing (new directory UI-tests) - Fixed crash if no available packages found in repos (bnc #591760) - Fixed "removed locks:" message not translated (bnc #581332) - Fixed 'lp --issues' and 'patch --cve #' (bnc #589640) - Showing full product name in installation summary and license text (bnc #589333) - Reporting why specified selectable can't be updated in 'zypper in packages' or 'zypper up packages' (bnc #522223) In case of 'zypper up' the summary also shows a list of packages that have update candidates, but will not get upgraded. - zypp-refresh-wrapper: set HOME so zypp/er credentials under /root can be found (bnc #585789) - Ignoring trailing slash when matching repos by URL (bnc #585082) - Show installed packages only from specified repos when 'zypper [-i|-u] -r repo' is used (bnc#467106) - Added a few forgotten strings for translation (bnc #581332) - Fix SEGV in Summary::writeResolvableList - Avoid a newline in 'zypper --quiet list-patches' (bnc #523573) - Showing packages that need additional customer contract separately in the installation summary (bnc #581926 c#6) - Avoiding confirmation of unchanged license on upgrade (bnc #394396) - clean --all: clean also garbage and zypper cache (bnc #467693) - Fixed broken --type (bnc #580571) - Fix 'zypper products' failing to list installed products under certain conditions (bnc #578721) - Fix SEGV if $HOME or $PWD are unset in the environment (bnc #578684) - Exit if missing required option argument. - Start using Capability::guessPackageSpec to parse package arguments. - man page updated (bnc #576080) - Fixed ignored .arch when specifying packages as name.arch (bnc #561294) - Setting --root correctly when working with lock (reported by Uwe) - Correctly abbreviate strings with non-ascii characters in tables (bnc #393723) - Avoid overwriting progress lines with other messages (bnc #495977) - Fixed --no-force-resolution help text (bnc #535816) - zypper.conf: main.showAlias option added to choose between alias and name for showing repos - search, pt: hide patterns flagged user invisible (bnc #538152) - Report invalid alias exception from libzypp (bnc #473834) - Match repositories also by name wherever repository is expected (bnc #462697). - Show truely all updates when --all is used (bnc #557557) - new prompt options for media errors: * cd/dvd: 'e' to eject selected drive (bnc #279045) * https: 's' to disable SSL CA check (bnc #223512) - solver.forceResolutionCommands added to zypper.conf to configure commands in which forceResolve solver option should be set (bnc #549940) - --download-* aliases added for --download <mode> option values - --download option added to in, up, dup, ve, and patch commands to set the package download mode ad-hoc. Available download modes: only, in-advance, in-heaps, as-needed. - Show update notifications after installation (fate #301175) - dist-upgrade: warn about muliple repos and show hint. This is a temporary solution to fate #305553. - Show recommended and suggested packages in summary (fate #303493) - --gpg-auto-import-keys global option added (fate #307087) - --with-interactive option added to 'patch' command (bnc #497711) - Fix zypper to use up-to-date RepoInfos. (bnc #544432) - fixed wrong package counting during installation (bnc #545295) - al/rl: Support 'kind:name' notation if -t is not given. Also required to remove a specific lock as rl does not yet support -t. (bnc 551956) - Fix typo in man page. (bnc #552265) - Prevent clipping lines when output is redirected. (bnc #551744) Special Instructions and Notes: Please log out and log in again after installing this update.This update triggers a restart of the software management stack. More