SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7552)

This update of openssl fixes a timing attack. This attack can be used to obtain the private key of a TLS server whenever ECDSA signatures are used. CVE-2011-1945: CVSS v2 Base Score: 4.3 important AV:N/AC:M/Au:N/C:P/I:N/A:N: Cryptographic Issues. CWE-310 %NASLMINLEVEL 70300 C Tenable Network...

SuSE 10 Security Update : vino (ZYPP Patch Number 7532)

This security update fixes two out-of-bounds memory access vulnerabilities in vinos' libvncserver. CVE-2011-0904 / CVE-2011-0905 Additionally, another possible server crash has been fixed. bln440712 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : wireshark (ZYPP Patch Number 7501)

This update to wireshark version 1.4.5 fixes the following security issues : - Resource Management Errors. CWE-399, CVE-2011-1590 - Buffer Errors. CWE-119, CVE-2011-1591 - Numeric Errors CWE-189, CVE-2011-1592 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugi...

SuSE 10 Security Update : logrotate (ZYPP Patch Number 7534)

This update for logrotate provides the following fixes : - Race condition in the createOutputFile function in logrotate allows local users to read log data by opening a file before the intended permissions are in place CVE-2011-1098. bnc677336 - The writeState function in logrotate might allow...

SuSE 10 Security Update : python (ZYPP Patch Number 7509)

This update of python fixes a possible denial of service bug or information leakage vulnerability while using user-crafted ftp:// or file:// URLs with urllib2. CVE-2011-1521: CVSS v2 Base Score: 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text descripti...

SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7505)

IBM Java 1.4.2 was updated to SR13 FP9, fixing bugs and security issues. More information can be found on the IBM JDK Alerts page : http://www.ibm.com/developerworks/java/jdk/alerts/ %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if...

SuSE 10 Security Update : vsftpd (ZYPP Patch Number 7373)

Certain file patterns could cause vsftpd to consume excessive CPU resulting in denial of service CVE-2011-0762. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : mailman (ZYPP Patch Number 7489)

This mailman update fixes several cross-site scripting XSS vulnerabilities. CVE-2011-0707 / CVE-2010-3089 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid53639;...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7463)

Malicious clients could have downgraded a connection to a low strength cipher suite on session resumption if the server offers such ciphers CVE-2010-4180. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Postfix (ZYPP Patch Number 7387)

The following bug has been fixed : - Postfix did not clear the receive buffer after the STARTTLS command. A man-in-the middle could therefore inject commands in the unencrypted stream that get interpreted in the encrypted phase after STARTTLS. CVE-2011-0411 %NASLMINLEVEL 70300 C Tenable Network...

SuSE 10 Security Update : dhcp6 (ZYPP Patch Number 7464)

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server. CVE-2011-0997 %NASLMINLEVEL 70300 C...

SuSE 10 Security Update : dhcp (ZYPP Patch Number 7456)

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server. CVE-2011-0997 %NASLMINLEVEL 70300 C...

SuSE 10 Security Update : X11 (ZYPP Patch Number 7417)

Remote attackers could execute arbitrary commands as root by assigning specially crafted hostnames to X11 clients via XDMCP. CVE-2011-0465 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 7375)

php5 was updated to fix several security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL 3000 exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid53285; scriptversion"1.7";...

SuSE 10 Security Update : quagga (ZYPP Patch Number 7355)

This security update of quagga fixes : - Direct BGP peers can send malformed extended communities which lead to a NULL pointer dereference. CVE-2010-1674 - A malformed ASPATHLIMIT path attribute will cause a session reset in Quagga. This malformed package is forwarded by other routers and can be...

SuSE 10 Security Update : gimp (ZYPP Patch Number 7374)

Several gimp plugins were prone to buffer overflows. CVE-2010-4540 / CVE-2010-4541 / CVE-2010-4542 / CVE-2010-4543 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : java-1_6_0-ibm, java-1_6_0-ibm-32bit, java-1_6_0-ibm-64bit, java-1_6_0-ibm-alsa, java-1_6_0-ibm-alsa-32bit, java-1_6_0-ibm-demo, java-1_6_0-ibm-devel, java-1_6_0-ibm-devel-32bit, java-1_6_0-ibm-fonts, java-1_6_0-ibm-jdbc, java-1_6_0-ibm-jdbc-32bit, java-1_6_0-ibm-jdbc-64bit, java-1_6_0-ibm-plugin, java-1_6_0-ibm-plugin-32bit, java-1_6_0-ibm-src (ZYPP Patch Number 7369)

IBM Java 6 SR9 FP1 was updated to fix a critical security bug in float number handling : - The Java Runtime Environment hangs forever when converting '2.2250738585072012e-308' to a binary floating-point number. CVE-2010-4476 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text descriptio...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7371)

Mozilla Firefox has been updated to version 3.6.15, fixing the following %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL 3000 exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid52736;...

SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 7359)

Specially crafted PDF documents can crash acroread or lead to execution of arbitrary code. Acroread has been updated to version 9.4.2 to address the issues CVE-2010-4091 / CVE-2011-0562 / CVE-2011-0563 / CVE-2011-0565 / CVE-2011-0566 / CVE-2011-0567 / CVE-2011-0570 / CVE-2011-0585 / CVE-2011-0586...

SuSE 10 Security Update : Tomcat (ZYPP Patch Number 7337)

This tomcat6 update fixes : - CVE-2010-3718: CVSS v2 Base Score: 4.0 AV:N/AC:H/Au:N/C:P/I:P/A:N: Design Error CWE-DesignError - CVE-2011-0013: CVSS v2 Base Score: 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N: XSS CWE-79 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is...