SuSE9 Security Update : libgsf (YOU Patch Number 11342)

Specially crafted OLE documents enabled attackers to use a heap buffer overlow for executing code. CVE-2006-4514 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE9 Security Update : dhcp-server (YOU Patch Number 11373)

A bug was fixed were a LDAP server with malicious data providing information to the DHCP server could crash and potentially execute code as the DHCP server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE9 Security Update : Apache 2 (YOU Patch Number 12258)

Missing sanity checks of FTP URLs allowed cross-site scripting XSS attacks via the modprodyftp module. CVE-2008-2939 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE9 Security Update : pcre (YOU Patch Number 11998)

Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code. CVE-2007-1659, CVE-2006-7230 %NASLMINLEVEL 7030...

SuSE9 Security Update : arc (YOU Patch Number 10496)

This updates fixes two bugs : - Eric Romang discovered that the ARC archive program under Unix creates a temporary file with insecure permissions which may lead to an attacker stealing sensitive information. CVE-2005-2945 - Joey Schulze discovered that the temporary file was created in an insecur...

SuSE9 Security Update : IBM Java5 JRE and SDK (YOU Patch Number 12461)

The IBM JRE/JDK version 5 was updated to Service Release 10. It fixes a number of bugs and likely also several security issues. As usual IBM does not publish fixed security issues on the release date so a detailed list cannot be given at this time. Please check...

SuSE9 Security Update : Tomcat (YOU Patch Number 12460)

This update of tomcat fixes several vulnerabilities : - RequestDispatcher usage can lead to information leakage. CVE-2008-5515 - denial of service via AJP connection. CVE-2009-0033 - some authentication classes allow user enumeration. CVE-2009-0580 - XSS bug in example application cal2.jsp...

SuSE9 Security Update : cups (YOU Patch Number 12016)

This update fixes a buffer overflow that can be exploited by users that are allowed to configure CUPS. CVE-2007-5848 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE9 Security Update : audiofile (YOU Patch Number 12342)

A heap-overflow in libaudiofile was fixed. The overflow existed in the WAV processing code and can be exploited to execute arbitrary code. CVE-2008-5824 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE9 Security Update : Postfix (YOU Patch Number 12219)

A local privilege escalation vulnerability as well as a mailbox ownership problem has been fixed in postfix. CVE-2008-2936 and CVE-2008-2937 have been assigned to this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE9 Security Update : Acrobat Reader (YOU Patch Number 12211)

This update of acroread fixes an unknown error in a JavaScript method that can lead to remote code execution. CVE-2008-2641 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE9 Security Update : postgresql (YOU Patch Number 12065)

This version update to 8.1.11 fixes among other things, several security issues : - Index Functions Privilege Escalation: CVE-2007-6600 - Regular Expression Denial-of-Service: CVE-2007-4772, CVE-2007-6067, CVE-2007-4769 - DBLink Privilege Escalation: CVE-2007-6601 %NASLMINLEVEL 70300 C Tenable...

SuSE9 Security Update : IBM Java2 JRE and SDK (YOU Patch Number 12210)

This update of IBM Java to 1.4.2 SR11 fixes various security problems : - Stack-based buffer overflow in Java Web Start javaws.exe allows remote attackers to execute arbitrary code via a crafted JNLP file. CVE-2008-1196 - Unspecified vulnerability in the Java Runtime Environment JRE allows remote...

SuSE9 Security Update : opensc, opensc-devel (YOU Patch Number 12240)

This revised update fixes a security issue with opensc that occurs when initializing blank smart cards with Siemens CardOS M4. After initialization, anyone could set the PIN of the smart card without authorization. CVE-2008-2235 NOTE: cards already initialized with the old version are still...

SuSE9 Security Update : ClamAV (YOU Patch Number 12442)

Multiple issues in clamav regarding malformed archives and emails have been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41307; scriptversion"1.7";...

SuSE9 Security Update : Tomcat (YOU Patch Number 12343)

Two old but not yet fixed security issues in tomcat5 were spotted and are fixed by this update : - Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon ; preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.d...

SuSE9 Security Update : unrar (YOU Patch Number 11465)

This update fixes a stack-based buffer overflow in unrar that can be exploited with user-assistance by sending a password-protected archive. CVE-2007-0855 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE9 Security Update : Python (YOU Patch Number 12316)

Integer overflows in the python imageop module and in the expandtabs method potentially allowed attackers to execute arbitrary code. CVE-2008-4864, CVE-2008-5031 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE9 Security Update : arts (YOU Patch Number 11075)

The KDE soundserver aRts lacked checks around some setuid calls. This could be used by a local attacker to gain root privileges. CVE-2006-2916 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE9 Security Update : YaST2 (YOU Patch Number 11952)

This update fixes a security bug in yast2-core that allows local attackers to provide malicious YaST2 modules to YaST2 which are subsequently executed with root privileges. To trigger this vulnerability root has to execute yast2 in an untrusted directory i.e. /tmp. %NASLMINLEVEL 70300 C Tenable...