updates will be available for installation after applying this update and restarting the application. Patch Instructions: To install this openSUSE YOU Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch softwaremgmt_201004-2355 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 1.3.4,2.18.11,2.18.22 and 6.31.4]: PackageKit-0.5.1-3.8.1 libqdialogsolver1-1.3.0-2.12.1 libzypp-6.31.4-0.1.1 yast2-gtk-2.20.5-1.3.1 yast2-ncurses-2.18.11-0.1.1 yast2-ncurses-pkg-2.18.4-2.10.2 yast2-pkg-bindings-2.18.11-1.3.1 yast2-qt-pkg-2.18.22-1.1.1 zypper-1.3.4-0.1.3 - openSUSE 11.2 (i586 x86_64) [New Version: 0.14.17,0.5.3,2.18.11 and 6.31.4]: PackageKit-devel-0.5.1-3.8.1 PackageKit-doc-0.5.1-3.8.1 libpackagekit-glib12-0.5.1-3.8.1 libpackagekit-glib12-devel-0.5.1-3.8.1 libpackagekit-qt12-0.5.1-3.8.1 libpackagekit-qt12-devel-0.5.1-3.8.1 libqdialogsolver1-devel-1.3.0-2.12.1 libsatsolver-demo-0.14.17-1.1.2 libsatsolver-devel-0.14.17-1.1.2 libzypp-devel-6.31.4-0.1.1 perl-satsolver-0.14.17-1.1.2 perl-zypp-0.5.3-1.1.1 python-satsolver-0.14.17-1.1.2 python-zypp-0.5.3-1.1.1 ruby-satsolver-0.14.17-1.1.2 ruby-zypp-0.5.3-1.1.1 ruck-0.5.1-3.8.1 satsolver-tools-0.14.17-1.1.2 yast2-ncurses-devel-2.18.11-0.1.1 - openSUSE 11.2 (noarch): PackageKit-lang-0.5.1-3.8.1 - openSUSE 11.2 (src) [New Version: 0.14.17 and 0.5.3]: libsatsolver-0.14.17-1.1.2 libzypp-bindings-0.5.3-1.1.1 References: https://bugzilla.novell.com/223512 https://bugzilla.novell.com/279045 https://bugzilla.novell.com/377568 https://bugzilla.novell.com/393723 https://bugzilla.novell.com/394396 https://bugzilla.novell.com/462697 https://bugzilla.novell.com/465532 https://bugzilla.novell.com/467106 https://bugzilla.novell.com/467693 https://bugzilla.novell.com/471436 https://bugzilla.novell.com/473834 https://bugzilla.novell.com/495977 https://bugzilla.novell.com/497711 https://bugzilla.novell.com/522223 https://bugzilla.novell.com/523573 https://bugzilla.novell.com/535816 https://bugzilla.novell.com/537870 https://bugzilla.novell.com/538152 https://bugzilla.novell.com/544432 https://bugzilla.novell.com/545106 https://bugzilla.novell.com/545295 https://bugzilla.novell.com/545722 https://bugzilla.novell.com/547354 https://bugzilla.novell.com/549940 https://bugzilla.novell.com/551637 https://bugzilla.novell.com/551744 https://bugzilla.novell.com/551956 https://bugzilla.novell.com/552180 https://bugzilla.novell.com/552265 https://bugzilla.novell.com/553712 https://bugzilla.novell.com/553895 https://bugzilla.novell.com/554480 https://bugzilla.novell.com/557557 https://bugzilla.novell.com/558813 https://bugzilla.novell.com/560496 https://bugzilla.novell.com/561294 https://bugzilla.novell.com/564239 https://bugzilla.novell.com/564816 https://bugzilla.novell.com/565525 https://bugzilla.novell.com/566291 https://bugzilla.novell.com/570623 https://bugzilla.novell.com/570917 https://bugzilla.novell.com/571410 https://bugzilla.novell.com/572634 https://bugzilla.novell.com/573897 https://bugzilla.novell.com/576080 https://bugzilla.novell.com/578052 https://bugzilla.novell.com/578684 https://bugzilla.novell.com/578721 https://bugzilla.novell.com/580571 https://bugzilla.novell.com/581276 https://bugzilla.novell.com/581332 https://bugzilla.novell.com/581926 https://bugzilla.novell.com/584644 https://bugzilla.novell.com/585000 https://bugzilla.novell.com/585082 https://bugzilla.novell.com/585409 https://bugzilla.novell.com/585789 https://bugzilla.novell.com/586303 https://bugzilla.novell.com/588850 https://bugzilla.novell.com/589331 https://bugzilla.novell.com/589333 https://bugzilla.novell.com/589640 https://bugzilla.novell.com/590864 https://bugzilla.novell.com/591760 https://bugzilla.novell.com/593385

1 0

openSUSE-SU-2010:0220-1 (moderate): libesmtp security update
by opensuse-security＠opensuse.org 05 May '10

05 May '10

openSUSE Security Update: libesmtp security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0220-1 Rating: moderate References: #585393 Cross-References: CVE-2010-1192 CVE-2010-1194 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: libesmtp did not properly handle wildcards and embedded null characters in the Common Name of X.509 certificates (CVE-2010-1192, CVE-2010-1194). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libesmtp-2389 - openSUSE 11.1: zypper in -t patch libesmtp-2389 - openSUSE 11.0: zypper in -t patch libesmtp-2389 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): libesmtp-1.0.4-158.2.1 - openSUSE 11.2 (i586 x86_64): libesmtp-devel-1.0.4-158.2.1 - openSUSE 11.1 (i586 ppc src x86_64): libesmtp-1.0.4-157.35.1 - openSUSE 11.1 (i586 ppc x86_64): libesmtp-devel-1.0.4-157.35.1 - openSUSE 11.0 (i586 ppc src x86_64): libesmtp-1.0.4-142.2 - openSUSE 11.0 (i586 ppc x86_64): libesmtp-devel-1.0.4-142.2 References: http://support.novell.com/security/cve/CVE-2010-1192.html http://support.novell.com/security/cve/CVE-2010-1194.html https://bugzilla.novell.com/585393

1 0

openSUSE-RU-2010:0218-1 (moderate): libqt4: Fix crashes with YaST in Japanese locale
by maintenance＠opensuse.org 05 May '10

05 May '10

openSUSE Recommended Update: libqt4: Fix crashes with YaST in Japanese locale ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0218-1 Rating: moderate References: #517894 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update improves stability of Qt applications when using Japanese locale with input methods enabled (bnc#517894). Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch libqt4-1896 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc src x86_64): libqt4-4.4.3-4.11.1 - openSUSE 11.1 (i586 ppc x86_64): libqt4-devel-4.4.3-4.11.1 libqt4-qt3support-4.4.3-4.11.1 libqt4-sql-4.4.3-4.11.1 libqt4-sql-sqlite-4.4.3-4.11.1 libqt4-x11-4.4.3-4.11.1 - openSUSE 11.1 (x86_64): libqt4-32bit-4.4.3-4.11.1 libqt4-qt3support-32bit-4.4.3-4.11.1 libqt4-sql-32bit-4.4.3-4.11.1 libqt4-x11-32bit-4.4.3-4.11.1 - openSUSE 11.1 (ppc): libqt4-64bit-4.4.3-4.11.1 libqt4-qt3support-64bit-4.4.3-4.11.1 libqt4-sql-64bit-4.4.3-4.11.1 libqt4-x11-64bit-4.4.3-4.11.1 References: https://bugzilla.novell.com/517894

1 0

openSUSE-SU-2010:0216-1 (moderate): evolution-data-server security update
by opensuse-security＠opensuse.org 05 May '10

05 May '10

openSUSE Security Update: evolution-data-server security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0216-1 Rating: moderate References: #475108 #568822 Cross-References: CVE-2009-0547 Affected Products: openSUSE 11.0 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: evolution considered S/MIME signatures to be valid even for modified mails (CVE-2009-0547). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.0: zypper in -t patch evolution-data-server-2333 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.0 (i586 ppc src x86_64): evolution-data-server-2.22.1.1-11.6 - openSUSE 11.0 (i586 ppc x86_64): evolution-data-server-devel-2.22.1.1-11.6 evolution-data-server-doc-2.22.1.1-11.6 - openSUSE 11.0 (x86_64): evolution-data-server-32bit-2.22.1.1-11.6 - openSUSE 11.0 (ppc): evolution-data-server-64bit-2.22.1.1-11.6 References: http://support.novell.com/security/cve/CVE-2009-0547.html https://bugzilla.novell.com/475108 https://bugzilla.novell.com/568822

