April 2014 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2014:0587-1: kiwi: Updates package to version 5.05.59
by maintenance＠opensuse.org 30 Apr '14

30 Apr '14

openSUSE Recommended Update: kiwi: Updates package to version 5.05.59 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0587-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issue with kiwi: - v5.05.59 released - Fixed message logging * don't log message to already closed file descriptor - Removed done statement from last Kiwi message * The Done message at the last line was confusing, especially when KIWI exited with errors. To keep consistency and since the done message wasn't really needed because the last message is not a task it was also removed for the success messages. - Added runtime check for Boot description * The test looks up the required boot image description according to the selected build type. if no such description exists, the build exit with an error telling the user which rpm package is missing on the build machine Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-323 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): kiwi-5.05.59-16.2 kiwi-debugsource-5.05.59-16.2 kiwi-desc-isoboot-requires-5.05.59-16.2 kiwi-desc-netboot-requires-5.05.59-16.2 kiwi-desc-oemboot-requires-5.05.59-16.2 kiwi-desc-vmxboot-requires-5.05.59-16.2 kiwi-tools-5.05.59-16.2 kiwi-tools-debuginfo-5.05.59-16.2 - openSUSE 13.1 (noarch): kiwi-desc-isoboot-5.05.59-16.2 kiwi-desc-netboot-5.05.59-16.2 kiwi-desc-oemboot-5.05.59-16.2 kiwi-desc-vmxboot-5.05.59-16.2 kiwi-doc-5.05.59-16.2 kiwi-instsource-5.05.59-16.2 kiwi-media-requires-5.05.59-16.2 kiwi-pxeboot-5.05.59-16.2 kiwi-templates-5.05.59-16.2 kiwi-test-5.05.59-16.2 References:

1 0

openSUSE-RU-2014:0586-1: moderate: php5-pear-phpunit(-PHP_CodeCoverage): Update to current version to support PHPUnit_MockObject
by maintenance＠opensuse.org 30 Apr '14

