Message-ID: <437B3087.mailC9L11FGRY@suse.de>
Date: Wed, 16 Nov 2005 14:13:43 +0100
From: Thomas Biege <thomas@...e.de>
To: bugtraq@...urityfocus.com
Subject: SUSE Security Announcement: gdk-pixbuf, gtk2 (SUSE-SA:2005:065)



-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________

                        SUSE Security Announcement

        Package:                gtk2, gdk-pixbuf
        Announcement ID:        SUSE-SA:2005:065
        Date:                   Wed, 16 Nov 2005 13:23:50 +0000
        Affected Products:      SUSE LINUX 10.0
                                SUSE LINUX 9.3
                                SUSE LINUX 9.2
                                SUSE LINUX 9.1
                                SuSE Linux 9.0
                                SuSE Linux Desktop 1.0
                                SuSE Linux Enterprise Server 8
                                SUSE SLES 9
                                UnitedLinux 1.0
        Vulnerability Type:     remote code execution
        Severity (1-10):        8
        SUSE Default Package:   yes
        Cross-References:       CVE-2005-3186
                                CVE-2005-2976
                                CVE-2005-2975

    Content of This Advisory:
        1) Security Vulnerability Resolved:
             - buffer overflow
             - integer overflow
             - infinite loop
           Problem Description
        2) Solution or Work-Around
        3) Special Instructions and Notes
        4) Package Location and Checksums
        5) Pending Vulnerabilities, Solutions, and Work-Arounds:
            none
        6) Authenticity Verification and Additional Information

______________________________________________________________________________

1) Problem Description and Brief Discussion

   The image loading library of the gdk-pixbug/gtk2 package is vulnerable
   to several security-related bugs. This makes every application (mostly
   GNOME applications) which is linked against this library vulnerable too.

   A carefully crafted XPM file can be used to execute arbitrary code while
   processing the image file. (CVE-2005-3186)

   Additionally Ludwig Nussel from the SuSE Security-Team discovered an
   integer overflow bug that can be used to execute arbitray code too
   (CVE-2005-2976), and an infinite loop which leads to a denial-of-service
   bug. (CVE-2005-2975)

2) Solution or Work-Around

   none

3) Special Instructions and Notes

   Please restart your system to make the update completely effective.

4) Package Location and Checksums

   The preferred method for installing security updates is to use the YaST
   Online Update (YOU) tool. YOU detects which updates are required and
   automatically performs the necessary steps to verify and install them.
   Alternatively, download the update packages for your distribution manually
   and verify their integrity by the methods listed in Section 6 of this
   announcement. Then install the packages using the command

     rpm -Fhv <file.rpm>

   to apply the update, replacing <file.rpm> with the filename of the
   downloaded RPM package.


    x86 Platform:

    SUSE Linux 10.0:
    ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gtk2-2.8.3-4.3.i586.rpm
      0be068d079c58cbbaaa52e80820e6c6e
    ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gtk2-devel-2.8.3-4.3.i586.rpm
      f6b37ad46fdd2ef2e7e2fc0e0e7598b1
    ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gdk-pixbuf-0.22.0-72.3.i586.rpm
      a3ed5aec0eb8a110af839d91468d2790
    ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gdk-pixbuf-devel-0.22.0-72.3.i586.rpm
      c1981e12a87989d8ccab4d91418a6310
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gtk2-2.8.3-4.3.i586.patch.rpm
      f5fb1c48e841a15b4194f196bde2ff10
    ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gtk2-devel-2.8.3-4.3.i586.patch.rpm
      9e94e889694c900d46b02ef6c22ba5e4
    ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gdk-pixbuf-0.22.0-72.3.i586.patch.rpm
      64d3bee622ee73b5ac50dbf73e65f526
    ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/gdk-pixbuf-devel-0.22.0-72.3.i586.patch.rpm
      c431dc98c53e4b9a000822ab311e7b0a
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/gtk2-2.8.3-4.3.src.rpm
      f827e0f9da7d988d03098559119ac2d7
    ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/gdk-pixbuf-0.22.0-72.3.src.rpm
      87e193dc3dce8969f47d6772e10b6e3a

