<?xml version="1.0" encoding="UTF-8"?>
<!--PATCHINFO id="f5dfc90a1cde762fb5e57175eac41a99"!-->
<update status="stable" from="maint-coord@suse.de" type="security" version="2531">
  <id>dbg111-popt</id>
  <title>rpm: Fix security problem where we miss to clear the SUID/SGID bits during package updates.</title>
  <release>openSUSE 11.1 DEBUGINFO</release>
  <issued date="1276126113"/>
  <references>
    <reference href="https://bugzilla.novell.com/show_bug.cgi?id=610941" id="610941" title="bug number 610941" type="bugzilla"/>
    <reference href="https://bugzilla.novell.com/show_bug.cgi?id=592269" id="592269" title="bug number 592269" type="bugzilla"/>
    <reference href="https://bugzilla.novell.com/show_bug.cgi?id=536256" id="536256" title="bug number 536256" type="bugzilla"/>
    <reference href="https://bugzilla.novell.com/show_bug.cgi?id=572280" id="572280" title="bug number 572280" type="bugzilla"/>
    <reference href="https://bugzilla.novell.com/show_bug.cgi?id=552622" id="552622" title="bug number 552622" type="bugzilla"/>
    <reference href="https://bugzilla.novell.com/show_bug.cgi?id=445037" id="445037" title="bug number 445037" type="bugzilla"/>
    <reference href="https://bugzilla.novell.com/show_bug.cgi?id=457908" id="457908" title="bug number 457908" type="bugzilla"/>
    <reference href="https://bugzilla.novell.com/show_bug.cgi?id=456695" id="456695" title="bug number 456695" type="bugzilla"/>
    <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2059" id="CVE-2010-2059" title="CVE-2010-2059" type="cve"/>
  </references>
  <description>This update fixes the problem where RPM misses to clear the
SUID/SGID bit of old files during package updates.
(CVE-2010-2059)

Also following bugfixes were merged from SLE11:
- make 'rpmconfigcheck status' exit with 4 [bnc#592269]
- do not use glibc for passwd/group lookups when --root is
  used  [bnc#536256]
- disable cpio md5 checking for repackaged rpms [bnc#572280]
- Add rpm-4.4.2.3-no-order-rescan-limit.patch from
  upstream  (bnc#552622)
- backport lazy statfs patch [fate#302038]
- define disttag as optional tag with macro just like
  disturl 
- add popt-devel and rpm-devel to baselibs config
  (bnc#445037)
- brp-symlink: whitelist kde4 doc path (bnc#457908) 
- find-supplements.ksyms: Module aliases may contain
  special characters that rpm does not allow in
  dependencies, such as commas. Encode those as %XX to
  avoid generating broken dependencies (bnc#456695).
- find-debuginfo.sh: Don't convert to binary.
</description>
  <pkglist>
    <collection>
        <package name="rpm-debuginfo" arch="i586" version="4.4.2.3" release="20.4.1">
          <filename>rpm-debuginfo-4.4.2.3-20.4.1.i586.rpm</filename>
        </package>
        <package name="rpm-debuginfo" arch="ppc" version="4.4.2.3" release="20.4.1">
          <filename>rpm-debuginfo-4.4.2.3-20.4.1.ppc.rpm</filename>
        </package>
        <package name="rpm-debuginfo" arch="x86_64" version="4.4.2.3" release="20.4.1">
          <filename>rpm-debuginfo-4.4.2.3-20.4.1.x86_64.rpm</filename>
        </package>
        <package name="rpm-debuginfo-32bit" arch="x86_64" version="4.4.2.3" release="20.4.1">
          <filename>rpm-debuginfo-32bit-4.4.2.3-20.4.1.x86_64.rpm</filename>
        </package>
        <package name="rpm-debuginfo-64bit" arch="ppc" version="4.4.2.3" release="20.4.1">
          <filename>rpm-debuginfo-64bit-4.4.2.3-20.4.1.ppc.rpm</filename>
        </package>
        <package name="rpm-debugsource" arch="i586" version="4.4.2.3" release="20.4.1">
          <filename>rpm-debugsource-4.4.2.3-20.4.1.i586.rpm</filename>
        </package>
        <package name="rpm-debugsource" arch="ppc" version="4.4.2.3" release="20.4.1">
          <filename>rpm-debugsource-4.4.2.3-20.4.1.ppc.rpm</filename>
        </package>
        <package name="rpm-debugsource" arch="x86_64" version="4.4.2.3" release="20.4.1">
          <filename>rpm-debugsource-4.4.2.3-20.4.1.x86_64.rpm</filename>
        </package>
    </collection>
  </pkglist>
</update>
