openSUSE 10 Security Update : tomcat5 (tomcat5-3950)

Certain characters of the URL were not properly filtered. This allowed directory reverse traversal attacks to access the web-root of tomcat. CVE-2007-0450 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

openSUSE 10 Security Update : libextractor (libextractor-2494)

This update fixes a vulnerability which occurs while processing a special PDF file. This bug can lead to a denial-of-service condition, or a memory corruption, or to arbitrary code execution. CVE-2007-0104 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package check...

openSUSE 10 Security Update : acroread (acroread-2506)

The Adobe Acrobat Reader has been updated to version 7.0.9. This update also includes following security fixes : CVE-2006-5857: A memory corruption problem was fixed in Adobe Acrobat Reader can potentially lead to code execution. CVE-2007-0044: Universal Cross Site Request Forgery CSRF problems...

openSUSE 10 Security Update : poppler (poppler-3991)

A buffer overflow in the xpdf code contained in poppler could be exploited by attackers to potentially execute arbitrary code CVE-2007-3387. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE 10 Security Update : python (python-3478)

This update fixes an off-by-one error in the PyLocalestrxfrm function which can lead to a memory leak. CVE-2007-2052 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update python-3478. The text...

openSUSE 10 Security Update : java-1_4_2-sun (java-1_4_2-sun-3843)

The Sun JAVA JDK 1.4.2 was upgraded to release 15 to fix various bugs, including the following security bugs : CVE-2007-2788 / CVE-2007-3004: Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit JDK, allows remote attackers to execute arbitrary code or cause a...

openSUSE 10 Security Update : gtk2 (gtk2-2498)

A bug in gdk-pixbuf could crash applications such as Evolution when trying to display certain images CVE-2007-0010 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update gtk2-2498. The text descripti...

openSUSE 10 Security Update : gpg (gpg-2995)

When printing a text stream with a GPG signature it was possible for an attacker to create a stream with 'unsigned text, signed text' where both unsigned and signed text would be shown without distinction which one was signed and which part wasn't. This is tracked by the Mitre CVE ID CVE-2007-126...

openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3978)

This update fixes multiple bugs in php : - predictable generaton of an initialization vector IV in the mcrypt extension - additional cookie attributes could be injected via a session id - specially crafted files could cause integer overflows in gd and leverage them to at least crash gd based...

openSUSE 10 Security Update : freeradius (freeradius-3286)

A memory leak in the code for handling EAP-TTLS tunnels could be exploited by attackers to crash freeradius CVE-2007-2028. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update freeradius-3286. The...

openSUSE 10 Security Update : star (star-4173)

This update fixes a directory traversal bug in star. CVE-2007-4131 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update star-4173. The text description of this plugin is C SUSE LLC...

openSUSE 10 Security Update : cups (cups-3715)

The previous cups update CVE-2007-0720 was incomplete and could lead to cupsd crashing. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update cups-3715. The text description of this plugin is C SUSE...

openSUSE 10 Security Update : gimp (gimp-3949)

The image editor GIMP was updated to fix a integer overflow in the handling of PSD files. By providing a crafted PSD file and tricking the user to open it an attacker could execute code. CVE-2007-2949 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

openSUSE 10 Security Update : clamav (clamav-2632)

This update to ClamAV version 0.90 fixes various bugs : CVE-2007-0897: A filedescriptor leak in the handling of CAB files can lead to a denial of service attack against the clamd scanner daemon caused by remote attackers. CVE-2007-0898: A directory traversal in handling of MIME E-Mail headers cou...

openSUSE 10 Security Update : perl-Net-DNS (perl-Net-DNS-3961)

perl-Net-DNS used sequential IDs for DNS lookups which could cause problem with some programs like spamassassin. It potentially also simplified DNS spoofing attacks against perl-Net-DNS CVE-2007-3377. Additionally malformed compressed DNS packets could trigger an endless loop in perl-Net-DNS...

openSUSE 10 Security Update : horde (horde-3089)

This udpate fixes a cross site scripting bug XSS in horde CVE-2007-1473. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update horde-3089. The text description of this plugin is C SUSE LLC...

Debian DSA-1387-1 : librpcsecgss - buffer overflow

It has been discovered that the original patch for a buffer overflow in svcauthgss.c in the RPCSECGSS RPC library in MIT Kerberos 5 CVE-2007-3999, DSA-1368-1 was insufficient to protect from arbitrary code execution in some environments. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

openSUSE 10 Security Update : asterisk (asterisk-3977)

This update fixes multiple bugs in asterisk that allowed remote attackers to crash the asterisk server or even execute arbitrary code CVE-2007-3762, CVE-2007-3763, CVE-2007-3764. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE 10 Security Update : sylpheed-claws (sylpheed-claws-4511)

This update fixes a format string bug in the incputerror function. This bug is triggered when error messages from the POP3 server are displayed and can be exploited remotely to execute arbitrary code. CVE-2007-2958 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandrake Linux Security Advisory : tar (MDKSA-2007:197)

A buffer overflow in GNU tar has unspecified attack vectors and impact, resulting in a crashing stack. Updated packages fix this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory...