May 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:0849-1: moderate: update for gpg2
by opensuse-security＠opensuse.org 31 May '13

31 May '13

openSUSE Security Update: update for gpg2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0849-1 Rating: moderate References: #780943 #798465 Cross-References: CVE-2012-6085 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update of gpg2 fixes two security issues: * fix for CVE-2012-6085 (bnc#798465) added gpg2-CVE-2012-6085.patch * fix for bnc#780943 added gpg2-set_umask_before_open_outfile.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-455 - openSUSE 12.1: zypper in -t patch openSUSE-2013-455 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): gpg2-2.0.19-2.4.1 gpg2-debuginfo-2.0.19-2.4.1 gpg2-debugsource-2.0.19-2.4.1 - openSUSE 12.2 (noarch): gpg2-lang-2.0.19-2.4.1 - openSUSE 12.1 (i586 x86_64): gpg2-2.0.18-7.4.1 gpg2-debuginfo-2.0.18-7.4.1 gpg2-debugsource-2.0.18-7.4.1 - openSUSE 12.1 (noarch): gpg2-lang-2.0.18-7.4.1 References: http://support.novell.com/security/cve/CVE-2012-6085.html https://bugzilla.novell.com/780943 https://bugzilla.novell.com/798465

1 0

openSUSE-SU-2013:0848-1: moderate: update for wireshark
by opensuse-security＠opensuse.org 31 May '13

31 May '13

openSUSE Security Update: update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0848-1 Rating: moderate References: #820566 Cross-References: CVE-2013-2486 CVE-2013-2487 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of wireshark includes several security and bug fixes. [bnc#820566] + vulnerabilities fixed: * The RELOAD dissector could go into an infinite loop. wnpa-sec-2013-23 CVE-2013-2486 CVE-2013-2487 * The GTPv2 dissector could crash. wnpa-sec-2013-24 * The ASN.1 BER dissector could crash. wnpa-sec-2013-25 * The PPP CCP dissector could crash. wnpa-sec-2013-26 * The DCP ETSI dissector could crash. wnpa-sec-2013-27 * The MPEG DSM-CC dissector could crash. wnpa-sec-2013-28 * The Websocket dissector could crash. wnpa-sec-2013-29 * The MySQL dissector could go into an infinite loop. wnpa-sec-2013-30 * The ETCH dissector could go into a large loop. wnpa-sec-2013-31 + Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.8.7.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-453 - openSUSE 12.1: zypper in -t patch openSUSE-2013-453 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): wireshark-1.8.7-1.27.1 wireshark-debuginfo-1.8.7-1.27.1 wireshark-debugsource-1.8.7-1.27.1 wireshark-devel-1.8.7-1.27.1 - openSUSE 12.1 (i586 x86_64): wireshark-1.8.7-3.45.1 wireshark-debuginfo-1.8.7-3.45.1 wireshark-debugsource-1.8.7-3.45.1 wireshark-devel-1.8.7-3.45.1 References: http://support.novell.com/security/cve/CVE-2013-2486.html http://support.novell.com/security/cve/CVE-2013-2487.html https://bugzilla.novell.com/820566

1 0

openSUSE-SU-2013:0847-1: important: kernel: security and bugfix update
by opensuse-security＠opensuse.org 31 May '13

