SuSE 11 Security Update : Linux kernel (SAT Patch Numbers 1581 / 1588 / 1591)

The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.39 fixing various bugs and security issues. The following security issues have been fixed : - A race condition during pipe open could be used by local attackers to cause a denial of service. Due to mmapminaddr protection enabled by default...

SuSE 11 Security Update : mutt (SAT Patch Number 1601)

This update improves the handling of SSL certificates and fixes a minor usability bug introduced with the last security update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itse...

SuSE 11 Security Update : bind (SAT Patch Number 1617)

The bind DNS server was updated to close a possible cache poisoning vulnerability which allowed to bypass DNSSEC. CVE-2009-4022: CVSS v2 Base Score: 2.6 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update...

SuSE 11 Security Update : IBM Java 1.4.2 (SAT Patch Number 1525)

IBM Java 1.4.2 was updated to Service Refresh 13 Fixpack 2 At least following security issues are fixed by this update: CVE-2009-1100: A vulnerability in the Java Runtime Environment JRE with storing temporary font files might allow an untrusted applet or application to consume a disproportionate...

SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 1563)

The Mozilla Firefox 3.5.5 release fixes some instability issues caused by the 3.5.4 security upgrade. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell,...

SuSE 11 Security Update : expat (SAT Patch Number 1487)

Specially crafted XML documents could make expat run into an enless loop, therefore locking up applications using expat. CVE-2009-3720 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The te...

SuSE 11 Security Update : KVM (SAT Patch Number 1553)

This update of QEMU KVM fixes the following bugs : - use-after-free bug in VNC code which might be used to execute code on the host system injected from the guest system. CVE-2009-3616: CVSS v2 Base Score: 8.5 - integer overflow in kvmdevioctlgetsupportedcpuid. CVE-2009-3638: CVSS v2 Base Score:...

SuSE 11 Security Update : OpenSSL (SAT Patch Number 1544)

The TLS/SSLv3 protocol as implemented in openssl prior to this update was not able to associate data to a renegotiated connection. This allowed man-in-the-middle attackers to inject HTTP requests in a HTTPS session without being noticed. For example Apache's modssl was vulnerable to this kind of...

SuSE 11 Security Update : libopenssl (SAT Patch Number 1540)

The TLS/SSLv3 protocol as implemented in openssl prior to this update was not able to associate data to a renegotiated connection. This allowed man-in-the-middle attackers to inject HTTP requests in a HTTPS session without being noticed. For example Apache's modssl was vulnerable to this kind of...

SuSE 11 Security Update : libqt4 (SAT Patch Number 1522)

This update fixes the handling of the subjectAltName field in SSL certificates. CVE-2009-2700 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc...

SuSE 11 Security Update : CUPS (SAT Patch Number 1504)

The cups web interface was prone to Cross-Site Scripting XSS problems. CVE-2009-2820 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc...

SuSE 11 Security Update : Mozilla (SAT Patch Number 1503)

This update fixes a bug in the Mozilla NSPR helper libraries, which could be used by remote attackers to potentially execute code via JavaScript vectors. - Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number...

SuSE 11 Security Update : Linux kernel (SAT Patch Numbers 1410 / 1412 / 1413)

The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.37 fixing various bugs and security issues. The following security issues were fixed : - Unsigned check in the ax25 socket handler could allow local attackers to potentially crash the kernel or even execute code. CVE-2009-2909 - Fixed...

SuSE 11 Security Update : Cyrus IMAPD (SAT Patch Number 1335)

This update fixes another buffer overflow in the Sieve code CVE-2009-3235. This can be exploited by users allowed to use their own sieve scripts to execute arbitrary code remotely. Additionally the handling of long headers was improved. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

SuSE 11 Security Update : libneon (SAT Patch Number 1376)

neon did not properly handle embedded NUL characters in X.509 certificates when comparing host names. Attackers could exploit that to spoof SSL servers. CVE-2009-2408 Specially crafted XML documents that contain a large number of nested entity references could cause neon to consume large amounts ...

SuSE 11 Security Update : acroread_ja (SAT Patch Number 1424)

Adobe Reader has been updated to fix numerous security vulnerabilities. Some of the vulnerabilities allowed attackers to potentially execute arbitrary code on the victim's system via specially crafted PDF files. CVE-2007-0048 / CVE-2007-0045 / CVE-2009-2564 / CVE-2009-2979 / CVE-2009-2980 /...

SuSE 11 Security Update : Acrobat Reader (SAT Patch Number 1425)

Adobe Reader has been updated to fix numerous security vulnerabilities. Some of the vulnerabilities allowed attackers to potentially execute arbitrary code on the victim's system via specially crafted PDF files. CVE-2007-0048 / CVE-2007-0045 / CVE-2009-2564 / CVE-2009-2979 / CVE-2009-2980 /...

SuSE 11 Security Update : Apache 2 (SAT Patch Number 1417)

This update of the Apache webserver fixes various security issues : - the option IncludesNOEXEC could be bypassed via .htaccess. CVE-2009-1195 - modproxy could run into an infinite loop when used as reverse proxy. CVE-2009-1890 - moddeflate continued to compress large files even after a network...

SuSE 11 Security Update : Samba (SAT Patch Number 1352)

samba's makeconnectionsnum handles certain input incorrectly, which may lead to disclosure of the root directory. CVE-2009-2813 has been assigned to this issue. Additionally an information disclosure vulnerability in mount.cifs has been fixed CVE-2009-2948 as well as a DoS condition. CVE-2009-290...

SuSE 11 Security Update : libapr (SAT Patch Number 1374)

This update of libapr-util1 and libapr1 fixes multiple integer overflows that could probably be used to execute arbitrary code remotely. CVE-2009-2412 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update...