30 Apr '14

openSUSE Recommended Update: php5-pear-phpunit(-PHP_CodeCoverage): Update to current version to support PHPUnit_MockObject ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0586-1 Rating: moderate References: #868699 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issues with php5-pear-phpunit and php5-pear-phpunit-PHP_CodeCoverage and adds php5-pear-symfony2-Yaml and php5-pear-channel-symfony2 as new packages. - php5-pear-phpunit: * bnc#868699: Update to version 3.7.28 * Stubbing/Mocking does not work in process isolation when using PHPUnit PHAR * Backtrace on Windows (phar) not being filtered properly * phpunit.phar is missing resources (such as templates) * Upgraded bundled version of PHP_TokenStream in the PHP Archive (PHAR) distribution of PHPUnit. * Upgraded bundled versions of PHP_CodeCoverage and PHPUnit_Selenium in the PHP Archive (PHAR) distribution of PHPUnit. * Process Isolation does not work when using PHPUnit from a PHP Archive (PHAR) * Dependencies updated to latest version in PHP Archive (PHAR) distribution. * Do not die on binary output with JSON logging. * Implemented a workaround for PHP bug #63055. * It is now possible to use generators as data providers. * Account for auto-globals-jit when setting $_ENV and $_SERVER variables in the xml config. * PHPUnit depends on packages that broke backwards compatibility. * Stand-alone functions logicalAnd(), logicalOr(), and logicalXor() did not work. * Suppress open_basedir warnings while searching for the composer autoloader. * Correctly parse single-line @expectedException annotations. * Better messages when JSON-related assertions receive invalid JSON. * Use the proper toString() method inside PHPUnit_Framework_TestFailure::toString(). * Allow symfony/yaml >=2.0,<3.0 * Don't rely on composer to set up the include_path for ErrorHandler.php. * assertTag() fails to match content in CDATA sections. * Version requirement for symfony/yaml is too restrictive. * Number of tests to run calculated incorrectly when --repeat is used. * Make sure the autoloader for PEAR-based installation is not used when PHPUnit is installed via Composer. * Process isolation not working on windows if there are spaces in path to php.exe * PHP notice in PHPUnit_Util_XML * NaN is not equal to NaN now to match PHPs behavior * Mocking a method with a reference to an object made argument matches fail. * Ensure isolation tests display errors so they can be handled by the test runner. * Fixed sebastianbergmann/phpunit-mock-objects#81. * Fixed an issue where PHP complained about an undeclared $time variable when running tests in strict mode. * Fixed version number. * Fixed installation issue for Symfony/Yaml. * assertJsonStringEqualsJsonFile didn't work with json arrays. * phpunit.phar cannot be executed if it is renamed. * Fixed error message when assertArrayHasKey() and assertArrayNotHasKey() are invoked with wrong arguments. * JSON matcher source files missing from package.xml. * Invoke autoloader when checking for Symfony\Component\Yaml\Dumper. * Added missing file to PEAR package. * phpunit script appears in stacktrace (when PHPUnit is installed through Composer). * PHPUnit now uses $_SERVER['SCRIPT_NAME'] instead of $_SERVER['_'] to filter the phpunit script (as the latter is not set when PHPUnit is invoked from Apache Ant's <exec> task, for instance). * phpunit script appears in stacktrace. * Improvements to running PHPUnit from a PHAR. * Always clean up mock objects (and free up memory) * Do not rely on autoloader class map to populate blacklist. * Added the addUncoveredFilesFromWhitelist configuration setting back in. * Reverted 'More than two positional arguments provided' check as it turned out to be a BC issue. * Disable token caching (in PHP_TokenStream, used by PHP_CodeCoverage) by default (to reduce memory footprint). * The version number is now displayed when using PHPUnit from a Composer install or Git checkout. * PHPUnit 3.7 is only supported on PHP 5.3.3 (or later) and PHP 5.4.7 (or later) is highly recommended. * When using process-isolation don't die silently when unserializing the test result fails. * Added a callback constraint that is useful for making complex assertions. * Restore current working directory if is changed by a test case. * Added --test-suffix that allows specifying