31 May '13

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0847-1 Rating: important References: #806138 #806976 #806980 #808829 #809748 #813735 #815745 #819519 #819789 Cross-References: CVE-2013-0913 CVE-2013-1767 CVE-2013-1774 CVE-2013-1796 CVE-2013-1797 CVE-2013-1798 CVE-2013-2094 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: The openSUSE 12.1 kernel was updated to fix a severe secrutiy issue and various bugs. Security issues fixed: CVE-2013-2094: The perf_swevent_init function in kernel/events/core.c in the Linux kernel used an incorrect integer data type, which allowed local users to gain privileges via a crafted perf_event_open system call. CVE-2013-1774: The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter. CVE-2013-1928: The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel lacked a certain error check, which might have allowed local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device. CVE-2013-1796: The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel did not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allowed guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application. CVE-2013-1797: Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel allowed guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation. CVE-2013-1798: The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel did not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allowed guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application. CVE-2013-1767: Use-after-free vulnerability in the shmem_remount_fs function in mm/shmem.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (system crash) by remounting a tmpfs filesystem without specifying a required mpol (aka mempolicy) mount option. CVE-2013-0913: Integer overflow in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel allowed local users to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted application that triggers many relocation copies, and potentially leads to a race condition. Bugs fixed: - qlge: fix dma map leak when the last chunk is not allocated (bnc#819519). - TTY: fix atime/mtime regression (bnc#815745). - fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check (bnc#813735). - USB: io_ti: Fix NULL dereference in chase_port() (bnc#806976, CVE-2013-1774). - KVM: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache_init (bnc#806980 CVE-2013-1797). - KVM: Fix bounds checking in ioapic indirect register read (bnc#806980 CVE-2013-1798). - KVM: Fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (bnc#806980 CVE-2013-1796). - kabi/severities: Allow kvm module abi changes - modules are self consistent - loopdev: fix a deadlock (bnc#809748). - block: use i_size_write() in bd_set_size() (bnc#809748). - drm/i915: bounds check execbuffer relocation count (bnc#808829,CVE-2013-0913). - tmpfs: fix use-after-free of mempolicy object (bnc#806138, CVE-2013-1767). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-454 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): kernel-debug-3.1.10-1.23.1.g8645a72 kernel-debug-base-3.1.10-1.23.1.g8645a72 kernel-debug-base-debuginfo-3.1.10-1.23.1.g8645a72 kernel-debug-debuginfo-3.1.10-1.23.1.g8645a72 kernel-debug-debugsource-3.1.10-1.23.1.g8645a72 kernel-debug-devel-3.1.10-1.23.1.g8645a72 kernel-debug-devel-debuginfo-3.1.10-1.23.1.g8645a72 kernel-default-3.1.10-1.23.1.g8645a72 kernel-default-base-3.1.10-1.23.1.g8645a72 kernel-default-base-debuginfo-3.1.10-1.23.1.g8645a72 kernel-default-debuginfo-3.1.10-1.23.1.g8645a72 kernel-default-debugsource-3.1.10-1.23.1.g8645a72 kernel-default-devel-3.1.10-1.23.1.g8645a72 kernel-default-devel-debuginfo-3.1.10-1.23.1.g8645a72 kernel-desktop-3.1.10-1.23.1.g8645a72 kernel-desktop-base-3.1.10-1.23.1.g8645a72 kernel-desktop-base-debuginfo-3.1.10-1.23.1.g8645a72 kernel-desktop-debuginfo-3.1.10-1.23.1.g8645a72 kernel-desktop-debugsource-3.1.10-1.23.1.g8645a72 kernel-desktop-devel-3.1.10-1.23.1.g8645a72 kernel-desktop-devel-debuginfo-3.1.10-1.23.1.g8645a72 kernel-ec2-3.1.10-1.23.1.g8645a72 kernel-ec2-base-3.1.10-1.23.1.g8645a72 kernel-ec2-base-debuginfo-3.1.10-1.23.1.g8645a72 kernel-ec2-debuginfo-3.1.10-1.23.1.g8645a72 kernel-ec2-debugsource-3.1.10-1.23.1.g8645a72 kernel-ec2-devel-3.1.10-1.23.1.g8645a72 kernel-ec2-devel-debuginfo-3.1.10-1.23.1.g8645a72 kernel-ec2-extra-3.1.10-1.23.1.g8645a72 kernel-ec2-extra-debuginfo-3.1.10-1.23.1.g8645a72 kernel-syms-3.1.10-1.23.1.g8645a72 kernel-trace-3.1.10-1.23.1.g8645a72 kernel-trace-base-3.1.10-1.23.1.g8645a72 kernel-trace-base-debuginfo-3.1.10-1.23.1.g8645a72 kernel-trace-debuginfo-3.1.10-1.23.1.g8645a72 kernel-trace-debugsource-3.1.10-1.23.1.g8645a72 kernel-trace-devel-3.1.10-1.23.1.g8645a72 kernel-trace-devel-debuginfo-3.1.10-1.23.1.g8645a72 kernel-vanilla-3.1.10-1.23.1.g8645a72 kernel-vanilla-base-3.1.10-1.23.1.g8645a72 kernel-vanilla-base-debuginfo-3.1.10-1.23.1.g8645a72 kernel-vanilla-debuginfo-3.1.10-1.23.1.g8645a72 kernel-vanilla-debugsource-3.1.10-1.23.1.g8645a72 kernel-vanilla-devel-3.1.10-1.23.1.g8645a72 kernel-vanilla-devel-debuginfo-3.1.10-1.23.1.g8645a72 kernel-xen-3.1.10-1.23.1.g8645a72 kernel-xen-base-3.1.10-1.23.1.g8645a72 kernel-xen-base-debuginfo-3.1.10-1.23.1.g8645a72 kernel-xen-debuginfo-3.1.10-1.23.1.g8645a72 kernel-xen-debugsource-3.1.10-1.23.1.g8645a72 kernel-xen-devel-3.1.10-1.23.1.g8645a72 kernel-xen-devel-debuginfo-3.1.10-1.23.1.g8645a72 - openSUSE 12.1 (noarch): kernel-devel-3.1.10-1.23.1.g8645a72 kernel-docs-3.1.10-1.23.2.g8645a72 kernel-source-3.1.10-1.23.1.g8645a72 kernel-source-vanilla-3.1.10-1.23.1.g8645a72 - openSUSE 12.1 (i586): kernel-pae-3.1.10-1.23.1.g8645a72 kernel-pae-base-3.1.10-1.23.1.g8645a72 kernel-pae-base-debuginfo-3.1.10-1.23.1.g8645a72 kernel-pae-debuginfo-3.1.10-1.23.1.g8645a72 kernel-pae-debugsource-3.1.10-1.23.1.g8645a72 kernel-pae-devel-3.1.10-1.23.1.g8645a72 kernel-pae-devel-debuginfo-3.1.10-1.23.1.g8645a72 References: http://support.novell.com/security/cve/CVE-2013-0913.html http://support.novell.com/security/cve/CVE-2013-1767.html http://support.novell.com/security/cve/CVE-2013-1774.html http://support.novell.com/security/cve/CVE-2013-1796.html http://support.novell.com/security/cve/CVE-2013-1797.html http://support.novell.com/security/cve/CVE-2013-1798.html http://support.novell.com/security/cve/CVE-2013-2094.html https://bugzilla.novell.com/806138 https://bugzilla.novell.com/806976 https://bugzilla.novell.com/806980 https://bugzilla.novell.com/808829 https://bugzilla.novell.com/809748 https://bugzilla.novell.com/813735 https://bugzilla.novell.com/815745 https://bugzilla.novell.com/819519 https://bugzilla.novell.com/819789