1 0

openSUSE-SU-2010:0198-2 (moderate): mysql security update
by opensuse-security＠opensuse.org 04 May '10

04 May '10

openSUSE Security Update: mysql security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0198-2 Rating: moderate References: #557669 Cross-References: CVE-2008-7247 CVE-2009-4019 CVE-2009-4028 CVE-2009-4030 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Updated mysql packages fix the following bugs: - upstream #47320 - checking server certificates (CVE-2009-4028) - upstream #48291 - error handling in subqueries (CVE-2009-4019) - upstream #47780 - preserving null_value flag in GeomFromWKB() (CVE-2009-4019) - upstream #39277 - symlink behaviour fixed (CVE-2008-7247) - upstream #32167 - symlink behaviour refixed (CVE-2009-4030) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libmysqlclient-devel-2315 - openSUSE 11.1: zypper in -t patch libmysqlclient-devel-2315 - openSUSE 11.0: zypper in -t patch libmysqlclient-devel-2315 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): mysql-5.1.36-6.8.8 - openSUSE 11.2 (i586 x86_64): libmysqlclient-devel-5.1.36-6.8.8 libmysqlclient16-5.1.36-6.8.8 libmysqlclient_r16-5.1.36-6.8.8 libmysqld-devel-5.1.36-6.8.8 mysql-bench-5.1.36-6.8.8 mysql-client-5.1.36-6.8.8 mysql-debug-5.1.36-6.8.8 mysql-ndb-extra-5.1.36-6.8.8 mysql-ndb-management-5.1.36-6.8.8 mysql-ndb-storage-5.1.36-6.8.8 mysql-ndb-tools-5.1.36-6.8.8 mysql-test-5.1.36-6.8.8 mysql-tools-5.1.36-6.8.8 - openSUSE 11.2 (x86_64): libmysqlclient16-32bit-5.1.36-6.8.8 libmysqlclient_r16-32bit-5.1.36-6.8.8 - openSUSE 11.1 (i586 ppc src x86_64): mysql-5.0.67-12.17.7 - openSUSE 11.1 (i586 ppc x86_64): libmysqlclient-devel-5.0.67-12.17.7 libmysqlclient15-5.0.67-12.17.7 libmysqlclient_r15-5.0.67-12.17.7 mysql-Max-5.0.67-12.17.7 mysql-bench-5.0.67-12.17.7 mysql-client-5.0.67-12.17.7 mysql-debug-5.0.67-12.17.7 mysql-test-5.0.67-12.17.7 mysql-tools-5.0.67-12.17.7 - openSUSE 11.1 (x86_64): libmysqlclient15-32bit-5.0.67-12.17.7 libmysqlclient_r15-32bit-5.0.67-12.17.7 - openSUSE 11.1 (ppc): libmysqlclient15-64bit-5.0.67-12.17.7 libmysqlclient_r15-64bit-5.0.67-12.17.7 - openSUSE 11.0 (i586 ppc ppc64 src x86_64): mysql-5.0.51a-27.8 - openSUSE 11.0 (i586 ppc x86_64): libmysqlclient-devel-5.0.51a-27.8 libmysqlclient15-5.0.51a-27.8 libmysqlclient_r15-5.0.51a-27.8 mysql-Max-5.0.51a-27.8 mysql-bench-5.0.51a-27.8 mysql-client-5.0.51a-27.8 mysql-debug-5.0.51a-27.8 mysql-tools-5.0.51a-27.8 - openSUSE 11.0 (x86_64): libmysqlclient15-32bit-5.0.51a-27.8 libmysqlclient_r15-32bit-5.0.51a-27.8 - openSUSE 11.0 (ppc): libmysqlclient15-64bit-5.0.51a-27.8 libmysqlclient_r15-64bit-5.0.51a-27.8 References: http://support.novell.com/security/cve/CVE-2008-7247.html http://support.novell.com/security/cve/CVE-2009-4019.html http://support.novell.com/security/cve/CVE-2009-4028.html http://support.novell.com/security/cve/CVE-2009-4030.html https://bugzilla.novell.com/557669

