SuSE 10 Security Update : build (ZYPP Patch Number 7395)

The build script uses cpio to extract untrusted rpm packages for bootstrapping virtual machines. cpio is not safe to use for this task, therefore the build script now uses bsdtar instead. CVE-2010-4226 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7713)

Mozilla Firefox was updated to version 3.6.20. It fixes bugs and security issues. Following security issues were fixed: Mozilla Foundation Security Advisory 2011-30 - MFSA 2011-30 - Miscellaneous memory safety hazards Mozilla developers and community members identified and fixed several memory...

SuSE 10 Security Update : coreutils (ZYPP Patch Number 7658)

This update fixes the following security issue : - 697897: coreutils: when running 'su -c' to execute commands as different user the target user could inject command back into the calling user's terminal via the TIOCSTI ioctl. It also fixes a bug : - 702995: Added -L and -P commandline options to...

SuSE 10 Security Update : flash-player (ZYPP Patch Number 7559)

This update of flash player fixes a cross-site scripting vulnerability CVE-2011-2107. For more information about this issue please refer to http://www.adobe.com/support/security/bulletins/apsb11-13.html . %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is ...

SuSE 10 Security Update : clamav (ZYPP Patch Number 7805)

This version update of clamav fixes a recursion level crash. CVE-2011-3627 was assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid57169;...

SuSE 10 Security Update : pidgin, libpurple and finch (ZYPP Patch Number 7827)

This update fixes the following security issues : - 604225: MSN emoticon DoS. CVE-2010-1624 - 648273: multiple NULL pointer dereference weaknesses. CVE-2010-3711 - 722199: vulnerability in SILC protocol handling CVE-2011-3594 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text descripti...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 7393)

PHP5 was updated to fix several security issues. CVE-2010-4150 / CVE-2010-4645 / CVE-2010-4697 / CVE-2010-4698 / CVE-2010-4699 / CVE-2011-0708 / CVE-2011-0752 / CVE-2011-0753 / CVE-2011-0755 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : openswan (ZYPP Patch Number 7836)

openswan's crypto helper was prone to an use-after-free flaw which could potentially allow remote attackers to cause a Denial of Service CVE-2011-4073, bnc727002. Additionally, a potential dereference of a no longer valid pointer has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

SuSE 10 Security Update : Mono (ZYPP Patch Number 7479)

The following bug has been fixed : - mono loaded shared libraries from the current directory. CVE-2010-4159 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid5716...

SuSE 10 Security Update : apache2-mod_auth_mysql (ZYPP Patch Number 7683)

This update of apache2-modauthmysql fixes a possible SQL injection vulnerability that can be exploited using multibyte character encoding. CVE-2008-2384: CVSS v2 Base Score: 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N: SQL Injection. CWE-89 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : dhcp (ZYPP Patch Number 7716)

This update of dhcp fixes two Denial of Service CVE-2011-2748 / CVE-2011-2749 vulnerabilities caused by specially crafted BOOTP packets. Additionally, the alias IP address handling of dhclient-script was fixed to not wipe out iptables connmark when renewing the lease. %NASLMINLEVEL 70300 C Tenabl...

SuSE 10 Security Update : tomcat5 (ZYPP Patch Number 7756)

The following bug has been fixed : - Specially crafted AJP messages could have been used to bypass authentication. CVE-2011-3190 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : freetype2 (ZYPP Patch Number 7399)

Specially crafted font files could crash applications that use freetype2 to render the fonts. CVE-2010-3814 / CVE-2010-3855 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : Postfix (ZYPP Patch Number 7403)

The following bug has been fixed : - Postfix did not clear the receive buffer after the STARTTLS command. A man-in-the middle could therefore inject commands in the unencrypted stream that get interpreted in the encrypted phase after STARTTLS. CVE-2011-0411 %NASLMINLEVEL 70300 C Tenable Network...

SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 7833)

Acrobat reader was updated to version 9.4.6 to fix several security issues. CVE-2011-1353 / CVE-2011-2431 / CVE-2011-2432 / CVE-2011-2433 / CVE-2011-2434 / CVE-2011-2435 / CVE-2011-2436 / CVE-2011-2437 / CVE-2011-2438 / CVE-2011-2439 / CVE-2011-2440 / CVE-2011-2441 / CVE-2011-2442 %NASLMINLEVEL...

SuSE 10 Security Update : openssl-certs (ZYPP Patch Number 7719)

This updates includes the latest SSL root certificates trusted by Mozilla as of 2011-08-31. This includes removing the DigiNotar CA. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7666)

This kernel update for the SUSE Linux Enterprise 10 SP4 kernel fixes several security issues and bugs. The following security issues were fixed : - The dccprcvstateprocess function in net/dccp/input.c in the Datagram Congestion Control Protocol DCCP implementation in the Linux kernel did not...

SuSE 10 Security Update : compat-openssl097g (ZYPP Patch Number 7645)

This update adds openssl patches since 2007 for : - CVE-2009-0590 - CVE-2008-5077 - CVE-2009-0789 - CVE-2009-3555 - CVE-2010-4180 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL 3000 exit0; include'deprecatednasllevel.inc';...

SuSE 10 Security Update : Gimp (ZYPP Patch Number 7776)

Specially crafted gif files could have caused an infinite loop or a heap-based buffer overflow in the gif decoder CVE-2011-2896. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : dhcp6 (ZYPP Patch Number 7465)

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server. CVE-2011-0997 %NASLMINLEVEL 70300 C...