1 0

openSUSE-SU-2013:0834-1: important: MozillaThunderbird: update to 17.0.6
by opensuse-security＠opensuse.org 27 May '13

27 May '13

openSUSE Security Update: MozillaThunderbird: update to 17.0.6 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0834-1 Rating: important References: #819204 Cross-References: CVE-2013-0801 CVE-2013-1669 CVE-2013-1670 CVE-2013-1674 CVE-2013-1675 CVE-2013-1676 CVE-2013-1677 CVE-2013-1678 CVE-2013-1679 CVE-2013-1680 CVE-2013-1681 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: MozillaThunderbird was updated to security update Thunderbird 17.0.6 (bnc#819204): * MFSA 2013-41/CVE-2013-0801/CVE-2013-1669 Miscellaneous memory safety hazards * MFSA 2013-42/CVE-2013-1670 (bmo#853709) Privileged access for content level constructor * MFSA 2013-46/CVE-2013-1674 (bmo#860971) Use-after-free with video and onresize event * MFSA 2013-47/CVE-2013-1675 (bmo#866825) Uninitialized functions in DOMSVGZoomEvent * MFSA 2013-48/CVE-2013-1676/CVE-2013-1677/CVE-2013-1678/ CVE-2013-1679/CVE-2013-1680/CVE-2013-1681 Memory corruption found using Address Sanitizer Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-447 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): MozillaThunderbird-17.0.6-49.43.1 MozillaThunderbird-buildsymbols-17.0.6-49.43.1 MozillaThunderbird-debuginfo-17.0.6-49.43.1 MozillaThunderbird-debugsource-17.0.6-49.43.1 MozillaThunderbird-devel-17.0.6-49.43.1 MozillaThunderbird-devel-debuginfo-17.0.6-49.43.1 MozillaThunderbird-translations-common-17.0.6-49.43.1 MozillaThunderbird-translations-other-17.0.6-49.43.1 enigmail-1.5.1+17.0.6-49.43.1 enigmail-debuginfo-1.5.1+17.0.6-49.43.1 References: http://support.novell.com/security/cve/CVE-2013-0801.html http://support.novell.com/security/cve/CVE-2013-1669.html http://support.novell.com/security/cve/CVE-2013-1670.html http://support.novell.com/security/cve/CVE-2013-1674.html http://support.novell.com/security/cve/CVE-2013-1675.html http://support.novell.com/security/cve/CVE-2013-1676.html http://support.novell.com/security/cve/CVE-2013-1677.html http://support.novell.com/security/cve/CVE-2013-1678.html http://support.novell.com/security/cve/CVE-2013-1679.html http://support.novell.com/security/cve/CVE-2013-1680.html http://support.novell.com/security/cve/CVE-2013-1681.html https://bugzilla.novell.com/819204