1 0

openSUSE-RU-2010:0214-1 (important): xorg-x11-server: Update to fix 'X eats up CPU on an idle system'
by maintenance＠opensuse.org 04 May '10

04 May '10

openSUSE Recommended Update: xorg-x11-server: Update to fix 'X eats up CPU on an idle system' ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0214-1 Rating: important References: #524724 #594433 Affected Products: openSUSE 11.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This updates includes a fix for 'X eats up CPU on an idle system' related to a previous gnome-screensaver update and some other minor fixes. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch xorg-x11-Xvnc-2306 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (i586 ppc src x86_64): xorg-x11-server-7.4-17.7.1 - openSUSE 11.1 (i586 ppc x86_64): xorg-x11-Xvnc-7.4-17.7.1 xorg-x11-server-extra-7.4-17.7.1 xorg-x11-server-sdk-7.4-17.7.1 References: https://bugzilla.novell.com/524724 https://bugzilla.novell.com/594433

1 0

openSUSE-SU-2010:0212-1 (low): moodle security update
by opensuse-security＠opensuse.org 04 May '10

04 May '10

openSUSE Security Update: moodle security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0212-1 Rating: low References: #591850 Cross-References: CVE-2010-1613 CVE-2010-1614 CVE-2010-1615 CVE-2010-1616 CVE-2010-1617 CVE-2010-1618 CVE-2010-1619 Affected Products: openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. It includes four new package versions. Description: Moodle version 1.9.8 fixes several security issues including cross-site-scripting (XSS) and SQL injection bugs (CVE-2010-1613, CVE-2010-1614, CVE-2010-1615, CVE-2010-1616, CVE-2010-1617 CVE-2010-1618, CVE-2010-1619). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.1: zypper in -t patch moodle-2387 - openSUSE 11.0: zypper in -t patch moodle-2387 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.1 (noarch src) [New Version: 1.9.8]: moodle-1.9.8-0.1.1 - openSUSE 11.1 (noarch) [New Version: 1.9.8]: moodle-af-1.9.8-0.1.1 moodle-ar-1.9.8-0.1.1 moodle-be-1.9.8-0.1.1 moodle-bg-1.9.8-0.1.1 moodle-bs-1.9.8-0.1.1 moodle-ca-1.9.8-0.1.1 moodle-cs-1.9.8-0.1.1 moodle-da-1.9.8-0.1.1 moodle-de-1.9.8-0.1.1 moodle-de_du-1.9.8-0.1.1 moodle-el-1.9.8-0.1.1 moodle-es-1.9.8-0.1.1 moodle-et-1.9.8-0.1.1 moodle-eu-1.9.8-0.1.1 moodle-fa-1.9.8-0.1.1 moodle-fi-1.9.8-0.1.1 moodle-fr-1.9.8-0.1.1 moodle-ga-1.9.8-0.1.1 moodle-gl-1.9.8-0.1.1 moodle-he-1.9.8-0.1.1 