SuSE 10 Security Update : dhcp6 (ZYPP Patch Number 7465)

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server. CVE-2011-0997 %NASLMINLEVEL 70300 C...

SuSE 10 Security Update : popt (ZYPP Patch Number 7792)

Specially crafted RPM packages could have caused memory corruption in rpm when verifying signatures CVE-2011-3378. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

SuSE 10 Security Update : opie (ZYPP Patch Number 7594)

This update fixes off-by-one errors in opiesu CVE-2011-2489 and missing setuid return value checks in opielogin. CVE-2011-2490 This update also removes the setuid bit from opiesu program. If you rely on the setuid bit on opiesu, add the following line to /etc/permissions.local : /usr/bin/opiesu...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7741)

This update brings Mozilla Firefox to 3.6.22. The purpose of this update is to blacklist the compromised DigiNotar Certificate Authority. For more information read : MFSA 2011-34 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : dbus-1 (ZYPP Patch Number 7592)

This update fixes the security issue that local users could disconnect system daemons from the bus by sending specially crafted messages. CVE-2011-2200 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : subversion (ZYPP Patch Number 7560)

Subversion was updated to fix several security issues : - The moddavsvn Apache HTTPD server module can be crashed though when asked to deliver baselined WebDAV resources. CVE-2011-1752 - The moddavsvn Apache HTTPD server module can trigger a loop which consumes all available memory on the system...

SuSE 10 Security Update : build (ZYPP Patch Number 7395)

The build script uses cpio to extract untrusted rpm packages for bootstrapping virtual machines. cpio is not safe to use for this task, therefore the build script now uses bsdtar instead. CVE-2010-4226 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7442)

IBM Java 5 was updated to SR 12 FP 4 fixing various security issues. For more details, please check the IBM JDK Alerts page : http://www.ibm.com/developerworks/java/jdk/alerts/ %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL...

SuSE 10 Security Update : libapr1 (ZYPP Patch Number 7610)

This update fixes the following security issue : - 693778: unconstrained recursion when processing patterns. CVE-2011-0419 / CVE-2011-1928 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : openssl-certs (ZYPP Patch Number 7719)

This updates includes the latest SSL root certificates trusted by Mozilla as of 2011-08-31. This includes removing the DigiNotar CA. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : libgssapi (ZYPP Patch Number 7541)

This update fixes insecure getenv usage, which could be used under some circumstances by local attackers do gain root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : rdesktop (ZYPP Patch Number 7525)

The following bug has been fixed : - A malicious server could access any file on clients connecting to it if the client shared some ressource. CVE-2011-1595 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : wireshark (ZYPP Patch Number 7500)

This update to wireshark version 1.4.5 fixes the following security issues : - Resource Management Errors. CWE-399, CVE-2011-1590 - Buffer Errors. CWE-119, CVE-2011-1591 - Numeric Errors CWE-189, CVE-2011-1592 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugi...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7462)

Malicious clients could have downgraded a connection to a low strength cipher suite on session resumption if the server offers such ciphers CVE-2010-4180. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : radvd (ZYPP Patch Number 7824)

This update of radvd fixes multiple buffer overread flaws in the processra function that could have potentially lead to crashes CVE-2011-3604. Additionally, a temporary Denial of Service flaw that could be triggered with a flood of NDROUTERSOLICIT has been fixed. CVE-2011-3605 %NASLMINLEVEL 70300...

SuSE 10 Security Update : pidgin, libpurple and finch (ZYPP Patch Number 7827)

This update fixes the following security issues : - 604225: MSN emoticon DoS. CVE-2010-1624 - 648273: multiple NULL pointer dereference weaknesses. CVE-2010-3711 - 722199: vulnerability in SILC protocol handling CVE-2011-3594 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text descripti...

SuSE 10 Security Update : pam (ZYPP Patch Number 7814)

The pamenv module is vulnerable to a stack overflow CVE-2011-3148 and a DoS condition CVE-2011-3149 when parsing users .pamenvironment files. Additionally a missing return value check inside pamxauth has been fixed. CVE-2010-3316 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7713)

Mozilla Firefox was updated to version 3.6.20. It fixes bugs and security issues. Following security issues were fixed: Mozilla Foundation Security Advisory 2011-30 - MFSA 2011-30 - Miscellaneous memory safety hazards Mozilla developers and community members identified and fixed several memory...

SuSE 10 Security Update : ruby (ZYPP Patch Number 7528)

This update improves the handling of big decimal integers. Prior to this update, a bug in VpMemAlloc could cause a denial of service situation or even lead to arbitrary code execution. CVE-2011-0188 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : foomatic-filters (ZYPP Patch Number 7677)

The foomatic print filters of the hplip package contained a remote code execution vulnerability. Remote users, if allowed to access a print server such as CUPS, could execute arbitrary commands as lp system user. CVE-2011-2697: CVSS v2 Base Score: 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P: Input Validation...