    SUSE Linux 9.3:
    ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gtk2-2.6.4-6.3.i586.rpm
      e7e6dceafe5a32ebab7a5b8a57661f87
    ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gtk2-devel-2.6.4-6.3.i586.rpm
      9f4c9d44adb7756dc7c458f266da7420
    ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gdk-pixbuf-0.22.0-67.3.i586.rpm
      b30948d644cc33444b5f03eeb3bca654
    ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gdk-pixbuf-devel-0.22.0-67.3.i586.rpm
      d515f01e0bb2292d647c04234b4c836a
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gtk2-2.6.4-6.3.i586.patch.rpm
      0439cde8222d72a9c1c46de79c609669
    ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gtk2-devel-2.6.4-6.3.i586.patch.rpm
      b9e5a1af3a8ad50879ae2339643b6953
    ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gdk-pixbuf-0.22.0-67.3.i586.patch.rpm
      42f9f1212c01aa7e866197f921646d79
    ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/gdk-pixbuf-devel-0.22.0-67.3.i586.patch.rpm
      da1f519c5e1b46cbf99a8eace632301f
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/gtk2-2.6.4-6.3.src.rpm
      6b7e57bea2b48ae3a7bfcc6378cdb7fe
    ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/gdk-pixbuf-0.22.0-67.3.src.rpm
      d546d4e4ca0401b3d530f3263a83639d

    SUSE Linux 9.2:
    ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gtk2-2.4.9-10.3.i586.rpm
      eea4e22113af4911766b88fb5afff990
    ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gtk2-devel-2.4.9-10.3.i586.rpm
      f9bccebbdbc4951ba929c0b3bdd5e748
    ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gdk-pixbuf-0.22.0-64.3.i586.rpm
      2f51e4f26ac2eb72ce9b188cf1a43d12
    ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gdk-pixbuf-devel-0.22.0-64.3.i586.rpm
      7f9d14be9e038b6079525a99141632c2
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gtk2-2.4.9-10.3.i586.patch.rpm
      3b9834d757ef903331eef11d263765aa
    ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gtk2-devel-2.4.9-10.3.i586.patch.rpm
      71a66acac5bdab4f540745e3f34513db
    ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gdk-pixbuf-0.22.0-64.3.i586.patch.rpm
      564c47762db1dfd0579a15a28a5bf198
    ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/gdk-pixbuf-devel-0.22.0-64.3.i586.patch.rpm
      ae58eb0eb9b21b6dc34a88576cda8d40
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/gtk2-2.4.9-10.3.src.rpm
      03fbda334b284e4764d287e635738e86
    ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/gdk-pixbuf-0.22.0-64.3.src.rpm
      922628a980e0c30438381c8c75ba1681

    SUSE Linux 9.1:
    ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gtk2-2.2.4-125.10.i586.rpm
      7076812e0edec87e47ac3e2773a29908
    ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gtk2-devel-2.2.4-125.10.i586.rpm
      6dbc2a7c8ed993e6868ff9becd264e5b
    ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gdk-pixbuf-0.22.0-62.13.i586.rpm
      cfd60a7867d3f19fdf2ef457ad61c3e2
    ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gdk-pixbuf-devel-0.22.0-62.13.i586.rpm
      0d9cd0869e0d461ca12f1b6702e09ae6
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gtk2-2.2.4-125.10.i586.patch.rpm
      c51455321b63c0f9db6b334879b74db2
    ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gtk2-devel-2.2.4-125.10.i586.patch.rpm
      2fdce6d74daaa4d0d36b9e299d005cf9
    ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gdk-pixbuf-0.22.0-62.13.i586.patch.rpm
      5d74d0c82efdf390e332e8cf51fe4018
    ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/gdk-pixbuf-devel-0.22.0-62.13.i586.patch.rpm
      953ab164ef73f95aa6eabf1b75fb9e81
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/gtk2-2.2.4-125.10.src.rpm
      7f25bb1592667d945298b55794a5ef34
    ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/gdk-pixbuf-0.22.0-62.13.src.rpm
      3ea3a4213e98c872386be297b34dbe2f