which filename suffixes are recognised by PHPUnit. * assertArrayHasKey() and assertArrayNotHasKey() now work with objects that implement ArrayAccess. * Improved reporting when there are unused CLI arguments to avoid misconceptions. * Show messages and stracktraces in JSON output for skipped and incomplete tests. * Added assertJson* functions that work like the existing assertXml* functions. * PHPUnit now provides a configuration.xsd schema file at http://schema.phpunit.de/configuration.xsd that can be used to validate your phpunit.xml and phpunit.xml.dist configuration files. * Added --testsuite argument, allowing to filter files/directory by parent testsuite name attribute. * Expanded the @requires annotation to allow for checking the existence of functions and extensions using multiple @requires function name statements. * @expectedExceptionCode and @expectedExceptionMessage can now use constants like Classname::CONST as their parameters. They will get evaluated if the class constant exists and used for comparison so test authors can avoid duplication. * Test listeners now trigger one autoload call instead of being silently ignored when the class was not loaded. * Failed assertStringMatchesFormat() calls now produce a better readable diff by only marking lines as different that don't match the format specifiers. * Added assertContainsOnlyInstancesOf() to help checking Collection objects and arrays with a descriptive assertion. * When an @expectedException fails it now shows - php5-pear-phpunit-PHP_CodeCoverage: * Update to version 1.2.13 * Fixed the origin of the coordinate system for the dashboard charts * JavaScript error in the HTML report. * Fixing an issue where an anonymous function as the last "method" in a class would cause the coverage report to ignore the rest. * Blacklisted PHPUnit Phar. * Executable code on a line that has a comment is processed incorrectly. * Eliminated the coupling to PHPUnit_Util_Printer in PHP_CodeCoverage_Report_Text. * Improved rendering of "lines covered" numbers for functions and methods with long names or argument lists. * Fixed the title of the Y axis of the Code Coverage ./. Cyclomatic Complexity dashboard chart. * Upgraded to Highcharts 2.3.5. * Upgraded to jQuery 1.9.1. * Reduced vertical whitespace in sourcecode view. * Upgraded to Bootstrap 2.2.2. * The html5shiv.js is now bundled. * @coversNothing didn't work as documented. * E_NOTICE thrown when generating coverage report. * Fixed regression introduced in PHP_CodeCoverage 1.2.4. * Incorrect code coverage for interfaces. * Do not rely on autoloader class map to populate blacklist. * Added support for parentheses after method names in the @covers annotation. * When addUncoveredFilesFromWhitelist=FALSE is set then files that are whitelisted but not covered by a single test are now excluded from the code coverage. * Non-english locales broke the coverage bars in the HTML report. * Percentage for tested classes and traits displayed incorrectly. * One line @covers annotations did not work. * Backwards compatibility wrapper for trait_exists() does not work. * Fixed invalid markup in the HTML report. * The version number is now displayed when using PHP_CodeCoverage from a Composer install or Git checkout. * The HTML report has been redesigned. * The new @coversDefaultClass annotation enables short @covers annotations when working with long class names or namespaces. * The new @coversNothing annotation can be used so tests do not record any code coverage. Useful for integration testing. * When processUncoveredFilesFromWhitelist=FALSE is set then files that are whitelisted but not covered by a single test are now included in the code coverage but with all lines, including those that are not executable, counted as not executed. * PHP_CodeCoverage 1.2 is only supported on PHP 5.3.3 (or later) and PHP 5.4.7 (or later) is highly recommended. - php5-pear-symfony-Yaml: * Initial pacakge at version 2.3.2 - php5-pear-channel-symfony2: * Initial package at version 1.0 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-324 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): php5-pear-channel-symfony2-1.0-2.1 php5-pear-phpunit-3.7.28-6.4.1 php5-pear-phpunit-PHP_CodeCoverage-1.2.13-7.4.1 php5-pear-symfony2-Yaml-2.3.2-2.1 References: https://bugzilla.novell.com/868699

