SuSE 10 Security Update : libvorbis (ZYPP Patch Number 7057)

This update of libvorbis fixes a memory corruption while parsing OGG files. The bug is exploitable by remote attackers to cause an application crash and could probably be exploited to execute arbitrary code. The issue has been tracked as CVE-2009-2663. %NASLMINLEVEL 70300 C Tenable Network...

SuSE 10 Security Update : neon (ZYPP Patch Number 6549)

neon did not properly handle embedded NUL characters in X.509 certificates when comparing host names. Attackers could exploit that to spoof SSL servers. CVE-2009-2408 Specially crafted XML documents that contain a large number of nested entity references could cause neon to consume large amounts ...

SuSE 10 Security Update : ethereal (ZYPP Patch Number 6890)

This update of ethereal fixes : - Several buffer overflows in the LWRES dissector. CVE-2010-0304 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid49846;...

SuSE 10 Security Update : libapr1 (ZYPP Patch Number 6545)

This update of libapr-util1 and libapr1 fixes multiple integer overflows that could probably be used to execute arbitrary code remotely. CVE-2009-2412 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : sendmail (ZYPP Patch Number 6860)

This update of sendmail improves the handling of special-characters in the SSL certificate. CVE-2009-4565: CVSS v2 Base Score: 7.5 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6944)

This update adds support for RFC5746 TLS renegotiations to address vulnerabilities tracked as CVE-2009-3555. It also fixes a mishandling of OOM conditions in bnwexpand. CVE-2009-3245 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Python (ZYPP Patch Number 6946)

This update of python has a copy of libxmlrpc that is vulnerable to denial of service bugs that can occur while processing malformed XML input. CVE-2009-2625: CVSS v2 Base Score: 5.0 moderate AV:N/AC:L/Au:N/C:N/I:N/A:P: Permissions, Privileges, and Access Control CWE-264 CVE-2009-3720: CVSS v2 Ba...

SuSE 10 Security Update : kdegraphics3-pdf (ZYPP Patch Number 6652)

Specially crafted PDF files could cause buffer overflows in the pdftops filter when printing such a document. CVE-2009-3608: CVSS v2 Base Score: 9.3 CVE-2009-3609: CVSS v2 Base Score: 4. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : clamav (ZYPP Patch Number 7056)

This update fixes the following security issues in clamav that can be used as a remote denial of service attack : - An off-by-one buffer overflow. CVE-2010-1640 - A crash while parsing PDFs CVE-2010-1639 / CVE-2010-2077 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of...

SuSE 10 Security Update : ncpfs (ZYPP Patch Number 7023)

This update fixes three security issues in ncpfs : Fixed a information leakage on mount CVE-2010-0790 / bnc583536 Fixed a mtab locking problem CVE-2010-0791 / bnc583536 Fixed a race condition in ncpfs mounts. CVE-2010-0788 / bnc550004 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : iscsitarget (ZYPP Patch Number 7109)

This update of iscscitarget/tgt fixes multiple overflows and a format string vulnerability : - CVE-2010-2221: CVSS v2 Base Score: 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:N/A:P: Buffer Errors CWE-119 - CVE-2010-0743: CVSS v2 Base Score: 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:N/A:P: Format String Vulnerability...

SuSE 10 Security Update : Samba (ZYPP Patch Number 6551)

samba's makeconnectionsnum handles certain input incorrectly, which may lead to disclosure of the root directory. CVE-2009-2813 has been assigned to this issue. Additionally an information disclosure vulnerability in mount.cifs has been fixed CVE-2009-2948 as well as a DoS condition. CVE-2009-290...

SuSE 10 Security Update : OpenLDAP 2 (ZYPP Patch Number 6598)

This update of openldap2 makes SSL certificate verification more robust against uses of the special character \0 in the subjects name. CVE-2009-2408 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : pango (ZYPP Patch Number 6800)

A long glyph string can trigger a heap-based buffer overflow in pango. CVE-2009-1194 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid49911; scriptversion"1.11";...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6536)

Multiple issues have been fixed in php5 : - phpopensslapplyverificationpolicy fails to verify certificate. CVE-2009-3291 - 'missing sainity checks around exif'. CVE-2009-3292 - unspecified vulnerability in the imagecolortransparent. CVE-2009-3293 - denial of service in exif module CVE-2009-2687...

SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6768)

The following bugs have been fixed : An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. CVE-2009-4136 Embedded null bytes in the common na...

SuSE 10 Security Update : Perl (ZYPP Patch Number 7108)

perl Safe.pm module was affected by two problems where attackers could break out of such a safed execution CVE-2010-1447 / CVE-2010-1168. This update fixes this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : cron (ZYPP Patch Number 6865)

This update of cron fixes a race condition in crontab that can be used to change the time-stamp of arbitrary files while editing the crontab entry. - CVSS v2 Base Score: 3.6 Additionally the return value of initgroups is verified now. CVE-2010-0424 %NASLMINLEVEL 70300 C Tenable Network Security,...

SuSE 10 Security Update : gpg2 (ZYPP Patch Number 7107)

This update fixes a vulnerability of GnuPG2 to arbitrary code execution by context-dependent attackers due to reusing a freed pointer when verifying a signature or importing a certificate with many 'Subject Alternate Names'. CVE-2010-2547 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

SuSE 10 Security Update : ethereal (ZYPP Patch Number 6628)

Update of wireshark to fix multiple vulnerabilities : - The Paltalk dissector could crash on alignment-sensitive processors. CVE-2009-3549: CVSS v2 Base Score: 5.0 MEDIUM - The DCERPC/NT dissector could crash. CVE-2009-3550: CVSS v2 Base Score: 4.3 MEDIUM - The SMB dissector could crash...