openSUSE 10 Security Update : xorg-x11-server (xorg-x11-server-2453)

This update fixes memory corruptions in the ProcRenderAddGlyphs/ ProcDbeGetVisualInfo/ProcDbeSwapBuffers functions CVE-2006-6101/ CVE-2006-6102/CVE-2006-6103. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

openSUSE 10 Security Update : seamonkey (seamonkey-2432)

This security update brings Mozilla SeaMonkey to version 1.0.7. http://www.mozilla.org/projects/security/known-vulnerabilities.html for more details. It includes fixes to the following security problems: CVE-2006-6497/MFSA2006-68: Crashes with evidence of memory corruption were fixed in the layou...

openSUSE 10 Security Update : bind (bind-2269)

The RSA signature problem tracked by the Mitre CVE ID CVE-2006-4339 also affects the DNSSEC implementation in the BIND nameserver. This update fixes this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSU...

openSUSE 10 Security Update : ImageMagick (ImageMagick-2414)

A security problem was fixed in ImageMagick during decoding SGI images. The issue in question is CVE-2006-4144 which we addressed before was not completely fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSU...

openSUSE 10 Security Update : awstats (awstats-1612)

This update fixes remote code execution vulnerabilities in awstats. Since backporting awstats fixes is error prone we have upgraded it to upstream version 6.6, which also includes new features. Security issues fixed: - CVE-2006-2237: missing sanitizing of the 'migrate' parameter. 173041 -...

openSUSE 10 Security Update : openssl (openssl-2162)

A previous openssl update CVE-2006-2940 introduced another bug that can lead to a crash by providing a large prime number. An uninitialized pointer is freed during error handling. This bug allows remote attackers to crash services that use openssl. %NASLMINLEVEL 70300 C Tenable Network Security,...

openSUSE 10 Security Update : fbi (fbi-1915)

The fbgs program did not activate security options in the postscript interpreter due to a typo CVE-2006-3119. fbgs also used a temporary directory with predictable name CVE-2006-1695. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE 10 Security Update : opera (opera-1697)

The webbrowser Opera has been upgraded to version 9.0 to add lots of new features, and to fix the following security problem : CVE-2006-3198: An integer overflow vulnerability exists in the Opera Web Browser due to the improper handling of JPEG files. If excessively large height and width values...

openSUSE 10 Security Update : tar (tar-2351)

This security update fixes a directory traversal in tar, where unpacked symlinks could be followed outside of the directory where the tar file is unpacked. CVE-2006-6097 This feature was made optional and needs to be enabled with a commandline option. %NASLMINLEVEL 70300 C Tenable Network Securit...

openSUSE 10 Security Update : qt3 (qt3-2189)

Multiple integer overflows have been found in image processing functions within the QT library. These could potentially lead to heap overflows and code execution. CVE-2006-4811 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

openSUSE 10 Security Update : phpMyAdmin (phpMyAdmin-1611)

Missing checks of the 'db' parameter could be exploited for cross site scripting attacks CVE-2006-2417. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update phpMyAdmin-1611. The text description of...

openSUSE 10 Security Update : kernel (kernel-2635)

This kernel update fixes the following security problems : - CVE-2006-2936: The ftdisio driver allowed local users to cause a denial of service memory consumption by writing more data to the serial port than the hardware can handle, which causes the data to be queued. This requires this driver to...

openSUSE 10 Security Update : tiff (tiff-1594)

This update fixes a stack-based buffer overflow in tiffsplit that can be triggered with long filemanes CVE-2006-2656 and a buffer overflow in tiff2pdf. Both tools are not setuid but may be exploited in conjunction with other applications. Exploitation very unlikely. %NASLMINLEVEL 70300 C Tenable...

openSUSE 10 Security Update : ImageMagick (ImageMagick-2585)

This update fixes a broken patch for CVE-2006-5456 and minor non-security issues. CVE-2007-0770 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update ImageMagick-2585. The text description of this...

openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-2039)

the CURL module lacked checks for control characters CVE-2006-2563 - strrepeat contained an integer overflow - ext/wddx contained a buffer overflow - memorylimit lacked checks for integer overflows - a bug in sscanf could potentially be exploited to execute arbitrary code CVE-2006-4020 - an...

openSUSE 10 Security Update : ethereal (ethereal-2246)

Various problems have been fixed in the network analyzer Ethereal, most leading to crashes of the ethereal program. CVE-2006-5740: A unspecified vulnerability in the LDAP dissector could be used to crash Ethereal. CVE-2006-4574: A single \0 byte heap overflow was fixed in the MIME multipart...

openSUSE 10 Security Update : opera (opera-1313)

Integer signedness error in Opera before 8.54 allows remote attackers to execute arbitrary code via long values in a stylesheet attribute, which pass a length check. CVE-2006-1834 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE 10 Security Update : gpg (gpg-2353)

Specially crafted files could overflow a buffer when gpg2 was used in interactive mode CVE-2006-6169. - Specially crafted files could modify a function pointer and execute code this way CVE-2006-6235. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

openSUSE 10 Security Update : quagga (quagga-1422)

It was possible to bypass RIPv2 authentication requirements by using RIPv1. Since RIPv1 doesn't support authentication at all this update introduces an option to switch off RIPv1 CVE-2006-2223, CVE-2006-2224. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

openSUSE 10 Security Update : sendmail (sendmail-2027)

Without this update sendmail may crash when finishing a mail due to referencing an already freed variable CVE-2006-4434. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update sendmail-2027. The text...