SuSE 10 Security Update : libgtop (ZYPP Patch Number 2511)

This update fixes a buffer overflow in libgtop's glibtopgetprocmaps function. CVE-2007-0235 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29502;...

SuSE 10 Security Update : findutils-locate (ZYPP Patch Number 3966)

The cronjob that deletes old core files could be tricked to delete arbitrary files. Old core files are deleted if DELETEOLDCORE=yes is set. That is not the case by default though. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : cups (ZYPP Patch Number 3716)

The previous cups update CVE-2007-0720 was incomplete and could lead to cupsd crashing. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29411;...

SuSE 10 Security Update : OpenSSH (ZYPP Patch Number 2257)

The OpenSSH release 4.5 contains a security fix which has been backported to the openssh versions in our old products. - Incorrect return argument checking in the privilege separation monitor was fixed. In case of an exploitable unprivileged helper this could have been used to elevate privileges...

SuSE 10 Security Update : tcpdump (ZYPP Patch Number 4037)

This update fixes a buffer overlow that could be triggered when displaying BGP packets. CVE-2007-3798 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29588;...

SuSE 10 Security Update : pcre (ZYPP Patch Number 4689)

Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code. CVE-2006-7224 / CVE-2006-7225 / CVE-2006-7226 /...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 3290)

This Update fixes numerous vulnerabilities in PHP. Most of them were made public during the 'Month of PHP Bugs'. The vulnerabilities potentially lead to crashes, information leaks or even execution of malicious code. CVE-2007-1380 / CVE-2007-0988 / CVE-2007-1375 / CVE-2007-1521 / CVE-2007-1376 /...

SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 4542)

The IBM Java JRE/SDK has been brought to release 1.4.2 SR9, containing several bugfixes, including the following security fixes : - A buffer overflow vulnerability in the image parsing code in the JavaTM Runtime Environment may allow an untrusted applet or application to elevate its privileges. F...

SuSE 10 Security Update : xpdf (ZYPP Patch Number 3969)

A buffer overflow in xpdf could be exploited by attackers to potentially execute arbitrary code. CVE-2007-3387 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : mutt (ZYPP Patch Number 3752)

This update of mutt fixes a vulnerability in the APOP implementation that allows an active attacker to guess three bytes of the password. CVE-2007-1558 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : libpng (ZYPP Patch Number 3740)

Applications using libpng can crash if libpng is ask to process a grayscale image with a malformed bad CRC tRNS chunk. CVE-2007-2445 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : jasper (ZYPP Patch Number 3139)

This update fixes two problems in libjasper that occured while parsing image files. Both bugs lead to memory corruption. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : gnutls (ZYPP Patch Number 2117)

A security problem was fixed in the GNU TLS library, where excess data was not checked during signature checking with RSA keys with exponent 3. This problem could be used to fake those RSA signatures. CVE-2006-4790 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this...

SuSE 10 Security Update : heartbeat (ZYPP Patch Number 1978)

This update fixes both a local and a remote denial of service attack within heartbeat, as well as numerous other bugs in the messaging and membership layer, GUI, Cluster Resource Manager, Local Resource Manager and Resource Agents. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : clamav (ZYPP Patch Number 2243)

The virus scan engine ClamAV was update to version 0.88.6. Following issues are fixed by this update : - freshclam: apply timeout patch from Everton da Silva Marques new options: ConnectTimeout and ReceiveTimeout - clamd: change stack size at the right place closes clamav bug103 -...

SuSE 10 Security Update : gpg2 (ZYPP Patch Number 2354)

Specially crafted files could overflow a buffer when gpg2 was used in interactive mode. CVE-2006-6169 - Specially crafted files could modify a function pointer and execute code this way. CVE-2006-6235 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : clamav (ZYPP Patch Number 1942)

This version update to 0.88.4 fixes among other things a security relevant buffer overflow in the UPX-Decoder. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : inkscape (ZYPP Patch Number 3061)

Several format string problems where fixed in inkscape. - A format string vulnerability in Inkscape allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, which is not properly handled by certain dialogs. CVE-2007-1463 - Format string vulnerability ...

SuSE 10 Security Update : tar (ZYPP Patch Number 4171)

This update fixes a bug in function safernamesuffix of tar which leads to a crashing stack. Exploitability is unknown. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : Kerberos 5 (ZYPP Patch Number 4249)

This update improves the patch for the previously released security update of krb5 to fix CVE-2007-3999 / CVE-2007-4000. CVE-2007-4743 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ...