SuSE 11.2 Security Update : Mozilla Firefox (SAT Patch Number 7004)

Mozilla Firefox was updated to the 10.0.10ESR security release. The following issue has been fixed : - Mozilla has fixed a number of issues related to the Location object in order to enhance overall security. Details for each of the current fixed issues are below. MFSA 2012-90 Thunderbird is only...

CentOS 6 : ipa (CESA-2013:0188)

Updated ipa packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

SuSE 11.1 Security Update : PHP5 (SAT Patch Number 6316)

PHP5 was updated with incremental fixes to the previous update : - Additional unsafe cgi wrapper scripts are also fixed now. CVE-2012-2335 - Even more commandline option handling is filtered, which could lead to crashes of the php interpreter. CVE-2012-2336 %NASLMINLEVEL 70300 C Tenable Network...

SuSE 11.1 Security Update : openssl (SAT Patch Number 6245)

This update of openssl fixes an integer conversation issue which could cause a heap-based memory corruption. CVE-2012-2110 Additionally, a check for negative buffer length values was added CVE-2012-2131 and the stack made non-executable by marking the enhanced Intel SSSE3 assembler code as not...

SuSE 10 Security Update : freetype2 (ZYPP Patch Number 8433)

This update fixes : - OOB access in bdffreefont CVE-2012-5668 As well as non-security bugs : - bdf Savannah bug 37905. o src/bdf/bdflib.c bdfparsestart: Reset propssize' to zero in case of allocation error; this value gets used in a loop in %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

SuSE 11.1 Security Update : Xen (SAT Patch Number 6399)

Three security issues were found in XEN. Two security issues are fixed by this update : - Due to incorrect fault handling in the XEN hypervisor it was possible for a XEN guest domain administrator to execute code in the XEN host environment. CVE-2012-0217 - Also a guest user could crash the guest...

SuSE 11.1 Security Update : arpwatch (SAT Patch Number 6570)

arpwatch was improperly dropping its privileges. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc...

SuSE 11.1 Security Update : bind (SAT Patch Number 6388)

The following issue has been fixed : - Records with zero length rdata field could have crashed named or disclose portions of memory to clients. CVE-2012-1667 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11...

SuSE 11.1 Security Update : libpng (SAT Patch Number 6596)

An integer overflow has been fixed in libpng. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 11.2 Security Update : kvm (SAT Patch Number 6755)

The kvm qemu vt100 emulation was affected by a problem where specific vt100 sequences could have been used by guest users to affect the host. CVE-2012-3515 aka XSA-17. Also the following non security bugs have been fixed : - permit qemu-kvm -device '?' even when no /dev/kvm. bnc772586 - SLES11SP2...

SuSE 11.2 Security Update : libsoup (SAT Patch Number 6520)

libsoup without ca path added, accepted all SSL certificats as trusted. This has been fixed. CVE-2012-2132 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. T...

SuSE 11.2 Security Update : Xen (SAT Patch Number 6748)

XEN was updated 4.1.3 to fix multiple bugs and security issues. The following security issues have been fixed : - xen: hypercall setdebugreg vulnerability XSA-12. CVE-2012-3494 - xen: hypercall physdevgetfreepirq vulnerability XSA-13. CVE-2012-3495 - xen: XENMEMpopulatephysmap DoS vulnerability...

SuSE 11.2 Security Update : Xen and libvirt (SAT Patch Number 6640)

Xen was updated to fix several security issues : - A xen HVM guest destroy p2m teardown host DoS vulnerability was fixed, where malicious guest could lock/crash the host. CVE-2012-3433 - A xen HVM guest user mode MMIO emulation DoS was fixed. CVE-2012-3432 - The xen pv bootloader doesn't check th...

SuSE 11.2 Security Update : Linux Kernel (SAT Patch Numbers 6338 / 6345 / 6349)

The SUSE Linux Enterprise 11 SP2 kernel was updated to 3.0.31, fixing many bugs and security issues. Various security and bug fixes contained in the Linux 3.0 stable releases 3.0.27 up to 3.0.31 have been included, but are not explicitly listed below. The following notable security issues have be...

SuSE 11.2 Security Update : Mono (SAT Patch Number 6543)

Mono was updated to fix a cross-site scripting attack in the System.Web class 'forbidden extensions' filtering has been fixed. CVE-2012-3382 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information...

SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 6227 / 6229 / 6230)

The SUSE Linux Enterprise 11 SP1 kernel has been updated to the 2.6.32.59 stable release to fix a lot of bugs and security issues. The following security issues have been fixed : - A use after free bug in hugetlb support could be used by local attackers to crash the system. CVE-2012-2133 - A NULL...

SUSE WebYaST remotely accessible hosts list vulnerability

Overview The WebYaST hosts list is remotely accessible by unauthenticated attackers. An attacker may be able to add a malicious host to the list and perform a man-in-the-middle attack against WebYaST. Description The SUSE security advisory states:The hosts list used by WebYaST for connecting to...

ImageCMS 4.0.0b - Multiple Vulnerabilities

Advisory ID: HTB23132 Product: ImageCMS Vendor: www.imagecms.net Vulnerable Versions: 4.0.0b and probably prior Tested Version: 4.0.0b Vendor Notification: December 5, 2012 Vendor Patch: January 16, 2013 Public Disclosure: January 23, 2013 Vulnerability Type: SQL Injection CWE-89 CVE Reference:...

CVE-2012-6095

ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the 1 MKD or 2 XMKD commands...

CVE-2012-6440

The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration and diagnostics information. Rockwell...