SuSE 10 Security Update : OpenSSH (ZYPP Patch Number 4580)

This update fixes a bug in ssh's cookie handling code. It does not properly handle the situation when an untrusted cookie cannot be created and uses a trusted X11 cookie instead. This allows attackers to violate the intended policy and gain privileges by causing an X client to be treated as...

openSUSE 10 Security Update : seamonkey (seamonkey-4794)

This update brings Mozilla SeaMonkey to security update version 1.1.7 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have th...

SuSE 10 Security Update : poppler,poppler-devel (ZYPP Patch Number 3992)

A buffer overflow in the xpdf code contained in poppler could be exploited by attackers to potentially execute arbitrary code. CVE-2007-3387 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : quagga (ZYPP Patch Number 3230)

Remote attackers could crash quagga via specially crafted 'UPDATE' messages. CVE-2007-1995 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29567;...

SuSE 10 Security Update : libpng (ZYPP Patch Number 4627)

Speciall crafted png files could crash applications when attempting to open such a file. CVE-2007-5269 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29509;...

SuSE 10 Security Update : XMMS (ZYPP Patch Number 3075)

Two integer overflows when processing BMP skin images potentially allows attackers to execute arbitrary code via specially crafted files. CVE-2007-0653 / CVE-2007-0654 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Samba (ZYPP Patch Number 3829)

The previous security fix for CVE-2007-2447 missed one character in the shell escape handling. Also fixed were some regressions introduced by the previous update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 4559)

A buffer overflow in the DTLS implementation of openssl could be exploited by attackers to potentially execute arbitrary code. CVE-2007-4995 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : id3lib (ZYPP Patch Number 4317)

This update fixes a bug that allows local attackers to overwrite arbitrary files. CVE-2007-4460 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29462;...

SuSE 10 Security Update : gnomemeeting (ZYPP Patch Number 3163)

This update fixes format string problems in gnomemeeting which might be used by remote attackers to crash gnomemeeting and on older distributions potentially execute code. CVE-2007-1007 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : IBM Java (ZYPP Patch Number 3851)

The IBM Java JRE/SDK has been brought to release 1.4.2 SR containing several bugfixes, including following security fixes : - A buffer overflow vulnerability in the JavaTM Runtime Environment may allow an untrusted applet to elevate its privileges. For example, an applet may grant itself...

SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 3131)

This update of ImageMagick fixes three integer overflow in DCM and XWD code. These bugs can be exploited remotely via other application. CVE-2007-1667 / CVE-2007-1797 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : t1lib (ZYPP Patch Number 4588)

A buffer overflow in t1lib could potentially be exploited to execute arbitrary code via specially crafted files. CVE-2007-4033 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 4770)

This update of OpenOfficeorg adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. CVE-2007-4575 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : file (ZYPP Patch Number 3034)

An integer underflow within the ELF header parsing has been fixed which could lead to arbitrary code execution. CVE-2007-1536 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc...

SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 4541)

This update of ImageMagick fixes several vulnerabilities. - infinite loop while parsing images. CVE-2007-4985 - integer overflows that can lead to code execution. CVE-2007-4986 - one-byte buffer overflow that can lead to code execution SLES8- and SLES9-based products are not affected. CVE-2007-49...

SuSE 10 Security Update : Kerberos 5 (ZYPP Patch Number 3046)

A bug in the function krb5klogsyslog leads to a buffer overflow which could be exploited to execute arbitrary code. CVE-2007-0957 A double-free bug in the GSS-API library could crash kadmind. It's potentially also exploitable to execute arbitrary code. CVE-2007-1216 %NASLMINLEVEL 70300 C Tenable...

SuSE 10 Security Update : madwifi (ZYPP Patch Number 3897)

The madwifi driver and userland packages were updated to 0.9.3.1. Please note that while the RPM version still says '0.9.3', the content is the 0.9.3.1 version. This updates fixes following security problems : - The 802.11 network stack in net80211/ieee80211input.c in MadWifi before 0.9.3.1 allow...

SuSE 10 Security Update : xpdf (ZYPP Patch Number 3969)

A buffer overflow in xpdf could be exploited by attackers to potentially execute arbitrary code. CVE-2007-3387 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 3754)

The following issues have been fixed : - missing openbasedir and safemode restriction. CVE-2007-3007 - chunksplit integer overflow. CVE-2007-2872 - DoS condition in libgd's image processing. CVE-2007-2756 - possible super-global overwrite inside importrequestvariables. CVE-2007-1396 - buffer...