openSUSE 10 Security Update : arts (arts-1670)

The KDE soundserver aRts lacked checks around some setuid calls. This could potentially be used by a local attacker to gain root privileges. CVE-2006-2916 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

openSUSE 10 Security Update : OpenOffice_org (OpenOffice_org-2408)

Following security problem was fixed in OpenOfficeorg : CVE-2006-5870: Bufferoverflows in WMF and Enhanced WMF handling in OpenOfficeorg could be used to potentially execute code or crash OpenOfficeorg. It is necessary that the user can be tricked to open a prepared document. This update also add...

openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-2100)

This security update brings Mozilla Thunderbird to version 1.5.0.7. More Details can be found on this page: http://www.mozilla.org/projects/security/known-vulnerabilities.html It includes fixes to the following security problems: MFSA 2006-64/CVE-2006-4571: Crashes with evidence of memory...

openSUSE 10 Security Update : kdebase3 (kdebase3-3347)

A problem with the interaction between the Flash Player and the Konqueror webbrowser was fixed. The problem could lead to keypresses leaking to the applet instead of the browser. CVE-2007-2022 This update of khcindexbuilder restricts the commands that can be executed with EGID 'man'. %NASLMINLEVE...

openSUSE 10 Security Update : compat-openssl097g (compat-openssl097g-2171)

A buffer overflow condition within the SSLgetsharedciphers function and a DoS condition known as 'parasitic public keys' have been fixed. The later problem allowed attackers to trick the OpenSSL engine to spend an extraordinary amount of time to process public keys. The following CAN numbers have...

openSUSE 10 Security Update : postgresql (postgresql-1443)

This update fixes a security problem that allowed attackers to inject SQL commands into queries CVE-2006-2313, CVE-2006-2314. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update postgresql-1443. T...

openSUSE 10 Security Update : hugin (hugin-4518)

This update of hugin disabled the usage of a temporary file. CVE-2007-5200 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update hugin-4518. The text description of this plugin is C SUSE LLC...

openSUSE 10 Security Update : libextractor (libextractor-1426)

Fix heap overflow in the asf plugin CVE-2006-2458 176280. Fix heap overflow in the qt plugin CVE-2006-2458 176280. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update libextractor-1426. The text...

openSUSE 10 Security Update : xpdf (xpdf-2473)

This update fixes a vulnerability which occurs while processing a special PDF file. This bug can lead to a denial-of-service condition, or a memory corruption, or to arbitrary code execution. CVE-2007-0104 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package check...

openSUSE 10 Security Update : samba (samba-3827)

The previous security fix for CVE-2007-2447 missed one character in the shell escape handling. Also fixed were some regressions introduced by the previous update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSU...

openSUSE 10 Security Update : samba (samba-3828)

The previous security fix for CVE-2007-2447 missed one character in the shell escape handling. Also fixed were some regressions introduced by the previous update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSU...

openSUSE 10 Security Update : tiff (tiff-1594)

This update fixes a stack-based buffer overflow in tiffsplit that can be triggered with long filemanes CVE-2006-2656 and a buffer overflow in tiff2pdf. Both tools are not setuid but may be exploited in conjunction with other applications. Exploitation very unlikely. %NASLMINLEVEL 70300 C Tenable...

openSUSE 10 Security Update : krb5 (krb5-3820)

This update fixes a stack-based buffer overflow in kadmind which can be exploited by authenticated remote users to gain root. CVE-2007-2798 Additionally two bugs in the RPC library of kadmind were fixed that can lead to remote system compromise. CVE-2007-2442, CVE-2007-2443 Note that third-party...

openSUSE 10 Security Update : horde (horde-1868)

This update fixes the following two security issues in the Horde Application Framework : - CVE-2006-3548: Multiple cross-site scripting XSS vulnerabilities allow remote attackers to inject arbitrary web script or HTML via a 1 JavaScript URI or an external 2 http, 3 https, or 4 ftp URI in the url...

openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-2039)

the CURL module lacked checks for control characters CVE-2006-2563 - strrepeat contained an integer overflow - ext/wddx contained a buffer overflow - memorylimit lacked checks for integer overflows - a bug in sscanf could potentially be exploited to execute arbitrary code CVE-2006-4020 - an...

openSUSE 10 Security Update : wireshark (wireshark-3886)

Various security problems were fixed in the wireshark 0.99.6 release, which were backported : CVE-2007-3389: Wireshark allowed remote attackers to cause a denial of service crash via a crafted chunked encoding in an HTTP response, possibly related to a zero-length payload. CVE-2007-3390: Wireshar...

openSUSE 10 Security Update : xfsdump (xfsdump-3151)

The program xfsfsr created a temporary directory with unrestricted read and write permissions. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update xfsdump-3151. The text description of this plugin...

openSUSE 10 Security Update : emacs (emacs-4197)

This update fixes a bug in parsing GIF images that lead to a crash of emacs. CVE-2007-2833 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update emacs-4197. The text description of this plugin is C...

openSUSE 10 Security Update : gv (gv-2266)

A stackoverflow in the postscript viewer gv could be used to exploited to execute code, if the user could be tricked into viewing a prepared postscript file. CVE-2006-5864 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fr...

openSUSE 10 Security Update : openssl (openssl-2162)

A previous openssl update CVE-2006-2940 introduced another bug that can lead to a crash by providing a large prime number. An uninitialized pointer is freed during error handling. This bug allows remote attackers to crash services that use openssl. %NASLMINLEVEL 70300 C Tenable Network Security,...