moodle-hi-1.9.8-0.1.1 moodle-hr-1.9.8-0.1.1 moodle-hu-1.9.8-0.1.1 moodle-id-1.9.8-0.1.1 moodle-is-1.9.8-0.1.1 moodle-it-1.9.8-0.1.1 moodle-ja-1.9.8-0.1.1 moodle-ka-1.9.8-0.1.1 moodle-km-1.9.8-0.1.1 moodle-kn-1.9.8-0.1.1 moodle-ko-1.9.8-0.1.1 moodle-lt-1.9.8-0.1.1 moodle-lv-1.9.8-0.1.1 moodle-mi_tn-1.9.8-0.1.1 moodle-ms-1.9.8-0.1.1 moodle-nl-1.9.8-0.1.1 moodle-nn-1.9.8-0.1.1 moodle-no-1.9.8-0.1.1 moodle-pl-1.9.8-0.1.1 moodle-pt-1.9.8-0.1.1 moodle-ro-1.9.8-0.1.1 moodle-ru-1.9.8-0.1.1 moodle-sk-1.9.8-0.1.1 moodle-sl-1.9.8-0.1.1 moodle-so-1.9.8-0.1.1 moodle-sq-1.9.8-0.1.1 moodle-sr-1.9.8-0.1.1 moodle-sv-1.9.8-0.1.1 moodle-th-1.9.8-0.1.1 moodle-tl-1.9.8-0.1.1 moodle-tr-1.9.8-0.1.1 moodle-uk-1.9.8-0.1.1 moodle-vi-1.9.8-0.1.1 moodle-zh_cn-1.9.8-0.1.1 - openSUSE 11.0 (noarch src) [New Version: 1.9.8]: moodle-1.9.8-0.1 - openSUSE 11.0 (noarch) [New Version: 1.9.8]: moodle-af-1.9.8-0.1 moodle-ar-1.9.8-0.1 moodle-be-1.9.8-0.1 moodle-bg-1.9.8-0.1 moodle-bs-1.9.8-0.1 moodle-ca-1.9.8-0.1 moodle-cs-1.9.8-0.1 moodle-da-1.9.8-0.1 moodle-de-1.9.8-0.1 moodle-de_du-1.9.8-0.1 moodle-el-1.9.8-0.1 moodle-es-1.9.8-0.1 moodle-et-1.9.8-0.1 moodle-eu-1.9.8-0.1 moodle-fa-1.9.8-0.1 moodle-fi-1.9.8-0.1 moodle-fr-1.9.8-0.1 moodle-ga-1.9.8-0.1 moodle-gl-1.9.8-0.1 moodle-he-1.9.8-0.1 moodle-hi-1.9.8-0.1 moodle-hr-1.9.8-0.1 moodle-hu-1.9.8-0.1 moodle-id-1.9.8-0.1 moodle-is-1.9.8-0.1 moodle-it-1.9.8-0.1 moodle-ja-1.9.8-0.1 moodle-ka-1.9.8-0.1 moodle-km-1.9.8-0.1 moodle-kn-1.9.8-0.1 moodle-ko-1.9.8-0.1 moodle-lt-1.9.8-0.1 moodle-lv-1.9.8-0.1 moodle-mi_tn-1.9.8-0.1 moodle-ms-1.9.8-0.1 moodle-nl-1.9.8-0.1 moodle-nn-1.9.8-0.1 moodle-no-1.9.8-0.1 moodle-pl-1.9.8-0.1 moodle-pt-1.9.8-0.1 moodle-ro-1.9.8-0.1 moodle-ru-1.9.8-0.1 moodle-sk-1.9.8-0.1 moodle-sl-1.9.8-0.1 moodle-so-1.9.8-0.1 moodle-sq-1.9.8-0.1 moodle-sr-1.9.8-0.1 moodle-sv-1.9.8-0.1 moodle-th-1.9.8-0.1 moodle-tl-1.9.8-0.1 moodle-tr-1.9.8-0.1 moodle-uk-1.9.8-0.1 moodle-vi-1.9.8-0.1 moodle-zh_cn-1.9.8-0.1 References: http://support.novell.com/security/cve/CVE-2010-1613.html http://support.novell.com/security/cve/CVE-2010-1614.html http://support.novell.com/security/cve/CVE-2010-1615.html http://support.novell.com/security/cve/CVE-2010-1616.html http://support.novell.com/security/cve/CVE-2010-1617.html http://support.novell.com/security/cve/CVE-2010-1618.html http://support.novell.com/security/cve/CVE-2010-1619.html https://bugzilla.novell.com/591850

