March 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:0564-1: moderate: privoxy: update to 3.0.21 to fix security issues and bugs
by opensuse-security＠opensuse.org 31 Mar '13

31 Mar '13

openSUSE Security Update: privoxy: update to 3.0.21 to fix security issues and bugs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0564-1 Rating: moderate References: #809123 Cross-References: CVE-2013-2503 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: privoxy was updated to 3.0.21 stable fo fix CVE-2013-2503 (bnc#809123) - changes in 3.0.21 * On POSIX-like platforms, network sockets with file descriptor values above FD_SETSIZE are properly rejected. Previously they could cause memory corruption in configurations that allowed the limit to be reached. * Proxy authentication headers are removed unless the new directive enable-proxy-authentication-forwarding is used. Forwarding the headers potentionally allows malicious sites to trick the user into providing them with login information. Reported by Chris John Riley. * Compiles on OS/2 again now that unistd.h is only included on platforms that have it. * The show-status page shows the FEATURE_STRPTIME_SANITY_CHECKS status. * A couple of assert()s that could theoretically dereference NULL pointers in debug builds have been relocated. * Added an LSB info block to the generic start script. Based on a patch from Natxo Asenjo. * The max-client-connections default has been changed to 128 which should be more than enough for most setups. * Block rover.ebay./ar.*\&adtype= instead of "/.*\&adtype=" which caused too man false positives. Reported by u302320 in #360284, additional feedback from Adam Piggott. * Unblock '.advrider.com/' and '/.*ADVrider'. Anonymously reported in #3603636. * Stop blocking '/js/slider\.js'. Reported by Adam Piggott in #3606635 and _lvm in #2791160. * Added an iframes filter. * The whole GPLv2 text is included in the user manual now, so Privoxy can serve it itself and the user can read it without having to wade through GPLv3 ads first. * Properly numbered and underlined a couple of section titles in the config that where previously overlooked due to a flaw in the conversion script. Reported by Ralf Jungblut. * Improved the support instruction to hopefully make it harder to unintentionally provide insufficient information when requesting support. Previously it wasn't obvious that the information we need in bug reports is usually also required in support requests. * Removed documentation about packages that haven't been provided in years. * Only log the test number when not running in verbose mode The position of the test is rarely relevant and it previously - for full list of changes see ChangeLog file shipped together with this package Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-51 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): privoxy-3.0.21-7.1 privoxy-debuginfo-3.0.21-7.1 privoxy-debugsource-3.0.21-7.1 privoxy-doc-3.0.21-7.1 References: http://support.novell.com/security/cve/CVE-2013-2503.html https://bugzilla.novell.com/809123

1 0

openSUSE-SU-2013:0563-1: moderate: clamav: 0.97.7 update
by opensuse-security＠opensuse.org 29 Mar '13

29 Mar '13

openSUSE Security Update: clamav: 0.97.7 update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0563-1 Rating: moderate References: #809945 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: clamav was updated to version 0.97.7 (bnc#809945) and contains several hardening fixes which might be security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-50 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): clamav-0.97.7-17.1 clamav-debuginfo-0.97.7-17.1 clamav-debugsource-0.97.7-17.1 - openSUSE 11.4 (noarch): clamav-db-0.97.7-17.1 References: https://bugzilla.novell.com/809945

1 0

openSUSE-SU-2013:0560-1: moderate: clamav: 0.97.7 update
by opensuse-security＠opensuse.org 28 Mar '13

