SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 2423)

This update brings MozillaFirefox to the security update release 1.5.0.9, including the following security fixes. http://www.mozilla.org/projects/security/known-vulnerabilities.html - Crashes with evidence of memory corruption were fixed in the layout engine. CVE-2006-6498 / MFSA 2006-68: Crashes...

SuSE 10 Security Update : clamav (ZYPP Patch Number 2631)

This update to ClamAV version 0.90 fixes various bugs : - A filedescriptor leak in the handling of CAB files can lead to a denial of service attack against the clamd scanner daemon caused by remote attackers. CVE-2007-0897 - A directory traversal in handling of MIME E-Mail headers could be used b...

SuSE 10 Security Update : gzip (ZYPP Patch Number 2085)

This update fixes several security problems that can be exploited to compromise the system in conjunction with other programs while processing malformated archive files. CVE-2006-4334 / CVE-2006-4335 / CVE-2006-4336 / CVE-2006-4337 / CVE-2006-4338 %NASLMINLEVEL 70300 C Tenable Network Security,...

SuSE 10 Security Update : libpng (ZYPP Patch Number 2325)

The sPLT chunk handling in libpng was incorrect and a handcrafted PNG file could be use to cause an out-of-bounds read, effectively crashing the PNG viewer or webbrowser. CVE-2006-5793 Additionally a 2 byte stackoverflow was fixed which we do not believe to be exploitable. It will cause an abort ...

SuSE 10 Security Update : perl-Net-DNS (ZYPP Patch Number 4046)

perl-Net-DNS used sequential IDs for DNS lookups which could cause problem with some programs like spamassassin. It potentially also simplified DNS spoofing attacks against perl-Net-DNS. CVE-2007-3377 Additionally malformed compressed DNS packets could trigger an endless loop in perl-Net-DNS...

SuSE 10 Security Update : gd (ZYPP Patch Number 3895)

This update fixes multiple integer overflows in the gd library. Specially crafted files could leverage them to at least crash gd based applications. CVE-2007-3472 / CVE-2007-3475 / CVE-2007-3476 / CVE-2007-3477 / CVE-2007-3478 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : YaST2 (ZYPP Patch Number 4623)

This update fixes a security bug in yast2-core that allowed local attackers to provide malicious yast2 modules to yast2 that are executed with root privileges. To trigger this vulnerability root has to execute yast2 in an untrusted directory i.e. /tmp. Thanks to Stefan Nordhausen for reporting th...

SuSE 10 Security Update : kdegraphics3 (ZYPP Patch Number 2301)

The KFILE JPEG plugin that is responsible for displaying meta-data of JPEG files was affected by some old common vulnerabilities in EXIF handling. A JPEG file could be prepapred with an EXIF section with endless recursion that would overflow the stack and cause the plugin and so the image browser...

SuSE 10 Security Update : bind,bind-devel,bind-utils (ZYPP Patch Number 3976)

The bind nameserver generated predicatable DNS query IDs. Remote attackers could use that to perform DNS poisoning attacks. CVE-2007-2926 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc...

SuSE 10 Security Update : gpg2 (ZYPP Patch Number 1834)

It is possible to crash denial of service the GNU Privacy Guard gpg by supplying a specifically crafted message specifying a very large UID, which leads to an out of memory situation or an integer overflow. It is unclear if this problem can be exploited to execute code. This issue is tracked by t...

SuSE 10 Security Update : open-iscsi (ZYPP Patch Number 4035)

This update fixes some possible vulnerabilities in the open-iscsi daemon. CVE-2007-3099 / CVE-2007-3100 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29533;...

SuSE 10 Security Update : Qt (ZYPP Patch Number 3047)

qt wongly accepts overly long UTF-8 sequences due to a bug in the UTF-8 decoder. This may lead to security problems unter certain circumstances. The bug for example allows for script tag injection in konqueror. CVE-2007-0242 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text descriptio...

SuSE 10 Security Update : Qt3 (ZYPP Patch Number 3898)

Format string bugs in QTextEdit can be exploited via specially crafted HTML tags to potentially execute code. CVE-2007-3388 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : Mono (ZYPP Patch Number 4453)

This update fixes a buffer overflow in Mono's BigInteger implementation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29389; scriptversion"1.17";...

SuSE 10 Security Update : Cups (ZYPP Patch Number 4667)

A buffer overflow in the xpdf code contained in cups could be exploited by attackers to potentially execute arbitrary code. CVE-2007-4352 / CVE-2007-5392 / CVE-2007-5393 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : kdegraphics3-pdf (ZYPP Patch Number 4682)

A buffer overflow in the xpdf code contained in kpdf could be exploited by attackers to potentially execute arbitrary code. CVE-2007-4352 / CVE-2007-5392 / CVE-2007-5393 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : xine (ZYPP Patch Number 2505)

This update fixes several format string bugs that can be exploited remotely with user-assistance to execute arbitrary code. CVE-2007-0017 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc...

SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 3737)

This update of ImageMagick fixes a bug in the patch for the last security update for CVE-2007-1797. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29352;...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 2175)

A previous openssl update CVE-2006-2940 introduced another bug that can lead to a crash by providing a large prime number. An uninitialized pointer is freed during error handling. This bug allows remote attackers to crash services that use openssl. %NASLMINLEVEL 70300 C Tenable Network Security,...

SuSE 10 Security Update : libvorbis (ZYPP Patch Number 3849)

An array boundary problem within libvorbis was fixed. CVE-2007-3106 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29513;...