SuSE 10 Security Update : IBM Java (ZYPP Patch Number 6380)

The IBM JRE/JDK version 5 was updated to Service Release 10. It fixes a number of bugs and likely also several security issues. As usual IBM does not publish fixed security issues on the release date so a detailed list cannot be given at this time. Please check...

SuSE 10 Security Update : libpng (ZYPP Patch Number 6003)

A allocation mistake in libpng's pngread.c has been fixed. CVE-2009-0040 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41547;...

SuSE 10 Security Update : libsoup (ZYPP Patch Number 6223)

Large strings could lead to a heap overflow in the base64 encoding and decoding functions. Attackers could potentially exploit that to execute arbitrary code. CVE-2009-0585 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Mono (ZYPP Patch Number 6353)

The XML signature checker did not impose limits on the minimum length of HMAC signatures in XML documents. Attackers could therefore specify a length of e.g. 1 to make the signature appear valid and therefore effectively bypass verification of XML documents. %NASLMINLEVEL 70300 C Tenable Network...

SuSE 10 Security Update : ethereal (ZYPP Patch Number 6269)

Version upgrade to Wireshark 1.0.7 to fix various vulnerabilities : - crash while loading a Tektronix .rf5 file CVE-2009-1268: crash in Check Point High-Availability Protocol CPHAP dissector CVE-2009-1267: LDAP dissector could crash on Windows CVE-2009-1210: PROFINET format string bug...

SuSE 10 Security Update : xterm (ZYPP Patch Number 5898)

XTerm evaluated various ANSI Escape sequences so that command execution was possible if an attacker could pipe raw data to an xterm. CVE-2008-2383 It is usually not recommended to display raw data on an xterm. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugi...

SuSE 10 Security Update : Python (ZYPP Patch Number 5837)

Integer Overflows in the python imageop module and in the expandtabs method potentially allowed attackers to execute arbitrary code. CVE-2008-4864 / CVE-2008-5031 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : CUPS (ZYPP Patch Number 5296)

specially crafted PNG files could cause an integer overflow in the png filter. CVE-2008-1693 - specially crafted pdf files with embedded fonts could crash pdftops. CVE-2008-1693 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : strongswan (ZYPP Patch Number 6116)

By sending a specially crafted Dead Peer Detection DPD packet remote attackers could crash the pluto IKE daemon. CVE-2009-0790 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : openswan (ZYPP Patch Number 6328)

Two vulnerabilities in the openswan ASN.1 parser when handling RDNs, UTCTIME and GENERALIZEDTIME strings could lead to remote crashes of the pluto daemon. CVE-2009-2185 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : NetworkManager (ZYPP Patch Number 6027)

The NetworkManager configuration was too permissive and allowed any user to read secrets CVE-2009-0365 or manipulate the configuration of other users. CVE-2009-0578 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Cyrus IMAPD (ZYPP Patch Number 6476)

This update of cyrus-imapd fixes a buffer overflow that occurs in snprintf due to incorrectly calculating the size of the destination buffer. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : knetworkmanager (ZYPP Patch Number 6026)

The knetworkmanager configuration was too permissive and allowed any user to read secrets. CVE-2009-0365 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41471;...

SuSE 10 Security Update : bind (ZYPP Patch Number 6382)

Specially crafted ddns update packets could trigger an exception in bind causing it to exit. The attack works if BIND is master for a zone even if ddns is not configured. CVE-2009-0696 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : libapr-util1 (ZYPP Patch Number 6289)

This update of libapr-util1 fixes a memory consumption bug in the XML parser that can cause a remote denial-of-service vulnerability in applications using APR WebDAV for example CVE-2009-1955. Additionally a one byte buffer overflow in function aprbrigadevprintf CVE-2009-1956 and buffer underflow...

SuSE 10 Security Update : clamav (ZYPP Patch Number 5769)

Various bugs such as a getunicodename off-by-one buffer overflow, a bug in URL parsing of phishing checks as well as minor other issues have been fixed in clamav. CVE-2008-5050 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : netatalk (ZYPP Patch Number 5983)

This update of netatalk adds a filter for characters of user-supplied data to papd. Prior to this update it was possible to execute arbitrary shell commands remotely. CVE-2008-5718 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : xntp (ZYPP Patch Number 6072)

ntp didn't properly check the return value of the openssl function EVPVerifyFinal. CVE-2009-0021 Additionally a problem where ntpd refused to use keys from /etc/ntp.keys has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : libpng (ZYPP Patch Number 6024)

A allocation mistake in libpng's pngread.c has been fixed CVE-2009-0040. The previous update was using an incomplete patch so it needed to be reissued. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6296)

OpenSSL DTLS remote DoS in ChangeCipherSpec CVE-2009-1386 and in out-of-sequence message handling CVE-2009-1387 have been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...