1 0

openSUSE-RU-2013:0833-1: phonon: Fixes loading of plugins
by maintenance＠opensuse.org 27 May '13

27 May '13

openSUSE Recommended Update: phonon: Fixes loading of plugins ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0833-1 Rating: low References: Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issue with phonon: - Fixes loading of plugins outside of KDE sessions although the plugins are installed in the KDE directory Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-445 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libphonon4-4.6.0-3.5.1 libphonon4-debuginfo-4.6.0-3.5.1 phonon-debugsource-4.6.0-3.5.1 phonon-devel-4.6.0-3.5.1 phonon-devel-debuginfo-4.6.0-3.5.1 - openSUSE 12.2 (x86_64): libphonon4-32bit-4.6.0-3.5.1 libphonon4-debuginfo-32bit-4.6.0-3.5.1 References:

1 0

openSUSE-RU-2013:0832-1: Rebuild kernel-kmps and perf against the current kernel to fix conflicts
by maintenance＠opensuse.org 27 May '13

27 May '13

openSUSE Recommended Update: Rebuild kernel-kmps and perf against the current kernel to fix conflicts ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0832-1 Rating: low References: Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update rebuilds the kernel-kmps and perf against the current kernel to fix conflicts Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-444 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): cloop-2.639-6.6.1 cloop-debuginfo-2.639-6.6.1 cloop-debugsource-2.639-6.6.1 cloop-kmp-default-2.639_k3.4.33_2.24-6.6.1 cloop-kmp-default-debuginfo-2.639_k3.4.33_2.24-6.6.1 cloop-kmp-desktop-2.639_k3.4.33_2.24-6.6.1 cloop-kmp-desktop-debuginfo-2.639_k3.4.33_2.24-6.6.1 cloop-kmp-xen-2.639_k3.4.33_2.24-6.6.1 cloop-kmp-xen-debuginfo-2.639_k3.4.33_2.24-6.6.1 crash-6.0.7-2.7.1 crash-debuginfo-6.0.7-2.7.1 crash-debugsource-6.0.7-2.7.1 crash-devel-6.0.7-2.7.1 crash-doc-6.0.7-2.7.1 crash-gcore-6.0.7-2.7.1 crash-gcore-debuginfo-6.0.7-2.7.1 crash-kmp-default-6.0.7_k3.4.33_2.24-2.7.1 crash-kmp-default-debuginfo-6.0.7_k3.4.33_2.24-2.7.1 crash-kmp-desktop-6.0.7_k3.4.33_2.24-2.7.1 crash-kmp-desktop-debuginfo-6.0.7_k3.4.33_2.24-2.7.1 crash-kmp-xen-6.0.7_k3.4.33_2.24-2.7.1 crash-kmp-xen-debuginfo-6.0.7_k3.4.33_2.24-2.7.1 crash-sial-6.0.7-2.7.1 crash-sial-debuginfo-6.0.7-2.7.1 hdjmod-debugsource-1.28-10.6.1 hdjmod-kmp-default-1.28_k3.4.33_2.24-10.6.1 hdjmod-kmp-default-debuginfo-1.28_k3.4.33_2.24-10.6.1 hdjmod-kmp-desktop-1.28_k3.4.33_2.24-10.6.1 hdjmod-kmp-desktop-debuginfo-1.28_k3.4.33_2.24-10.6.1 hdjmod-kmp-xen-1.28_k3.4.33_2.24-10.6.1 hdjmod-kmp-xen-debuginfo-1.28_k3.4.33_2.24-10.6.1 ipset-6.12-2.6.1 ipset-debuginfo-6.12-2.6.1 ipset-debugsource-6.12-2.6.1 ipset-devel-6.12-2.6.1 ipset-kmp-default-6.12_k3.4.33_2.24-2.6.1 