SuSE 10 Security Update : xen (ZYPP Patch Number 4766)

This update fixes various Xen issues. Two security problems were fixed: CVE-2007-5906: Xen allowed virtual guest system users to cause a denial of service hypervisor crash by using a debug register DR7 to set certain breakpoints. - Xen 3.1.1 does not prevent modification of the CR4 TSC from...

SuSE 10 Security Update : clamav (ZYPP Patch Number 2631)

This update to ClamAV version 0.90 fixes various bugs : - A filedescriptor leak in the handling of CAB files can lead to a denial of service attack against the clamd scanner daemon caused by remote attackers. CVE-2007-0897 - A directory traversal in handling of MIME E-Mail headers could be used b...

SuSE 10 Security Update : openldap2-client (ZYPP Patch Number 2291)

OpenLDAP libldap's strval2strlen function contained a bug when processing the authcid string of certain Bind Requests, which could allow attackers to cause an affected application especially the OpenLDAP Server to crash. CVE-2006-5779 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : Tk (ZYPP Patch Number 4478)

This update fixes a buffer overflow that occurs while processing interlaced/animatedGIF images. CVE-2007-4851 This bug could be used to execute code remotely. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 3290)

This Update fixes numerous vulnerabilities in PHP. Most of them were made public during the 'Month of PHP Bugs'. The vulnerabilities potentially lead to crashes, information leaks or even execution of malicious code. CVE-2007-1380 / CVE-2007-0988 / CVE-2007-1375 / CVE-2007-1521 / CVE-2007-1376 /...

SuSE 10 Security Update : mutt (ZYPP Patch Number 3752)

This update of mutt fixes a vulnerability in the APOP implementation that allows an active attacker to guess three bytes of the password. CVE-2007-1558 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : Kerberos 5 (ZYPP Patch Number 3046)

A bug in the function krb5klogsyslog leads to a buffer overflow which could be exploited to execute arbitrary code. CVE-2007-0957 A double-free bug in the GSS-API library could crash kadmind. It's potentially also exploitable to execute arbitrary code. CVE-2007-1216 %NASLMINLEVEL 70300 C Tenable...

SuSE 10 Security Update : ruby (ZYPP Patch Number 2224)

A denial of service problem in the CGI multipart parsing of 'ruby' was fixed, which could have allowed remote attackers to affect a denial of service attack against ruby based webservices. CVE-2006-5467 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : pcre (ZYPP Patch Number 4689)

Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code. CVE-2006-7224 / CVE-2006-7225 / CVE-2006-7226 /...

SuSE 10 Security Update : ruby (ZYPP Patch Number 1946)

An attacker could bypass the 'safe level' checks. CVE-2006-3694 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29570; scriptversion"1.12";...

SuSE 10 Security Update : gv (ZYPP Patch Number 2339)

The previous 'gv' update to fix a stack overflow did not completely fix the problem spotted. An attacker could still cause the handling to use up all system memory, or open windows much wider than the X display and crash. Code execution however was not possible. %NASLMINLEVEL 70300 C Tenable...

SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 3131)

This update of ImageMagick fixes three integer overflow in DCM and XWD code. These bugs can be exploited remotely via other application. CVE-2007-1667 / CVE-2007-1797 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : cron (ZYPP Patch Number 3093)

By setting hard links to /etc/crontab users were able to prevent cron from running scheduled jobs. CVE-2007-1856 A re-emerged symlink bug allowed users to edit the crontab of other users. CVE-2005-1038 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : Qt3 (ZYPP Patch Number 3052)

qt wrongly accepts overly long UTF-8 sequences due to a bug in the UTF-8 decoder. This may lead to security problems unter certain circumstances. The bug for example allows for script tag injection in konqueror. CVE-2007-0242 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text descripti...

SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 2276)

The SQL Server PostgreSQL has been updated to fix the following security problems : - backend/parser/analyze.c in PostgreSQL 8.1.x allowed remote authenticated users to cause a denial of service daemon crash via certain aggregate functions in an UPDATE statement, which are not properly handled...

SuSE 10 Security Update : xfsdump (ZYPP Patch Number 3159)

The program xfsfsr created a temporary directory with unrestricted read and write permissions. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29597;...

SuSE 10 Security Update : LUM (ZYPP Patch Number 2274)

A security problem was fixed in 'novell-lum', the eDirectory based 'Linux User Management'. Under certain circumstances it was possible to login to the console without any password. ssh is not affected, since it rejects empty passwords. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The tex...

SuSE 10 Security Update : kdelibs3,kdelibs3-devel,CVE-2007-1564 (ZYPP Patch Number 3988)

A bug in konqueror allowed attackers to abuse the FTP passive mode for portscans. CVE-2007-1564 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29483;...

SuSE 10 Security Update : ethereal (ZYPP Patch Number 2028)

A security problem was fixed in ethereal, which could be used by remote attackers to hang the ethereal process. - If the SSCOP dissector has a port range configured AND the SSCOP payload protocol is Q.2931, a malformed packet could make the Q.2931 dissector use up available memory. No port range ...

SuSE 10 Security Update : libexif (ZYPP Patch Number 3721)

A denial of service problem crash was fixed in the EXIF Loader of libexif, which could be used to crash the browser or image viewer when it interprets the EXIF tags in prepared JPEG files. CVE-2007-2645 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...