    SUSE Linux 9.0:
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gtk2-2.2.3-57.i586.rpm
      b7a34c4ca59ad4ff986539d41f5a3c62
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gtk2-devel-2.2.3-57.i586.rpm
      45cfa2114c629d787f4c94ab7a7a26b5
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gdk-pixbuf-0.18.0-615.i586.rpm
      2e1d762dbce602f2cd4bdba9c6481f22
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gdk-pixbuf-devel-0.18.0-615.i586.rpm
      70152ca0189e5af94730a39d362c4679
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gtk2-2.2.3-57.i586.patch.rpm
      92b162e49010fdd8bc01113a55f98963
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gtk2-devel-2.2.3-57.i586.patch.rpm
      43f931a74169a3ab25ca2219fad8e260
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gdk-pixbuf-0.18.0-615.i586.patch.rpm
      4736822d29064f7d05bee4f7eb877d5d
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/gdk-pixbuf-devel-0.18.0-615.i586.patch.rpm
      aace0a16af2c70132a5c7ce94ee9315d
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/gtk2-2.2.3-57.src.rpm
      54ea94d4fadeedc9617c6b9e3ab253c0
    ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/gdk-pixbuf-0.18.0-615.src.rpm
      af97a34f1df9e537a5babb7309f10e85



    x86-64 Platform:

    SUSE Linux 10.0:
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gtk2-32bit-2.8.3-4.3.x86_64.rpm
      a6f11004299a6bc194758e58631eb14d
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gtk2-32bit-2.8.3-4.3.x86_64.rpm
      a6f11004299a6bc194758e58631eb14d
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gtk2-devel-2.8.3-4.3.x86_64.rpm
      d10769dfd24dd41298930ba09bfef93f
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gdk-pixbuf-0.22.0-72.3.x86_64.rpm
      d60b38927a4b25ff8d5c61b15805be4b
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gdk-pixbuf-devel-0.22.0-72.3.x86_64.rpm
      1e4281501647d4d227f6b2c7a6709e44
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gdk-pixbuf-32bit-0.22.0-72.3.x86_64.rpm
      b1331a95be856bca8cc58a6ba92156fa
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gtk2-32bit-2.8.3-4.3.x86_64.patch.rpm
      57dae5b10043cef231709c75b9c1fef0
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gtk2-32bit-2.8.3-4.3.x86_64.patch.rpm
      57dae5b10043cef231709c75b9c1fef0
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gtk2-devel-2.8.3-4.3.x86_64.patch.rpm
      0e1af403bc2a960a10b546b7551a83da
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gdk-pixbuf-0.22.0-72.3.x86_64.patch.rpm
      d496410edd7f6da4d48a4d8fbb71c6ae
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gdk-pixbuf-devel-0.22.0-72.3.x86_64.patch.rpm
      969bb92ada0efac69c035ed71661deaf
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/x86_64/gdk-pixbuf-32bit-0.22.0-72.3.x86_64.patch.rpm
      f43a0a3ff732634d62ec5c0404a8883b
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/src/gtk2-2.8.3-4.3.src.rpm
      f827e0f9da7d988d03098559119ac2d7
    ftp://ftp.suse.com/pub/suse/x86_64/update/10.0/rpm/src/gdk-pixbuf-0.22.0-72.3.src.rpm
      87e193dc3dce8969f47d6772e10b6e3a