1 0

openSUSE-RU-2010:0210-1 (low): xorg-x11-libXext: This update fixes a race condition in libXext
by maintenance＠opensuse.org 04 May '10

04 May '10

openSUSE Recommended Update: xorg-x11-libXext: This update fixes a race condition in libXext ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0210-1 Rating: low References: #578577 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: XAllocID must only be called with the Display lock held. There's a race condition in libXext that causes apps that use the X shared memory extensions to occasionally crash. It affects lots of X programs, including Evolution, Firefox, various parts of Gnome, etc. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch xorg-x11-libXext-2379 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): xorg-x11-libXext-7.4-7.2.1 - openSUSE 11.2 (i586 x86_64): xorg-x11-libXext-devel-7.4-7.2.1 - openSUSE 11.2 (x86_64): xorg-x11-libXext-32bit-7.4-7.2.1 xorg-x11-libXext-devel-32bit-7.4-7.2.1 References: https://bugzilla.novell.com/578577

1 0

openSUSE-SU-2010:0209-1 (moderate): libmikmod security update
by opensuse-security＠opensuse.org 04 May '10

04 May '10

openSUSE Security Update: libmikmod security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0209-1 Rating: moderate References: #577875 Cross-References: CVE-2009-3995 CVE-2009-3996 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Specially crafted "Impulse Tracker" and "Ultratracker" files could cause a heap based buffer overflow in libmikmod. Attackers could exploit that to crash or potentially execute code in applications linking against libmikmod (CVE-2009-3995, CVE-2009-3996). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libmikmod-2353 - openSUSE 11.1: zypper in -t patch libmikmod-2353 - openSUSE 11.0: zypper in -t patch libmikmod-2353 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): libmikmod-3.1.11a-118.2.1 - openSUSE 11.2 (i586 x86_64): libmikmod-devel-3.1.11a-118.2.1 - openSUSE 11.2 (x86_64): libmikmod-32bit-3.1.11a-118.2.1 - openSUSE 11.1 (i586 ppc src x86_64): libmikmod-3.1.11a-71.57.1 - openSUSE 11.1 (i586 ppc x86_64): libmikmod-devel-3.1.11a-71.57.1 - openSUSE 11.1 (x86_64): libmikmod-32bit-3.1.11a-71.57.1 - openSUSE 11.1 (ppc): libmikmod-64bit-3.1.11a-71.57.1 - openSUSE 11.0 (i586 ppc src x86_64): libmikmod-3.1.11a-84.5 - openSUSE 11.0 (i586 ppc x86_64): libmikmod-devel-3.1.11a-84.5 - openSUSE 11.0 (x86_64): libmikmod-32bit-3.1.11a-84.5 - openSUSE 11.0 (ppc): libmikmod-64bit-3.1.11a-84.5 References: http://support.novell.com/security/cve/CVE-2009-3995.html http://support.novell.com/security/cve/CVE-2009-3996.html https://bugzilla.novell.com/577875

1 0

openSUSE-RU-2010:0204-1 (moderate): unscd: This update fixes huge log file generation
by maintenance＠opensuse.org 03 May '10

03 May '10

openSUSE Recommended Update: unscd: This update fixes huge log file generation ______________________________________________________________________________ Announcement ID: openSUSE-RU-2010:0204-1 Rating: moderate References: #575736 Affected Products: openSUSE 11.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. It includes one version update. Description: With the security-related version upgrade, the debug level setup has been tweaked in such a way that without any -d option passed, the debug level is set to the maximum. This causes unscd generating huge /var/log/nscd.log, eventually in the order of gigabytes. Fixed by this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch unscd-2366 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 0.45]: unscd-0.45-0.2.1 References: https://bugzilla.novell.com/575736