ipset-kmp-default-debuginfo-6.12_k3.4.33_2.24-2.6.1 ipset-kmp-desktop-6.12_k3.4.33_2.24-2.6.1 ipset-kmp-desktop-debuginfo-6.12_k3.4.33_2.24-2.6.1 ipset-kmp-xen-6.12_k3.4.33_2.24-2.6.1 ipset-kmp-xen-debuginfo-6.12_k3.4.33_2.24-2.6.1 libipset2-6.12-2.6.1 libipset2-debuginfo-6.12-2.6.1 libvmtools-devel-8.8.2-3.6.4 libvmtools0-8.8.2-3.6.4 libvmtools0-debuginfo-8.8.2-3.6.4 ndiswrapper-1.57.99-2.6.1 ndiswrapper-debuginfo-1.57.99-2.6.1 ndiswrapper-debugsource-1.57.99-2.6.1 ndiswrapper-kmp-default-1.57.99_k3.4.33_2.24-2.6.1 ndiswrapper-kmp-default-debuginfo-1.57.99_k3.4.33_2.24-2.6.1 ndiswrapper-kmp-desktop-1.57.99_k3.4.33_2.24-2.6.1 ndiswrapper-kmp-desktop-debuginfo-1.57.99_k3.4.33_2.24-2.6.1 omnibook-debugsource-20110911-5.6.1 omnibook-kmp-default-20110911_k3.4.33_2.24-5.6.1 omnibook-kmp-default-debuginfo-20110911_k3.4.33_2.24-5.6.1 omnibook-kmp-desktop-20110911_k3.4.33_2.24-5.6.1 omnibook-kmp-desktop-debuginfo-20110911_k3.4.33_2.24-5.6.1 omnibook-kmp-xen-20110911_k3.4.33_2.24-5.6.1 omnibook-kmp-xen-debuginfo-20110911_k3.4.33_2.24-5.6.1 open-vm-tools-8.8.2-3.6.4 open-vm-tools-debuginfo-8.8.2-3.6.4 open-vm-tools-debugsource-8.8.2-3.6.4 open-vm-tools-gui-8.8.2-3.6.4 open-vm-tools-gui-debuginfo-8.8.2-3.6.4 pcfclock-0.44-253.6.1 pcfclock-debuginfo-0.44-253.6.1 pcfclock-debugsource-0.44-253.6.1 pcfclock-kmp-default-0.44_k3.4.33_2.24-253.6.1 pcfclock-kmp-default-debuginfo-0.44_k3.4.33_2.24-253.6.1 pcfclock-kmp-desktop-0.44_k3.4.33_2.24-253.6.1 pcfclock-kmp-desktop-debuginfo-0.44_k3.4.33_2.24-253.6.1 perf-3.4.33-20.4.1 perf-debuginfo-3.4.33-20.4.1 perf-debugsource-3.4.33-20.4.1 python-virtualbox-4.1.22-1.14.6 python-virtualbox-debuginfo-4.1.22-1.14.6 vhba-kmp-debugsource-20120422-2.6.1 vhba-kmp-default-20120422_k3.4.33_2.24-2.6.1 vhba-kmp-default-debuginfo-20120422_k3.4.33_2.24-2.6.1 vhba-kmp-desktop-20120422_k3.4.33_2.24-2.6.1 vhba-kmp-desktop-debuginfo-20120422_k3.4.33_2.24-2.6.1 vhba-kmp-xen-20120422_k3.4.33_2.24-2.6.1 vhba-kmp-xen-debuginfo-20120422_k3.4.33_2.24-2.6.1 virtualbox-4.1.22-1.14.6 virtualbox-debuginfo-4.1.22-1.14.6 virtualbox-debugsource-4.1.22-1.14.6 virtualbox-devel-4.1.22-1.14.6 virtualbox-guest-kmp-default-4.1.22_k3.4.33_2.24-1.14.6 virtualbox-guest-kmp-default-debuginfo-4.1.22_k3.4.33_2.24-1.14.6 virtualbox-guest-kmp-desktop-4.1.22_k3.4.33_2.24-1.14.6 virtualbox-guest-kmp-desktop-debuginfo-4.1.22_k3.4.33_2.24-1.14.6 virtualbox-guest-tools-4.1.22-1.14.6 virtualbox-guest-tools-debuginfo-4.1.22-1.14.6 virtualbox-guest-x11-4.1.22-1.14.6 virtualbox-guest-x11-debuginfo-4.1.22-1.14.6 virtualbox-host-kmp-default-4.1.22_k3.4.33_2.24-1.14.6 virtualbox-host-kmp-default-debuginfo-4.1.22_k3.4.33_2.24-1.14.6 virtualbox-host-kmp-desktop-4.1.22_k3.4.33_2.24-1.14.6 virtualbox-host-kmp-desktop-debuginfo-4.1.22_k3.4.33_2.24-1.14.6 