SuSE 10 Security Update : freetype2 (ZYPP Patch Number 1918)

This security update fixes crashes in the PCF handling of freetype2 which might be used to crash freetype2 using applications or even to execute code in them. This issue is tracked by the Mitre CVE ID CVE-2006-3467. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this...

SuSE 10 Security Update : openssl (ZYPP Patch Number 2082)

This update fixes a bug in OpenSSL that allowed the forgery of some special RSA signatures. CVE-2006-4339 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29541;...

SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 2407)

Following security problem was fixed in OpenOfficeorg : - Bufferoverflows in WMF and Enhanced WMF handling in OpenOfficeorg could be used to potentially execute code or crash OpenOfficeorg. It is necessary that the user can be tricked to open a prepared document. CVE-2006-5870 This update also ad...

SuSE 10 Security Update : ncompress (ZYPP Patch Number 1911)

Lack of bounds checking in the decompression routine could result in a heap buffer underflow. Attackers could potentially exploit this to execute arbitrary code by tricking users into decompressing a specially crafted archive. CVE-2006-1168 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

SuSE 10 Security Update : avahi (ZYPP Patch Number 2216)

Avahi did not check that the received netlink messages originated from the kernel. This could be used by local attackers to inject packets into avahi which could be used to inject bad netlink messages into Avahi, confusing its routing code or worse. CVE-2006-5461 %NASLMINLEVEL 70300 C Tenable...

SuSE 10 Security Update : gnutls (ZYPP Patch Number 2117)

A security problem was fixed in the GNU TLS library, where excess data was not checked during signature checking with RSA keys with exponent 3. This problem could be used to fake those RSA signatures. CVE-2006-4790 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this...

SuSE 10 Security Update : libmusicbrainz (ZYPP Patch Number 2042)

This update fixes various buffer overflows that can by exploited by malicious servers to execute arbitrary code. CVE-2006-4197 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : pcre (ZYPP Patch Number 4707)

Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code. CVE-2006-7230 %NASLMINLEVEL 70300 C Tenable...

SuSE 10 Security Update : PHP (ZYPP Patch Number 2236)

This update fixes the following security problems in the PHP scripting language : - Various buffer overflows in htmlentities/htmlspecialchars internal routines could be used to crash the PHP interpreter or potentially execute code, depending on the PHP application used. CVE-2006-5465 - A missing...

SuSE 10 Security Update : OpenSSH (ZYPP Patch Number 2184)

Several security problems were fixed in OpenSSH : - A denial of service problem has been fixed in OpenSSH which could be used to cause lots of CPU consumption on a remote openssh server. CVE-2006-4924 - If a remote attacker is able to inject network traffic this could be used to cause a client...

SuSE 10 Security Update : xsupplicant (ZYPP Patch Number 2455)

xsupplicant has been upgraded to version 1.2.8, which includes bugfixes and one security fix : - A post-authentication stack overflow in the EAP handling could be used by already authenticated attacker to overflow a stackbuffer and so potentially execute code. CVE-2006-5601 %NASLMINLEVEL 70300 C...

SuSE 10 Security Update : clamav (ZYPP Patch Number 2390)

This update to ClamAV version 0.88.7 fixes various bugs : - Clam AntiVirus ClamAV allows remote attackers to cause a denial of service crash via a malformed base64-encoded MIME attachment that triggers a NULL pointer dereference. CVE-2006-5874 - Clam AntiVirus ClamAV 0.88.6 allowed remote attacke...

SuSE 10 Security Update : Qt (ZYPP Patch Number 2187)

Multiple integer overflows have been found in image processing functions within the QT library. These could potentially lead to heap overflows and code execution. CVE-2006-4811 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Java (ZYPP Patch Number 3891)

The IBM Java JRE/SDK has been brought to release 1.4.2 SR8, containing several bugfixes, including the following security fixes : - A buffer overflow vulnerability in the JavaTM Runtime Environment may allow an untrusted applet to elevate its privileges. For example, an applet may grant itself...

SuSE 10 Security Update : krb5-apps-servers and krb5-apps-clients (ZYPP Patch Number 1938)

Various return checks of setuid and seteuid calls have been fixed in kerberos client and server applications. If these applications are setuid, it might have been possible for local attackers to gain root access. CVE-2006-3083 We are not affected by the seteuid problems, tracked by CVE-2006-3084...

SuSE 10 Security Update : gzip (ZYPP Patch Number 2085)

This update fixes several security problems that can be exploited to compromise the system in conjunction with other programs while processing malformated archive files. CVE-2006-4334 / CVE-2006-4335 / CVE-2006-4336 / CVE-2006-4337 / CVE-2006-4338 %NASLMINLEVEL 70300 C Tenable Network Security,...

SuSE 10 Security Update : xine-lib (ZYPP Patch Number 2307)

Multiple buffer overflows were fixed in the XINE decoder libraries, which could be used by attackers to crash players or potentially execute code. - Buffer overflow in ffmpeg for xine-lib before 1.1.2 might allow context-dependent attackers to execute arbitrary code via a crafted AVI file and 'ba...

SuSE 10 Security Update : compat-openssl097g (ZYPP Patch Number 2163)

A buffer overflow condition within the SSLgetsharedciphers function and a DoS condition known as 'parasitic public keys' have been fixed. The later problem allowed attackers to trick the OpenSSL engine to spend an extraordinary amount of time to process public keys. The following CAN numbers have...

SuSE 10 Security Update : gpg2 (ZYPP Patch Number 1834)

It is possible to crash denial of service the GNU Privacy Guard gpg by supplying a specifically crafted message specifying a very large UID, which leads to an out of memory situation or an integer overflow. It is unclear if this problem can be exploited to execute code. This issue is tracked by t...

SuSE 10 Security Update : avahi (ZYPP Patch Number 2986)

This update fixes a remote denial of service problem in avahi, where attackers could cause an endless loop. CVE-2006-6870 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...