SuSE 11 Security Update : squid (SAT Patch Number 2143)

The following vulnerabilities have been fixed in squid : - DoS via special crafted auth header. CVE-2009-2855 - DoS via invalid DoS header. CVE-2010-0308 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update...

SuSE 11 Security Update : CUPS (SAT Patch Number 2108)

lppasswd when running setuid or setgid still honors environment variables that specify the location of message files. Local attackers could exploit that to gather information by using crafted format strings. CVE-2010-0393 The previous fix for a use-after-free vulnerability CVE-2009-3553 was...

SuSE 11 Security Update : cron (SAT Patch Number 2027)

This update of cron fixes a race condition in crontab that can be used to change the time-stamp of arbitrary files while editing the crontab entry. Additionally the return value of initgroups is verified now. CVE-2010-0424: CVSS v2 Base Score: 3.6 %NASLMINLEVEL 70300 C Tenable Network Security,...

SuSE 11 Security Update : wireshark (SAT Patch Number 2082)

This update of wireshark fixes : - Remote attackers could potentially trigger a buffer overflow in the Daintree SNA file parser. CVE-2009-4376 - Specially crafted packets could cause the SMB and SMB2 dissector to crash wireshark. CVE-2009-4377 - Unspecified vulnerability in the Infiniband dissect...

SuSE 11 Security Update : evolution-data-server (SAT Patch Number 1944)

This update fixes the following vulnerability : evolution considered S/MIME signatures to be valid even for modified mails. CVE-2009-0547: CVSS v2 Base Score: 5.0 Additionally the following bug has been fixed : - A POP3 server sending overly long lines could crash evolution. %NASLMINLEVEL 70300 C...

SuSE 11 Security Update : sudo (SAT Patch Number 2084)

This update fixes two security issues : - Sudo failed to properly reset group permissions, when 'runasdefault' option was used. If a local, unprivileged user was authorized by sudoers file to perform their sudo commands under default user account, it could lead to privilege escalation...

SuSE 11 Security Update : libnetpbm (SAT Patch Number 1999)

This update of netpbm fxes a stack-based buffer overflow that could be triggered while processing the contents of XPM headers in image files. CVE-2009-4274: CVSS v2 Base Score: 5.8 moderate AV:N/AC:M/Au:N/C:N/I:P/A:P: Buffer Errors CWE-119 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

SuSE 11 Security Update : Acrobat Reader (SAT Patch Number 2065)

This update of acroread fixes : - Cross-domain request vulnerability. CVE-2010-0186 : CVSS v2 Base Score: 5.8 - An unspecified vulnerability that possibly allowed remote code execution. CVE-2010-0188 : CVSS v2 Base Score: 6.8 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive te...

SuSE 11 Security Update : Linux kernel (SAT Patch Numbers 2040 / 2043 / 2044)

The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.45 fixing various bugs and security issues. - The wakefutexpi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly handle certain unlock operations for a Priority Inheritance PI futex, which allows local users...

SuSE 11 Security Update : pidgin (SAT Patch Number 2019)

This update of pidgin fixes various security vulnerabilities : - Remote file disclosure vulnerability by using the MSN protocol. CVE-2010-0013: CVSS v2 Base Score: 4.3 : Path Traversal CWE-22 - MSN protocol plugin in libpurple allowed remote attackers to cause a denial of service memory corruptio...

SuSE 11 Security Update : sendmail (SAT Patch Number 2021)

This update of sendmail improves the handling of special-characters in the SSL certificate. CVE-2009-4565: CVSS v2 Base Score: 7.5 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text...

SuSE 11 Security Update : gmime (SAT Patch Number 1998)

This update of gmime fixes a buffer overflow in the GMIMEUUENCODELEN macro which allowed possible code execution while processing uuencoded data. CVE-2010-0409: CVSS v2 Base Score: 5.8 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

SuSE 11 Security Update : PHP5 (SAT Patch Number 1978)

This update of PHP5 fixes : - CVE-2008-5624: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P : Permissions, Privileges, and Access Control CWE-264 - CVE-2008-5625: CVSS v2 Base Score: 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P : Permissions, Privileges, and Access Control CWE-264 - Cross-Site...

SuSE 11 Security Update : flash-player (SAT Patch Number 1977)

The following bug has been fixed : Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests CVE-2010-0186. The update also fixes a denial of service condition. CVE-2010-0187 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive tex...

SuSE 11 Security Update : pango (SAT Patch Number 1880)

A long glyph string can trigger a heap-based buffer overflow in pango. CVE-2009-1194 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc...

SuSE 11 Security Update : fuse (SAT Patch Number 1867)

A race condition in fusermount allowed users to umount any filesystem CVE-2009-3297. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C...

SuSE 11 Security Update : NetworkManager-gnome (SAT Patch Number 1879)

The following bugs have been fixed : - nm-applet connected to WPA2 Enterprise networks even if the specified CA certificate file didn't exist. CVE-2009-4144 - When editing connections in nm-applet the connection object was exported via DBus disclosing potentially sensitive information to local...

SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 1779)

Mozilla Firefox was upgraded to 3.5.7 fixing some bugs and regressions. The following security bug has been fixed : - The nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp in Mozilla Firefox before 3.5.7 allows remote attackers to cause a denial of service application cras...

SuSE 11 Security Update : acroread_ja (SAT Patch Number 1881)

Specially crafted PDF files could crash acroread. Attackers could exploit that to potentially execute arbitrary code. CVE-2009-3953 / CVE-2009-3954 / CVE-2009-3955 / CVE-2009-3956 / CVE-2009-3957 / CVE-2009-3958 / CVE-2009-3959 / CVE-2009-4324 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

SuSE 11 Security Update : Mozilla XULrunner (SAT Patch Number 1778)

Mozilla XULrunner was upgraded to 1.9.0.17 fixing some bugs and regressions. The following security bug has been fixed : - The nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp in Mozilla Firefox before 3.5.7 allows remote attackers to cause a denial of service application...