February 2015 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] Re: openSUSE-SU-2015:0351-1: moderate: Security update for glibc
by Christoph Feck 24 Feb '15

24 Feb '15

On Monday 23 February 2015 15:04:55 opensuse- security(a)opensuse.org wrote: > openSUSE Security Update: Security update for glibc Could you please include "i686" architecture for this update? (13.1 for me, but I guess 13.2 also offers i686 packages for glibc). > ___________________________________________________________________ > ___________ > > Announcement ID: openSUSE-SU-2015:0351-1 > Rating: moderate > References: #906371 #910599 #915526 #916222 > Cross-References: CVE-2013-7423 CVE-2014-7817 CVE-2014-9402 > CVE-2015-1472 > Affected Products: > openSUSE 13.2 > openSUSE 13.1 > ___________________________________________________________________ > ___________ > > An update that fixes four vulnerabilities is now available. > > Description: > > > Glibc was updated to fix several security issues. > > - Avoid infinite loop in nss_dns getnetbyname (CVE-2014-9402, > bsc#910599, BZ #17630) > - wordexp fails to honour WRDE_NOCMD (CVE-2014-7817, bsc#906371, > BZ #17625) - Fix invalid file descriptor reuse while sending DNS > query (CVE-2013-7423, bsc#915526, BZ #15946) > - Fix buffer overflow in wscanf (CVE-2015-1472, bsc#916222, BZ > #16618) > > > Patch Instructions: > > To install this openSUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - openSUSE 13.2: > > zypper in -t patch openSUSE-2015-173=1 > > - openSUSE 13.1: > > zypper in -t patch openSUSE-2015-173=1 > > To bring your system up-to-date, use "zypper patch". > > > Package List: > > - openSUSE 13.2 (i586 i686 x86_64): > > glibc-2.19-16.5.1 > glibc-debuginfo-2.19-16.5.1 > glibc-debugsource-2.19-16.5.1 > glibc-devel-2.19-16.5.1 > glibc-devel-debuginfo-2.19-16.5.1 > glibc-devel-static-2.19-16.5.1 > glibc-locale-2.19-16.5.1 > glibc-locale-debuginfo-2.19-16.5.1 > glibc-profile-2.19-16.5.1 > > - openSUSE 13.2 (i586 x86_64): > > glibc-extra-2.19-16.5.1 > glibc-extra-debuginfo-2.19-16.5.1 > glibc-utils-2.19-16.5.1 > glibc-utils-debuginfo-2.19-16.5.1 > glibc-utils-debugsource-2.19-16.5.1 > nscd-2.19-16.5.1 > nscd-debuginfo-2.19-16.5.1 > > - openSUSE 13.2 (x86_64): > > glibc-32bit-2.19-16.5.1 > glibc-debuginfo-32bit-2.19-16.5.1 > glibc-devel-32bit-2.19-16.5.1 > glibc-devel-debuginfo-32bit-2.19-16.5.1 > glibc-devel-static-32bit-2.19-16.5.1 > glibc-locale-32bit-2.19-16.5.1 > glibc-locale-debuginfo-32bit-2.19-16.5.1 > glibc-profile-32bit-2.19-16.5.1 > glibc-utils-32bit-2.19-16.5.1 > glibc-utils-debuginfo-32bit-2.19-16.5.1 > > - openSUSE 13.2 (noarch): > > glibc-html-2.19-16.5.1 > glibc-i18ndata-2.19-16.5.1 > glibc-info-2.19-16.5.1 > > - openSUSE 13.2 (i586): > > glibc-obsolete-2.19-16.5.1 > glibc-obsolete-debuginfo-2.19-16.5.1 > > - openSUSE 13.1 (i586 x86_64): > > glibc-2.18-4.25.1 > glibc-debuginfo-2.18-4.25.1 > glibc-debugsource-2.18-4.25.1 > glibc-devel-2.18-4.25.1 > glibc-devel-debuginfo-2.18-4.25.1 > glibc-devel-static-2.18-4.25.1 > glibc-extra-2.18-4.25.1 > glibc-extra-debuginfo-2.18-4.25.1 > glibc-locale-2.18-4.25.1 > glibc-locale-debuginfo-2.18-4.25.1 > glibc-profile-2.18-4.25.1 > glibc-utils-2.18-4.25.1 > glibc-utils-debuginfo-2.18-4.25.1 > glibc-utils-debugsource-2.18-4.25.1 > nscd-2.18-4.25.1 > nscd-debuginfo-2.18-4.25.1 > > - openSUSE 13.1 (x86_64): > > glibc-utils-32bit-2.18-4.25.1 > glibc-utils-debuginfo-32bit-2.18-4.25.1 > > - openSUSE 13.1 (noarch): > > glibc-html-2.18-4.25.1 > glibc-i18ndata-2.18-4.25.1 > glibc-info-2.18-4.25.1 > > - openSUSE 13.1 (i586): > > glibc-obsolete-2.18-4.25.1 > glibc-obsolete-debuginfo-2.18-4.25.1 > > > References: > > http://support.novell.com/security/cve/CVE-2013-7423.html > http://support.novell.com/security/cve/CVE-2014-7817.html > http://support.novell.com/security/cve/CVE-2014-9402.html > http://support.novell.com/security/cve/CVE-2015-1472.html > https://bugzilla.suse.com/906371 > https://bugzilla.suse.com/910599 > https://bugzilla.suse.com/915526 > https://bugzilla.suse.com/916222 -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 1

