openSUSE Security Update: otrs: 3.1.18 update to fix security issues and bugs ______________________________________________________________________________
Announcement ID: openSUSE-SU-2013:1338-1 Rating: moderate References: #828850 Cross-References: CVE-2013-2625 CVE-2013-2637 CVE-2013-3551 CVE-2013-4088 CVE-2013-4717 CVE-2013-4718
Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________
An update that fixes 6 vulnerabilities is now available.
The ticket system OTRS was updated to 3.1.18 to fix various bugs and security issues.
Update to 3.1.18: * OSA-2013-05, CVE-2013-4717, CVE-2013-4718 fixed. * Fixed bug#9561 - ACL restriction with CustomerID for DynamicFields at new Ticket screen not working. * Fixed bug#9425 - Wrong created date for queue view. * Fixed bug#9125 - AgentTicketSearch dialog does not expand when choosing more search criteria. * Fixed bug#8273 - Copying text in preview mode not possible. * Fixed bug#9557 - Cannot see quoted text in customer ticket zoom. * Fixed bug#9011 - GenericInterface: New value after value mapping can't be 0. * Improved parameter quoting in various places. * Fixed bug#9104 - Group permission for customer subset overwrites permissions for other customers. * Fixed bug#8719 - PasswordMin2Lower2UpperCharacters problem. - 3.1.17 * Fixed OSA-2013-04, CVE-2013-4088. * Improved permission checks in AgentTicketWatcher. * Fixed bug#9503 - no connection header in soap responses. * Added parameter "-t dbonly" to backup.pl to only backup the database * Fixed bug#9491 - GenericAgent job update with dynamic fields sends Uninitialized value error. * Fixed bug#9462 - Package Management page timeout due to HTTPS disabled on Proxy connections. - 3.1.16 * Fixed OSA-2013-03, CVE-2013-3551. * Updated Package Manager, that will ensure that packages to be installed meet the quality standards of OTRS Group. This is to guarantee that your package wasn’t modified, which may possibly harm your system or have an influence on the stability and performance of it. All independent package contributors will have to conduct a check of their Add-Ons by OTRS Group in order to take full advantage of the OTRS package verification. * Fixed bug#9387 - Error in a condition with dynamic fields in NotificationEvent. * Fixed bug#9286 - Ticket::ChangeOwnerToEveryone isn't functional, After a AJAX Load the setting is ignored. * Fixed bug#7518 - Escalation Notify by not working properly (follow-up fix). * Fixed bug#7478 - Got an external answer to an internal mail. * Improved permission checks in AgentTicketPhone. * Fixed bug#(http://bugs.otrs.org/show_bug.cgi?id=9360) - DynamicField Names shown in CSV output. * Fixed bug#9384 - Problem with Method ServiceParentsGet of ServiceObject. * Fixed bug#9072 - Reply to email-internal includes customer users email in Cc. field. - 3.1.15 * Added Malay translation. * Fixed bug#8960 - AgentTicketSearch.pm SearchProfile problem. * Fixed bug#9182 - Customer Search Function -> If you go into a ticket and go back you got not the search results. * Fixed bug#9198 - Linked search with fulltext AND additional attributes. * Fixed bug#9295 - Article dynamic field is not searchable. * Fixed bug#9312 - LinkObject permission check problem. - 3.1.14 * Fixed for OSA-2013-01, CVE-2013-2625. * Fixed bug#9257 - No notifications to agents with out-of-office set but period not reached. * Improved permission checks in LinkObject. * Fixed bug#9191 - When ticket types are restricted, first available type is selected in AgentTicketActionCommon-based screens. * Updated Turkish translation, thanks to Sefer Şimşek / Network Group! * Fixed bug#9214 - IE10: impossible to open links from rich text articles. * Fixed bug#9218 - Cannot use special characters in TicketHook. * Fixed bug#9056 - Unused SysConfig option Ticket::Frontend::CustomerInfoQueueMaxSize. * Follow-up fix for bug#8533 apache will not start on Fedora. * Fixed bug#9172 - Generic Interface does not work on IIS 7.0. * Updated Czech language translation, thanks to Katerina Bubenickova! * Fixed bug#8865 - Additional empty data column in statistics CSV-Output. - update OTRS::ITSM to 3.1.10 (fix for OSA-2013-05, CVE-2013-4717, CVE-2013-4718) - update OTRS::ITSM to 3.1.9 (fix for OSA-2013-03, CVE-2013-3551) - update OTRS::ITSM to 3.1.8 (fix for OSA-2013-01, CVE-2013-2625) (fix for OSA-2013-02, CVE-2013-2637)
