SuSE 10 Security Update : kdegraphics (ZYPP Patch Number 7235)

Various pointer dereferencing vulnerabilities in kdegraphics3's KSVG have been fixed. CVE-2009-1709 / CVE-2009-0945 have been assigned to this issue. Also specially crafted PDF files could crash kpdf or potentially even cause execution of arbitrary code. CVE-2010-3702 / CVE-2010-3703 /...

SuSE 10 Security Update : kdelibs (ZYPP Patch Number 7217)

An invalid character reference causing a buffer overflow in khtml has been fixed in the kdelibs package. CVE-2009-1725 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL 3000 exit0;...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 7221)

The following issues have been fixed : - Insufficient handling of certain character sequences in the utf8decode function could be leveraged to conduct cross-site scripting XSS attacks. CVE-2010-3870 - php5 could also consume large amounts of memory and crash if a long mail address was passed to...

SuSE 10 Security Update : IBM Java 5 (ZYPP Patch Number 7205)

This update brings IBM Java 5 to Service Release 12 Fixpack 2. It fixes quite a large number of security problems and other bugs. The security issues are tracked by the following CVE ids: CVE-2009-3555 / CVE-2010-1321 / CVE-2010-3541 / CVE-2010-3548 / CVE-2010-3549 / CVE-2010-3550 / CVE-2010-3551...

SuSE 10 Security Update : libxml2 (ZYPP Patch Number 7214)

libxml2: Invalid memory access in the xpath handling has been fixed. CVE-2010-4008 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : libpoppler (ZYPP Patch Number 7192)

Specially crafted PDF files could crash poppler or potentially even cause execution of arbitrary code. CVE-2010-3702 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : quagga (ZYPP Patch Number 7237)

This update of quagga fixes two security issues : - Stack-based buffer overflow while processing malformed Route-Refresh messages. CVE-2010-2948: CVSS v2 Base Score: 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P - Denial of service while processing malformed BGP update AS path messages. CVE-2010-2949: CV...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7174)

Specially crafted responses from SSL servers could cause a double-free bug in openssl's client implementation. Malicious servers could exploit that to crash programs use openssl for the SSL connection CVE-2010-2939. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The tex...

SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 7186)

PostgreSQL functions implemented in Perl or TCL shared a global state even across different user user ids. A user could therefore influence functions of other users in an unexpected or even malicious way. CVE-2010-3433 PostgreSQL was updated to version 8.1.22 which fixes the security issue...

SuSE 10 Security Update : CUPS (ZYPP Patch Number 6721)

Specially crafted PDF files could cause buffer overflows in the pdftops filter when printing such a document. CVE-2009-3609 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : clamav (ZYPP Patch Number 6990)

Specially crafted CAB archives could crash clamav CVE-2010-1311 or bypass virus detection CVE-2010-0098. clamav has been updated to version 0.96 which fixes those issues. Citing freshmeat.net : This Release introduces new malware detection mechanisms and other significant improvements to the scan...

SuSE 10 Security Update : MySQL (ZYPP Patch Number 6899)

This update fixes various security issues bnc557669 : upstream 47320 - checking server certificates CVE-2009-4028 upstream 48291 - error handling in subqueries CVE-2009-4019 upstream 47780 - preserving nullvalue flag in GeomFromWKB CVE-2009-4019 upstream 39277 - symlink behaviour fixed...

SuSE 10 Security Update : avahi (ZYPP Patch Number 6790)

The avahi-daemon reflector could cause packet storms when reflecting legacy unicast mDNS traffic CVE-2009-0758. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : netpbm (ZYPP Patch Number 6852)

This update of netpbm fxes a stack-based buffer overflow that could be triggered while processing the contents of XPM headers in image files. CVE-2009-4274: CVSS v2 Base Score: 5.8 moderate AV:N/AC:M/Au:N/C:N/I:P/A:P: Buffer Errors CWE-119 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

SuSE 10 Security Update : bzip2 (ZYPP Patch Number 7169)

This update fixes an integer overflow in the BZ2decompress function of bzip2/libbz2. This can be exploited via a crafted archive to cause a denial of service or even execute arbitrary code. CVE-2010-0405 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : pyxml (ZYPP Patch Number 6715)

Specially crafted XML documents could make pyxml run into an enless loop, therefore locking up applications using pyxml. CVE-2009-3720 / CVE-2009-3560 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6536)

Multiple issues have been fixed in php5 : - phpopensslapplyverificationpolicy fails to verify certificate. CVE-2009-3291 - 'missing sainity checks around exif'. CVE-2009-3292 - unspecified vulnerability in the imagecolortransparent. CVE-2009-3293 - denial of service in exif module CVE-2009-2687...

SuSE 10 Security Update : w3m (ZYPP Patch Number 7076)

w3m does not handle embedded NUL characters in the common name and in subject alternative names of X.509 certificates CVE-2010-2074. This update fixes the issue and also turns on verification of x509 certificates by default which was not the case before. %NASLMINLEVEL 70300 C Tenable Network...

SuSE 10 Security Update : cpio (ZYPP Patch Number 6948)

This update fixes a heap-based buffer overflow flaw that can happen while expanding specially crafted archive files. CVE-2010-0624 It also contains changes for : fixed Dat160 Tape Drive density information bnc415166 fixed cpio issues with file sizes = 2^32 fixed handling eof and eod marks...

SuSE 10 Security Update : strongswan (ZYPP Patch Number 6529)

The previous fix for a flaw in the ASN.1 parser was incomplete and had to be reworked. CVE-2009-2661 This could lead to crashes of the pluto IKE daemon. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...