    SUSE Linux 9.3:
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gtk2-2.6.4-6.3.x86_64.rpm
      270711bb1b6d023c9d3629f312e50749
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gtk2-32bit-9.3-7.1.x86_64.rpm
      37515e93536ea2937a0094e96aff080b
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gtk2-devel-2.6.4-6.3.x86_64.rpm
      99822738b70178f12976c93f8bcc9e5e
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gdk-pixbuf-32bit-9.3-7.1.x86_64.rpm
      7f083e788760599185f5383fbd6074cc
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gdk-pixbuf-devel-0.22.0-67.3.x86_64.rpm
      d07ea6f37ec3914951a4b32f085af0a0
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gdk-pixbuf-32bit-9.3-7.1.x86_64.rpm
      7f083e788760599185f5383fbd6074cc
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gtk2-2.6.4-6.3.x86_64.patch.rpm
      831bcb2924eacdf3e06094f155366a64
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gtk2-32bit-9.3-7.1.x86_64.patch.rpm
      5969ab9de490013c104d32070336c702
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gtk2-devel-2.6.4-6.3.x86_64.patch.rpm
      3f8bac290a7417022e4605681db0ec5f
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gdk-pixbuf-32bit-9.3-7.1.x86_64.patch.rpm
      fa40ceaa517c75d2029803f8910b528d
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gdk-pixbuf-devel-0.22.0-67.3.x86_64.patch.rpm
      7d363a368b905f1f223cc6bb6a50a744
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/x86_64/gdk-pixbuf-32bit-9.3-7.1.x86_64.patch.rpm
      fa40ceaa517c75d2029803f8910b528d
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/gtk2-2.6.4-6.3.src.rpm
      6b7e57bea2b48ae3a7bfcc6378cdb7fe
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/baselibs-32bit-9.3-7.1.src.rpm
      2a749acae07d01e7249fc8348673e339
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/gtk2-2.6.4-6.3.src.rpm
      6b7e57bea2b48ae3a7bfcc6378cdb7fe
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/baselibs-32bit-9.3-7.1.src.rpm
      2a749acae07d01e7249fc8348673e339
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/gdk-pixbuf-0.22.0-67.3.src.rpm
      d546d4e4ca0401b3d530f3263a83639d
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.3/rpm/src/baselibs-32bit-9.3-7.1.src.rpm
      2a749acae07d01e7249fc8348673e339

    SUSE Linux 9.2:
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gtk2-2.4.9-10.3.x86_64.rpm
      2121161aa786e90f0e6ae4919da90a3a
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gtk2-32bit-9.2-200511030547.x86_64.rpm
      3c3d9e1d3a02d7c53b6c9a453c9bbb79
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gtk2-devel-2.4.9-10.3.x86_64.rpm
      de587bb88d05ef7ea69d61df65955cbb
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gdk-pixbuf-32bit-9.2-200511030547.x86_64.rpm
      5b3038697146b9fe3a736d6b0be689d6
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gdk-pixbuf-devel-0.22.0-64.3.x86_64.rpm
      dd99a4ce37d4504d17f89a5b835674c6
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gdk-pixbuf-32bit-9.2-200511030547.x86_64.rpm
      5b3038697146b9fe3a736d6b0be689d6
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gtk2-2.4.9-10.3.x86_64.patch.rpm
      aa15a4974bc6bb066829cf113c0470a9
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gtk2-32bit-9.2-200511030547.x86_64.patch.rpm
      f509872128353007b4ece66bfd839d6b
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gtk2-devel-2.4.9-10.3.x86_64.patch.rpm
      18f1afa7c3b873f8aecb9d93f273dca6
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gdk-pixbuf-32bit-9.2-200511030547.x86_64.patch.rpm
      364d36b4a5a411054145ba41fb42b637
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gdk-pixbuf-devel-0.22.0-64.3.x86_64.patch.rpm
      0a6ff2ebe95bedbfd200778e5e771d74
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/gdk-pixbuf-32bit-9.2-200511030547.x86_64.patch.rpm
      364d36b4a5a411054145ba41fb42b637
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/gtk2-2.4.9-10.3.src.rpm
      03fbda334b284e4764d287e635738e86
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/baselibs-32bit-9.2-200511030547.src.rpm
      336ba61bad29df1bb83a51d940ce1347
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/gtk2-2.4.9-10.3.src.rpm
      03fbda334b284e4764d287e635738e86
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/baselibs-32bit-9.2-200511030547.src.rpm
      336ba61bad29df1bb83a51d940ce1347
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/gdk-pixbuf-0.22.0-64.3.src.rpm
      922628a980e0c30438381c8c75ba1681
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/baselibs-32bit-9.2-200511030547.src.rpm
      336ba61bad29df1bb83a51d940ce1347

