SUSE SLES10 Security Update : OpenSSL (SUSE-SU-2014:1387-1) (POODLE)

This OpenSSL update fixes the following issues : - Session Ticket Memory Leak CVE-2014-3567 - Build option no-ssl3 is incomplete CVE-2014-3568 - Add support for TLSFALLBACKSCSV to mitigate CVE-2014-3566 POODLE Note that Tenable Network Security has extracted the preceding description block direct...

SUSE SLED10 / SLES10 Security Update : glibc (SUSE-SU-2012:1488-1)

This collective update to the GNU Lib C library glibc provides the following fixes : - Make addmntent return errors also for cached streams bnc676178, CVE-2011-1089 - Fix overflows in vfprintf bnc770891, CVE-2012-3406 - Fix incomplete results from nscd bnc753756 - Fix a deadlock in dlsym in case...

SUSE SLED10 / SLES10 Security Update : nfs-utils (SUSE-SU-2013:0822-1)

This update fixes a DNS spoofing problem with NFS rpc-gssd. CVE-2013-1923bnc813464 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

SUSE SLED10 / SLES10 Security Update : PostgreSQL (SUSE-SU-2012:1336-1)

PostgreSQL was updated to the latest stable release 8.1.23, fixing various bugs and security issues. The following security issues have been fixed : - CVE-2012-3488: This update fixes arbitrary read and write of files via XSL functionality. - CVE-2012-2655: postgresql: denial of service stack...

SUSE SLES10 Security Update : glibc (SUSE-SU-2015:0550-1)

glibc has been updated to fix four security issues : - CVE-2014-0475: Directory traversal in locale environment handling bnc887022 - CVE-2014-7817: wordexp failed to honour WRDENOCMD bsc906371 - CVE-2014-9402: Avoid infinite loop in nssdns getnetbyname bsc910599 - CVE-2015-1472: Fixed buffer...

SUSE SLED10 / SLED11 / SLES10 / SLES11 Security Update : ClamAV (SUSE-SU-2013:0617-1)

ClamAV has been updated to the 0.97.7 release that contains various security related hardening fixes. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as...

SUSE SLES10 / SLES11 Security Update : xinetd (SUSE-SU-2014:0871-1)

Xinetd receives a LTSS roll-up update to fix two security issues. - CVE-2012-0862: xinetd enabled all services when tcp multiplexing is used. - CVE-2013-4342: xinetd ignored user and group directives for tcpmux services, running services as root. While both issues are not so problematic on their...

SUSE SLES10 Security Update : kernel (SUSE-SU-2014:0536-1)

The SUSE Linux Enterprise Server 10 Service Pack 4 LTSS kernel has been updated to fix various security issues and several bugs. The following security issues have been addressed : CVE-2011-2492: The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data...

SUSE SLES10 Security Update : libxml2 (SUSE-SU-2013:1627-1)

libxml2 has been updated to fix the following security issue : - CVE-2013-0338: libxml2 allowed context-dependent attackers to cause a denial of service CPU and memory consumption via an XML file containing an entity declaration with long replacement text and many references to this entity, aka...

SUSE SLED10 / SLES10 Security Update : kernel (SUSE-SU-2012:1391-1)

This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel. The following security issues have been fixed : CVE-2011-2494: kernel/taskstats.c in the Linux kernel allowed local users to obtain sensitive I/O statistics by sending taskstats commands to...

SUSE SLES10 Security Update : OpenSSL (SUSE-SU-2014:0539-1)

OpenSSL has been updated to fix an attack on ECDSA Nonces. Using the FLUSH+RELOAD Cache Side-channel Attack the Nonces could be recovered. CVE-2014-0076 The update also enables use of SHA-2 family certificate verification of X.509 certificates used in todays SSL certificate infrastructure. Note...

SUSE SLES10 Security Update : IBM Java 5 (SUSE-SU-2014:0732-1)

IBM Java 5 was updated to SR 16 FP 6 to fix several bugs and security issues. Further information is available at: https://www.ibm.com/developerworks/java/jdk/aix/j532/fixes.htmlSR16FP 6 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE securi...

SUSE SLES10 Security Update : Mozilla Firefox (SUSE-SU-2013:0306-1)

Mozilla Firefox is updated to the 10.0.12ESR version. This is a roll-up update for LTSS. It fixes a lot of security issues and bugs. 10.0.12ESR fixes specifically : MFSA 2013-01: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other...

SUSE SLES10 Security Update : Xen (SUSE-SU-2014:1691-1)

Xen has been updated to fix six security issues : - Guest effectable page reference leak in MMUMACHPHYSUPDATE handling CVE-2014-9030. - Insufficient bounding of 'REP MOVS' to MMIO emulated inside the hypervisor CVE-2014-8867. - Missing privilege level checks in x86 emulation of far branches...

SUSE SLES10 Security Update : kernel (SUSE-SU-2014:0772-1)

The SUSE Linux Enterprise Server 10 Service Pack 4 LTSS kernel has been updated to fix various security issues and several bugs. The following security issues have been addressed : CVE-2013-6382: Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local...

SUSE SLED10 / SLES10 Security Update : xorg-x11-server (SUSE-SU-2013:0857-1)

In some cases, input events are sent to X servers not currently the VT owner, allowing a user to capture passwords. This update fixes this issue. CVE-2013-1940 has been assigned to this issue. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

SUSE SLES10 Security Update : glibc (SUSE-SU-2014:1119-1)

This glibc update fixes a critical privilege escalation problem and the following security and non security issues : - bnc892073: An off-by-one error leading to a heap-based buffer overflow was found in gconvtranslitfind. An exploit that targets the problem is publicly available. CVE-2014-5119 -...

SUSE SLES10 Security Update : gnutls (SUSE-SU-2014:0321-1)

The GnuTLS library received a critical security fix and other updates : - CVE-2014-0092: The X.509 certificate verification had incorrect error handling, which could lead to broken certificates marked as being valid. - CVE-2009-5138: A verification problem in handling V1 certificates could also...

SUSE SLES10 Security Update : PHP5 (SUSE-SU-2012:1210-1)

This update fixes header code injection issues in PHP5 CVE-2011-1398 and CVE-2011-4388. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

SUSE SLES10 Security Update : apache2 (SUSE-SU-2013:0387-1)

This update fixes the following security issues with apache2 httpd : - Improper LDLIBRARYPATH handling CVE-2012-0883 - Filename escaping problem CVE-2012-2687 Additionally, some non-security bugs have been fixed as enumerated in the changelog of the RPM. Note that Tenable Network Security has...