SUSE-RU-2014:1131-1: Recommended update for SUSE Studio

[sle-updates at lists.suse.com]

   SUSE Recommended Update: Recommended update for SUSE Studio
______________________________________________________________________________

Announcement ID:    SUSE-RU-2014:1131-1
Rating:             low
References:         #821211 #846792 #869709 #870539 #875682 #877692 
                    #878851 #882186 #883479 #887489 #889372 
Affected Products:
                    SUSE Studio Onsite 1.3
______________________________________________________________________________

   An update that solves one vulnerability and has 10 fixes is
   now available. It includes one version update.

Description:


   This update provides SUSE Studio 1.3.8, including many enhancements and
   bug fixes.

   The following issues have been fixed by this update:

       * bnc#887489 - Can't copy image tree to disk: "rsync: set_acl:
         sys_acl_set_file Operation not supported".
       * bnc#869709 - Unable to create appliance imported from 1.2 server.
       * bnc#846792 - SLE license is not shown when SUSE Cloud support is
         enabled.
       * bnc#875682 - Unable to re-enable disabled repositories.
       * bnc#821211 - POST of overlay file behaves differently in 1.3 than it
         does in 1.2.
       * bnc#882186 - Update Syntax library and fix copyright header.
       * bnc#877692 - Switching repos not recorded in changelog.
       * bnc#870539 - pgsql dump not recorded in changelog.
       * bnc#883479 - Graphics fail in testdrive with UEFI enabled appliance.
       * bnc#878851 - Directory traversal issue in rubygem-actionpack.
         (CVE-2014-0130)
       * bnc#889372 - Error SID failed service ping. Cache is not available
         for this repository.

   Security Issues:

       * CVE-2014-0130
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0130>


Patch Instructions:

   To install this SUSE Recommended Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Studio Onsite 1.3:

      zypper in -t patch slestso13-susestudio-138-201408-9638

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Studio Onsite 1.3 (x86_64) [New Version: 1.3.8]:

      susestudio-1.3.8-0.15.2
      susestudio-bundled-packages-1.3.8-0.15.2
      susestudio-common-1.3.8-0.15.2
      susestudio-runner-1.3.8-0.15.2
      susestudio-sid-1.3.8-0.15.2
      susestudio-ui-server-1.3.8-0.15.2


References:

   http://support.novell.com/security/cve/CVE-2014-0130.html
   https://bugzilla.novell.com/821211
   https://bugzilla.novell.com/846792
   https://bugzilla.novell.com/869709
   https://bugzilla.novell.com/870539
   https://bugzilla.novell.com/875682
   https://bugzilla.novell.com/877692
   https://bugzilla.novell.com/878851
   https://bugzilla.novell.com/882186
   https://bugzilla.novell.com/883479
   https://bugzilla.novell.com/887489
   https://bugzilla.novell.com/889372
   http://download.suse.com/patch/finder/?keywords=41de1f34dbe9da845bd7348fd35ef0f9