SuSE9 Security Update : ruby (YOU Patch Number 12452)

This update for ruby fixes the following security issues : - Improve return value checks for OpenSSL function OCSPbasicverify to refuse usage of revoked certificates. CVE-2009-0642 - Increase entropy of DNS identifiers to avoid spoofing attacks. CVE-2008-3905 - Fix denial of service DoS...

SuSE9 Security Update : CUPS (YOU Patch Number 12261)

Specially crafted print jobs could trigger buffer overflows in the 'imagetops', 'texttops' and 'hpgltops' filters. Attackers could potentially exploit that to execute arbitrary code on the cups server. CVE-2008-3639, CVE-2008-3640, CVE-2008-3641 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

SuSE9 Security Update : arc (YOU Patch Number 10496)

This updates fixes two bugs : - Eric Romang discovered that the ARC archive program under Unix creates a temporary file with insecure permissions which may lead to an attacker stealing sensitive information. CVE-2005-2945 - Joey Schulze discovered that the temporary file was created in an insecur...

SuSE9 Security Update : pcre (YOU Patch Number 11998)

Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code. CVE-2007-1659, CVE-2006-7230 %NASLMINLEVEL 7030...

SuSE9 Security Update : MySQL (YOU Patch Number 12456)

This update is provided as RPM packages that can easily be installed onto a running system by using the YaST online update module. - the COMCREATEDB and COMDROPDB suffered from format string vulnerabilities. CVE-2009-2446 - the command line client was prone to cross-site scripting XSS attacks...

SuSE9 Security Update : Tomcat (YOU Patch Number 12078)

Fixed various issues in tomcat : - modjk directory traversal. CVE-2007-1860 - Handling of cookies containing a ' character. CVE-2007-3382 - Handling of a double-quote character in cookies. CVE-2007-3385 - tomcat path traversal / information leak. CVE-2007-5641 - tomcat HTTP Request Smuggling...

SuSE9 Security Update : ruby (YOU Patch Number 11442)

The ruby package was updated to fix a denial of service problem in its CGI module when parsing multipart MIME messages. CVE-2006-6303 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; i...

SuSE9 Security Update : perl-Archive-Zip (YOU Patch Number 9462)

Mail virus scanners like amavis use perl-Archive-Zip to scan ZIP archives. A bug in the handling of files with manipulated size entires has been fixed that could leave malicious code in such files undetected. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin...

SuSE9 Security Update : Tk (YOU Patch Number 11853)

This update fixes a buffer overflow that occurs while processing interlaced/animatedGIF images. CVE-2007-4851 This bug could be used to execute code remotely. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc...

SuSE9 Security Update : ethereal (YOU Patch Number 12323)

This update fixes problems that could crash wireshark when processing compressed data CVE-2008-3933 and Q.931 packets. CVE-2008-4685 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE9 Security Update : bind (YOU Patch Number 12328)

This update improves the verification of return values of openssl functions. Prior this update it was possible to spoof answers signed with DSA and NSEC3DSA. CVE-2009-0025 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE9 Security Update : IBM Java5 JRE and SDK (YOU Patch Number 12461)

The IBM JRE/JDK version 5 was updated to Service Release 10. It fixes a number of bugs and likely also several security issues. As usual IBM does not publish fixed security issues on the release date so a detailed list cannot be given at this time. Please check...

SuSE9 Security Update : imap (YOU Patch Number 9885)

This update fixes a logical error in the challenge response authentication mechanism CRAM-MD5. Due to this mistake a remote attacker can gain access to the IMAP server as arbitrary user. CVE-2005-0198 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE9 Security Update : libxml2 (YOU Patch Number 12286)

This update fixes an integer overflow in libxml2 that could lead to memory corruption and arbitrary code execution. CVE-2008-4226 Thanks to: Drew Yao of Apple Product Security %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE9 Security Update : libksba (YOU Patch Number 11222)

The gpgsm program, which uses the libksba library, crashes when verifying a signature with certain malformed X.509 certificates. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE9 Security Update : Perl (YOU Patch Number 12208)

Specially crafted regular expressions could crash perl. CVE-2008-1927 Additionally problem in the CGI module was fixed that could result in an endless loop if uploads were cancelled. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE9 Security Update : DHCP (YOU Patch Number 12347)

This update contains a backported patch from dhcp-3.0.7 to fix a buffer overflow which could lead to a denial-of-service condition in cases when the dhcp server is configured to send many DHCP options to clients. CVE-2007-0062 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE9 Security Update : libpng (YOU Patch Number 12358)

A allocation mistake in libpng's pngread.c has been fixed CVE-2009-0040. The previous update was using an incomplete patch so it needed to be reissued. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE9 Security Update : freetype2 (YOU Patch Number 12398)

Freetype was updated to fix some integer overflows that can be exploited remotely in conjunction with programs like a web-browser. CVE-2009-0946 Thanks to Tavis Ormandy who found the bugs. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE9 Security Update : rsh (YOU Patch Number 12241)

in.rexecd was not using the system wide limits, potentially allowing remote rexec users to exhaust all system resources. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...