SuSE 10 Security Update : xterm (ZYPP Patch Number 5898)

XTerm evaluated various ANSI Escape sequences so that command execution was possible if an attacker could pipe raw data to an xterm. CVE-2008-2383 It is usually not recommended to display raw data on an xterm. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugi...

SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 6073)

The previous security fix for gnutls CVE-2008-4989 introduced a regression in the X.509 validation code for self-signed certificates. This update fixes this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : yast2-backup (ZYPP Patch Number 5760)

This updated of yast2-backup fixes a sellcode injection vulnerability and improves handling of symlinks for the backup process. CVE-2008-4636 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : libpng (ZYPP Patch Number 6024)

A allocation mistake in libpng's pngread.c has been fixed CVE-2009-0040. The previous update was using an incomplete patch so it needed to be reissued. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : libpng (ZYPP Patch Number 6003)

A allocation mistake in libpng's pngread.c has been fixed. CVE-2009-0040 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41547;...

SuSE 10 Security Update : CUPS (ZYPP Patch Number 6279)

The 'pdftops' was prone to several integer overflows CVE-2009-0791. The cups daemon could crash when receiving IPP requests with multiple unsupported tags. CVE-2009-0949 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : dbus (ZYPP Patch Number 5969)

The dbus package used a too permissive configuration. Therefore intended access control for some services was not applied. CVE-2008-4311 The new configuration denies access by default. Some dbus services may break due to this setting and need an updated configuration as well. %NASLMINLEVEL 70300 ...

SuSE 10 Security Update : strongswan (ZYPP Patch Number 6116)

By sending a specially crafted Dead Peer Detection DPD packet remote attackers could crash the pluto IKE daemon. CVE-2009-0790 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : fetchmail (ZYPP Patch Number 6409)

This update of fetchmail improves SSL certificate validation to stop possible man-in-the-middle attacks by inserting \0-character in the certificate's subject name. CVE-2009-2666 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : net-snmp (ZYPP Patch Number 5807)

Remote attackers could crash net-snmp via GETBULK-Request. CVE-2008-4309 In addition the following non-security issues have been fixed : - typo in error message. bnc439857 - fix duplicate registration warnings on startup. bnc326957 - container insert errors reproducable with shared ip setups...

SuSE 10 Security Update : dbus (ZYPP Patch Number 5701)

This update fixes a denial of service bug in dbus. CVE-2008-3834 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid35034; scriptversion"1.18";...

SuSE 10 Security Update : Samba (ZYPP Patch Number 5819)

Malicious clients could potentially retrieve arbitrary memory content from a samba server. CVE-2008-4314 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid35025;...

SuSE 10 Security Update : yast2-backup (ZYPP Patch Number 5739)

This updated of yast2-backup fixes a shellcode injection vulnerability and improves handling of symlinks for the backup process. CVE-2008-4636 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : clamav (ZYPP Patch Number 5768)

Various bugs such as a getunicodename off-by-one buffer overflow, a bug in URL parsing of phishing checks as well as minor other issues have been fixed in clamav. CVE-2008-5050 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 5746)

The acroread package was update to fix several security vulnerabilities in the JavaScript engine. CVE-2008-2992 / CVE-2008-2549 / CVE-2008-4812 / CVE-2008-4813 / CVE-2008-4817 / CVE-2008-4816 / CVE-2008-4814 / CVE-2008-4815 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description...

SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5786)

This update brings the Mozilla Firefox browser to version 2.0.0.18. It fixes following security issues : - The http-index-format MIME type parser nsDirIndexParser in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure,...

SuSE 10 Security Update : libxml2 (ZYPP Patch Number 5756)

This update fixes an integer overflow in libxml2 that could lead to memory corruption and arbitrary code execution. CVE-2008-4226 Thanks to: Drew Yao of Apple Product Security %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 5740)

This update fixes an integer overflow in the WMF handler CVE-2008-2237 and multiple bugs in the EMF parser CVE-2008-2238. Additionally multiple non-security bugs were fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 5767)

Missing sanity checks of FTP URLs allowed cross-site scripting XSS attacks via the modprodyftp module. CVE-2008-2939 Missing precautions allowed cross-site request forgery CSRF via the modproxybalancer interface. CVE-2007-6420 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : MySQL (ZYPP Patch Number 5618)

Empty bit-strings in a query could crash the MySQL server. CVE-2008-3963 Due to another flaw users could access tables of other users. CVE-2008-4097 / CVE-2008-4098 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL 3000 exit0;...