[opensuse-security] Change /var/{cache,log}/squid ownership to squid:squid
by Marcos Felipe Rasia de Mello 23 Feb '15

23 Feb '15

Hi, Can you take a look? https://bugzilla.opensuse.org/show_bug.cgi?id=918434 Squid daemon having its own exclusive group should allow us drop root group ownership on these folders. Current 13.2 package (3.4.4-3.4.2): # ls -al /var/{cache,log}/squid /var/cache/squid: total 76 drwxr-x--- 18 squid root 4096 Feb 20 07:31 . drwxr-xr-x 8 root root 4096 Feb 20 07:30 .. drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 00 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 01 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 02 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 03 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 04 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 05 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 06 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 07 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 08 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 09 drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 0A drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 0B drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 0C drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 0D drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 0E drwxr-x--- 258 squid nogroup 4096 Feb 20 07:31 0F -rw-r----- 1 squid nogroup 72 Feb 20 07:31 swap.state /var/log/squid: total 96 drwxr-x--- 2 squid root 4096 Feb 20 07:33 . drwxr-xr-x 7 root root 4096 Feb 20 07:33 .. -rw-r----- 1 squid root 0 Feb 20 07:33 access.log -rw-r----- 1 squid nogroup 416 Feb 20 07:32 access.log-20150220.xz -rw-r----- 1 squid root 79913 Feb 20 07:33 cache.log -rw-r----- 1 squid nogroup 1580 Feb 20 07:32 cache.log-20150220.xz After the changes: # ls -al /var/{cache,log}/squid /var/cache/squid: total 76 drwxr-x--- 18 squid squid 4096 Feb 20 07:34 . drwxr-xr-x 8 root root 4096 Feb 20 07:30 .. drwxr-x--- 258 squid squid 4096 Feb 20 07:31 00 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 01 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 02 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 03 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 04 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 05 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 06 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 07 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 08 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 09 drwxr-x--- 258 squid squid 4096 Feb 20 07:31 0A drwxr-x--- 258 squid squid 4096 Feb 20 07:31 0B drwxr-x--- 258 squid squid 4096 Feb 20 07:31 0C drwxr-x--- 258 squid squid 4096 Feb 20 07:31 0D drwxr-x--- 258 squid squid 4096 Feb 20 07:31 0E drwxr-x--- 258 squid squid 4096 Feb 20 07:31 0F -rw-r----- 1 squid squid 72 Feb 20 07:34 swap.state /var/log/squid: total 176 drwxr-x--- 2 squid squid 4096 Feb 19 17:15 . drwxr-xr-x 7 root root 4096 Feb 20 07:33 .. -rw-r----- 1 squid squid 0 Feb 20 07:33 access.log -rw-r----- 1 squid squid 416 Feb 20 07:32 access.log-20150220.xz -rw-r----- 1 squid squid 163672 Feb 20 07:34 cache.log -rw-r----- 1 squid squid 1580 Feb 20 07:32 cache.log-20150220.xz logrotate config fragment is using 'su squid squid' as an extra safety measure. -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 4

