openSUSE Security Update: update for rsyslog ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1297-1 Rating: moderate References: #890228 #897262 #899756 Cross-References: CVE-2014-3634 CVE-2014-3683 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: - Fixed PRI DoS vulnerability patch (CVE-2014-3683,bnc#899756) [* rsyslog-7.4.7-remote-PRI-DoS-fix-backport_CVE-2014-3634.patch] - Removed broken, unsupported and dropped by upstream zpipe utility from rsyslog-diag-tools package (bnc#890228) - Remote syslog PRI DoS vulnerability fix (CVE-2014-3634,bnc#897262) [+ rsyslog-7.4.7-remote-PRI-DoS-fix-backport_CVE-2014-3634.patch] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-592 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): rsyslog-7.4.7-2.20.1 rsyslog-debuginfo-7.4.7-2.20.1 rsyslog-debugsource-7.4.7-2.20.1 rsyslog-diag-tools-7.4.7-2.20.1 rsyslog-diag-tools-debuginfo-7.4.7-2.20.1 rsyslog-doc-7.4.7-2.20.1 rsyslog-module-dbi-7.4.7-2.20.1 rsyslog-module-dbi-debuginfo-7.4.7-2.20.1 rsyslog-module-elasticsearch-7.4.7-2.20.1 rsyslog-module-elasticsearch-debuginfo-7.4.7-2.20.1 rsyslog-module-gcrypt-7.4.7-2.20.1 rsyslog-module-gcrypt-debuginfo-7.4.7-2.20.1 rsyslog-module-gssapi-7.4.7-2.20.1 rsyslog-module-gssapi-debuginfo-7.4.7-2.20.1 rsyslog-module-gtls-7.4.7-2.20.1 rsyslog-module-gtls-debuginfo-7.4.7-2.20.1 rsyslog-module-guardtime-7.4.7-2.20.1 rsyslog-module-guardtime-debuginfo-7.4.7-2.20.1 rsyslog-module-mmnormalize-7.4.7-2.20.1 rsyslog-module-mmnormalize-debuginfo-7.4.7-2.20.1 rsyslog-module-mysql-7.4.7-2.20.1 rsyslog-module-mysql-debuginfo-7.4.7-2.20.1 rsyslog-module-pgsql-7.4.7-2.20.1 rsyslog-module-pgsql-debuginfo-7.4.7-2.20.1 rsyslog-module-relp-7.4.7-2.20.1 rsyslog-module-relp-debuginfo-7.4.7-2.20.1 rsyslog-module-snmp-7.4.7-2.20.1 rsyslog-module-snmp-debuginfo-7.4.7-2.20.1 rsyslog-module-udpspoof-7.4.7-2.20.1 rsyslog-module-udpspoof-debuginfo-7.4.7-2.20.1 References: http://support.novell.com/security/cve/CVE-2014-3634.html http://support.novell.com/security/cve/CVE-2014-3683.html https://bugzilla.suse.com/show_bug.cgi?id=890228 https://bugzilla.suse.com/show_bug.cgi?id=897262 https://bugzilla.suse.com/show_bug.cgi?id=899756