SuSE 10 Security Update : cpio (ZYPP Patch Number 4184)

This update fixes a bug in function safernamesuffix of cpio which leads to a crashing stack. Exploitability is unknown. CVE-2007-4476 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; i...

SuSE 10 Security Update : apache2-mod_python (ZYPP Patch Number 4449)

This update fixes a buffer overflow in apache2-modpython that occurs while using python-based output-filter. This bug can be triggered remotely to read possibly confidential data from the process space of the web-server and in rare cases to execute arbitrary code. CVE-2004-2680 %NASLMINLEVEL 7030...

SuSE 10 Security Update : xpdf (ZYPP Patch Number 4644)

A buffer overflow in xpdf could be exploited by attackers to potentially execute arbitrary code. CVE-2007-4352 / CVE-2007-5392 / CVE-2007-5393 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : libpng (ZYPP Patch Number 4627)

Speciall crafted png files could crash applications when attempting to open such a file. CVE-2007-5269 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29509;...

SuSE 10 Security Update : pam_ldap (ZYPP Patch Number 2196)

pamldap in nssldap does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pamauthenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver. CVE-2006-5170...

SuSE 10 Security Update : vim and gvim (ZYPP Patch Number 4095)

This update of Vim addresses a format-string bug in 'helptags'. This bug can be exploited to execute code with the privileges of the user running Vim. CVE-2007-2953 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : openCryptoki (ZYPP Patch Number 4244)

The openCryptoki crypto framework package has been updated to fix a incorrect crypto initialisation which leads to weak IV initial vectors. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 2048)

Several security problems have been fixed in ImageMagick : - Several heap buffer overflow were found in the Sun Bitmap decoder of ImageMagick by an audit by the Google Security Team. This problem could be exploited by an attacker to execute code. CVE-2006-3744 - Multiple buffer overflows were fou...

SuSE 10 Security Update : htdig (ZYPP Patch Number 4761)

A flaw in the htsearch Program could be exploited by attackers to conduct cross-site scripting XSS attacks. CVE-2007-6110 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 4542)

The IBM Java JRE/SDK has been brought to release 1.4.2 SR9, containing several bugfixes, including the following security fixes : - A buffer overflow vulnerability in the image parsing code in the JavaTM Runtime Environment may allow an untrusted applet or application to elevate its privileges. F...

SuSE 10 Security Update : gpg (ZYPP Patch Number 2994)

When printing a text stream with a GPG signature it was possible for an attacker to create a stream with 'unsigned text, signed text' where both unsigned and signed text would be shown without distinction which one was signed and which part wasn't. This is tracked by the Mitre CVE ID CVE-2007-126...

SuSE 10 Security Update : Qt (ZYPP Patch Number 2187)

Multiple integer overflows have been found in image processing functions within the QT library. These could potentially lead to heap overflows and code execution. CVE-2006-4811 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Mono (ZYPP Patch Number 4453)

This update fixes a buffer overflow in Mono's BigInteger implementation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29389; scriptversion"1.17";...

SuSE 10 Security Update : squid (ZYPP Patch Number 2502)

This update fixes a remotely exploitable denial-of-service bug in squid, that can be triggered by using special ftp:// URLs. CVE-2007-0247 The packages are not vulnerable to a bug in external ACLs. CVE-2007-0248 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this...

SuSE 10 Security Update : KDE (ZYPP Patch Number 4433)

Users could log in as root without having to enter the password if auto login was enabled and if kdm was configured to require the root passwort to shutdown the system. CVE-2007-4569 JavaScript code could modify the URL in the address bar to make the currently displayed website appear to come fro...

SuSE 10 Security Update : dhcp-server (ZYPP Patch Number 2437)

A bug was fixed were a LDAP server with malicious data providing information to the DHCP server could crash and potentially execute code as the DHCP server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : libpng (ZYPP Patch Number 3740)

Applications using libpng can crash if libpng is ask to process a grayscale image with a malformed bad CRC tRNS chunk. CVE-2007-2445 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : Xorg X11 (ZYPP Patch Number 3083)

Integer overflows in the XC-MISC extension of the X-server could potentially be exploited to execute code with root privileges. CVE-2007-1003 Integer overflows in libx11 could cause crashes. CVE-2007-1667 Integer overflows in the font handling of the X-server could potentially be exploited to...

SuSE 10 Security Update : krb5-apps-servers and krb5-apps-clients (ZYPP Patch Number 1938)

Various return checks of setuid and seteuid calls have been fixed in kerberos client and server applications. If these applications are setuid, it might have been possible for local attackers to gain root access. CVE-2006-3083 We are not affected by the seteuid problems, tracked by CVE-2006-3084...

SuSE 10 Security Update : gpg2 (ZYPP Patch Number 1834)

It is possible to crash denial of service the GNU Privacy Guard gpg by supplying a specifically crafted message specifying a very large UID, which leads to an out of memory situation or an integer overflow. It is unclear if this problem can be exploited to execute code. This issue is tracked by t...