SuSE 11.1 Security Update : tomcat6 (SAT Patch Number 5759)

This update fixes a regression in parameter passing in urldecoding of parameters that contain spaces. In addition, multiple weaknesses in HTTP DIGESTS have been fixed CVE-2011-1184 : - The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33 and...

SuSE 11.1 Security Update : glibc (SAT Patch Number 4944) (deprecated)

The implementation of the blowfish based password hashing method had a bug affecting passwords that contain 8bit characters e.g. umlauts. Affected passwords are potentially faster to crack via brute-force methods. CVE-2011-2483 SUSE's crypt implementation supports the blowfish password hashing...

SuSE 11.1 Security Update : KVM (SAT Patch Number 5655)

The following vulnerabilities have been fixed in KVM : - buffer overflow in e1000 device emulation. CVE-2012-0029 - missing initgroups for -runas CVE-2011-2527 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11...

SuSE 11.1 Security Update : squid (SAT Patch Number 5584)

This update fixes the following security issue : - 587375: squid NULL deref via HTCP request CVE-2010-0639 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C...

SuSE 11.1 Security Update : libxml2 (SAT Patch Number 5654)

A heap-based buffer overflow during decoding of entity references with overly long names has been fixed. CVE-2011-3919 has been assigned. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The...

SuSE 11.1 Security Update : icu (SAT Patch Number 5653)

The following bugs have been fixed : - Specially crafted strings could cause a buffer overflow in icu. CVE-2011-4599 - An integer overflow in the getSymbol function could crash applications using icu CVE-2010-4409 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

SuSE 11.1 Security Update : sysconfig (SAT Patch Number 5618)

sysconfig hook script for NetworkManager did not properly quote shell meta characters when processing ESSIDs. Specially crafted network names could have therefore lead to execution of shell code. CVE-2011-4182 In addition, the following non-security bugs were fixed : - 580018: ip addr flush $ifna...

SuSE 11.1 Security Update : Acrobat Reader (SAT Patch Number 5649)

Acrobat Reader was updated to version 9.4.7 to fix two security issues. CVE-2011-2462 / CVE-2011-4369 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell,...

SuSE 11.1 Security Update : OpenSSL (SAT Patch Number 5635)

Various security vulnerabilities have been fixed in OpenSSL : - DTLS plaintext recovery attack. CVE-2011-4108 - double-free in Policy Checks. CVE-2011-4109 - uninitialized SSL 3.0 padding. CVE-2011-4576 - malformed RFC 3779 data can cause assertion failures. CVE-2011-4577 - SGC restart DoS attack...

SuSE 11.1 Security Update : libxml2 (SAT Patch Number 5489)

Specially crafted XPath expressions could have allowed attackers to cause a denial of service or possibly have unspecified other impact CVE-2011-2821 / CVE-2011-2834. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

SuSE 11.1 Security Update : pidgin (SAT Patch Number 5586)

Remote users could have crashed pidgin via ICQ, SILC, XMPP and Yahoo protocols CVE-2011-4601 / CVE-2011-4603 / CVE-2011-4602 / CVE-2011-1091. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 1...

SuSE 11.1 Security Update : glibc (SAT Patch Number 5555)

The following bug has been fixed : - Specially crafted time zone files could cause a heap overflow in glibc. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C...

SuSE 11.1 Security Update : Kerberos 5 (SAT Patch Number 5594)

This update of krb5 fixes two security issues. - A remote code execution in the kerberized telnet daemon was fixed. This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE.. CVE-2011-4862 - / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file access...

SuSE 11.1 Security Update : NetworkManager (SAT Patch Number 5381)

NetworkManager did not pin a certificate's subject to an ESSID. A rogue access point could therefore be used to conduct MITM attacks by using any other valid certificate issued by same CA as used in the original network CVE-2006-7246. This has been fixed. Please note that existing WPA2 Enterprise...

SuSE 11.1 Security Update : xorg-x11-server (SAT Patch Number 5479)

This update fixes two security issues with the X server : - A local attacker could find out if a file exists by exploiting the way that Xorg creates its lock files. CVE-2011-4028 - A non-root local user could set the read permission for all users on any file or directory. CVE-2011-4029...

SuSE 11.1 Security Update : perf (SAT Patch Number 5417)

The following perf tool bugs have been fixed : - it was issuing excessive number of gettimeofday calls creating noise when trying to measure performance. bnc607339 - it would consider a file named 'config' in the current-working-directory as containing perf configuration data, this fact could be...

SuSE 11.1 Security Update : wireshark (SAT Patch Number 5433)

This is a wireshark version upgrade to 1.4.10 to fix various security flaws and other non-security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C...

SuSE 11.1 Security Update : Samba (SAT Patch Number 5000)

A Cross-Site Request Forgery CSRF and a Cross Site Scripting vulnerability have been fixed in Samba's SWAT. CVE-2011-2522: CVSS v2 Base Score: 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N CVE-2011-2694: CVSS v2 Base Score: 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

SuSE 11.1 Security Update : CUPS (SAT Patch Number 5180)

This update fixes the following security issues : - 601830: CSRF via admin web interface. CVE-2010-0540 - 680210: users in group 'lp' can overwrite arbitrary files. CVE-2010-2431 - 680212: denial of service via cupsDoAuthentication. CVE-2010-2432 - 711490: heap overflow in gif decoder...

SuSE 11.1 Security Update : squid3 (SAT Patch Number 5095)

This update of squid3 fixes a buffer overflow vulnerability in the Gopher reply parser code. CVE-2011-3205 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C...