    SUSE Linux 9.1:
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gtk2-2.2.4-125.10.x86_64.rpm
      dda27248ea4c5a9c1fac68296a02cda1
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gtk2-devel-2.2.4-125.10.x86_64.rpm
      2e6c139ee38655ed850cf7392ec6147a
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gdk-pixbuf-0.22.0-62.13.x86_64.rpm
      5f471e724c1e81511d282b2d5a0741da
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gdk-pixbuf-devel-0.22.0-62.13.x86_64.rpm
      05577700604c7651e0a9a4b0d34f929d
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gtk2-2.2.4-125.10.x86_64.patch.rpm
      c3495bec0ac4043dc7fb60112cd4b93e
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gtk2-devel-2.2.4-125.10.x86_64.patch.rpm
      1a0b8b30d9b5717aea242bab6cc04def
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gdk-pixbuf-0.22.0-62.13.x86_64.patch.rpm
      38523f56baf169bc35579869e77ea3cc
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/gdk-pixbuf-devel-0.22.0-62.13.x86_64.patch.rpm
      34ba091cf09bb721bbbe98194a7b8af7
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/gtk2-2.2.4-125.10.src.rpm
      c78f44a653b8c7078850214d6d0305a4
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/gdk-pixbuf-0.22.0-62.13.src.rpm
      9d56df6bd1f836bff06f3c320e6af720

    SUSE Linux 9.0:
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gtk2-2.2.3-57.x86_64.rpm
      1be59dd02108d53f2b6136970281458f
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gtk2-devel-2.2.3-57.x86_64.rpm
      8c5a75f2e162f946120fbc1991177141
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gdk-pixbuf-0.18.0-615.x86_64.rpm
      9db2ce9ac353de3b3d40baa694a265fc
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gdk-pixbuf-devel-0.18.0-615.x86_64.rpm
      c4dbed18cd259adc7069e4df1fb8925b
    patch rpm(s):
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gtk2-2.2.3-57.x86_64.patch.rpm
      99bcb3c24cdff9959c01e1f00a8bcd65
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gtk2-devel-2.2.3-57.x86_64.patch.rpm
      9ffaea29a6cb96579c158219db2fd8ea
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gdk-pixbuf-0.18.0-615.x86_64.patch.rpm
      5a684ec36f5f292aebccb55f7e23260d
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/gdk-pixbuf-devel-0.18.0-615.x86_64.patch.rpm
      f0c738175d874e0c2e29866a6ee87fcc
    source rpm(s):
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/gtk2-2.2.3-57.src.rpm
      d8c2495842a49bfb178248df91c58464
    ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/gdk-pixbuf-0.18.0-615.src.rpm
      fa3e8a1b1fb4b8fcc35cf9ea0afea3a3

   Our maintenance customers are notified individually. The packages are
   offered for installation from the maintenance web:

   http://support.novell.com/cgi-bin/search/searchtid.cgi?psdb/4f5fae06488ebd06d78f3ec5ecb019e6.html
   http://portal.suse.com/psdb/4f5fae06488ebd06d78f3ec5ecb019e6.html

   http://support.novell.com/cgi-bin/search/searchtid.cgi?psdb/5ec7432d76a4db8b287ee5545e207443.html
   http://portal.suse.com/psdb/5ec7432d76a4db8b287ee5545e207443.html

   http://support.novell.com/cgi-bin/search/searchtid.cgi?psdb/fe498fdfdd2ea49200596544a0aac288.html
   http://portal.suse.com/psdb/fe498fdfdd2ea49200596544a0aac288.html

______________________________________________________________________________

5) Pending Vulnerabilities, Solutions, and Work-Arounds:

   - See SUSE Security Summary Report
______________________________________________________________________________

6) Authenticity Verification and Additional Information

  - Announcement authenticity verification:

    SUSE security announcements are published via mailing lists and on Web
    sites. The authenticity and integrity of a SUSE security announcement is
    guaranteed by a cryptographic signature in each announcement. All SUSE
    security announcements are published with a valid signature.

    To verify the signature of the announcement, save it as text into a file
    and run the command

      gpg --verify <file>

    replacing <file> with the name of the file where you saved the
    announcement. The output for a valid signature looks like:

      gpg: Signature made <DATE> using RSA key ID 3D25D3D9
      gpg: Good signature from "SuSE Security Team <security@...e.de>"

    where <DATE> is replaced by the date the document was signed.

    If the security team's key is not contained in your key ring, you can
    import it from the first installation CD. To import the key, use the
    command

      gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc

  - Package authenticity verification:

    SUSE update packages are available on many mirror FTP servers all over the
    world. While this service is considered valuable and important to the free
    and open source software community, the authenticity and the integrity of
    a package needs to be verified to ensure that it has not been tampered
    with.

