openSUSE Security Update: update for openssl
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2014:1052-1
Rating:             moderate
References:         #890764 #890765 #890766 #890767 #890768 #890769
                    #890770 #890771 #890772
Cross-References:   CVE-2014-3505 CVE-2014-3506 CVE-2014-3507
                    CVE-2014-3508 CVE-2014-3509 CVE-2014-3510
                    CVE-2014-3511 CVE-2014-3512 CVE-2014-5139

Affected Products:
                    openSUSE 13.1
                    openSUSE 12.3
______________________________________________________________________________

   An update that fixes 9 vulnerabilities is now available.

Description:

   This openssl update fixes the following security issues:

   - openssl 1.0.1i
   * Information leak in pretty printing functions (CVE-2014-3508)
   * Crash with SRP ciphersuite in Server Hello message (CVE-2014-5139)
   * Race condition in ssl_parse_serverhello_tlsext (CVE-2014-3509)
   * Double Free when processing DTLS packets (CVE-2014-3505)
   * DTLS memory exhaustion (CVE-2014-3506)
   * DTLS memory leak from zero-length fragments (CVE-2014-3507)
   * OpenSSL DTLS anonymous EC(DH) denial of service (CVE-2014-3510)
   * OpenSSL TLS protocol downgrade attack (CVE-2014-3511)
   * SRP buffer overrun (CVE-2014-3512)
Updated emulators/suse131_openssl to 13.1nb9
Update adoble-flash-plugin11 to 11.2.202.400 for APSB14-18.
Updated multimedia/adobe-flash-plugin11 to 11.2.202.400
   openSUSE Security Update: update for jbigkit
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2014:0978-1
Rating:             moderate
References:         #870855
Cross-References:   CVE-2013-6369
Affected Products:
                    openSUSE 13.1
                    openSUSE 12.3
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:


       The following security issue is fixed in this update
   - [bnc#870855] - CVE-2013-6369: jbigkit buffer overflow
Updated emulators/suse131_libtiff to 13.1nb1
   openSUSE Security Update: krb5
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2014:0977-1
Rating:             low
References:         #886016 #888697
Cross-References:   CVE-2014-4341 CVE-2014-4342 CVE-2014-4343
                    CVE-2014-4344
Affected Products:
                    openSUSE 13.1
                    openSUSE 12.3
______________________________________________________________________________

   An update that fixes four vulnerabilities is now available.

Description:

   The following security isses are fixed in this update:

   CVE-2014-4341 CVE-2014-4342: denial of service flaws when handling RFC
   1964 tokens (bnc#886016)

   CVE-2014-4343 CVE-2014-4344: multiple flaws in SPNEGO (bnc#888697)
Updated emulators/suse131_krb5 to 13.1nb1
Fix linkage. For some reason, Qsci.so was not linked against
libqscintilla2, make it unusable by itself. Hardcode libqscintilla2
into LDFLAGS.

Bump PKGREVISION.
Updated x11/py-qt4-qscintilla to 2.8.3nb1
Update to 4.5.24. Extract using bsdtar instead of gtar.
Fix python interpreter in installed files.

Changes:

Version 4.5.24:
- bug fixes

Version 4.5.23:
- bug fixes

Version 4.5.22:
- bug fixes

Version 4.5.21:
- bug fixes
- changed the eric mascot to be a Python (i.e. the snake). New icons
  and pixmaps provided by Thimo Kraemer.

Version 4.5.20:
- bug fixes
- Italian translations completed by Gianpietro Zamolo

Version 4.5.19:
- bug fixes
Updated devel/eric4 to 4.5.24
Limit RUBY_VERSION_SUPPORTED to those supported by ruby-zip.

Fixes bulk builds.
Stop installing some banner files and the testprint page, to avoid
conflict with cups-1.7.
Upstream bug report was filed a month ago, but so far there was
no clarification:
https://bugs.linuxfoundation.org/show_bug.cgi?id=1222

Bump PKGREVISION.
Updated print/cups-filters to 1.0.54nb2
Update libsixel to 1.0.0.

Bump ABI to 1.0.0.
Updated graphics/libsixel to 1.0.0