openSUSE 10 Security Update : avahi (avahi-2982)

This update fixes a remote denial of service problem in avahi, where attackers could cause an endless loop. CVE-2006-6870 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update avahi-2982. The text...

openSUSE 10 Security Update : gimp (gimp-3995)

Multiple gimp import filters contained integer overflows. Attackers could exploit that to potentially execute code by tricking users into opening specially crafted files CVE-2006-4519. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE 10 Security Update : postgresql (postgresql-1443)

This update fixes a security problem that allowed attackers to inject SQL commands into queries CVE-2006-2313, CVE-2006-2314. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update postgresql-1443. T...

openSUSE 10 Security Update : dia (dia-1435)

Format string bugs in dia could potentially be exploited to execute arbitrary code CVE-2006-2453, CVE-2006-2480. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update dia-1435. The text description ...

openSUSE 10 Security Update : openssh (openssh-2256)

The OpenSSH release 4.5 contains a security fix which has been backported to the openssh versions in our old products. CVE-2006-5794: Incorrect return argument checking in the privilege separation monitor was fixed. In case of an exploitable unprivileged helper this could have been used to elevat...

openSUSE 10 Security Update : openssh (openssh-2183)

Several security problems were fixed in OpenSSH : - CVE-2006-4924: A denial of service problem has been fixed in OpenSSH which could be used to cause lots of CPU consumption on a remote openssh server. - CVE-2006-4925: If a remote attacker is able to inject network traffic this could be used to...

openSUSE 10 Security Update : qt3 (qt3-2189)

Multiple integer overflows have been found in image processing functions within the QT library. These could potentially lead to heap overflows and code execution. CVE-2006-4811 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

openSUSE 10 Security Update : phpMyAdmin (phpMyAdmin-1611)

Missing checks of the 'db' parameter could be exploited for cross site scripting attacks CVE-2006-2417. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update phpMyAdmin-1611. The text description of...

openSUSE 10 Security Update : asterisk (asterisk-2272)

This update fixes 2 security problem in the PBX software Asterisk. CVE-2006-5444: Integer overflow in the getinput function in the Skinny channel driver chanskinny.c as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integ...

openSUSE 10 Security Update : tar (tar-2351)

This security update fixes a directory traversal in tar, where unpacked symlinks could be followed outside of the directory where the tar file is unpacked. CVE-2006-6097 This feature was made optional and needs to be enabled with a commandline option. %NASLMINLEVEL 70300 C Tenable Network Securit...

openSUSE 10 Security Update : sendmail (sendmail-2027)

Without this update sendmail may crash when finishing a mail due to referencing an already freed variable CVE-2006-4434. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update sendmail-2027. The text...

openSUSE 10 Security Update : krb5-apps-clients (krb5-apps-clients-1937)

Various return checks of setuid and seteuid calls have been fixed in kerberos client and server applications. If these applications are setuid, it might have been possible for local attackers to gain root access CVE-2006-3083. We are not affected by the seteuid problems, tracked by CVE-2006-3084...

openSUSE 10 Security Update : ImageMagick (ImageMagick-2235)

Two security problems were found in GraphicsMagick which are also present in ImageMagick. CVE-2006-5456: Multiple buffer overflows in ImageMagick allowed user-assisted attackers to cause a denial of service and possibly execute arbitrary code via 1 a DCM image that is not properly handled by the...

openSUSE 10 Security Update : mysql (mysql-2075)

This update of mysql fixes several security vulnerabilities. CVE-2006-4031,CVE-2006-4226,CVE-2006-4227 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update mysql-2075. The text description of this...

openSUSE 10 Security Update : opera (opera-1313)

Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check. CVE-2006-1834 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE 10 Security Update : ethereal (ethereal-2246)

Various problems have been fixed in the network analyzer Ethereal, most leading to crashes of the ethereal program. CVE-2006-5740: A unspecified vulnerability in the LDAP dissector could be used to crash Ethereal. CVE-2006-4574: A single \0 byte heap overflow was fixed in the MIME multipart...

openSUSE 10 Security Update : evince (evince-2362)

Specially crafted Postscript files could be used to execute arbitrary code by causing a buffer overflow in evince CVE-2006-5864. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update evince-2362. Th...

openSUSE 10 Security Update : squirrelmail (squirrelmail-2417)

Multiple cross site scripting bugs in squirrelmail have been fixed. CVE-2006-6142 This update is a reissue, fixing some bugs that were introduced by the previous security update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE 10 Security Update : quagga (quagga-1422)

It was possible to bypass RIPv2 authentication requirements by using RIPv1. Since RIPv1 doesn't support authentication at all this update introduces an option to switch off RIPv1 CVE-2006-2223, CVE-2006-2224. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

openSUSE 10 Security Update : ruby (ruby-1948)

An attacker could bypass the 'safe level' checks CVE-2006-3694. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update ruby-1948. The text description of this plugin is C SUSE LLC...