    There are two verification methods that can be used independently from
    each other to prove the authenticity of a downloaded file or RPM package:

    1) Using the internal gpg signatures of the rpm package
    2) MD5 checksums as provided in this announcement

    1) The internal rpm package signatures provide an easy way to verify the
       authenticity of an RPM package. Use the command

        rpm -v --checksig <file.rpm>

       to verify the signature of the package, replacing <file.rpm> with the
       filename of the RPM package downloaded. The package is unmodified if it
       contains a valid signature from build@...e.de with the key ID 9C800ACA.

       This key is automatically imported into the RPM database (on
       RPMv4-based distributions) and the gpg key ring of 'root' during
       installation. You can also find it on the first installation CD and at
       the end of this announcement.

    2) If you need an alternative means of verification, use the md5sum
       command to verify the authenticity of the packages. Execute the command

         md5sum <filename.rpm>

       after you downloaded the file from a SUSE FTP server or its mirrors.
       Then compare the resulting md5sum with the one that is listed in the
       SUSE security announcement. Because the announcement containing the
       checksums is cryptographically signed (by security@...e.de), the
       checksums show proof of the authenticity of the package if the
       signature of the announcement is valid. Note that the md5 sums
       published in the SUSE Security Announcements are valid for the
       respective packages only. Newer versions of these packages cannot be
       verified.

  - SUSE runs two security mailing lists to which any interested party may
    subscribe:

    suse-security@...e.com
        -   General Linux and SUSE security discussion.
            All SUSE security announcements are sent to this list.
            To subscribe, send an e-mail to
                <suse-security-subscribe@...e.com>.

    suse-security-announce@...e.com
        -   SUSE's announce-only mailing list.
            Only SUSE's security announcements are sent to this list.
            To subscribe, send an e-mail to
                <suse-security-announce-subscribe@...e.com>.

    For general information or the frequently asked questions (FAQ),
    send mail to <suse-security-info@...e.com> or
    <suse-security-faq@...e.com>.

    =====================================================================
    SUSE's security contact is <security@...e.com> or <security@...e.de>.
    The <security@...e.de> public key is listed below.
    =====================================================================
______________________________________________________________________________

    The information in this advisory may be distributed or reproduced,
    provided that the advisory is not modified in any way. In particular, the
    clear text signature should show proof of the authenticity of the text.

    SUSE Linux Products GmbH provides no warranties of any kind whatsoever
    with respect to the information contained in this security advisory.

Type Bits/KeyID    Date       User ID
pub  2048R/3D25D3D9 1999-03-06 SuSE Security Team <security@...e.de>
pub  1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build@...e.de>

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff
4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d
M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO
QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK
XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE
D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd
G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM
CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE
myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr
YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD
wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d
NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe
QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe
LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t
XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU
D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3
0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot
1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW
cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E
ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f
AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E
Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/
HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h
t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT
tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM
523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q
2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8
QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw
JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ
1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH
ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1
wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY
EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol
0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK
CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co
SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo
omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt
A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J
/LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE
GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf
ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT
ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8
RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ
8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb
B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X
11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA
8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj
qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p
WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL
hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG
BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+
AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi
RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0
zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM
/3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7
whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl
D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz
dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI
RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI
DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE=
=LRKC
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux)

iQEVAwUBQ3swVXey5gA9JdPZAQGWhwf9EOsn5HOknjlUf+IP5xOPi6HeDnJRgT+B
UjA/mH8vfNcSO5SA7Mdk7Hzwi8lsHg49y+NQYiR5xOHjvdMag0h3lkmmN+ETPJ5z
1TzuQDq3XSWyLhiO4KP8hGW5MUjnNnmmsVqU103P9b8xP1IKWDSDclWOUb/a07yV
BPj3u95CUg5ASEJ1MgxVBSd7vMiYBJYQqr5h/+SsHVjQFWwS2NOQaEZRu8SPlPTo
RB+RA9ecfVleWheskQ9CgQsuIcMVpskGHRxijz8OG4Wih0GFo+8jdIsYdSEdOXLT
WRH713GDu3EAKsQT1uzAnlT+VRCiGxciv5lDfwBiGajJlZewaM4BmA==
=rfCY
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists