SUSE Security Announcement - MozillaFirefox (SUSE-SA:2009:052)
______________________________________________________________________________
SUSE Security Announcement
Package: MozillaFirefox
Announcement ID: SUSE-SA:2009:052
Date: Wed, 04 Nov 2009 12:00:00 +0000
Affected Products: openSUSE 11.0
openSUSE 11.1
SLE SDK 10 SP2
SLE SDK 10 SP3
SUSE Linux Enterprise Desktop 10 SP2
SUSE Linux Enterprise Desktop 10 SP3
SUSE Linux Enterprise 10 SP2 DEBUGINFO
SUSE Linux Enterprise Server 10 SP2
SUSE Linux Enterprise 10 SP3 DEBUGINFO
SUSE Linux Enterprise Server 10 SP3
SLES 11 DEBUGINFO
SLE 11
SLED 11
SLES 11
Vulnerability Type: remote code execution
Severity (1-10): 8
SUSE Default Package: yes
Cross-References: CVE-2009-1563, CVE-2009-3274, CVE-2009-3370
CVE-2009-3371, CVE-2009-3372, CVE-2009-3373
CVE-2009-3374, CVE-2009-3375, CVE-2009-3376
CVE-2009-3377, CVE-2009-3378, CVE-2009-3379
CVE-2009-3380, CVE-2009-3381, CVE-2009-3382
CVE-2009-3383, MFSA 2009-52, MFSA 2009-53
MFSA 2009-54, MFSA 2009-55, MFSA 2009-56
MFSA 2009-57, MFSA 2009-59, MFSA 2009-61
MFSA 2009-62, MFSA 2009-63, MFSA 2009-64
Content of This Advisory:
1) Security Vulnerability Resolved:
Mozilla Firefox security update
Problem Description
2) Solution or Work-Around
3) Special Instructions and Notes
4) Package Location and Checksums
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
See SUSE Security Summary Report.
6) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Problem Description and Brief Discussion
The Mozilla Firefox browser was updated to fix various bugs and
security issues.
On all SUSE Linux Enterprise products it was updated to the stable
version 3.5.4, on openSUSE 11.0 and 11.1 it was updated to the stable
version 3.0.0.15.
Following security issues have been fixed:
MFSA 2009-52 / CVE-2009-3370:
Security researcher Paul Stone reported that a user's form history,
both from web content as well as the smart location bar, was vulnerable
to theft. A malicious web page could synthesize events such as mouse
focus and key presses on behalf of the victim and trick the browser
into auto-filling the form fields with history entries and then
reading the entries.
MFSA 2009-53 / CVE-2009-3274:
Security researcher Jeremy Brown reported that the file naming scheme
used for downloading a file which already exists in the downloads
folder is predictable. If an attacker had local access to a victim's
computer and knew the name of a file the victim intended to open
through the Download Manager, he could use this vulnerability to
place a malicious file in the world-writable directory used to save
temporary downloaded files and cause the browser to choose the
incorrect file when opening it. Since this attack requires local
access to the victim's machine, the severity of this vulnerability
was determined to be low.
MFSA 2009-54 / CVE-2009-3371:
Security researcher Orlando Berrera of Sec Theory reported that
recursive creation of JavaScript web-workers can be used to create a
set of objects whose memory could be freed prior to their use. These
conditions often result in a crash which could potentially be used
by an attacker to run arbitrary code on a victim's computer.
MFSA 2009-55 / CVE-2009-3372:
Security researcher Marco C. reported a flaw in the parsing of regular
expressions used in Proxy Auto-configuration (PAC) files. In certain
cases this flaw could be used by an attacker to crash a victim's
browser and run arbitrary code on their computer. Since this
vulnerability requires the victim to have PAC configured in their
environment with specific regular expressions which can trigger the
crash, the severity of the issue was determined to be moderate.
MFSA 2009-56 / CVE-2009-3373:
Security research firm iDefense reported that researcher regenrecht
discovered a heap-based buffer overflow in Mozilla's GIF image
parser. This vulnerability could potentially be used by an attacker
to crash a victim's browser and run arbitrary code on their computer.
