openSUSE 10 Security Update : gpg (gpg-1664)

It is possible to crash denial of service the GNU Privacy Guard gpg by supplying a specifically crafted message specifying a very large UID, which leads to an out of memory situation or an integer overflow. It is unclear if this problem can be exploited to execute code. This issue is tracked by t...

openSUSE 10 Security Update : kernel (kernel-3760)

This kernel update fixes the following security problems : - CVE-2007-1861: The nlfiblookup function in net/ipv4/fibfrontend.c allows attackers to cause a denial of service kernel panic via NETLINKFIBLOOKUP replies, which trigger infinite recursion and a stack overflow. - CVE-2007-1496:...

openSUSE 10 Security Update : samba (samba-1830)

Prevent potential crash in winbindd's credential cache handling; 184450. - Fix memory exhaustion DoS; CVE-2006-3403; 190468. - Fix the munlock call, samba.org svn rev r16755 from Volker. - Change the kerberos principal for LDAP authentication to netbios-name$@realm from host/name@realm; 184450. -...

openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-1981)

This security update brings Mozilla Firefox to version 1.5.0.6. Note that on SUSE Linux 9.2, 9.3 and 10.0 this is a major version upgrade, please check if your manually installed extensions and plugins are still working. Please also see...

openSUSE 10 Security Update : squirrelmail (squirrelmail-1837)

This update fixes a local file inclusion problem in the squirrelmail webmail frontend. The issue is tracked by the Mitre CVE ID CVE-2006-2842. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE 10 Security Update : dovecot (dovecot-1398)

Users could potentially find out mailbox names of other users CVE-2006-2414. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update dovecot-1398. The text description of this plugin is C SUSE LLC...

openSUSE 10 Security Update : mutt (mutt-1701)

Mutt had a buffer overflow in IMAP namespace parsing code which may open a possible remote vulnerability CVE-2006-3242. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update mutt-1701. The text...

openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-1924)

This security update brings Mozilla Thunderbird to version 1.5.0.6. Note that on SUSE Linux 9.2, 9.3 and 10.0 this is a major version upgrade. More Details can be found on this page: http://www.mozilla.org/projects/security/known-vulnerabilities.html It includes fixes to the following security...

openSUSE 10 Security Update : xorg-x11-server (xorg-x11-server-2056)

This update fixes an integer overflow vulnerability when rendering CID-keyed fonts CVE-2006-3739/CVE-2006-3740. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update xorg-x11-server-2056. The text...

openSUSE 10 Security Update : w3m (w3m-2433)

A format string problem in w3m -dump / -backend mode could be used by a malicious server to crash w3m or execute code. CVE-2006-6772 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update w3m-2433. T...

openSUSE 10 Security Update : man (man-3100)

A heap based buffer overflow in the 'man' command could potentially be exploited by users to run code as root CVE-2006-4250. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update man-3100. The text...

openSUSE 10 Security Update : php5 (php5-1590)

This update fixes the following security issues: - invalid charactes in session names were not blocked - a bug in zendhashdel allowed attackers to prevent unsetting of some variables - bugs in the substrcompare and wordwrap function could crash php CVE-2006-1991, CVE-2006-1990 - a memory leak in...

openSUSE 10 Security Update : acroread (acroread-1690)

Various unspecified security problems have been fixed in Acrobat Reader version 7.0.8 CVE-2006-3093, contained in this update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update acroread-1690. Th...

openSUSE 10 Security Update : gpg2 (gpg2-1956)

This update of gpg2 fixes an segmentation fault when using the--no-armor option. This failure leads to a denial-of-service attack and may be used execute arbitrary code. CVE-2006-3746 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE 10 Security Update : screen (screen-2198)

A special formed UTF-8 sequence in text could be used to crash the terminal multitasker screen by overwriting memory in the heap. This is potentially exploitable to execute code. CVE-2006-4573 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

openSUSE 10 Security Update : openssl (openssl-2140)

A buffer overflow condition within the SSLgetsharedciphers function and a DoS condition known as 'parasitic public keys' have been fixed. The later problem allowed attackers to trick the OpenSSL engine to spend an extraordinary amount of time to process public keys. The following CAN numbers have...

openSUSE 10 Security Update : wv2 (wv2-1687)

The wv2 library was updated to fix some boundary checks which could be exploited by maliciously crafted files to access memory outside bounds and possibly execute arbitrary code. CVE-2006-2197 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

openSUSE 10 Security Update : gimp (gimp-1921)

A buffer overflow was fixed in the xcf loader in GIMP that allows user-complicit attackers to cause a denial of service crash and possibly execute arbitrary code via an XCF file with a large numaxes value in the VECTORS property. CVE-2006-3404 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

openSUSE 10 Security Update : gpg2 (gpg2-2352)

Specially crafted files could overflow a buffer when gpg2 was used in interactive mode CVE-2006-6169. - Specially crafted files could modify a function pointer and execute code this way CVE-2006-6235. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

openSUSE 10 Security Update : jboss4 (jboss4-2304)

This update fixes a problem in the JBOSS server where it was possible to potentially execute code if the console manager was enabled. CVE-2006-5750 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...