1 0

openSUSE-SU-2010:0198-1 (moderate): mysql security update
by opensuse-security＠opensuse.org 03 May '10

03 May '10

openSUSE Security Update: mysql security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0198-1 Rating: moderate References: #557669 Cross-References: CVE-2008-7247 CVE-2009-4019 CVE-2009-4028 CVE-2009-4030 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update fixes several security issues in mysql: - checking server certificates (CVE-2009-4028) - error handling in subqueries (CVE-2009-4019) - preserving null_value flag in GeomFromWKB (CVE-2009-4019) - symlink behavior fixed (CVE-2008-7247) - symlink behavior refixed (CVE-2009-4030) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch libmysqlclient-devel-1706 - openSUSE 11.1: zypper in -t patch libmysqlclient-devel-1706 - openSUSE 11.0: zypper in -t patch libmysqlclient-devel-1706 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64): mysql-5.1.36-6.8.2 - openSUSE 11.2 (i586 x86_64): libmysqlclient-devel-5.1.36-6.8.2 libmysqlclient16-5.1.36-6.8.2 libmysqlclient_r16-5.1.36-6.8.2 libmysqld-devel-5.1.36-6.8.2 mysql-bench-5.1.36-6.8.2 mysql-client-5.1.36-6.8.2 mysql-debug-5.1.36-6.8.2 mysql-ndb-extra-5.1.36-6.8.2 mysql-ndb-management-5.1.36-6.8.2 mysql-ndb-storage-5.1.36-6.8.2 mysql-ndb-tools-5.1.36-6.8.2 mysql-test-5.1.36-6.8.2 mysql-tools-5.1.36-6.8.2 - openSUSE 11.2 (x86_64): libmysqlclient16-32bit-5.1.36-6.8.2 libmysqlclient_r16-32bit-5.1.36-6.8.2 - openSUSE 11.1 (i586 ppc src x86_64): mysql-5.0.67-12.17.1 - openSUSE 11.1 (i586 ppc x86_64): libmysqlclient-devel-5.0.67-12.17.1 libmysqlclient15-5.0.67-12.17.1 libmysqlclient_r15-5.0.67-12.17.1 mysql-Max-5.0.67-12.17.1 mysql-bench-5.0.67-12.17.1 mysql-client-5.0.67-12.17.1 mysql-debug-5.0.67-12.17.1 mysql-test-5.0.67-12.17.1 mysql-tools-5.0.67-12.17.1 - openSUSE 11.1 (x86_64): libmysqlclient15-32bit-5.0.67-12.17.1 libmysqlclient_r15-32bit-5.0.67-12.17.1 - openSUSE 11.1 (ppc): libmysqlclient15-64bit-5.0.67-12.17.1 libmysqlclient_r15-64bit-5.0.67-12.17.1 - openSUSE 11.0 (i586 ppc ppc64 src x86_64): mysql-5.0.51a-27.6 - openSUSE 11.0 (i586 ppc x86_64): libmysqlclient-devel-5.0.51a-27.6 libmysqlclient15-5.0.51a-27.6 libmysqlclient_r15-5.0.51a-27.6 mysql-Max-5.0.51a-27.6 mysql-bench-5.0.51a-27.6 mysql-client-5.0.51a-27.6 mysql-debug-5.0.51a-27.6 mysql-tools-5.0.51a-27.6 - openSUSE 11.0 (x86_64): libmysqlclient15-32bit-5.0.51a-27.6 libmysqlclient_r15-32bit-5.0.51a-27.6 - openSUSE 11.0 (ppc): libmysqlclient15-64bit-5.0.51a-27.6 libmysqlclient_r15-64bit-5.0.51a-27.6 References: http://support.novell.com/security/cve/CVE-2008-7247.html http://support.novell.com/security/cve/CVE-2009-4019.html http://support.novell.com/security/cve/CVE-2009-4028.html http://support.novell.com/security/cve/CVE-2009-4030.html https://bugzilla.novell.com/557669

1 0