1 0

openSUSE-SU-2014:0585-1: critical: update for flash-player
by opensuse-security＠opensuse.org 30 Apr '14

30 Apr '14

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0585-1 Rating: critical References: #875577 Cross-References: CVE-2014-0515 Affected Products: openSUSE 13.1:NonFree openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This flash-player update fixes a critical buffer overflow vulnerability that leads to arbitrary code execution. The flash-player package was updated to version 11.2.202.356. * bnc#875577, APSB14-13, CVE-2014-0515 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2014-322 - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2014-322 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.356-46.1 flash-player-gnome-11.2.202.356-46.1 flash-player-kde4-11.2.202.356-46.1 - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.356-2.72.1 flash-player-gnome-11.2.202.356-2.72.1 flash-player-kde4-11.2.202.356-2.72.1 References: http://support.novell.com/security/cve/CVE-2014-0515.html https://bugzilla.novell.com/875577

1 0

openSUSE-SU-2014:0584-1: important: MozillaThunderbird,seamonkey
by opensuse-security＠opensuse.org 30 Apr '14

30 Apr '14

openSUSE Security Update: MozillaThunderbird,seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0584-1 Rating: important References: #868603 Cross-References: CVE-2014-1493 CVE-2014-1494 CVE-2014-1497 CVE-2014-1498 CVE-2014-1499 CVE-2014-1500 CVE-2014-1502 CVE-2014-1504 CVE-2014-1505 CVE-2014-1508 CVE-2014-1509 CVE-2014-1510 CVE-2014-1511 CVE-2014-1512 CVE-2014-1513 CVE-2014-1514 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: Mozilla Thunderbird was updated to 24.4.0. Mozilla SeaMonkey was updated to 2.25. * MFSA 2014-15/CVE-2014-1493/CVE-2014-1494 Miscellaneous memory safety hazards * MFSA 2014-17/CVE-2014-1497 (bmo#966311) Out of bounds read during WAV file decoding * MFSA 2014-18/CVE-2014-1498 (bmo#935618) crypto.generateCRMFRequest does not validate type of key * MFSA 2014-19/CVE-2014-1499 (bmo#961512) Spoofing attack on WebRTC permission prompt * MFSA 2014-20/CVE-2014-1500 (bmo#956524) onbeforeunload and Javascript navigation DOS * MFSA 2014-22/CVE-2014-1502 (bmo#972622) WebGL content injection from one domain to rendering in another * MFSA 2014-23/CVE-2014-1504 (bmo#911547) Content Security Policy for data: documents not preserved by session restore * MFSA 2014-26/CVE-2014-1508 (bmo#963198) Information disclosure through polygon rendering in MathML * MFSA 2014-27/CVE-2014-1509 (bmo#966021) Memory corruption in Cairo during PDF font rendering * MFSA 2014-28/CVE-2014-1505 (bmo#941887) SVG filters information disclosure through feDisplacementMap * MFSA 2014-29/CVE-2014-1510/CVE-2014-1511 (bmo#982906, bmo#982909) Privilege escalation using WebIDL-implemented APIs * MFSA 2014-30/CVE-2014-1512 (bmo#982957) Use-after-free in TypeObject * MFSA 2014-31/CVE-2014-1513 (bmo#982974) Out-of-bounds read/write through neutering ArrayBuffer objects * MFSA 2014-32/CVE-2014-1514 (bmo#983344) Out-of-bounds write through TypedArrayObject after neutering Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-321 - openSUSE 12.3: zypper in -t patch openSUSE-2014-321 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-24.4.0-70.15.8 MozillaThunderbird-buildsymbols-24.4.0-70.15.8 MozillaThunderbird-debuginfo-24.4.0-70.15.8 MozillaThunderbird-debugsource-24.4.0-70.15.8 MozillaThunderbird-devel-24.4.0-70.15.8 MozillaThunderbird-translations-common-24.4.0-70.15.8 MozillaThunderbird-translations-other-24.4.0-70.15.8 enigmail-1.6.0+24.4.0-70.15.8 enigmail-debuginfo-1.6.0+24.4.0-70.15.8 seamonkey-2.25-16.7 seamonkey-debuginfo-2.25-16.7 seamonkey-debugsource-2.25-16.7 seamonkey-dom-inspector-2.25-16.7 seamonkey-irc-2.25-16.7 seamonkey-translations-common-2.25-16.7 seamonkey-translations-other-2.25-16.7 seamonkey-venkman-2.25-16.7 - openSUSE 12.3 (i586 x86_64): MozillaThunderbird-24.4.0-61.43.5 MozillaThunderbird-buildsymbols-24.4.0-61.43.5 MozillaThunderbird-debuginfo-24.4.0-61.43.5 MozillaThunderbird-debugsource-24.4.0-61.43.5 MozillaThunderbird-devel-24.4.0-61.43.5 MozillaThunderbird-translations-common-24.4.0-61.43.5 MozillaThunderbird-translations-other-24.4.0-61.43.5 enigmail-1.6.0+24.4.0-61.43.5 enigmail-debuginfo-1.6.0+24.4.0-61.43.5 seamonkey-2.25-1.41.5 seamonkey-debuginfo-2.25-1.41.5 seamonkey-debugsource-2.25-1.41.5 seamonkey-dom-inspector-2.25-1.41.5 seamonkey-irc-2.25-1.41.5 seamonkey-translations-common-2.25-1.41.5 seamonkey-translations-other-2.25-1.41.5 seamonkey-venkman-2.25-1.41.5 References: http://support.novell.com/security/cve/CVE-2014-1493.html http://support.novell.com/security/cve/CVE-2014-1494.html http://support.novell.com/security/cve/CVE-2014-1497.html http://support.novell.com/security/cve/CVE-2014-1498.html http://support.novell.com/security/cve/CVE-2014-1499.html http://support.novell.com/security/cve/CVE-2014-1500.html http://support.novell.com/security/cve/CVE-2014-1502.html http://support.novell.com/security/cve/CVE-2014-1504.html http://support.novell.com/security/cve/CVE-2014-1505.html http://support.novell.com/security/cve/CVE-2014-1508.html http://support.novell.com/security/cve/CVE-2014-1509.html http://support.novell.com/security/cve/CVE-2014-1510.html http://support.novell.com/security/cve/CVE-2014-1511.html http://support.novell.com/security/cve/CVE-2014-1512.html http://support.novell.com/security/cve/CVE-2014-1513.html http://support.novell.com/security/cve/CVE-2014-1514.html https://bugzilla.novell.com/868603