MFSA 2009-57 / CVE-2009-3374:
Mozilla security researcher moz_bug_r_a4 reported that the XPCOM
utility XPCVariant::VariantDataToJS unwrapped doubly-wrapped objects
before returning them to chrome callers. This could result in chrome
privileged code calling methods on an object which had previously been
created or modified by web content, potentially executing malicious
JavaScript code with chrome privileges.
MFSA 2009-59 / CVE-2009-1563:
Security researcher Alin Rad Pop of Secunia Research reported a
heap-based buffer overflow in Mozilla's string to floating point
number conversion routines. Using this vulnerability an attacker
could craft some malicious JavaScript code containing a very long
string to be converted to a floating point number which would result
in improper memory allocation and the execution of an arbitrary memory
location. This vulnerability could thus be leveraged by the attacker
to run arbitrary code on a victim's computer.
MFSA 2009-61 / CVE-2009-3375:
Security researcher Gregory Fleischer reported that text within a
selection on a web page can be read by JavaScript in a different domain
using the document.getSelection function, violating the same-origin
policy. Since this vulnerability requires user interaction to exploit,
its severity was determined to be moderate.
MFSA 2009-62 / CVE-2009-3376:
Mozilla security researchers Jesse Ruderman and Sid Stamm reported
that when downloading a file containing a right-to-left override
character (RTL) in the filename, the name displayed in the dialog
title bar conflicts with the name of the file shown in the dialog
body. An attacker could use this vulnerability to obfuscate the name
and file extension of a file to be downloaded and opened, potentially
causing a user to run an executable file when they expected to open
a non-executable file.
MFSA 2009-63 / CVE-2009-3377 / CVE-2009-3379 / CVE-2009-3378
Mozilla upgraded several third party libraries used in media rendering
to address multiple memory safety and stability bugs identified by
members of the Mozilla community. Some of the bugs discovered could
potentially be used by an attacker to crash a victim's browser and
execute arbitrary code on their computer. liboggz, libvorbis, and
liboggplay were all upgraded to address these issues. Audio and
video capabilities were added in Firefox 3.5 so prior releases
of Firefox were not affected. Georgi Guninski reported a crash in
liboggz. (CVE-2009-3377), Lucas Adamski, Matthew Gregan, David Keeler,
and Dan Kaminsky reported crashes in libvorbis. (CVE-2009-3379),
Juan Becerra reported a crash in liboggplay (CVE-2009-3378).
MFSA 2009-64 / CVE-2009-3380 / CVE-2009-3381 / CVE-2009-3382 / CVE-2009-3383:
Mozilla developers and community members identified and fixed
several stability bugs in the browser engine used in Firefox and other
Mozilla-based products. Some of these crashes showed evidence of memory
corruption under certain circumstances and we presume that with enough
effort at least some of these could be exploited to run arbitrary code.
2) Solution or Work-Around
There is no known workaround, please install the update packages.
3) Special Instructions and Notes
Please close and restart all running instances of Firefox and xulrunner using
programs after the update.
4) Package Location and Checksums
The preferred method for installing security updates is to use the YaST
Online Update (YOU) tool. YOU detects which updates are required and
automatically performs the necessary steps to verify and install them.
Alternatively, download the update packages for your distribution manually
and verify their integrity by the methods listed in Section 6 of this
announcement. Then install the packages using the command
rpm -Fhv <file.rpm>
to apply the update, replacing <file.rpm> with the filename of the
downloaded RPM package.
x86 Platform:
openSUSE 11.1:
http://download.opensuse.org/debug/update/11.1/rpm/i586/MozillaFirefox-debuginfo-3.0.
15-0.1.2.i586.rpm
http://download.opensuse.org/debug/update/11.1/rpm/i586/MozillaFirefox-debugsource-3.
0.15-0.1.2.i586.rpm
http://download.opensuse.org/debug/update/11.1/rpm/i586/mozilla-xulrunner190-debuginf
o-1.9.0.15-0.1.2.i586.rpm
http://download.opensuse.org/debug/update/11.1/rpm/i586/mozilla-xulrunner190-debugsou
rce-1.9.0.15-0.1.2.i586.rpm
http://download.opensuse.org/update/11.1/rpm/i586/MozillaFirefox-3.0.15-0.1.2.i586.rp
m
http://download.opensuse.org/update/11.1/rpm/i586/MozillaFirefox-branding-upstream-3.
0.15-0.1.2.i586.rpm
http://download.opensuse.org/update/11.1/rpm/i586/MozillaFirefox-translations-3.0.15-
0.1.2.i586.rpm
http://download.opensuse.org/update/11.1/rpm/i586/mozilla-xulrunner190-1.9.0.15-0.1.2
.i586.rpm
http://download.opensuse.org/update/11.1/rpm/i586/mozilla-xulrunner190-devel-1.9.0.15
-0.1.2.i586.rpm
http://download.opensuse.org/update/11.1/rpm/i586/mozilla-xulrunner190-gnomevfs-1.9.0
.15-0.1.2.i586.rpm
http://download.opensuse.org/update/11.1/rpm/i586/mozilla-xulrunner190-translations-1
.9.0.15-0.1.2.i586.rpm
http://download.opensuse.org/update/11.1/rpm/i586/python-xpcom190-1.9.0.15-0.1.2.i586
.rpm
openSUSE 11.0:
http://download.opensuse.org/debug/update/11.0/rpm/i586/MozillaFirefox-debuginfo-3.0.
15-0.1.i586.rpm
http://download.opensuse.org/debug/update/11.0/rpm/i586/MozillaFirefox-debugsource-3.
0.15-0.1.i586.rpm
http://download.opensuse.org/debug/update/11.0/rpm/i586/mozilla-xulrunner190-debuginf
o-1.9.0.15-0.1.i586.rpm
http://download.opensuse.org/debug/update/11.0/rpm/i586/mozilla-xulrunner190-debugsou
rce-1.9.0.15-0.1.i586.rpm
http://download.opensuse.org/update/11.0/rpm/i586/MozillaFirefox-3.0.15-0.1.i586.rpm
http://download.opensuse.org/update/11.0/rpm/i586/MozillaFirefox-translations-3.0.15-
0.1.i586.rpm
http://download.opensuse.org/update/11.0/rpm/i586/mozilla-xulrunner190-1.9.0.15-0.1.i
586.rpm
http://download.opensuse.org/update/11.0/rpm/i586/mozilla-xulrunner190-devel-1.9.0.15
-0.1.i586.rpm
http://download.opensuse.org/update/11.0/rpm/i586/mozilla-xulrunner190-gnomevfs-1.9.0
.15-0.1.i586.rpm
http://download.opensuse.org/update/11.0/rpm/i586/mozilla-xulrunner190-translations-1
.9.0.15-0.1.i586.rpm
Power PC Platform:
openSUSE 11.1:
http://download.opensuse.org/debug/update/11.1/rpm/ppc/MozillaFirefox-debuginfo-3.0.1
5-0.1.2.ppc.rpm
http://download.opensuse.org/debug/update/11.1/rpm/ppc/MozillaFirefox-debugsource-3.0
.15-0.1.2.ppc.rpm
http://download.opensuse.org/debug/update/11.1/rpm/ppc/mozilla-xulrunner190-debuginfo
-1.9.0.15-0.1.2.ppc.rpm
http://download.opensuse.org/debug/update/11.1/rpm/ppc/mozilla-xulrunner190-debugsour
ce-1.9.0.15-0.1.2.ppc.rpm
http://download.opensuse.org/update/11.1/rpm/ppc/MozillaFirefox-3.0.15-0.1.2.ppc.rpm
http://download.opensuse.org/update/11.1/rpm/ppc/MozillaFirefox-branding-upstream-3.0
.15-0.1.2.ppc.rpm
http://download.opensuse.org/update/11.1/rpm/ppc/MozillaFirefox-translations-3.0.15-0
.1.2.ppc.rpm
http://download.opensuse.org/update/11.1/rpm/ppc/mozilla-xulrunner190-1.9.0.15-0.1.2.
ppc.rpm
http://download.opensuse.org/update/11.1/rpm/ppc/mozilla-xulrunner190-devel-1.9.0.15-
0.1.2.ppc.rpm
http://download.opensuse.org/update/11.1/rpm/ppc/mozilla-xulrunner190-gnomevfs-1.9.0.
15-0.1.2.ppc.rpm
http://download.opensuse.org/update/11.1/rpm/ppc/mozilla-xulrunner190-translations-1.
9.0.15-0.1.2.ppc.rpm
http://download.opensuse.org/update/11.1/rpm/ppc/python-xpcom190-1.9.0.15-0.1.2.ppc.r
pm
openSUSE 11.0:
http://download.opensuse.org/debug/update/11.0/rpm/ppc/MozillaFirefox-debuginfo-3.0.1
5-0.1.ppc.rpm
http://download.opensuse.org/debug/update/11.0/rpm/ppc/MozillaFirefox-debugsource-3.0
.15-0.1.ppc.rpm
http://download.opensuse.org/debug/update/11.0/rpm/ppc/mozilla-xulrunner190-debuginfo
-1.9.0.15-0.1.ppc.rpm
http://download.opensuse.org/debug/update/11.0/rpm/ppc/mozilla-xulrunner190-debugsour
ce-1.9.0.15-0.1.ppc.rpm
http://download.opensuse.org/update/11.0/rpm/ppc/MozillaFirefox-3.0.15-0.1.ppc.rpm
http://download.opensuse.org/update/11.0/rpm/ppc/MozillaFirefox-translations-3.0.15-0
.1.ppc.rpm
http://download.opensuse.org/update/11.0/rpm/ppc/mozilla-xulrunner190-1.9.0.15-0.1.pp
c.rpm
http://download.opensuse.org/update/11.0/rpm/ppc/mozilla-xulrunner190-64bit-1.9.0.15-
0.1.ppc.rpm
http://download.opensuse.org/update/11.0/rpm/ppc/mozilla-xulrunner190-devel-1.9.0.15-
0.1.ppc.rpm
http://download.opensuse.org/update/11.0/rpm/ppc/mozilla-xulrunner190-gnomevfs-1.9.0.
15-0.1.ppc.rpm
http://download.opensuse.org/update/11.0/rpm/ppc/mozilla-xulrunner190-gnomevfs-64bit-
1.9.0.15-0.1.ppc.rpm
http://download.opensuse.org/update/11.0/rpm/ppc/mozilla-xulrunner190-translations-1.
9.0.15-0.1.ppc.rpm
http://download.opensuse.org/update/11.0/rpm/ppc/mozilla-xulrunner190-translations-64
bit-1.9.0.15-0.1.ppc.rpm
x86-64 Platform:
openSUSE 11.1:
http://download.opensuse.org/debug/update/11.1/rpm/x86_64/MozillaFirefox-debuginfo-3.
0.15-0.1.2.x86_64.rpm
http://download.opensuse.org/debug/update/11.1/rpm/x86_64/MozillaFirefox-debugsource-
3.0.15-0.1.2.x86_64.rpm
http://download.opensuse.org/debug/update/11.1/rpm/x86_64/mozilla-xulrunner190-debugi
nfo-1.9.0.15-0.1.2.x86_64.rpm
http://download.opensuse.org/debug/update/11.1/rpm/x86_64/mozilla-xulrunner190-debugi
nfo-32bit-1.9.0.15-0.1.2.x86_64.rpm
http://download.opensuse.org/debug/update/11.1/rpm/x86_64/mozilla-xulrunner190-debugs
ource-1.9.0.15-0.1.2.x86_64.rpm
http://download.opensuse.org/update/11.1/rpm/x86_64/MozillaFirefox-3.0.15-0.1.2.x86_6
4.rpm
http://download.opensuse.org/update/11.1/rpm/x86_64/MozillaFirefox-branding-upstream-
3.0.15-0.1.2.x86_64.rpm
http://download.opensuse.org/update/11.1/rpm/x86_64/MozillaFirefox-translations-3.0.1
5-0.1.2.x86_64.rpm
http://download.opensuse.org/update/11.1/rpm/x86_64/mozilla-xulrunner190-1.9.0.15-0.1
.2.x86_64.rpm
http://download.opensuse.org/update/11.1/rpm/x86_64/mozilla-xulrunner190-32bit-1.9.0.
