SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7462)

Malicious clients could have downgraded a connection to a low strength cipher suite on session resumption if the server offers such ciphers CVE-2010-4180. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : wireshark (ZYPP Patch Number 7500)

This update to wireshark version 1.4.5 fixes the following security issues : - Resource Management Errors. CWE-399, CVE-2011-1590 - Buffer Errors. CWE-119, CVE-2011-1591 - Numeric Errors CWE-189, CVE-2011-1592 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugi...

SuSE 10 Security Update : radvd (ZYPP Patch Number 7824)

This update of radvd fixes multiple buffer overread flaws in the processra function that could have potentially lead to crashes CVE-2011-3604. Additionally, a temporary Denial of Service flaw that could be triggered with a flood of NDROUTERSOLICIT has been fixed. CVE-2011-3605 %NASLMINLEVEL 70300...

SuSE 10 Security Update : fuse (ZYPP Patch Number 7418)

The following security issues were fixed in fuse : - FUSE allowed local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a symlink attack on the parent directory of the mountpoint of a FUSE filesystem. CVE-2010-3879 - Avoid mounting a directory...

SuSE 10 Security Update : dbus (ZYPP Patch Number 7482)

Local users could crash the D-Bus daemon by sending a specially crafted message CVE-2010-4352. This update also properly fixes CVE-2008-3834 / CVE-2009-1189. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'...

SuSE 10 Security Update : Mozilla XULrunner (ZYPP Patch Number 7427)

Mozilla XULRunner 1.9.1 was updated to version 1.9.1.18 to fix the following security issue : - Several invalid HTTPS certificates were placed on the certificate blacklist to prevent their misuse. MFSA 2011-11 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugi...

SuSE 10 Security Update : Apache (ZYPP Patch Number 7722)

This update fixes a remote denial of service bug memory exhaustion in the Apache 2 HTTP server, that could be triggered by remote attackers using multiple overlapping Request Ranges. CVE-2011-3192 It also fixes a bug, where the LimitRequestFieldsize config option into account when parsing headers...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7741)

This update brings Mozilla Firefox to 3.6.22. The purpose of this update is to blacklist the compromised DigiNotar Certificate Authority. For more information read : MFSA 2011-34 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : subversion (ZYPP Patch Number 7560)

Subversion was updated to fix several security issues : - The moddavsvn Apache HTTPD server module can be crashed though when asked to deliver baselined WebDAV resources. CVE-2011-1752 - The moddavsvn Apache HTTPD server module can trigger a loop which consumes all available memory on the system...

SuSE 11.1 Security Update : NetworkManager (SAT Patch Number 5381)

NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network CVE-2006-7246. This has been fixed. Please note that existing WPA2 Enterprise...

SuSE 11.1 Security Update : squid3 (SAT Patch Number 5095)

This update of squid3 fixes a buffer overflow vulnerability in the Gopher reply parser code. CVE-2011-3205 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C...

SuSE 11.1 Security Update : libcap (SAT Patch Number 5380)

The following bug has been fixed : - capsh did not chdir'/' after calling chroot. Programs could therefore access the current directory outside of the chroot. CVE-2011-4099 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

SuSE 10 Security Update : dbus-1 (ZYPP Patch Number 7592)

This update fixes the security issue that local users could disconnect system daemons from the bus by sending specially crafted messages. CVE-2011-2200 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : popt (ZYPP Patch Number 7792)

Specially crafted RPM packages could have caused memory corruption in rpm when verifying signatures CVE-2011-3378. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

SuSE 10 Security Update : evince (ZYPP Patch Number 7409)

This update of evince fixes a buffer overflow in linetoken. CVE-2011-0433 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid57185; scriptversion"1.6";...

SuSE 11.1 Security Update : empathy (SAT Patch Number 5363)

The following bug has been fixed : - Insufficient quoting of nick names allowed attackers to inject arbitrary html CVE-2011-3635 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text...

SuSE 10 Security Update : clamav (ZYPP Patch Number 7805)

This version update of clamav fixes a recursion level crash. CVE-2011-3627 was assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid57169;...

SuSE 10 Security Update : apache2-mod_auth_mysql (ZYPP Patch Number 7683)

This update of apache2-modauthmysql fixes a possible SQL injection vulnerability that can be exploited using multibyte character encoding. CVE-2008-2384: CVSS v2 Base Score: 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N: SQL Injection. CWE-89 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : pam (ZYPP Patch Number 7814)

The pamenv module is vulnerable to a stack overflow CVE-2011-3148 and a DoS condition CVE-2011-3149 when parsing users .pamenvironment files. Additionally a missing return value check inside pamxauth has been fixed. CVE-2010-3316 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : firefox3-pango (ZYPP Patch Number 7459)

The following bug has been fixed : - Specially crafted font files could cause a heap corruption in applications linked against pango. CVE-2011-0020 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...