1 0

openSUSE-RU-2014:0572-1: moderate: xorg-x11-server: Fixes a crash when out of range DRI_PRIME is used
by maintenance＠opensuse.org 25 Apr '14

25 Apr '14

openSUSE Recommended Update: xorg-x11-server: Fixes a crash when out of range DRI_PRIME is used ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0572-1 Rating: moderate References: #846352 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update fixes the following issue with xorg-x11-server: - bnc#846352: Fixes a crash when out of range DRI_PRIME is used Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-320 - openSUSE 12.3: zypper in -t patch openSUSE-2014-320 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): xorg-x11-server-7.6_1.14.3.901-8.1 xorg-x11-server-debuginfo-7.6_1.14.3.901-8.1 xorg-x11-server-debugsource-7.6_1.14.3.901-8.1 xorg-x11-server-extra-7.6_1.14.3.901-8.1 xorg-x11-server-extra-debuginfo-7.6_1.14.3.901-8.1 xorg-x11-server-sdk-7.6_1.14.3.901-8.1 - openSUSE 12.3 (i586 x86_64): xorg-x11-server-7.6_1.13.2-1.25.1 xorg-x11-server-debuginfo-7.6_1.13.2-1.25.1 xorg-x11-server-debugsource-7.6_1.13.2-1.25.1 xorg-x11-server-extra-7.6_1.13.2-1.25.1 xorg-x11-server-extra-debuginfo-7.6_1.13.2-1.25.1 xorg-x11-server-sdk-7.6_1.13.2-1.25.1 References: https://bugzilla.novell.com/846352

1 0

openSUSE-SU-2014:0561-1: moderate: update for otrs
by opensuse-security＠opensuse.org 22 Apr '14

22 Apr '14

openSUSE Security Update: update for otrs ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0561-1 Rating: moderate References: #871758 Cross-References: CVE-2014-2553 CVE-2014-2554 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This otrs update fixes the following security and non security issues: - bnc#871758: Fixed OSA-2014-04 (CVE-2014-2553) and OSA-2014-05 (CVE-2014-2554). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-319 - openSUSE 12.3: zypper in -t patch openSUSE-2014-319 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (noarch): otrs-3.2.16-31.9.1 otrs-doc-3.2.16-31.9.1 otrs-itsm-3.2.9-31.9.1 - openSUSE 12.3 (noarch): otrs-3.1.21-26.15.1 otrs-doc-3.1.21-26.15.1 otrs-itsm-3.1.10-26.15.1 References: http://support.novell.com/security/cve/CVE-2014-2553.html http://support.novell.com/security/cve/CVE-2014-2554.html https://bugzilla.novell.com/871758

1 0

openSUSE-SU-2014:0560-1: moderate: update for openssl
by opensuse-security＠opensuse.org 22 Apr '14

22 Apr '14

openSUSE Security Update: update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0560-1 Rating: moderate References: Cross-References: CVE-2014-0160 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This is an openssl version update to 1.0.1g. - The main reason for this upgrade was to be clear about the TLS heartbeat problem know as "Heartbleed" (CVE-2014-0160). That problem was already fixed in our previous openssl update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-318 - openSUSE 12.3: zypper in -t patch openSUSE-2014-318 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1g-11.36.1 libopenssl1_0_0-1.0.1g-11.36.1 libopenssl1_0_0-debuginfo-1.0.1g-11.36.1 openssl-1.0.1g-11.36.1 openssl-debuginfo-1.0.1g-11.36.1 openssl-debugsource-1.0.1g-11.36.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1g-11.36.1 libopenssl1_0_0-32bit-1.0.1g-11.36.1 libopenssl1_0_0-debuginfo-32bit-1.0.1g-11.36.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1g-11.36.1 - openSUSE 12.3 (i586 x86_64): libopenssl-devel-1.0.1g-1.48.1 libopenssl1_0_0-1.0.1g-1.48.1 libopenssl1_0_0-debuginfo-1.0.1g-1.48.1 openssl-1.0.1g-1.48.1 openssl-debuginfo-1.0.1g-1.48.1 openssl-debugsource-1.0.1g-1.48.1 - openSUSE 12.3 (x86_64): libopenssl-devel-32bit-1.0.1g-1.48.1 libopenssl1_0_0-32bit-1.0.1g-1.48.1 libopenssl1_0_0-debuginfo-32bit-1.0.1g-1.48.1 - openSUSE 12.3 (noarch): openssl-doc-1.0.1g-1.48.1 References: http://support.novell.com/security/cve/CVE-2014-0160.html