- update to 3.1.13 - http://www.otrs.com/en/open-source/community-news/releases-n otes/ release-notes-otrs-help-desk-3113/ - http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.22 60.2.206&view=markup * Fixed bug#9162 - Setting the start day of the week for the datepicker to Sunday does not work. * Fixed bug#9141 - Confused Columns in CustomerTicketSearch (ResultShort). * Fixed bug#9146 - Signed SMIME mails with altered content shows a not clear message. * Fixed bug#9145 - SMIME sign verification errors are not displayed in TicketZoom. * Fixed bug#9140 - Postmaster Filter for empty subjects does not work. * Fixed bug#9121 - Filenames with Unicode NFD are incorrectly reported as NFC by Main::DirectoryRead(). * Fixed bug#9108 - Check for opened/closed tickets not working with Ticket::SubjectFormat = Right. * Fixed bug#8839 - DateChecksum followup doesn't get correctly SystemID. * Updated Russian translation, thanks to Vadim Goncharov! * Fixed bug#9101 - Not possible to create dropdown with autocomplete attribute. * Fixed bug#9096 - All services list is shown instead of only default services. * Fixed bug#8470 - otrs.GenericAgent.pl reports: Can't open '/opt/otrs/otrs_vemco/var/tmp/CacheFileStorable/DynamicField /f3b7e10730fb6c9cab5ae0e7f7e034f3'. * Added new translation for Spanish (Colombia), thanks to John Edisson Ortiz Roman! * Fixed bug#9054 - Link Object deletes all links under certain conditions. * Fixed bug#8944 - do not backup the cache. * Fixed bug#9057 - Generating a PDF with bin/otrs.GenerateStats.pl produces lots of warnings. * Fixed bug#8929 - Fix problems with empty ticket search results while Ticket::Frontend::AgentTicketSearch###ExtendedSearchConditio n is inactive. * Fixed bug#9042 - Add X-Spam-Score to Ticket.xml. * Fixed bug#9047 - HistoryTicketGet caches info on disk directly. * Fixed bug#8923 - Alert message shown, if parent window is reloaded while bulk action popup is open. * Fixed bug#9030 - Wrong handling of Invalid YAML in Scheduler Tasks. * Updated CKEditor to version 3.6.6. * Updated Polish translation, thanks to Pawel @ ib.pl! * Follow-up fix for bug#8805 - Cron missing as RPM dependency on RHEL. Changed dependency on 'anacron' to 'vixie-cron' on RHEL5. * Fixed bug#9020 - Generic Ticket Connector does not support attachments with ContentType without charset. * Fixed bug#8545 - Attachment download not possible if pop up of another action is open. * Fixed bug#9009 - Empty Multiselect Dynamic Fields provokes an error. * Fixed bug#8589 - Bulk-Action not possible for single ticket. * Fixed bug#7198 - Broken repository selection width in Package Manager. * Fixed bug#8457 - Error if accessing AgentTicketSearch from AgentTicketPhone in IE8. * Fixed bug#8695 - Table head of Customer Ticket History does not resize on window resize. * Fixed bug#8533 - Apache will not start if you use mod_perl on Fedora 16 or 17. * Fixed bug#8974 - Event Based Notification does not populate REALNAME with Customer User data.
To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product:
- openSUSE 12.3:
zypper in -t patch openSUSE-2013-639
- openSUSE 12.2:
zypper in -t patch openSUSE-2013-639
To bring your system up-to-date, use "zypper patch".
- openSUSE 12.3 (noarch):
otrs-3.1.18-26.5.1 otrs-doc-3.1.18-26.5.1 otrs-itsm-3.1.10-26.5.1
- openSUSE 12.2 (noarch):
otrs-3.1.18-20.17.1 otrs-doc-3.1.18-20.17.1 otrs-itsm-3.1.10-20.17.1
http://support.novell.com/security/cve/CVE-2013-2625.html http://support.novell.com/security/cve/CVE-2013-2637.html http://support.novell.com/security/cve/CVE-2013-3551.html http://support.novell.com/security/cve/CVE-2013-4088.html http://support.novell.com/security/cve/CVE-2013-4717.html http://support.novell.com/security/cve/CVE-2013-4718.html https://bugzilla.novell.com/828850