SUSE CVE-2007-6430

Asterisk Open Source 1.2.x before 1.2.26 and 1.4.x before 1.4.16, and Business Edition B.x.x before B.2.3.6 and C.x.x before C.1.0-beta8, when using database-based registrations "realtime" and host-based authentication, does not check the IP address when the username is correct and there is no...

SUSE CVE-2007-6600

PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for 1 VACUUM and 2 ANALYZE operations within index functions, and supports 3 SET ROLE and 4 SET SESSION AUTHORIZATION within inde...

SUSE CVE-2007-6703

Unspecified vulnerability in vdccm before 0.10.1 in SynCE SynCE-dccm might allow attackers to cause a denial of service via unspecified vectors...

SUSE CVE-2007-6715

Mozilla Firefox allows remote attackers to cause a denial of service crash via crafted image, as demonstrated by the zzuf lol-firefox.gif test case...

SUSE CVE-2007-6750

The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service daemon outage via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the modreqtimeout module in versions before 2.2.15...

SUSE CVE-2008-0122

Off-by-one error in the inetnetwork function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEASE, allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via crafted input that triggers memory corruption...

SUSE CVE-2008-0169

Plugin/passwordauth.pm aka the passwordauth plugin in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence...

SUSE CVE-2008-0887

gnome-screensaver before 2.22.1, when a remote authentication server is enabled, crashes upon an unlock attempt during a network outage, which allows physically proximate attackers to gain access to the locked session, a related issue to CVE-2007-1859...

SUSE CVE-2008-0888

The NEEDBITS macro in the inflatedynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data...

SUSE CVE-2008-1372

bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service crash via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats...

SUSE CVE-2008-1628

Stack-based buffer overflow in the auditlogusercommand function in lib/auditlogging.c in Linux Audit before 1.7 might allow remote attackers to execute arbitrary code via a long command argument. NOTE: some of these details are obtained from third party information...

SUSE CVE-2008-1721

Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative signed integer, which triggers insufficient memory allocation and a buffer overflow...

SUSE CVE-2008-1802

Buffer overflow in the processredirectpdu rdp.c function in rdesktop 1.5.0 allows remote attackers to execute arbitrary code via a Remote Desktop Protocol RDP redirect request with modified length fields...

SUSE CVE-2008-1803

Integer signedness error in the xrealloc function rdesktop.c in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow. NOTE: the role of the channelprocess function was not specified by the original researcher...

SUSE CVE-2008-1807

FreeType2 before 2.3.6 allow context-dependent attackers to execute arbitrary code via an invalid "number of axes" field in a Printer Font Binary PFB file, which triggers a free of arbitrary memory locations, leading to memory corruption...

SUSE CVE-2008-2933

Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' pipe characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely...

SUSE CVE-2008-3139

The RTMPT dissector in Wireshark formerly Ethereal 0.99.8 through 1.0.0 allows remote attackers to cause a denial of service crash via unknown vectors. NOTE: this might be due to a use-after-free error...

SUSE CVE-2008-3330

Cross-site scripting XSS vulnerability in services/obrowser/index.php in Horde 3.2 and Turba 2.2 allows remote attackers to inject arbitrary web script or HTML via the contact name...

SUSE CVE-2008-3972

pkcs15-tool in OpenSC before 0.11.6 does not apply security updates to a smart card unless the card's label matches the "OpenSC" string, which might allow physically proximate attackers to exploit vulnerabilities that the card owner expected were patched, as demonstrated by exploitation of...

SUSE CVE-2008-4108

Tools/faqwiz/move-faqwiz.sh aka the generic FAQ wizard moving tool in Python 2.4.5 might allow local users to overwrite arbitrary files via a symlink attack on a tmp$RANDOM.tmp temporary file. NOTE: there may not be common usage scenarios in which tmp$RANDOM.tmp is located in an untrusted directo...