[opensuse-security] just introducing our photo retouching
by Ralf 20 Feb '15

20 Feb '15

How are you today? Hope this email finds you well! We wish you to use our photo editing/retouching rervices at good rates. We mainly specialize in : photoshop photo editing/retouching, jewellery photo retouching, ecommerce products photo editing, photo cutting out/clipping Path, beauty/skin retouching, wedding image editing, and photo background manipulation. You may send us photo for free testing to check our quality Looking for your soonest Response. Thanks, Ralf Tan Email: ralfcontact(a)sina.com ------------------------------------------------- This e-mail message and its attachments are intended solely for the use of the address hereof. In addition, this message and the attachments may contain information that is confidential, privileged and exempt from disclosure under applicable law. If you are not the intended recipient of this message, you are prohibited from reading, disclosing, reproducing, distributing, disseminating or otherwise using this transmission. Delivery of this message to any person other than the intended recipient is not intended to waive any right or privilege. If you have received this message in error, please promptly notify the sender and immediately delete this message from your system. -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] Invoices for INTERCON, INC. Sent on 02/17/15 from Electroshield Inc
by accounting＠interconinc.com 17 Feb '15

17 Feb '15

Invoices in attachment

1 0

[opensuse-security] GOOGLE int
by GOOGLE 12 Feb '15

12 Feb '15

Congratulations on your victory in the international lottery GOOGLE INT and win in the amount of 10,000 euro. For winning fill out the form and send it to us investing in response. *********************************************** Mr. Kan Hans Mirrow Trust Agency TEL:+386225264263 Email:kan.hans@gmail.com New York 66, 4545,2 *********************************************** If you cann't open the file, download and install Adobe Acrobat. http://get.adobe.com/ru/reader/otherversions/

1 0

[opensuse-security] RE: [security-announce] openSUSE-SU-2015:0226-1: important: Security update for xen
by lars.buerding＠mopay.com 06 Feb '15

06 Feb '15

Dear Sir or Madam, IMPORTANT: the e-mail address of the contact you are trying to reach has changed. Please use the following address: lars.buerding(a)mopay.com Addresses in the domain @mindmatics.com and @mindmatics.de will not work anymore for this person. Your e-Mail did NOT reach your contact and will NOT be forwarded. Please re-send your e-mail to the mentioned Address. Kind regards, the system administration of mopay AG Sehr geehrte Damen und Herren, WICHTIG: die E-Mail-Adresse Ihres Ansprechpartners hat sich geändert. Bitte verwenden Sie künftig ausschließlich die Adresse lars.buerding(a)mopay.com Adressen aus den Domains @mindmatics.de und @mindmatics.com funktionieren für ihren Ansprechpartner nicht mehr. Ihre e-mail hat Ihren Ansprechpartner NICHT erreicht, und wird NICHT weitergeleitet, bitte senden Sie ihre Nachricht erneut an die angegebene Adresse. Mit freundlichen Grüßen, die Systemadministration der mopay AG

1 0

[opensuse-security] Thanks for GHOST patch for 12.3
by jdebert 03 Feb '15

03 Feb '15

Thanks for pushing out the glibc patch for 12.3. Have to do with utnil upgrades can be managed. Such patches are really helpful. jd -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0