SuSE 10 Security Update : compat-curl2 (ZYPP Patch Number 6408)

This update of libcurl2 fixes the 0-character handling in the subject name of a SSL certificate. This bug could be used to execute an undetected man-in-the-middle-attack. CVE-2009-2417 Additionally the arbitrary file access problem was fixed. CVE-2009-0037 %NASLMINLEVEL 70300 C Tenable Network...

SuSE 10 Security Update : Java Struts (ZYPP Patch Number 6122)

Insufficient quoting of parameters allowed attackers to conduct cross-site scripting XSS attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41590;...

SuSE 10 Security Update : hal (ZYPP Patch Number 6036)

The dbus package used a too permissive configuration. Therefore intended access control for some services was not applied. CVE-2008-4311 The new configuration denies access by default. Some dbus services may break due to this setting and need an updated configuration as well. Additionally a bug i...

SuSE 10 Security Update : poppler (ZYPP Patch Number 6315)

This update of poppler: fix various security bugs that occur while decoding JBIG2. CVE-2009-0146 / CVE-2009-0147 / CVE-2009-0165 / CVE-2009-0166 / CVE-2009-0799 / CVE-2009-0800 / CVE-2009-1179 / CVE-2009-1180 / CVE-2009-1181 / CVE-2009-1182 / CVE-2009-1183 Further a denial of service bug in...

SuSE 10 Security Update : ClamAV (ZYPP Patch Number 6188)

This clamav version upgrade to 0.95.1 fixes a buffer overflow error in the cliurlcanon function and a denial of service condition occuring while parsing malformed UPack archives. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : strongswan (ZYPP Patch Number 5693)

This update of strongswan fixes a denial of service problem that occurs while parsing a IKESAINIT message dursing key exchange. This allows an remote attacker to crash the daemon. CVE-2008-4551 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell,...

SuSE 10 Security Update : postgresql-pl (ZYPP Patch Number 6208)

Due to tight package dependencies postgresql-pl has to be updated to match the recently released postgresql packages. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6267)

Three remote DoS vulnerabilities have been fixed in OpenSSL: a DTLS epoch record buffer memory DoS CVE-2009-1377, a DTLS fragment handling memory DoS CVE-2009-1378 and a DTLS fragment read after a free DoS. CVE-2009-1379 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of...

SuSE 10 Security Update : ethereal (ZYPP Patch Number 5866)

This update fixes problems that could crash wireshark when processing compressed data CVE-2008-3933 and Q.931 packets. CVE-2008-4685 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : strongswan (ZYPP Patch Number 6286)

This update fixes two denial of service bugs that can lead to a remote pre-auth crash while processing a IKESAINIT or a IKEAUTH request. CVE-2009-1957 / CVE-2009-1958 have been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 6470)

This update of gnutls improves the verification of the domain/subject names in a SSL certificate. CVE-2009-2417 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : gstreamer (ZYPP Patch Number 6293)

Specially crafted files could cause integer overflows in the PNG decoding module of GStreamer. CVE-2009-1932 if !definedfunc"nasllevel" || nasllevel = 70000 && nasllevel = 70200 && nasllevel = 80000 && nasllevel 80502 exit0; C Tenable Network Security, Inc. The text description of this plugin is ...

SuSE 10 Security Update : udev (ZYPP Patch Number 6153)

This update fixes a local privilege escalation in udev. - udev did not check the origin of the netlink messages. A local attacker could fake device create events and so gain root privileges. CVE-2009-1185 It also fixes three bugs : - Fixup persistent symlinks for tapes. bnc446534 - Fixup broken A...

SuSE 10 Security Update : OpenLDAP2 (ZYPP Patch Number 6485)

This update of openldap2 makes SSL certificate verification more robust against uses of the special character \0 in the subjects name. CVE-2009-2408 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 5851)

gnutls did not properly verify x509 certificate chains. An attacker could exploit that to trick client programs into trusting servers that would normally get rejected. CVE-2008-4989 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : liblcms (ZYPP Patch Number 6048)

Specially crafted image files could cause an integer overflow in lcms. Attackers could potentially exploit that to crash applications using lcms or even execute arbitrary code. CVE-2009-0723 / CVE-2009-0581 / CVE-2009-0733 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description ...

SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 6136)

This update brings the IBM Java 1.4.2 JDK and JRE to Service Release 13. It fixes lots of bugs and various %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL 3000 exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : Emacs (ZYPP Patch Number 5297)

Xemacs automatically loaded fast-lock files which allowed local attackers to execute arbitrary code as the user editing the associated files. CVE-2008-2142 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : MySQL (ZYPP Patch Number 6446)

the COMCREATEDB and COMDROPDB suffered from format string vulnerabilities. CVE-2009-2446 - the command line client was prone to cross-site scripting XSS attacks. CVE-2008-4456 Additionally a problem that sometimes prevented slave hosts from reconnecting to the master server has been fixed...

SuSE 10 Security Update : vim (ZYPP Patch Number 6025)

The VI Improved editor vim received bugfixes for some code execution problems. - Arbitrary code execution in vim helper plugins filetype.vim, zipplugin, xpm.vim, gzipvim, and netrw were fix ed. CVE-2008-4101: Arbitrary code execution when pressing K, ctrl- or g depending on the text under the...