1 0

openSUSE-SU-2014:0559-1: CVE-2014-0128: squid can crash when SSLBump is used in combination with range requests.
by opensuse-security＠opensuse.org 22 Apr '14

22 Apr '14

openSUSE Security Update: CVE-2014-0128: squid can crash when SSLBump is used in combination with range requests. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0559-1 Rating: low References: #867533 Cross-References: CVE-2014-0128 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The SSLBump feature acts as TLS/SSL termination for clients. If this feature is enabled, squid can crash with range requests, leading to a potential Denial of Service condition. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-316 - openSUSE 12.3: zypper in -t patch openSUSE-2014-316 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): squid-3.3.8-2.4.2 squid-debuginfo-3.3.8-2.4.2 squid-debugsource-3.3.8-2.4.2 - openSUSE 12.3 (i586 x86_64): squid-3.2.11-3.12.1 squid-debuginfo-3.2.11-3.12.1 squid-debugsource-3.2.11-3.12.1 References: http://support.novell.com/security/cve/CVE-2014-0128.html https://bugzilla.novell.com/867533

1 0

openSUSE-SU-2014:0558-1: moderate: update for json-c
by opensuse-security＠opensuse.org 22 Apr '14

22 Apr '14

openSUSE Security Update: update for json-c ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0558-1 Rating: moderate References: #870147 Cross-References: CVE-2013-6370 CVE-2013-6371 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This json-c update fixes the following two security issue: - bnc#870147: Fixed buffer overflow if size_t is larger than int (CVE-2013-6370). - bnc#870147: Fixed possible hash collision DoS (CVE-2013-6371). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-317 - openSUSE 12.3: zypper in -t patch openSUSE-2014-317 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): json-c-debugsource-0.10-3.4.1 libjson-devel-0.10-3.4.1 libjson0-0.10-3.4.1 libjson0-debuginfo-0.10-3.4.1 - openSUSE 13.1 (x86_64): libjson0-32bit-0.10-3.4.1 libjson0-debuginfo-32bit-0.10-3.4.1 - openSUSE 13.1 (noarch): libjson-doc-0.10-3.4.1 - openSUSE 12.3 (i586 x86_64): json-c-debugsource-0.9-13.4.1 libjson-devel-0.9-13.4.1 libjson0-0.9-13.4.1 libjson0-debuginfo-0.9-13.4.1 - openSUSE 12.3 (x86_64): libjson0-32bit-0.9-13.4.1 libjson0-debuginfo-32bit-0.9-13.4.1 - openSUSE 12.3 (noarch): libjson-doc-0.9-13.4.1 References: http://support.novell.com/security/cve/CVE-2013-6370.html http://support.novell.com/security/cve/CVE-2013-6371.html https://bugzilla.novell.com/870147

1 0

openSUSE-RU-2014:0557-1: WindowMaker:correct menus for openSUSE paths
by maintenance＠opensuse.org 22 Apr '14

22 Apr '14

openSUSE Recommended Update: WindowMaker:correct menus for openSUSE paths ______________________________________________________________________________ Announcement ID: openSUSE-RU-2014:0557-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update fixes the following issue with WindowMaker: - correct menus for openSUSE paths - Generated fix_wmgenmenu_paths.patch, so wmmenugen uses buildtime configured paths when generating WMRootMenu Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-312 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): WindowMaker-0.95.4-5.4.1 WindowMaker-debuginfo-0.95.4-5.4.1 WindowMaker-debugsource-0.95.4-5.4.1 WindowMaker-devel-0.95.4-5.4.1 References:

1 0