SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7740)

This update brings Mozilla Firefox to 3.6.22. The purpose of this update is to blacklist the compromised DigiNotar Certificate Authority. For more information read : MFSA 2011-34 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : tomcat5 (ZYPP Patch Number 7688)

The following security issues were fixed in tomcat : - Fixed a tomcat user password information leak. CVE-2011-2204 - Fixed a tomcat information leak and DoS CVE-2011-2526 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : apache2-mod_auth_mysql (ZYPP Patch Number 7682)

This update of apache2-modauthmysql fixes a possible SQL injection vulnerability that can be exploited using multibyte character encoding. CVE-2008-2384: CVSS v2 Base Score: 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N: SQL Injection. CWE-89 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : ClamAV (ZYPP Patch Number 7661)

New clamav packages fix an off-by-one vulnerability which could lead to a DoS condition. CVE-2011-2721 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

SuSE 10 Security Update : libpng (ZYPP Patch Number 7669)

This update of libpng fixes : - CVE-2008-6218: CVSS v2 Base Score: 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C: Resource Management Errors CWE-399 - CVE-2011-2690: CVSS v2 Base Score: 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P: Buffer Errors CWE-119 - CVE-2011-2692: CVSS v2 Base Score: 5.0 AV:N/AC:M/Au:N/C:N/I:N/A:P:...

SuSE 10 Security Update : libvirt (ZYPP Patch Number 7613)

libvirtd could crash if bogus parameters where passed to the VirDomainGetVcpus call. CVE-2011-2511 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid55850;...

SuSE 10 Security Update : foomatic-filters (ZYPP Patch Number 7676)

The foomatic print filters of the hplip package contained a remote code execution vulnerability. Remote users, if allowed to access a print server such as CUPS, could execute arbitrary commands as lp system user. CVE-2011-2697: CVSS v2 Base Score: 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P: Input Validation...

SuSE 10 Security Update : coreutils (ZYPP Patch Number 7655)

This update of coreutils fixes the following security issue : - 697897: coreutils: when running 'su -c' to execute commands as different user the target user could inject command back into the calling users terminal via the TIOCSTI ioctl. This update also fixes the following non-security issues :...

SuSE 10 Security Update : libsndfile (ZYPP Patch Number 7638)

An integer overflow in libsndfile while processing certain PAF files has been fixed. CVE-2011-2696 has been assigned to this issue. Additionally an divide by zero error CVE-2009-4835 has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : compat-openssl097g (ZYPP Patch Number 7644)

This update adds openssl patches since 2007 for : - CVE-2009-0590 - CVE-2008-5077 - CVE-2009-0789 - CVE-2009-3555 - CVE-2010-4180 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL 3000 exit0; include'deprecatednasllevel.inc';...

SuSE 10 Security Update : opie (ZYPP Patch Number 7595)

This update fixes off-by-one errors in opiesu CVE-2011-2489 and missing setuid return value checks in opielogin. CVE-2011-2490 This update also removes the setuid bit from opiesu program. If you rely on the setuid bit on opiesu, add the following line to /etc/permissions.local : /usr/bin/opiesu...

SuSE 10 Security Update : nagios (ZYPP Patch Number 7624)

The following bug has been fixed : - statusmap.cgi was prone to a cross-site scripting XSS vulnerability. CVE-2011-1523 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : cyrus-imapd (ZYPP Patch Number 7584)

Cyrus-imapd recognized commands before switching to an encrypted channel via STARTTLS. Attackers could potentially exploit that to inject plain text commands. CVE-2011-1926 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7626)

IBM Java 1.6.0 SR9-FP2 fixes several of bugs and thew following security issues : - An unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 6 Update 25 and earlier, 5.0 Update 29 and earlier, and 1.4.231 and earlier allows remote untrusted Java Web Start...

SuSE 10 Security Update : dbus-1 (ZYPP Patch Number 7593)

This update fixes the security issue that local users could disconnect system daemons from the bus by sending specially crafted messages. CVE-2011-2200 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : libapr (ZYPP Patch Number 7611)

This update fixes the following security issues : - 650435: remote DoS in APR. CVE-2010-1623 - 693778: unconstrained recursion when processing patterns. CVE-2011-0419 / CVE-2011-1928 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7602)

This kernel update for the SUSE Linux Enterprise 10 SP3 kernel fixes a regression in the last security update, which due to a version checking mismatch disabled multipath IO support. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7597)

Mozilla Firefox was updated to the 3.6.18 security release. - Miscellaneous memory safety hazards. MFSA 2011-19 / CVE-2011-2374 / CVE-2011-2376 / CVE-2011-2364 / CVE-2011-2365 - bmo617247 Use-after-free vulnerability when viewing XUL document with script disabled. MFSA 2011-20 / CVE-2011-2373 -...

SuSE 10 Security Update : glibc (ZYPP Patch Number 7575)

The following bugs have been fixed : - Specially crafted input to the fnmatch function could cause an integer overflow. CVE-2011-1071 - The output of the 'locale' command was not properly quoted. CVE-2011-1095 - Don't search the current directory if $ORIGIN is in RPATH of libraries called by setu...

SuSE 10 Security Update : libgssapi (ZYPP Patch Number 7544)

This update fixes insecure getenv usage, which could be used under some circumstances by local attackers do gain root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...