15-0.1.2.x86_64.rpm
http://download.opensuse.org/update/11.1/rpm/x86_64/mozilla-xulrunner190-devel-1.9.0.
15-0.1.2.x86_64.rpm
http://download.opensuse.org/update/11.1/rpm/x86_64/mozilla-xulrunner190-gnomevfs-1.9
.0.15-0.1.2.x86_64.rpm
http://download.opensuse.org/update/11.1/rpm/x86_64/mozilla-xulrunner190-gnomevfs-32b
it-1.9.0.15-0.1.2.x86_64.rpm
http://download.opensuse.org/update/11.1/rpm/x86_64/mozilla-xulrunner190-translations
-1.9.0.15-0.1.2.x86_64.rpm
http://download.opensuse.org/update/11.1/rpm/x86_64/mozilla-xulrunner190-translations
-32bit-1.9.0.15-0.1.2.x86_64.rpm
http://download.opensuse.org/update/11.1/rpm/x86_64/python-xpcom190-1.9.0.15-0.1.2.x8
6_64.rpm
openSUSE 11.0:
http://download.opensuse.org/debug/update/11.0/rpm/x86_64/mozilla-xulrunner190-debugi
nfo-1.9.0.15-0.1.x86_64.rpm
http://download.opensuse.org/debug/update/11.0/rpm/x86_64/mozilla-xulrunner190-debugs
ource-1.9.0.15-0.1.x86_64.rpm
http://download.opensuse.org/update/11.0/rpm/x86_64/MozillaFirefox-3.0.15-0.1.x86_64.
rpm
http://download.opensuse.org/update/11.0/rpm/x86_64/MozillaFirefox-translations-3.0.1
5-0.1.x86_64.rpm
http://download.opensuse.org/update/11.0/rpm/x86_64/mozilla-xulrunner190-1.9.0.15-0.1
.x86_64.rpm
http://download.opensuse.org/update/11.0/rpm/x86_64/mozilla-xulrunner190-32bit-1.9.0.
15-0.1.x86_64.rpm
http://download.opensuse.org/update/11.0/rpm/x86_64/mozilla-xulrunner190-devel-1.9.0.
15-0.1.x86_64.rpm
http://download.opensuse.org/update/11.0/rpm/x86_64/mozilla-xulrunner190-gnomevfs-1.9
.0.15-0.1.x86_64.rpm
http://download.opensuse.org/update/11.0/rpm/x86_64/mozilla-xulrunner190-gnomevfs-32b
it-1.9.0.15-0.1.x86_64.rpm
http://download.opensuse.org/update/11.0/rpm/x86_64/mozilla-xulrunner190-translations
-1.9.0.15-0.1.x86_64.rpm
http://download.opensuse.org/update/11.0/rpm/x86_64/mozilla-xulrunner190-translations
-32bit-1.9.0.15-0.1.x86_64.rpm
Sources:
openSUSE 11.1:
http://download.opensuse.org/update/11.1/rpm/src/MozillaFirefox-3.0.15-0.1.2.src.rpm
http://download.opensuse.org/update/11.1/rpm/src/mozilla-xulrunner190-1.9.0.15-0.1.2.
