SuSE 10 Security Update : Kerberos 5 (ZYPP Patch Number 3046)

A bug in the function krb5klogsyslog leads to a buffer overflow which could be exploited to execute arbitrary code. CVE-2007-0957 A double-free bug in the GSS-API library could crash kadmind. It's potentially also exploitable to execute arbitrary code. CVE-2007-1216 %NASLMINLEVEL 70300 C Tenable...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 2684)

This update fixes security problems also fixed in PHP 5.2.1, including following problems : - Multiple buffer overflows in PHP before 5.2.1 allow attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors in the 1 session, 2 zip, 3 imap, and 4 sqlite...

SuSE 10 Security Update : mutt (ZYPP Patch Number 3752)

This update of mutt fixes a vulnerability in the APOP implementation that allows an active attacker to guess three bytes of the password. CVE-2007-1558 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : nagios plugins (ZYPP Patch Number 4624)

fix possible buffer overflow during HTTP Location header parsing in checkhttp CVE-2007-5198 fix possible buffer overflow during snmpget parsing in checksnmp. CVE-2007-5623 if !definedfunc"nasllevel" || nasllevel = 70000 && nasllevel = 70200 && nasllevel = 80000 && nasllevel 80502 exit0; C Tenable...

SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 3737)

This update of ImageMagick fixes a bug in the patch for the last security update for CVE-2007-1797. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29352;...

SuSE 10 Security Update : java-1_5_0-ibm (ZYPP Patch Number 4687)

The IBM Java JRE/SDK has been brought to release 1.5.0 SR6, containing several bugfixes, including the following security fixes : - A vulnerability in the Java Runtime Environment JRE with applet caching may allow an untrusted applet that is downloaded from a malicious website to make network...

SuSE 10 Security Update : xine (ZYPP Patch Number 2505)

This update fixes several format string bugs that can be exploited remotely with user-assistance to execute arbitrary code. CVE-2007-0017 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc...

SuSE 10 Security Update : Novell GroupWise client (ZYPP Patch Number 4494)

This update fixes a security vulnerability in the GroupWise system that allows a malicious user to intercept authentication credentials through a 'man in the middle' attack. CVE-2007-5195 / CVE-2007-5196 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : clamav (ZYPP Patch Number 2631)

This update to ClamAV version 0.90 fixes various bugs : - A filedescriptor leak in the handling of CAB files can lead to a denial of service attack against the clamd scanner daemon caused by remote attackers. CVE-2007-0897 - A directory traversal in handling of MIME E-Mail headers could be used b...

SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 2592)

This update fixes a broken patch for CVE-2006-5456 and minor non-security issues. CVE-2007-0770 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29350;...

SuSE 10 Security Update : perl (ZYPP Patch Number 4665)

This update fixes a buffer overflow in perl's regex engine. CVE-2007-5116 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29550; scriptversion"1.17";...

SuSE 10 Security Update : python (ZYPP Patch Number 3750)

This update fixes an off-by-one error in the PyLocalestrxfrm function which can lead to a memory leak. CVE-2007-2052 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 4544)

The IBM Java JRE/SDK has been brought to release 1.5.0 SR5a, containing several bugfixes, including the following security fixes : - A buffer overflow vulnerability in the image parsing code in the JavaTM Runtime Environment may allow an untrusted applet or application to elevate its privileges...

SuSE 10 Security Update : gimp (ZYPP Patch Number 3962)

The image editor gimp was updated to fix a integer overflow in the handling of PSD files. By providing a crafted PSD file and tricking the user to open it an attacker could execute code. CVE-2007-2949 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : gimp (ZYPP Patch Number 3283)

Specially crafted RAS files could cause a buffer overflow in the SUNRAS plugin. The bug could potentially be exploited to execute arbitrary code. CVE-2007-2356 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : festival (ZYPP Patch Number 4378)

The festival daemon runs as root. The default config doesn't have a password set. A local attacker could therefore connect to the daemon to have commands executed as root. CVE-2007-4074 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : bind,bind-devel,bind-utils (ZYPP Patch Number 3976)

The bind nameserver generated predicatable DNS query IDs. Remote attackers could use that to perform DNS poisoning attacks. CVE-2007-2926 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc...

SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 2651)

Following security problems were fixed in OpenOfficeorg : This update also brings OpenOfficeorg to version 2.0.4.17, same as SUSE Linux Enterprise Desktop 10 and contains lots of bugfixes. It also contains support for the Office XML converter hooks. - Various problems were fixed in the Wordperfec...

SuSE 10 Security Update : evolution-data-server (ZYPP Patch Number 3826)

A malicious IMAP server could execute code within evolution by sending a malformed response to a SEQUENCE command. CVE-2007-3257 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : ktorrent (ZYPP Patch Number 3049)

Ktorrent insufficiently validated the target file name. A malicious Server could therefore overwrite arbitary files of the user CVE-2007-1384 / CVE-2007-1799. Another bug could be exploited to crash Ktorrent. CVE-2007-1385 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description ...