28 Mar '13

openSUSE Security Update: clamav: 0.97.7 update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0560-1 Rating: moderate References: #809945 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: clamav was updated to version 0.97.7 (bnc#809945) and contains several hardening fixes which might be security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-265 - openSUSE 12.2: zypper in -t patch openSUSE-2013-265 - openSUSE 12.1: zypper in -t patch openSUSE-2013-265 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): clamav-0.97.7-5.4.1 clamav-debuginfo-0.97.7-5.4.1 clamav-debugsource-0.97.7-5.4.1 - openSUSE 12.2 (i586 x86_64): clamav-0.97.7-1.8.1 clamav-debuginfo-0.97.7-1.8.1 clamav-debugsource-0.97.7-1.8.1 - openSUSE 12.2 (noarch): clamav-db-0.97.7-1.8.1 - openSUSE 12.1 (i586 x86_64): clamav-0.97.7-11.1 clamav-debuginfo-0.97.7-11.1 clamav-debugsource-0.97.7-11.1 - openSUSE 12.1 (noarch): clamav-db-0.97.7-11.1 References: https://bugzilla.novell.com/809945

1 0

openSUSE-SU-2013:0559-1: moderate: sssd: fixed some access control management issues
by opensuse-security＠opensuse.org 28 Mar '13

28 Mar '13

openSUSE Security Update: sssd: fixed some access control management issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0559-1 Rating: moderate References: #809153 Cross-References: CVE-2013-0287 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: When SSSD is configured as an Active Directory client by using the new Active Directory provider or equivalent configuration of the LDAP provider, the Simple Access Provider does not handle access control correctly. If any groups are specified with the simple_deny_groups option, the group members are permitted access. (CVE-2013-0287) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-264 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libipa_hbac-devel-1.9.4-1.9.1 libipa_hbac0-1.9.4-1.9.1 libipa_hbac0-debuginfo-1.9.4-1.9.1 libsss_idmap-devel-1.9.4-1.9.1 libsss_idmap0-1.9.4-1.9.1 libsss_idmap0-debuginfo-1.9.4-1.9.1 libsss_sudo-1.9.4-1.9.1 libsss_sudo-debuginfo-1.9.4-1.9.1 python-ipa_hbac-1.9.4-1.9.1 python-ipa_hbac-debuginfo-1.9.4-1.9.1 python-sssd-config-1.9.4-1.9.1 python-sssd-config-debuginfo-1.9.4-1.9.1 sssd-1.9.4-1.9.1 sssd-debuginfo-1.9.4-1.9.1 sssd-debugsource-1.9.4-1.9.1 sssd-ipa-provider-1.9.4-1.9.1 sssd-ipa-provider-debuginfo-1.9.4-1.9.1 sssd-tools-1.9.4-1.9.1 sssd-tools-debuginfo-1.9.4-1.9.1 - openSUSE 12.3 (x86_64): sssd-32bit-1.9.4-1.9.1 sssd-debuginfo-32bit-1.9.4-1.9.1 References: http://support.novell.com/security/cve/CVE-2013-0287.html https://bugzilla.novell.com/809153

1 0

openSUSE-SU-2013:0555-1: moderate: libxml2: fixed two entity expansion problems
by opensuse-security＠opensuse.org 27 Mar '13

27 Mar '13

openSUSE Security Update: libxml2: fixed two entity expansion problems ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0555-1 Rating: moderate References: #805233 Cross-References: CVE-2013-0338 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libxml2 was updated to limit internal entity expansion denial of service problems (IXE) (CVE-2013-0338) (bnc#805233) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-49 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libxml2-2.7.8-41.1 libxml2-debuginfo-2.7.8-41.1 libxml2-debugsource-2.7.8-41.1 libxml2-devel-2.7.8-41.1 - openSUSE 11.4 (x86_64): libxml2-32bit-2.7.8-41.1 libxml2-debuginfo-32bit-2.7.8-41.1 libxml2-devel-32bit-2.7.8-41.1 - openSUSE 11.4 (noarch): libxml2-doc-2.7.8-41.1 - openSUSE 11.4 (ia64): libxml2-debuginfo-x86-2.7.8-41.1 libxml2-x86-2.7.8-41.1 References: http://support.novell.com/security/cve/CVE-2013-0338.html https://bugzilla.novell.com/805233

1 0

openSUSE-RU-2013:0553-1: important: evolution-data-server: Display IMAP alerts
by maintenance＠opensuse.org 27 Mar '13

27 Mar '13

openSUSE Recommended Update: evolution-data-server: Display IMAP alerts ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0553-1 Rating: important References: Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issue for evolution-data-server: - bgo#695915: Evolution did not display IMAP alerts, which may easily cause lost mails due to silent exceeding of quota. This is fixed with this update. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-259 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): evolution-data-server-3.6.3-1.5.1 evolution-data-server-debuginfo-3.6.3-1.5.1 evolution-data-server-debugsource-3.6.3-1.5.1 evolution-data-server-devel-3.6.3-1.5.1 evolution-data-server-doc-3.6.3-1.5.1 libcamel-1_2-40-3.6.3-1.5.1 libcamel-1_2-40-debuginfo-3.6.3-1.5.1 libebackend-1_2-5-3.6.3-1.5.1 libebackend-1_2-5-debuginfo-3.6.3-1.5.1 libebook-1_2-14-3.6.3-1.5.1 libebook-1_2-14-debuginfo-3.6.3-1.5.1 libecal-1_2-15-3.6.3-1.5.1 libecal-1_2-15-debuginfo-3.6.3-1.5.1 libedata-book-1_2-15-3.6.3-1.5.1 libedata-book-1_2-15-debuginfo-3.6.3-1.5.1 libedata-cal-1_2-18-3.6.3-1.5.1 libedata-cal-1_2-18-debuginfo-3.6.3-1.5.1 libedataserver-1_2-17-3.6.3-1.5.1 libedataserver-1_2-17-debuginfo-3.6.3-1.5.1 libedataserverui-3_0-4-3.6.3-1.5.1 libedataserverui-3_0-4-debuginfo-3.6.3-1.5.1 typelib-1_0-EBook-1_2-3.6.3-1.5.1 typelib-1_0-ECalendar-1_2-3.6.3-1.5.1 typelib-1_0-EDataServer-1_2-3.6.3-1.5.1 - openSUSE 12.3 (x86_64): libcamel-1_2-40-32bit-3.6.3-1.5.1 libcamel-1_2-40-debuginfo-32bit-3.6.3-1.5.1 libebackend-1_2-5-32bit-3.6.3-1.5.1 libebackend-1_2-5-debuginfo-32bit-3.6.3-1.5.1 libebook-1_2-14-32bit-3.6.3-1.5.1 libebook-1_2-14-debuginfo-32bit-3.6.3-1.5.1 libecal-1_2-15-32bit-3.6.3-1.5.1 libecal-1_2-15-debuginfo-32bit-3.6.3-1.5.1 libedata-book-1_2-15-32bit-3.6.3-1.5.1 libedata-book-1_2-15-debuginfo-32bit-3.6.3-1.5.1 libedata-cal-1_2-18-32bit-3.6.3-1.5.1 libedata-cal-1_2-18-debuginfo-32bit-3.6.3-1.5.1 libedataserver-1_2-17-32bit-3.6.3-1.5.1 libedataserver-1_2-17-debuginfo-32bit-3.6.3-1.5.1 libedataserverui-3_0-4-32bit-3.6.3-1.5.1 libedataserverui-3_0-4-debuginfo-32bit-3.6.3-1.5.1 - openSUSE 12.3 (noarch): evolution-data-server-lang-3.6.3-1.5.1 References:

1 0

openSUSE-SU-2013:0552-1: moderate: libxml2: fixed two entity expansion problems
by opensuse-security＠opensuse.org 27 Mar '13

27 Mar '13

openSUSE Security Update: libxml2: fixed two entity expansion problems ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0552-1 Rating: moderate References: #805233 Cross-References: CVE-2013-0338 Affected Products: openSUSE 12.3 openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libxml2 was updated to limit internal entity expansion denial of service problems (IXE) (CVE-2013-0338) (bnc#805233) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-263 - openSUSE 12.2: zypper in -t patch openSUSE-2013-263 - openSUSE 12.1: zypper in -t patch openSUSE-2013-263 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libxml2-2-2.9.0-2.5.1 libxml2-2-debuginfo-2.9.0-2.5.1 libxml2-debugsource-2.9.0-2.5.1 libxml2-devel-2.9.0-2.5.1 libxml2-tools-2.9.0-2.5.1 libxml2-tools-debuginfo-2.9.0-2.5.1 python-libxml2-2.9.0-2.5.1 python-libxml2-debuginfo-2.9.0-2.5.1 python-libxml2-debugsource-2.9.0-2.5.1 - openSUSE 12.3 (x86_64): libxml2-2-32bit-2.9.0-2.5.1 libxml2-2-debuginfo-32bit-2.9.0-2.5.1 libxml2-devel-32bit-2.9.0-2.5.1 - openSUSE 12.3 (noarch): libxml2-doc-2.9.0-2.5.1 - openSUSE 12.2 (i586 x86_64): libxml2-2-2.7.8+git20120223-8.14.1 libxml2-2-debuginfo-2.7.8+git20120223-8.14.1 libxml2-debugsource-2.7.8+git20120223-8.14.1 libxml2-devel-2.7.8+git20120223-8.14.1 libxml2-tools-2.7.8+git20120223-8.14.1 libxml2-tools-debuginfo-2.7.8+git20120223-8.14.1 python-libxml2-2.7.8+git20120223-8.14.1 python-libxml2-debuginfo-2.7.8+git20120223-8.14.1 python-libxml2-debugsource-2.7.8+git20120223-8.14.1 - openSUSE 12.2 (x86_64): libxml2-2-32bit-2.7.8+git20120223-8.14.1 libxml2-2-debuginfo-32bit-2.7.8+git20120223-8.14.1 libxml2-devel-32bit-2.7.8+git20120223-8.14.1 - openSUSE 12.2 (noarch): libxml2-doc-2.7.8+git20120223-8.14.1 - openSUSE 12.1 (i586 x86_64): libxml2-2.7.8+git20110708-3.20.1 libxml2-debuginfo-2.7.8+git20110708-3.20.1 libxml2-debugsource-2.7.8+git20110708-3.20.1 libxml2-devel-2.7.8+git20110708-3.20.1 - openSUSE 12.1 (x86_64): libxml2-32bit-2.7.8+git20110708-3.20.1 libxml2-debuginfo-32bit-2.7.8+git20110708-3.20.1 libxml2-devel-32bit-2.7.8+git20110708-3.20.1 - openSUSE 12.1 (noarch): libxml2-doc-2.7.8+git20110708-3.20.1 - openSUSE 12.1 (ia64): libxml2-debuginfo-x86-2.7.8+git20110708-3.20.1 libxml2-x86-2.7.8+git20110708-3.20.1 References: http://support.novell.com/security/cve/CVE-2013-0338.html https://bugzilla.novell.com/805233

1 0

openSUSE-RU-2013:0551-1: systemd: re-add persistent network rules
by maintenance＠opensuse.org 27 Mar '13

