openSUSE Security Update : krb5 (openSUSE-SU-2011:0348-1)

A remote attacker may be able to make kadmind free an invalid pointer, leading to a crash of the service CVE-2011-0285. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update krb5-4373. The text...

openSUSE Security Update : nginx-1.0 (openSUSE-2011-48)

A flaw in the custom DNS resolver of nginx could lead to a heap based buffer overflow which could potentially allow attackers to execute arbitrary code or to cause a Denial of Service bnc731084, CVE-2011-4315. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

openSUSE Security Update : empathy (openSUSE-SU-2011:1257-1)

Insufficient quoting of nick names allowed attackers to inject arbitrary html CVE-2011-3635 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update empathy-5376. The text description of this plugin is...

openSUSE Security Update : icecast (openSUSE-SU-2012:0333-1)

Icecast didn't strip newlines from log entries, therefore allowing uses to forge log entries CVE-2011-4612. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update icecast-5932. The text description o...

openSUSE Security Update : python-feedparser (openSUSE-SU-2011:0314-1)

Various issues in python-feedparser have been fixed, including fixes for crashes due to missing input sanitizaion and a XSS vulnerability. CVE-2011-1156, CVE-2011-1157, CVE-2011-1158 and CVE-2009-5065 have been assigned to these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

openSUSE Security Update : flash-player (openSUSE-SU-2011:0215-1)

The Adobe Flash Player was updated to the 10.2.153.1, fixing several bugs and one security issue. This vulnerability CVE-2011-0609 could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild...

openSUSE Security Update : proftpd (openSUSE-2011-19)

Vulnerabilities were discovered for the proftpd packages in openSUSE version 12.1. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2011-19. The text description of this plugin is C SU...

openSUSE Security Update : icu (openSUSE-SU-2012:0100-1)

Specially crafted strings could cause a buffer overflow in icu CVE-2011-4599. An integer overflow in the getSymbol function could crash applications using icu CVE-2010-4409 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

openSUSE Security Update : python-cupshelpers (openSUSE-SU-2011:1331-1)

system-config-printer used an unauthenticated connection when downloading printer drivers from openprinting.org CVE-2011-4405. This update disables the printer driver download feature. system-config-printer did not properly quote shell meta characters in SMB server or workgroup names when passing...

openSUSE Security Update : krb5-appl (openSUSE-SU-2012:0019-1)

This update of krb5 applications fixes two security issues. CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE. CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd...

openSUSE Security Update : exim (openSUSE-SU-2011:0105-1)

Exim was updated to verify the return value of the setuid/setgid calls now. CVE-2011-0017: CVSS v2 Base Score: 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C: Link Following CWE-59 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

openSUSE Security Update : dhcp (openSUSE-2012-71)

Updated to ISC dhcp-4.2.3-P2 release, providing a DDNS security fix: Modify the DDNS handling code. In a previous patch we added logging code to the DDNS handling. This code included a bug that caused it to attempt to dereference a NULL pointer and eventually segfault. While reviewing the code as...

openSUSE Security Update : wireshark (openSUSE-SU-2011:0347-1)

Wireshark was updated to version 1.4.4 to fix several security issues CVE-2011-1138, CVE-2011-1139, CVE-2011-1140 CVE-2011-1143. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update wireshark-4339...

openSUSE Security Update : mozilla-js192 (mozilla-js192-4203)

Mozilla XULRunner 1.9.2 was updated to version 1.9.2.16 to fix the following security issue : MFSA 2011-11 Several invalid HTTPS certificates were placed on the certificate blacklist to prevent their misuse. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

openSUSE Security Update : perl (openSUSE-SU-2011:0479-1)

This update fixes a bug in perl that makes spamassassin crash and does not allow bypassing taint mode by using lc or uc anymore. - CVE-2010-4777: CVSS v2 Base Score: 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P - CVE-2011-1487: CVSS v2 Base Score: 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N: Permissions, Privileges, and...

openSUSE Security Update : libsvn_auth_gnome_keyring-1-0 (openSUSE-SU-2011:0238-1)

Remote attackers could crash an svn server by causing a NULL deref CVE-2011-0715. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update libsvnauthgnomekeyring-1-0-4226. The text description of this...

openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)

Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks CVE-2011-3872. Note: If you've set the 'certdnsnames' option in your master's puppet.conf file...

openSUSE Security Update : libQtWebKit-devel (openSUSE-SU-2011:1119-1)

Specially crafted font files could cause a single byte heap based buffer overflow CVE-2011-3193. Specially crafted grey scale images could cause a heap based buffer overflow CVE-2011-3194. The update also fixes the following non-security bugs : - fix QFileDialog not showing system files bnc669604...

openSUSE Security Update : icedtea-web (openSUSE-SU-2011:0829-1)

This update of icedtea/icedtea-web fixes two issues : - CVE-2011-2513: CVSS v2 Base Score: 4.3: An information leak allows unsigned Web Start applications to determine the path to the cache directory used to store downloaded class and jar files. - CVE-2011-2514: CVSS v2 Base Score: 5.1 An unsigne...

openSUSE Security Update : dhcpcd (openSUSE-SU-2011:0385-1)

A rogue dhcp server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the dhcp client needs to sanitize the host name offered by the server CVE-2011-0996. Note this update is...