SuSE 10 Security Update : vim (ZYPP Patch Number 6025)

The VI Improved editor vim received bugfixes for some code execution problems. - Arbitrary code execution in vim helper plugins filetype.vim, zipplugin, xpm.vim, gzipvim, and netrw were fix ed. CVE-2008-4101: Arbitrary code execution when pressing K, ctrl- or g depending on the text under the...

SuSE 10 Security Update : audiofile (ZYPP Patch Number 5948)

A heap-overflow in libaudiofile was fixed. The overflow existsed in the WAV processing code and can be exploited to execute arbitrary code. CVE-2008-5824 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : libtiff (ZYPP Patch Number 6407)

This update of the tiff package fixes various integer overflows in the tools. CVE-2009-2347 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41553;...

SuSE 10 Security Update : libpng (ZYPP Patch Number 6326)

This update of libpng improves the parsing of 1-bit interlaced images. This bug could be abused to use 'out-of-bounds pixels' to read memory. CVE-2009-2042 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6114)

Remote authenticated users could crash the postgresql server by requesting a conversion with an inappropriate encoding. CVE-2009-0922 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; i...

SuSE 10 Security Update : OpenSC (ZYPP Patch Number 6053)

Private data objects on smartcards initialized with OpenSC could be accessed without authentication. CVE-2009-0368 Only blank cards initialized with OpenSC are affected by this problem. Affected cards need to be manually fixed, updating the opensc package alone is not sufficient! Please carefully...

SuSE 10 Security Update : ia32el (ZYPP Patch Number 6466)

A 32bit x86 user program could crash the Itanium IA64 kernel in the IA 32 Intel 32bit emulation. CVE-2009-2707 Updating IA32EL to 70427022, the same version as shipped on SLES 10 SP3, fixes this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : Kerberos (ZYPP Patch Number 6140)

Clients sending negotiation requests with invalid flags could crash the kerberos server. CVE-2009-0845 GSS-API clients could crash when reading from an invalid address space. CVE-2009-0844 Invalid length checks could crash applications using the kerberos ASN.1 parser. CVE-2009-0847 Under certain...

SuSE 10 Security Update : Linux Kernel (x86) (ZYPP Patch Number 5565)

This kernel security update fixes lots of bugs and some %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41534; scriptversion"1.12";...

SuSE 10 Security Update : undocumented patch for 4acd101addd2ea93972eb5d9389cadf3 (ZYPP Patch Number 5026)

Test update of update-test-security %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41595; scriptversion"1.10";...

SuSE 10 Security Update : pam_mount (ZYPP Patch Number 5911)

This update fixes the temp-flle handling in the passwdehd script that allowed a symlink attack. CVE-2008-5138 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : ipsec-tools (ZYPP Patch Number 6301)

This update of ipsec-tools fixes a crash of racoon in ISAKMP's de-fragmentation code due to a NULL pointer dereference. CVE-2009-1574 Additionally multiple memory leaks were fixed that allowed to execute a remote denial of service attack. CVE-2009-1632 %NASLMINLEVEL 70300 C Tenable Network...

SuSE 10 Security Update : ClamAV (ZYPP Patch Number 5842)

Specially crafted jpg files could crash the clamd daemon of clamav. CVE-2008-5314 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41485; scriptversion"1.11";...

SuSE 10 Security Update : ClamAV (ZYPP Patch Number 6144)

ClamAV update to version 0.95. This also fix some potential security bugs. CVE-2009-1241 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41486;...

SuSE 10 Security Update : openswan (ZYPP Patch Number 6478)

The previous fix for a flaw in the ASN.1 parser was incomplete and had to be reworked. CVE-2009-2661 This could lead to crashes of the pluto IKE daemon. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : NetworkManager-gnome (ZYPP Patch Number 6028)

The NetworkManager configuration was too permissive and allowed any user to read secrets CVE-2009-0365 or manipulate the configuration of other users. CVE-2009-0578 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Ghostscript (ZYPP Patch Number 6066)

Integer overflows and missing upper bounds checks in Ghostscript's ICC library potentially allowed attackers to crash Ghostscript or even cause execution of arbitrary code via specially crafted PS or PDF files. CVE-2009-0583 / CVE-2009-0584 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

SuSE 10 Security Update : curl (ZYPP Patch Number 6015)

Arbitrary file access via HTTP-redirect has been fixed in curl. CVE-2009-0037 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : Websphere Community Edition (ZYPP Patch Number 6312)

This update of WebSphere fixes the following vulnerabilities : - GERONIMO-3838: close potential denial of service attack - fix Apache Geronimo web administration console directory traversal vulnerabilities. CVE-2008-5518 - fix Apache Geronimo web administration console XSS vulnerabilities...

SuSE 10 Security Update : Emacs (ZYPP Patch Number 5297)

Xemacs automatically loaded fast-lock files which allowed local attackers to execute arbitrary code as the user editing the associated files. CVE-2008-2142 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...