27 Mar '13

openSUSE Recommended Update: systemd: re-add persistent network rules ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0551-1 Rating: low References: #809843 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue for systemd: - bnc#809843: udev: re-add persistent network rules (bnc#809843). - rebase all patches, ensure that they apply properly. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-262 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libgudev-1_0-0-195-13.14.1 libgudev-1_0-0-debuginfo-195-13.14.1 libgudev-1_0-devel-195-13.14.1 libudev-devel-195-13.14.1 libudev-mini-devel-195-13.14.1 libudev-mini1-195-13.14.1 libudev-mini1-debuginfo-195-13.14.1 libudev1-195-13.14.1 libudev1-debuginfo-195-13.14.1 systemd-195-13.14.1 systemd-analyze-195-13.14.1 systemd-debuginfo-195-13.14.1 systemd-debugsource-195-13.14.1 systemd-devel-195-13.14.1 systemd-logger-195-13.14.1 systemd-mini-195-13.14.1 systemd-mini-analyze-195-13.14.1 systemd-mini-debuginfo-195-13.14.1 systemd-mini-debugsource-195-13.14.1 systemd-mini-devel-195-13.14.1 systemd-mini-sysvinit-195-13.14.1 systemd-sysvinit-195-13.14.1 typelib-1_0-GUdev-1_0-195-13.14.1 udev-195-13.14.1 udev-debuginfo-195-13.14.1 udev-mini-195-13.14.1 udev-mini-debuginfo-195-13.14.1 - openSUSE 12.3 (x86_64): libgudev-1_0-0-32bit-195-13.14.1 libgudev-1_0-0-debuginfo-32bit-195-13.14.1 libudev1-32bit-195-13.14.1 libudev1-debuginfo-32bit-195-13.14.1 systemd-32bit-195-13.14.1 systemd-debuginfo-32bit-195-13.14.1 References: https://bugzilla.novell.com/809843

1 0

openSUSE-RU-2013:0550-1: udisks2: provide a way to use /media to mount devices
by maintenance＠opensuse.org 27 Mar '13

27 Mar '13

openSUSE Recommended Update: udisks2: provide a way to use /media to mount devices ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0550-1 Rating: low References: #809837 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This udpate fixes the following issue for udisks2: - bnc#809837: provide a way to use /media to mount devices by setting UDISKS_FILESYSTEM_SHARED=1 device property Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-261 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libudisks2-0-2.0.0-5.4.1 libudisks2-0-debuginfo-2.0.0-5.4.1 typelib-1_0-UDisks-2_0-2.0.0-5.4.1 udisks2-2.0.0-5.4.1 udisks2-debuginfo-2.0.0-5.4.1 udisks2-debugsource-2.0.0-5.4.1 udisks2-devel-2.0.0-5.4.1 - openSUSE 12.3 (noarch): udisks2-lang-2.0.0-5.4.1 References: https://bugzilla.novell.com/809837

1 0

openSUSE-RU-2013:0548-1: xtrabackup: update to 2.0.6
by maintenance＠opensuse.org 27 Mar '13

27 Mar '13

openSUSE Recommended Update: xtrabackup: update to 2.0.6 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0548-1 Rating: low References: #810880 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Update for xtrabackup to version 2.0.6: - bnc#810880: * Individual InnoDB tablespaces with size less than 1MB were extended to 1MB on the backup prepare operation. This led to a large increase in disk usage in cases when there are many small InnoDB tablespaces. * Fixed the issue that caused databases corresponding to inaccessible datadir subdirectories to be ignored by XtraBackup without warning or error messages. This was happening because InnoDB code silently ignored datadir subdirectories it could not open. * Under some circumstances XtraBackup could fail to copy a tablespace with a high --parallel option value and a low innodb_open_files value. * Fixed a regression that caused individual partition backups to fail when used with --include option in innobackupex or the --tables option in xtrabackup. * innobackupex didn’t add the file-per-table setting for table-independent backups. Fixed by making XtraBackup auto-enable innodb_file_per_table when the --export option is used. * Under some circumstances XtraBackup could fail on a backup prepare with innodb_flush_method=O_DIRECT. * innobackupex did not pass the --tmpdir option to the xtrabackup binary resulting in the server’s tmpdir always being used for temporary files. * XtraBackup has improved the error reporting for unrecognized server versions. * innobackupex would fail when --no-lock and --rsync were used in conjunction. * Fix a regression that caused xtrabackup_pid file to remain in the temporary dir after execution. * Unnecessary debug messages have been removed from the XtraBackup output Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-260 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): xtrabackup-2.0.6-2.8.1 xtrabackup-debuginfo-2.0.6-2.8.1 xtrabackup-debugsource-2.0.6-2.8.1 References: https://bugzilla.novell.com/810880

1 0