SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6665)

The Mozilla Firefox 3.5.5 release fixes some instability issues caused by the 3.5.4 security upgrade. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid42868;...

SuSE 10 Security Update : expat (ZYPP Patch Number 6618)

Specially crafted XML documents could make expat run into an enless loop, therefore locking up applications using expat. CVE-2009-3720 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6656)

The TLS/SSLv3 protocol as implemented in openssl prior to this update was not able to associate data to a renegotiated connection. This allowed man-in-the-middle attackers to inject HTTP requests in a HTTPS session without being noticed. For example Apache's modssl was vulnerable to this kind of...

SuSE 10 Security Update : kdegraphics3-pdf (ZYPP Patch Number 6653)

Specially crafted PDF files could cause buffer overflows in the pdftops filter when printing such a document. CVE-2009-3608: CVSS v2 Base Score: 9.3 CVE-2009-3609: CVSS v2 Base Score: 4. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : xpdf (ZYPP Patch Number 6556)

Specially crafted PDF files could cause buffer overflows in xpdf when viewing such a document. CVE-2009-3603 / CVE-2009-3604 / CVE-2009-3605 / CVE-2009-3606 / CVE-2009-3608 / CVE-2009-3609 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. i...

SuSE 10 Security Update : neon (ZYPP Patch Number 6548)

neon did not properly handle embedded NUL characters in X.509 certificates when comparing host names. Attackers could exploit that to spoof SSL servers. CVE-2009-2408 Specially crafted XML documents that contain a large number of nested entity references could cause neon to consume large amounts ...

SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 6571)

This update of the Apache webserver fixes various security issues : - the option IncludesNOEXEC could be bypassed via .htaccess. CVE-2009-1195 - modproxy could run into an infinite loop when used as reverse proxy. CVE-2009-1890 - moddeflate continued to compress large files even after a network...

SuSE 10 Security Update : libapr (ZYPP Patch Number 6546)

This update of libapr-util1 and libapr1 fixes multiple integer overflows that could probably be used to execute arbitrary code remotely. CVE-2009-2412 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : freeradius (ZYPP Patch Number 6499)

This update of freeradius fixes a remote denial-of-service bug in function raddecode which can be triggered by zero-length Tunnel-Password attributes to make radiusd crash. CVE-2009-3111 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : ethereal (ZYPP Patch Number 5866)

This update fixes problems that could crash wireshark when processing compressed data CVE-2008-3933 and Q.931 packets. CVE-2008-4685 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : strongswan (ZYPP Patch Number 6286)

This update fixes two denial of service bugs that can lead to a remote pre-auth crash while processing a IKESAINIT or a IKEAUTH request. CVE-2009-1957 / CVE-2009-1958 have been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 6470)

This update of gnutls improves the verification of the domain/subject names in a SSL certificate. CVE-2009-2417 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : gstreamer (ZYPP Patch Number 6293)

Specially crafted files could cause integer overflows in the PNG decoding module of GStreamer. CVE-2009-1932 if !definedfunc"nasllevel" || nasllevel = 70000 && nasllevel = 70200 && nasllevel = 80000 && nasllevel 80502 exit0; C Tenable Network Security, Inc. The text description of this plugin is ...

SuSE 10 Security Update : udev (ZYPP Patch Number 6153)

This update fixes a local privilege escalation in udev. - udev did not check the origin of the netlink messages. A local attacker could fake device create events and so gain root privileges. CVE-2009-1185 It also fixes three bugs : - Fixup persistent symlinks for tapes. bnc446534 - Fixup broken A...

SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 5851)

gnutls did not properly verify x509 certificate chains. An attacker could exploit that to trick client programs into trusting servers that would normally get rejected. CVE-2008-4989 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : liblcms (ZYPP Patch Number 6048)

Specially crafted image files could cause an integer overflow in lcms. Attackers could potentially exploit that to crash applications using lcms or even execute arbitrary code. CVE-2009-0723 / CVE-2009-0581 / CVE-2009-0733 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description ...

SuSE 10 Security Update : CUPS (ZYPP Patch Number 6174)

Specially crafted tiff files could cause an integer overflow in the 'imagetops' filter. CVE-2009-0163 Specially crafted pdf files could cause overflows in the 'pdftops' filter. CVE-2009-0165 / CVE-2009-0166 / CVE-2009-0146 / CVE-2009-0147 / CVE-2009-0799 / CVE-2009-0800 / CVE-2009-1179 /...

SuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 5960)

This update brings IBM Java 5 to Service Release 9. It fixes the following security problems : - A security vulnerability in the Java Runtime Environment JRE may allow an untrusted applet or application to list the contents of the home directory of the user running the applet or application...

SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 6035)

A DoS condition in apache2's modproxy has been fixed. CVE-2008-2364 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41473;...

SuSE 10 Security Update : OpenSLP (ZYPP Patch Number 5980)

OpenSLP prior this update does not correctly check the return values of OpenSSL functions. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41569;...