SuSE 10 Security Update : freetype2 (ZYPP Patch Number 1918)

This security update fixes crashes in the PCF handling of freetype2 which might be used to crash freetype2 using applications or even to execute code in them. This issue is tracked by the Mitre CVE ID CVE-2006-3467. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 2258)

This update brings MozillaFirefox to the security update release 1.5.0.8, including the following security fixes. Full details can be found on: http://www.mozilla.org/projects/security/known-vulnerabiliti es.html - Is split into 3 sub-entries, for ongoing stability improvements in the Mozilla...

SuSE 10 Security Update : Xorg X11 (ZYPP Patch Number 3083)

Integer overflows in the XC-MISC extension of the X-server could potentially be exploited to execute code with root privileges. CVE-2007-1003 Integer overflows in libx11 could cause crashes. CVE-2007-1667 Integer overflows in the font handling of the X-server could potentially be exploited to...

SuSE 10 Security Update : flash-player (ZYPP Patch Number 2065)

Multiple input validation errors have been identified in Flash Player that could lead to the potential execution of arbitrary code. These vulnerabilities could be accessed through content delivered from a remote location via the user's web browser, email client, or other applications that include...

SuSE 10 Security Update : krb5-apps-servers and krb5-apps-clients (ZYPP Patch Number 1938)

Various return checks of setuid and seteuid calls have been fixed in kerberos client and server applications. If these applications are setuid, it might have been possible for local attackers to gain root access. CVE-2006-3083 We are not affected by the seteuid problems, tracked by CVE-2006-3084...

SuSE 10 Security Update : mozilla-nss,mozilla-nss-devel (ZYPP Patch Number 2067)

A security problem in the SSL handling of the NSS libraries was found : If an RSA key with exponent 3 is used it may be possible to forge a PKCS verify the certificate if they are not checking for excess data in the RSA exponentiation result of the signature. This bug is tracked by the Mitre CVE ...

SuSE 10 Security Update : xorg-x11-server (ZYPP Patch Number 1913)

This security update fixes crashes in the PCF handling, which might be used to crash the Xserver using applications or even to execute code in them. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : avahi (ZYPP Patch Number 2986)

This update fixes a remote denial of service problem in avahi, where attackers could cause an endless loop. CVE-2006-6870 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

SuSE 10 Security Update : openldap2-client (ZYPP Patch Number 2291)

OpenLDAP libldap's strval2strlen function contained a bug when processing the authcid string of certain Bind Requests, which could allow attackers to cause an affected application especially the OpenLDAP Server to crash. CVE-2006-5779 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : libwmf (ZYPP Patch Number 1833)

A heap overflow could be triggered by specially crafted WMF Windows Meta Files in the libwmf library. This problem could be exploited to execute code, by a remote attacker providing a file with embedded WMF data to an application understanding this like OpenOfficeorg, abiword, gimp. This issue is...

SuSE 10 Security Update : dhcp-server (ZYPP Patch Number 2437)

A bug was fixed were a LDAP server with malicious data providing information to the DHCP server could crash and potentially execute code as the DHCP server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : gv (ZYPP Patch Number 2339)

The previous 'gv' update to fix a stack overflow did not completely fix the problem spotted. An attacker could still cause the handling to use up all system memory, or open windows much wider than the X display and crash. Code execution however was not possible. %NASLMINLEVEL 70300 C Tenable...

SuSE 10 Security Update : tar (ZYPP Patch Number 2344)

This security update fixes a directory traversal in tar, where unpacked symlinks could be followed outside of the directory where the tar file is unpacked. CVE-2006-6097 The problematic feature has been made optional and is disabled by default. It can be enabled by a commandline switch...

SuSE 10 Security Update : ruby (ZYPP Patch Number 1946)

An attacker could bypass the 'safe level' checks. CVE-2006-3694 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29570; scriptversion"1.12";...

SuSE 10 Security Update : apache2 (ZYPP Patch Number 4669)

Several bugs were fixed in the Apache2 webserver : These include the following security issues : - modstatus: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset 'detection'. CVE-2006-5752 - modcache: Prevent a...

SuSE 10 Security Update : kdebase3 (ZYPP Patch Number 3407)

A problem with the interaction between the Flash Player and the Konqueror webbrowser was fixed. The problem could lead to keypresses leaking to the applet instead of the browser. CVE-2007-2022 This update of khcindexbuilder also restricts the commands that can be executed with EGID 'man'...

SuSE 10 Security Update : Novell GroupWise client (ZYPP Patch Number 4494)

This update fixes a security vulnerability in the GroupWise system that allows a malicious user to intercept authentication credentials through a 'man in the middle' attack. CVE-2007-5195 / CVE-2007-5196 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : festival (ZYPP Patch Number 4378)

The festival daemon runs as root. The default config doesn't have a password set. A local attacker could therefore connect to the daemon to have commands executed as root. CVE-2007-4074 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : evolution-data-server (ZYPP Patch Number 3826)

A malicious IMAP server could execute code within evolution by sending a malformed response to a SEQUENCE command. CVE-2007-3257 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : KDE (ZYPP Patch Number 4433)

Users could log in as root without having to enter the password if auto login was enabled and if kdm was configured to require the root passwort to shutdown the system. CVE-2007-4569 JavaScript code could modify the URL in the address bar to make the currently displayed website appear to come fro...