virtualbox-qt-4.1.22-1.14.6 virtualbox-qt-debuginfo-4.1.22-1.14.6 virtualbox-websrv-4.1.22-1.14.6 virtualbox-websrv-debuginfo-4.1.22-1.14.6 vmware-guest-kmp-default-8.8.2_k3.4.33_2.24-3.6.4 vmware-guest-kmp-default-debuginfo-8.8.2_k3.4.33_2.24-3.6.4 vmware-guest-kmp-desktop-8.8.2_k3.4.33_2.24-3.6.4 vmware-guest-kmp-desktop-debuginfo-8.8.2_k3.4.33_2.24-3.6.4 xen-debugsource-4.1.4_02-5.25.6 xen-devel-4.1.4_02-5.25.6 xen-kmp-default-4.1.4_02_k3.4.33_2.24-5.25.6 xen-kmp-default-debuginfo-4.1.4_02_k3.4.33_2.24-5.25.6 xen-kmp-desktop-4.1.4_02_k3.4.33_2.24-5.25.6 xen-kmp-desktop-debuginfo-4.1.4_02_k3.4.33_2.24-5.25.6 xen-libs-4.1.4_02-5.25.6 xen-libs-debuginfo-4.1.4_02-5.25.6 xen-tools-domU-4.1.4_02-5.25.6 xen-tools-domU-debuginfo-4.1.4_02-5.25.6 xtables-addons-1.42-2.13.1 xtables-addons-debuginfo-1.42-2.13.1 xtables-addons-debugsource-1.42-2.13.1 xtables-addons-kmp-default-1.42_k3.4.33_2.24-2.13.1 xtables-addons-kmp-default-debuginfo-1.42_k3.4.33_2.24-2.13.1 xtables-addons-kmp-desktop-1.42_k3.4.33_2.24-2.13.1 xtables-addons-kmp-desktop-debuginfo-1.42_k3.4.33_2.24-2.13.1 xtables-addons-kmp-xen-1.42_k3.4.33_2.24-2.13.1 xtables-addons-kmp-xen-debuginfo-1.42_k3.4.33_2.24-2.13.1 - openSUSE 12.2 (x86_64): xen-4.1.4_02-5.25.6 xen-doc-html-4.1.4_02-5.25.6 xen-doc-pdf-4.1.4_02-5.25.6 xen-libs-32bit-4.1.4_02-5.25.6 xen-libs-debuginfo-32bit-4.1.4_02-5.25.6 xen-tools-4.1.4_02-5.25.6 xen-tools-debuginfo-4.1.4_02-5.25.6 - openSUSE 12.2 (i586): cloop-kmp-pae-2.639_k3.4.33_2.24-6.6.1 cloop-kmp-pae-debuginfo-2.639_k3.4.33_2.24-6.6.1 crash-kmp-pae-6.0.7_k3.4.33_2.24-2.7.1 crash-kmp-pae-debuginfo-6.0.7_k3.4.33_2.24-2.7.1 hdjmod-kmp-pae-1.28_k3.4.33_2.24-10.6.1 hdjmod-kmp-pae-debuginfo-1.28_k3.4.33_2.24-10.6.1 ipset-kmp-pae-6.12_k3.4.33_2.24-2.6.1 ipset-kmp-pae-debuginfo-6.12_k3.4.33_2.24-2.6.1 ndiswrapper-kmp-pae-1.57.99_k3.4.33_2.24-2.6.1 ndiswrapper-kmp-pae-debuginfo-1.57.99_k3.4.33_2.24-2.6.1 omnibook-kmp-pae-20110911_k3.4.33_2.24-5.6.1 omnibook-kmp-pae-debuginfo-20110911_k3.4.33_2.24-5.6.1 pcfclock-kmp-pae-0.44_k3.4.33_2.24-253.6.1 pcfclock-kmp-pae-debuginfo-0.44_k3.4.33_2.24-253.6.1 vhba-kmp-pae-20120422_k3.4.33_2.24-2.6.1 vhba-kmp-pae-debuginfo-20120422_k3.4.33_2.24-2.6.1 virtualbox-guest-kmp-pae-4.1.22_k3.4.33_2.24-1.14.6 virtualbox-guest-kmp-pae-debuginfo-4.1.22_k3.4.33_2.24-1.14.6 virtualbox-host-kmp-pae-4.1.22_k3.4.33_2.24-1.14.6 virtualbox-host-kmp-pae-debuginfo-4.1.22_k3.4.33_2.24-1.14.6 vmware-guest-kmp-pae-8.8.2_k3.4.33_2.24-3.6.4 vmware-guest-kmp-pae-debuginfo-8.8.2_k3.4.33_2.24-3.6.4 xen-kmp-pae-4.1.4_02_k3.4.33_2.24-5.25.6 xen-kmp-pae-debuginfo-4.1.4_02_k3.4.33_2.24-5.25.6 xtables-addons-kmp-pae-1.42_k3.4.33_2.24-2.13.1 xtables-addons-kmp-pae-debuginfo-1.42_k3.4.33_2.24-2.13.1 References:

1 0

openSUSE-SU-2013:0831-1: important: xulrunner to 17.0.6esr
by opensuse-security＠opensuse.org 27 May '13

27 May '13

openSUSE Security Update: xulrunner to 17.0.6esr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0831-1 Rating: important References: #819204 Cross-References: CVE-2013-0801 CVE-2013-1669 CVE-2013-1670 CVE-2013-1674 CVE-2013-1675 CVE-2013-1676 CVE-2013-1677 CVE-2013-1678 CVE-2013-1679 CVE-2013-1680 CVE-2013-1681 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: Mozilla xulrunner was updated to 17.0.6esr (bnc#819204) * MFSA 2013-41/CVE-2013-0801/CVE-2013-1669 Miscellaneous memory safety hazards * MFSA 2013-42/CVE-2013-1670 (bmo#853709) Privileged access for content level constructor * MFSA 2013-46/CVE-2013-1674 (bmo#860971) Use-after-free with video and onresize event * MFSA 2013-47/CVE-2013-1675 (bmo#866825) Uninitialized functions in DOMSVGZoomEvent * MFSA 2013-48/CVE-2013-1676/CVE-2013-1677/CVE-2013-1678/ CVE-2013-1679/CVE-2013-1680/CVE-2013-1681 Memory corruption found using Address Sanitizer Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-448 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): mozilla-js-17.0.6-2.42.1 mozilla-js-debuginfo-17.0.6-2.42.1 xulrunner-17.0.6-2.42.1 xulrunner-buildsymbols-17.0.6-2.42.1 xulrunner-debuginfo-17.0.6-2.42.1 xulrunner-debugsource-17.0.6-2.42.1 xulrunner-devel-17.0.6-2.42.1 xulrunner-devel-debuginfo-17.0.6-2.42.1 - openSUSE 12.2 (x86_64): mozilla-js-32bit-17.0.6-2.42.1 mozilla-js-debuginfo-32bit-17.0.6-2.42.1 xulrunner-32bit-17.0.6-2.42.1 xulrunner-debuginfo-32bit-17.0.6-2.42.1 References: http://support.novell.com/security/cve/CVE-2013-0801.html http://support.novell.com/security/cve/CVE-2013-1669.html http://support.novell.com/security/cve/CVE-2013-1670.html http://support.novell.com/security/cve/CVE-2013-1674.html http://support.novell.com/security/cve/CVE-2013-1675.html http://support.novell.com/security/cve/CVE-2013-1676.html http://support.novell.com/security/cve/CVE-2013-1677.html http://support.novell.com/security/cve/CVE-2013-1678.html http://support.novell.com/security/cve/CVE-2013-1679.html http://support.novell.com/security/cve/CVE-2013-1680.html http://support.novell.com/security/cve/CVE-2013-1681.html https://bugzilla.novell.com/819204

1 0

openSUSE-RU-2013:0829-2: important: duplicity: fixed data corruption when resuming interrupted backup
by maintenance＠opensuse.org 27 May '13

27 May '13

openSUSE Recommended Update: duplicity: fixed data corruption when resuming interrupted backup ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0829-2 Rating: important References: #813319 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Duplicity was upgraded to prevent data corruption when resuming an interrupted backup. If you use the DejaDup backup tool, consider switching to a new backup location to ensure restorations from the new location are safe. This affects both encrypted and unencrypted backups. (bnc#813319) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-443 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): duplicity-0.6.18-2.4.1 duplicity-debuginfo-0.6.18-2.4.1 duplicity-debugsource-0.6.18-2.4.1 References: https://bugzilla.novell.com/813319

1 0

openSUSE-RU-2013:0829-1: important: duplicity: fixed data corruption when resuming interrupted backup
by maintenance＠opensuse.org 27 May '13

27 May '13

openSUSE Recommended Update: duplicity: fixed data corruption when resuming interrupted backup ______________________________________________________________________________ Announcement ID: openSUSE-RU-2013:0829-1 Rating: important References: #813319 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Duplicity was upgraded to prevent data corruption when resuming an interrupted backup. If you use the DejaDup backup tool, consider switching to a new backup location to ensure restorations from the new location are safe. This affects both encrypted and unencrypted backups. (bnc#813319) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2013-443 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): duplicity-0.6.15-2.4.1 duplicity-debuginfo-0.6.15-2.4.1 duplicity-debugsource-0.6.15-2.4.1 References: https://bugzilla.novell.com/813319

1 0

openSUSE-SU-2013:0826-1: moderate: Package icedtea-web was updated to version 1.4.
by opensuse-security＠opensuse.org 24 May '13

24 May '13

openSUSE Security Update: Package icedtea-web was updated to version 1.4. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0826-1 Rating: moderate References: #818768 Cross-References: CVE-2012-3422 CVE-2012-3423 CVE-2013-1926 CVE-2013-1927 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Changes in icedtea-web with update to 1.4 (bnc#818768): * Added cs, de, pl localization * Splash screen for javaws and plugin * Better error reporting for plugin via Error-splash-screen * All IcedTea-Web dialogues are centered to middle of active screen * Download indicator made compact for more then one jar * User can select its own JVM via itw-settings and deploy.properties. * Added extended applets security settings and dialogue * Security updates - CVE-2013-1926, RH916774: Class-loader incorrectly shared for applets with same relative-path. - CVE-2013-1927, RH884705: fixed gifar vulnerabilit - CVE-2012-3422, RH840592: Potential read from an uninitialized memory location - CVE-2012-3423, RH841345: Incorrect handling of not 0-terminated strings * NetX - PR1027: DownloadService is not supported by IcedTea-Web - PR725: JNLP applications will prompt for creating desktop shortcuts every time they are run - PR1292: Javaws does not resolve versioned jar names with periods correctly * Plugin - PR1106: Buffer overflow in plugin table- - PR1166: Embedded JNLP File is not supported in applet tag - PR1217: Add command line arguments for plugins - PR1189: Icedtea-plugin requires code attribute when using jnlp_href - PR1198: JSObject is not passed to javascript correctly - PR1260: IcedTea-Web should not rely on GTK - PR1157: Applets can hang browser after fatal exception - PR580: http://www.horaoficial.cl/ loads improperly * Common - PR1049: Extension jnlp's signed jar with the content of only META-INF/* is considered - PR955: regression: SweetHome3D fails to run - PR1145: IcedTea-Web can cause ClassCircularityError - PR1161: X509VariableTrustManager does not work correctly with OpenJDK7 - PR822: Applets fail to load if jars have different signers - PR1186: System.getProperty("deployment.user.security.trusted.cacerts ") is null - PR909: The Java applet at http://de.gosupermodel.com/games/wardrobegame.jsp fails - PR1299: WebStart doesn't read socket proxy settings from firefox correctly Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-439 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): icedtea-web-1.4-1.17.1 icedtea-web-debuginfo-1.4-1.17.1 icedtea-web-debugsource-1.4-1.17.1 - openSUSE 12.2 (noarch): icedtea-web-javadoc-1.4-1.17.1 References: http://support.novell.com/security/cve/CVE-2012-3422.html http://support.novell.com/security/cve/CVE-2012-3423.html http://support.novell.com/security/cve/CVE-2013-1926.html http://support.novell.com/security/cve/CVE-2013-1927.html https://bugzilla.novell.com/818768

1 0