src.rpm
openSUSE 11.0:
http://download.opensuse.org/update/11.0/rpm/src/MozillaFirefox-3.0.15-0.1.src.rpm
http://download.opensuse.org/update/11.0/rpm/src/mozilla-xulrunner190-1.9.0.15-0.1.sr
c.rpm
Our maintenance customers are notified individually. The packages are
offered for installation from the maintenance web:
SUSE Linux Enterprise Server 10 SP3
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=b45a9
7409a57ffb7bfed2096ba136e83
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=a1051
39fcdfd8a2d443ee7ac045f2e46
SLE SDK 10 SP3
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=b45a9
7409a57ffb7bfed2096ba136e83
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=a1051
39fcdfd8a2d443ee7ac045f2e46
SUSE Linux Enterprise 10 SP3 DEBUGINFO
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=b45a9
7409a57ffb7bfed2096ba136e83
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=a1051
39fcdfd8a2d443ee7ac045f2e46
SUSE Linux Enterprise Desktop 10 SP3
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=b45a9
7409a57ffb7bfed2096ba136e83
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=a1051
39fcdfd8a2d443ee7ac045f2e46
SUSE Linux Enterprise Server 10 SP2
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=465a2
4b33c89591935093ce2f999824f
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=97e3d
820850fcfc5d0f11f5006eb7f29
SLE SDK 10 SP2
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=465a2
4b33c89591935093ce2f999824f
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=97e3d
820850fcfc5d0f11f5006eb7f29
SUSE Linux Enterprise 10 SP2 DEBUGINFO
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=465a2
4b33c89591935093ce2f999824f
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=97e3d
820850fcfc5d0f11f5006eb7f29
SUSE Linux Enterprise Desktop 10 SP2
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=465a2
4b33c89591935093ce2f999824f
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=97e3d
820850fcfc5d0f11f5006eb7f29
SLES 11
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=04c6e
38838a85fc92531b3e56904b052
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=49179
a9289fbe778bc2320690c17d088
SLED 11
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=04c6e
38838a85fc92531b3e56904b052
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=49179
a9289fbe778bc2320690c17d088
SLE 11
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=04c6e
38838a85fc92531b3e56904b052
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=49179
a9289fbe778bc2320690c17d088
SLES 11 DEBUGINFO
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=04c6e
38838a85fc92531b3e56904b052
http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=49179
a9289fbe778bc2320690c17d088
______________________________________________________________________________
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
See SUSE Security Summary Report.
______________________________________________________________________________
6) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and on Web
sites. The authenticity and integrity of a SUSE security announcement is
guaranteed by a cryptographic signature in each announcement. All SUSE
security announcements are published with a valid signature.
To verify the signature of the announcement, save it as text into a file
and run the command
gpg --verify <file>
replacing <file> with the name of the file where you saved the
announcement. The output for a valid signature looks like:
gpg: Signature made <DATE> using RSA key ID 3D25D3D9
gpg: Good signature from "SuSE Security Team <security@suse.de>"
where <DATE> is replaced by the date the document was signed.
If the security team's key is not contained in your key ring, you can
import it from the first installation CD. To import the key, use the
command
gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc
- Package authenticity verification:
SUSE update packages are available on many mirror FTP servers all over the
world. While this service is considered valuable and important to the free
and open source software community, the authenticity and the integrity of
a package needs to be verified to ensure that it has not been tampered
with.
The internal rpm package signatures provide an easy way to verify the
authenticity of an RPM package. Use the command
rpm -v --checksig <file.rpm>
to verify the signature of the package, replacing <file.rpm> with the
filename of the RPM package downloaded. The package is unmodified if it
contains a valid signature from build@suse.de with the key ID 9C800ACA.
This key is automatically imported into the RPM database (on
RPMv4-based distributions) and the gpg key ring of 'root' during
installation. You can also find it on the first installation CD and at
the end of this announcement.
- SUSE runs two security mailing lists to which any interested party may
subscribe:
opensuse-security@opensuse.org
- General Linux and SUSE security discussion.
All SUSE security announcements are sent to this list.
To subscribe, send an e-mail to
<opensuse-security+subscribe@opensuse.org>.
opensuse-security-announce@opensuse.org
- SUSE's announce-only mailing list.
Only SUSE's security announcements are sent to this list.
To subscribe, send an e-mail to
<opensuse-security-announce+subscribe@opensuse.org>.
=====================================================================
SUSE's security contact is <security@suse.com> or <security@suse.de>.
The <security@suse.de> public key is listed below.
=====================================================================
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way. In particular, the
clear text signature should show proof of the authenticity of the text.
SUSE Linux Products GmbH provides no warranties of any kind whatsoever
with respect to the information contained in this security advisory.
Type Bits/KeyID Date User ID
pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security@suse.de>
pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build@suse.de>
HNS MAIN FEED
Friday, 21:48 EST
