-------- Forwarded Message -------- To avoid messages like "i did knew that....."

-----Original Message----- From: Marcus Meissner [mailto:meissner@suse.de] Sent: Thursday, May 12, 2011 7:02 PM To: opensuse-security-announce@opensuse.org Subject: [security-announce] openSUSE 11.2 has reached end of SUSE support - 11.2 Evergreen goes on!

Hi,

With the release of a kdelibs4 security fix on Thursday 12th of May SUSE has released the last update for openSUSE 11.2.

openSUSE 11.2 is now officially discontinued and out of support by SUSE.

However the openSUSE Evergreen community effort is going to continue the openSUSE 11.2 maintenance similar to 11.1.

The overview page of this project, how to activate and use it, and other details, is on: http://en.opensuse.org/openSUSE:Evergreen The Evergreen project is lead by openSUSE community member Wolfgang Rosenauer.

Here are some security statistics:

openSUSE 11.2 was released on November 12th 2009, making it 18 months of security and bugfix support.

Some statistics on the released patches (compared to 11.1, which had 7 months more):

(As comparison would otherwise be difficult due to the different lifetimes, I did adjust the 11.1 numbers by *18/25)

Total updates: 489 (-19) Security: 317 (-19) Recommended: 172 (+ 3) Optional: 0 (- 3)

CVE Entries: 1134 (+288) (-35 unadjusted)

There is a 3% decrease in the number of security updates compared to openSUSE 11.1. There is however a 24% increase in CVE numbers fixed.

The increase is largely due to approximately 180 webkit CVEs we solved by two version upgrades.

Top issues (compared to 11.1 for issues down to 5), (not lifetime adjusted): 13 MozillaFirefox (-6) 11 seamonkey (+3) 10 flash-player (+1) 9 krb5 (+4) 8 MozillaThunderbird (0) 8 java-1_6_0-openjdk (-2) 8 acroread (-3) 7 opera (-2) 6 mozilla-xulrunner191 5 tomcat6 5 libopenssl-devel (-4) 5 kernel (-9) 5 java-1_6_0-sun (+2) 5 clamav (-2) 5 apache2-mod_php5 (-2)

And top issues sorted by CVE (Common Vulnerability Enumeration) count (down to 5) (compared to 11.1 for the top, not adjusted to lifetime): 180 libwebkit (NEW) 120 seamonkey (+37) 119 MozillaFirefox (-44) (would be around 0 equalized) 113 acroread (-2) 95 MozillaThunderbird (-25) 94 java-1_6_0-sun (-20) 106 kernel (+23) 84 mozilla-xulrunner191 (-43) 83 flash-player (+1) 63 java-1_6_0-openjdk (-20) 45 php5 (+7) 27 opera (0) 26 wireshark (-7) 23 mysql (+8) 18 freetype2 (+1) 15 krb5 (+3) 19 OpenOffice_org (+12) 12 pidgin/finch (-2) 11 tomcat6 (+1) 10 clamav (0) 9 perl 9 poppler (-4) 9 postgresql (-2) 8 cups 8 python 6 sudo 6 gimp 6 glibc 6 openssl (-8) 6 libvirt 6 bind 5 viewvc 5 ghostscript (-6) 5 texlive 5 fuse 5 libtiff 5 exim 5 dovecot12 5 build 5 evince 5 python-feedparser 5 libpcsclite1 5 samba (-7)

# security updates by count # grep -l type..secur updateinfo-*|sed -e 's/^updateinfo-//;s/-[0-9]*.xml$//;'|sort|uniq -c|sort -n +0 -r|less # grep CVE- update* |perl -e '%cves=();while (<>) { while (/(CVE-2...-....)/) { $cve{$1}++; s/CVE-2...-....//;} } print join("\n",sort keys %cve)."\n";' | wc -l # for i in updateinfo-* ; do echo -n "$i " ; grep CVE- $i|perl -e '%cves=();while (<>) { while (/(CVE-2...-....)/) { $cve{$1}++; s/CVE-2...-....//;} } print join("\n",sort keys %cve)."\n";' | wc -l ; done |perl -e 'while (<>) { /^updateinfo-(\S*)-\d*.xml (\d*)$/; $cnt{$1}+=$2; } ; foreach (sort { $cnt{$b} <=> $cnt{$a} } keys %cnt) { print "$cnt{$_}\t\t$_\n";} '

______________________________________________________________________ Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het elektronisch verzenden van berichten.

This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.