The OVAL Repository 5.4 2015-09-03T06:49:26.706-04:00 SUSE Linux Enterprise Desktop 10 release-notes-sled This update provides the latest version of the Release Notes for SUSE Linux Enterprise Desktop 10 SP4. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 wireshark wireshark was updated to 1.8.5 (bnc#801131), fixing bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Mozilla Firefox MozillaFirefox has been updated to the 17.0.4ESR release. Besides the major version update from the 10ESR stable release line to the 17ESR stable release line, this update brings critical security and bugfixes. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 squid A denial of service problem in Squid via invalid Content-Length headers and memory leaks has been fixed. (CVE-2012-5643,CVE-2013-0189, SQUID-2012:1) Also a logrotate permission issue has been fixed. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 flash-player flash-player has been updated to 11.2.202.273 security update, which fixes several critical security bugs that could have been used by remote attackers to execute code. (CVE-2013-0504, CVE-2013-0643, CVE-2013-0648) More information can be found on: https://www.adobe.com/support/security/bulletins/apsb13-08.h tml <https://www.adobe.com/support/security/bulletins/apsb13-08. html> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 parted This collective update for parted provides the following fixes: * Fix automatic correcting of GPT label which can cause problems on systems which use dmraid * Fix issues while resizing ReiserFS file systems with YaST2, when parted could either hang or fail to resize the file system. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 ipmitool This collective update for ipmitool provides the following fixes: * Fix reading of FRU data from servers where FRU/SDR device #0, LUN 0 is absent (bnc#789624) * Fix a string handling problem in ipmi_sel.c that could cause a segmentation fault (bnc#788393) * Fix reading of sensors from some specific servers over lanplus (bnc#794160) * Handle "BCDplus" fields in FRU descriptors correctly * Retrieve and print sensor data records (sdr) correctly (bnc#761203) * Do not crash in fru command if the lanplus password is wrong (bnc#767413) * Do not crash (assert(0)/abort) when BMC replies with the wrong session id (bnc#729514) * Fix detection if it is no longer connected to BMC (bnc#739377) * Fix ipmitool on UV10 systems (bnc#614916) * Add sanity checks for erroneous SDR data (bnc#604896). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 timezone This update provides the latest timezone information for your system. The changes in detail are: * Chile is changing its DST rules * Estimate Morocco 2013-2038 transitions for Ramadan * New alias Europe/Busingen for Europe/Zurich * New zones Asia/Khandyga, Asia/Ust-Nera * Libya moving to CET, but with DST. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 acroread Acrobat Reader has been updated to 9.5.4 which fixes two critical security issues where attackers supplying PDFs could have caused code execution with acrobat. (CVE-2013-0640, CVE-2013-0641) More information can be found on: https://www.adobe.com/support/security/bulletins/apsb13-07.h tml <https://www.adobe.com/support/security/bulletins/apsb13-07. html> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 flash-player Adobe flash-player has been updated to 11.2.202.285 security update, which fixes various remote code execution problems and other security issues. Some more details can be found on: https://www.adobe.com/support/security/bulletins/apsb13-14.h tml <https://www.adobe.com/support/security/bulletins/apsb13-14. html> Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Java IBM Java 5 has been updated to SR16 which fixes various critical security issues and bugs. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 apparmor-profiles This update for apparmor-profiles provides fixes in ntpd's profile which is allowing the daemon to access all needed files in /proc. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 nfs-utils This update fixes a DNS spoofing problem with NFS rpc-gssd. (CVE-2013-1923)(bnc#813464) Security Issue reference: * CVE-2013-1923 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1923 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Perl This update of Perl 5 fixes the following security issues: * fix rehash DoS [bnc#804415] [CVE-2013-1667] * improve CGI crlf escaping [bnc#789994] [CVE-2012-5526] * fix glob denial of service [bnc#796014] [CVE-2011-2728] * sanitize input in Maketext.pm [bnc#797060] [CVE-2012-6329] * make getgrent work with long group entries [bnc#788388] Security Issue reference: * CVE-2013-1667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1667 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 supportutils This update fixes the following issues: - supportconfig: 2.25-370 - supportconfig: 2.25-359 - supportconfig: 2.25-358 - supportconfig: 2.25-350 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 Mozilla Firefox MozillaFirefox has been updated to the 17.0.5ESR release fixing bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 lvm2 The following issue has been fixed: * SLE-10-SP4 LVM2 pvmove event deregistration failed: No such device (bnc#748617) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 xorg-x11-server In some cases, input events are sent to X servers not currently the VT owner, allowing a user to capture passwords. This update fixes this issue. CVE-2013-1940 has been assigned to this issue. Security Issue reference: * CVE-2013-1940 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1940 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 gpg This update for gpg provides the following fixes: * Set proper file permissions when en/de-crypting files (bnc#780943) * Fix an issue that could cause corruption of the public keys database. (CVE-2012-6085, bnc#798465) Security Issue reference: * CVE-2012-6085 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6085 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 libtiff This update fixes two buffer overflow security issues with libtiff: * CVE-2013-1960 * CVE-2013-1961 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 flash-player Adobe Flash Player has been updated to security release 11.2.202.275 (APSB13-09), fixing severe security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 autofs5 This collective update for AutoFS provides fixes for some issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 poppler This update of poppler fixes the following vulnerabilities: * CVE-2013-1788: Various invalid memory issues could be used by attackers supplying PDFs to crash the PDF viewer or potentially execute code. * CVE-2013-1789: A crash in poppler could be used by attackers providing PDFs to crash the PDF viewer. * CVE-2013-1790: An uninitialized memory read could be used by attackers providing PDFs to crash the PDF viewer. This also fixes that transparent background in images are rendered black with evince. (bnc#745620). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 10 subversion This update fixes several DoS vulnerabilities in subversion's mod_dav_svn Apache HTTPD server module. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 compat-curl2 This update of compat-curl2 fixes a security vulnerability: * libcurl URL decode buffer boundary flaw (bnc#824517 / CVE-2013-2174) Security Issue reference: * CVE-2013-2174 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2174 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Linux kernel The SUSE Linux Enterprise 10 SP4 kernel has been updated to fix various bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 clamav This update contains clamav 0.97.8 which fixes security issues (bnc#816865): * CVE-2013-2020: Fix heap corruption * CVE-2013-2021: Fix overflow due to PDF key length computation. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 pidgin idgin was updated to fix 4 security issues: * Fixed a crash when receiving UPnP responses with abnormally long values. (CVE-2013-0274, bnc#804742) * Fixed a crash in Sametime protocol when a malicious server sends us an abnormally long user ID. (CVE-2013-0273, bnc#804742) * Fixed a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution.(CVE-2013-0272, bnc#804742) * Fixed a bug where a remote MXit user could possibly specify a local file path to be written to. (CVE-2013-0271, bnc#804742) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Linux kernel This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 glibc This collective update for the GNU C library (glibc) provides the following fixes: * Fix stack overflow in getaddrinfo with many results (bnc#813121, CVE-2013-1914) * Fix locking in _IO_cleanup (bnc#796982) * Fix buffer overflow in glob (bnc#691365) * Fix memory leak in execve (bnc#805899) Security Issue reference: * CVE-2013-1914 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1914 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 10 ImageMagick ImageMagick has been updated to fix an integer overflow (CVE-2012-3438). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 libxml2 libxml2 has been updated to fix entity expansion problems: * CVE-2013-0338: Internal entity expansion within XML was not bounded, leading to simple small XML files being able to cause "out of memory" denial of service conditions. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 CUPS This update for CUPS adjusts the translations of site templates to send the session ID on POST operations. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 xorg-x11 This update of xorg-x11 fixes several security vulnerabilities. * Bug 815451- X.Org Security Advisory: May 23, 2013 * Bug 821664 - libX11 * Bug 821671 - libXv * Bug 821670 - libXt * Bug 821669 - libXrender * Bug 821668 - libXp * Bug 821667 - libXfixes * Bug 821665 - libXext * Bug 821663 - libFS, libXcursor, libXi, libXinerama, libXRes, libXtst, libXvMC, libXxf86dga, libXxf86vm, libdmx Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 timezone This update provides the latest timezone information for your system. The changes in detail are: * Morocco's midsummer transitions this year are July 7 and August 10 * Israel now falls back from DST on the last Sunday of October * Palestine observed DST starting March 29, 2013 * From 2013 on, Gaza and Hebron both observe DST. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 curl This update of curl fixes several security issues. * libcurl URL decode buffer boundary flaw (bnc#824517 / CVE-2013-2174) Security Issue reference: * CVE-2013-2174 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2174 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 OpenSSL OpenSSL has been updated to fix several security issues: * CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL compression by default. Setting the environment variable "OPENSSL_NO_DEFAULT_ZLIB" to "no" enables compression again. Please note that openssl on SUSE Linux Enterprise 10 is not built with compression support. * CVE-2013-0169: Timing attacks against TLS could be used by physically local attackers to gain access to transmitted plain text or private keymaterial. This issue is also known as the "Lucky-13" issue. * CVE-2013-0166: A OCSP invalid key denial of service issue was fixed. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 ksh This update to Korn Shell 93u+ provides fixes for many issues, including: * Fix segmentation fault on typeset on ENV variable. (bnc#803613) * Do not free data which is used later on in the hash tree of reloaded shell functions. (bnc#795324) * Make sure that tty is closed even if an interrupt arrived during close. (bnc#790315) * Fix truncation of variables when TMOUT is used. (bnc#808956) * Fix syntax error on command substitution in here-document. (bnc#804998) * Make Shift_JIS patch more reliable as requested by upstream. For a comprehensive list of fixes please refer to the package's change log. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 ClamAV ClamAV has been updated to the 0.97.7 release that contains various security related hardening fixes. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 GnuTLS This GnuTLS update fixes incorrect padding which weakens the encryption. CVE-2013-1619 has been assigned to this issue. Security Issue reference: * CVE-2013-1619 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1619 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Samba The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery (CVE-2013-0214) and a click-jacking attack (CVE-2013-0213). This has been fixed. Additionally a bug in mount.cifs has been fixed which could have lead to file disclosure (CVE-2012-1586). Also a uninitialized memory read bug in talloc_free() has been fixed. (bnc#764577). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 10 subversion This update of subversion fixes two potential DoS vulnerabilities (bug#821505, CVE-2013-1968, CVE-2013-2112). * Server-side bugfixes: o fix FSFS repository corruption due to newline in filename (issue #4340) o fix svnserve exiting when a client connection is aborted (r1482759) * Other tool improvements and bugfixes: o fix argument processing in contrib hook scripts (r1485350) Security Issues: * CVE-2013-1968 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1968 > * CVE-2013-2112 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2112 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 sudo This update fixes the following security issues which allowed to bypass the sudo authentication: CVE-2013-1775, CVE-2013-1776, CVE-2013-2776 and CVE-2013-2777. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 10 ruby Ruby failed to check hostnames correctly when setting up a SSL client connection. CVE-2013-4073 was assigned to this issue. Security Issues: * CVE-2013-4073 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4073 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 10 release-notes-sled This announcement marks the end of the security and maintenance patch period for SUSE Linux Enterprise Desktop 10 Service Pack 4 and the end of General Support for SUSE Linux Enterprise 10. In order to keep your systems up to date and secure, please migrate your systems to SUSE Linux Enterprise Desktop 11 Service Pack 3. All customers with active SUSE Linux Enterprise Desktop subscriptions can migrate to SUSE Linux Enterprise Desktop 11 Service Pack 3 at no additional cost. For more information on how to upgrade to SUSE Linux Enterprise Desktop 11 Service Pack 3, please read: https://www.suse.com/support/kb/doc.php?id=7012368 <https://www.suse.com/support/kb/doc.php?id=7012368> Please make sure that you applied all maintenance updates provided for SUSE Linux Enterprise Desktop 10 Service Pack 4 before starting the migration. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 libxslt libxslt has been updated to fix two denial of service issues via crashes by NULL pointer dereference on attacker supplied XSLT scripts (CVE-2012-6139). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 krb5 This krb5 update fixes a security issue. * kpasswd UDP ping-pong (bug#825985 / CVE-2002-2443) Security Issue reference: * CVE-2002-2443 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2443 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Samba This collective update for Samba provides the following fixes: * Fix 'map untrusted to domain' with NTLMv2. (bnc#817919) * Fix logon of AD users with many group memberships. (bnc#657026) * CIFS: do not restart during dhcp lease renewal when IP address remains the same. (bnc#573246) * Relicense source/client/{mount.cifs,mount.h,mtab.c}.c under GPLv2+ Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 compat-curl2 This update of compat-curl2 fixes several security issues. * fixes for the cookie domain tailmatch vulnerability (bnc#814655) * updated curl CA-Cert Bundle (bnc#810010) * fixes for a potential BEAST attack (bnc#742306) Security Issue reference: * CVE-2013-1944 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1944 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 timezone This update provides the latest timezone information for your system. The changes in detail are: * Haiti uses US daylight-saving rules this year * Paraguay will end DST on March 24 this year * Morocco does not observe DST during Ramadan. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 10 inkscape inkscape has been updated to fix a XXE (Xml eXternal Entity) attack during rasterization of SVG images. (CVE-2012-5656), where the rendering of malicious SVG images could have connected from inkscape to internal hosts. Security Issue reference: * CVE-2012-5656 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5656 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 flash-player This update for flash-player to version 11.2.202.270, tracked as ABSP13-05 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 util-linux This collective update for util-linux provides the following fixes and enhancements: Fix creation of partitions spanning across the entire disk (", , ") in sfdisk(8). (bnc#808155) Fix typos in taskset(1) man page. (bnc#771925) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 wireshark wireshark has been updated to 1.8.6 which fixes bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 GnuTLS This update of GnuTLS fixes a regression introduced by the previous update that could have resulted in a Denial of Service (application crash). Security Issue reference: * CVE-2013-2116 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2116 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 nfs-utils This update for the NFS support utilities (nfs-utils) provides the following fixes: * Allow gssd to work with more than 1024 connections, depending on the 'nofile' resource limit. Increase this limit to 4096 before starting rpc.gssd * Fix a signal handling issue that could cause silent termination of the rpc.idmapd daemon Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Mesa This update of Mesa fixes multiple integer overflows. Security Issue reference: * CVE-2013-1993 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1993 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Mozilla Firefox Mozilla Firefox has been updated to the 17.0.6ESR security release. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 flash-player Adobe flash-player has been updated to version 11.2.202.291 (ABSP13-17) which fixes bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Java 1.5.0 IBM Java 1.5.0 has been updated to SR13-FP2 which fixes several bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 ksh This update for Korn Shell provides fixes for the following issues: * #808449: set -k does not work properly with ksh-93t-13.17 and higher * #814135: crash in bestreclaim() after traversing a memory block with a very large size * #824187: set -k breaks aliases with ksh-93u. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 curl This update fixes the cookie domain tailmatch vulnerability in curl. CVE-2013-1944 has been assigned to this issue. Also the CA-Cert Bundle has been updated to the current state. Security Issue reference: * CVE-2013-1944 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1944 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 krb5 This update for Kerberos 5 provides the following fixes and enhancements: * Improved compatibility with processes that handle large numbers of open files (bnc#787272) * Fixed memory leak in gss_accept_sec_context() and other functions (bnc#808191) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 openswan This openswan update fixes a remote buffer overflow issue (bnc#824316 / CVE-2013-2053). Security Issue reference: * CVE-2013-2053 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2053 > Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 curl This update for curl adds Digicert certificates to the CA bundle. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 Acrobat Reader Acrobat Reader has been updated to version 9.5.5. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 flash-player Adobe Flash Player was updated to release 11.2.202.262, fixing bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 java-1_5_0-ibm IBM Java 1.5.0 has been updated to SR16-FP3 to fix bugs and security issues. Please see also http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Also the following bug has been fixed: * add Europe/Busingen to tzmappings (bnc#817062) * mark files in jre/bin and bin/ as executable (bnc#823034) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 java-1_6_0-ibm IBM Java 6 was updated to SR13 FP1, fixing bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 Xorg This update for xorg-x11 provides fixes for the following issues: * 743810: Xnest to remote machine displays black screen * 805590: Xvnc server crashes while launching Java Swing application. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 10 wireshark This wireshark version update to 1.6.16 includes several security and general bug fixes. http://www.wireshark.org/docs/relnotes/wireshark-1.6.16.html <http://www.wireshark.org/docs/relnotes/wireshark-1.6.16.htm l> * The CAPWAP dissector could crash. Discovered by Laurent Butti. (CVE-2013-4074) * The HTTP dissector could overrun the stack. Discovered by David Keeler. (CVE-2013-4081) * The DCP ETSI dissector could crash. (CVE-2013-4083) http://www.wireshark.org/docs/relnotes/wireshark-1.6.15.html <http://www.wireshark.org/docs/relnotes/wireshark-1.6.15.htm l> * The ASN.1 BER dissector could crash. ( CVE-2013-3556 CVE-2013-3557 ) The releases also fix various non-security issues. Additionally, a crash in processing SCTP filters has been fixed. (bug#816887) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 10 libcurl4 This update of curl fixes several security issues: * libcurl URL decode buffer boundary flaw (bnc#824517 / CVE-2013-2174) * cookie domain tailmatch (bnc#814655 / CVE-2013-1944) * curl sets SSL_OP_ALL (bnc#742306 / CVE-2011-3389) * When SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier (CVE-2010-4180) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 nfs-client This update for the NFS support utilities (nfs-client, nfs-kernel-server) enhances gssd to work with more than 1024 connections, respecting the 'nofile' resource limit. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 10 flash-player Adobe Flash Player has been updated to 11.2.202.280 to fix various bugs and security issues. More information can be found on: http://www.adobe.com/support/security/bulletins/apsb13-11.ht ml <http://www.adobe.com/support/security/bulletins/apsb13-11.h tml> * APSB13-11, CVE-2013-1378, CVE-2013-1379, CVE-2013-1380, CVE-2013-2555 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 Mozilla Firefox Mozilla Firefox has been updated to the 17.0.7 ESR version, which fixes bugs and security issues. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 11.x is installed. Maria Mikhno DRAFT INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Desktop 10 is installed. Thomas R. Jones DRAFT Jonathan Baker INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Evgeniy Pavlov INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 11.x is installed. Maria Kedovskaya DRAFT INTERIM ACCEPTED Evgeniy Pavlov INTERIM ACCEPTED ACCEPTED SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Server 10 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED Evgeniy Pavlov INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10:server