SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 6647)

IBM Java 1.4.2 was updated to Service Refresh 13 Fixpack 2 At least following security issues are fixed by this update: CVE-2009-1100: A vulnerability in the Java Runtime Environment JRE with storing temporary font files might allow an untrusted applet or application to consume a disproportionate...

SuSE 10 Security Update : pango (ZYPP Patch Number 6800)

A long glyph string can trigger a heap-based buffer overflow in pango. CVE-2009-1194 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid49911; scriptversion"1.11";...

SuSE 10 Security Update : gzip (ZYPP Patch Number 6793)

The following bug has been fixed : Specially crafted gzip archives could trigger integer overflows. Attackers could exploit that to crash gzip or potentially execute arbitrary code CVE-2010-0001. Only 64bit architectures are affected by this flaw. %NASLMINLEVEL 70300 C Tenable Network Security,...

SuSE 10 Security Update : clamav (ZYPP Patch Number 6990)

Specially crafted CAB archives could crash clamav CVE-2010-1311 or bypass virus detection CVE-2010-0098. clamav has been updated to version 0.96 which fixes those issues. Citing freshmeat.net : This Release introduces new malware detection mechanisms and other significant improvements to the scan...

SuSE 10 Security Update : iscsitarget (ZYPP Patch Number 7109)

This update of iscscitarget/tgt fixes multiple overflows and a format string vulnerability : - CVE-2010-2221: CVSS v2 Base Score: 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:N/A:P: Buffer Errors CWE-119 - CVE-2010-0743: CVSS v2 Base Score: 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:N/A:P: Format String Vulnerability...

SuSE 10 Security Update : IBM Java 1.5.0 (ZYPP Patch Number 7077)

This update of IBM Java 1.5.0 to SR11 FP2 to fixes the following security issues : - Various unspecified and undocumented vulnerabilities that allows remote attackers to affect confidentiality, integrity and availability via various unknown vectors. CVE-2010-0084 / CVE-2010-0085 / CVE-2010-0087 /...

SuSE 10 Security Update : Mozilla NSS (ZYPP Patch Number 6978)

Mozilla NSS was updated to version 3.12.6. This fixes all currently known issues in mozilla-nss, and also implements the new TLS/SSL renegotiation handling. CVE-2009-3555 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6655)

The TLS/SSLv3 protocol as implemented in openssl prior to this update was not able to associate data to a renegotiated connection. This allowed man-in-the-middle attackers to inject HTTP requests in a HTTPS session without being noticed. For example Apache's modssl was vulnerable to this kind of...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6944)

This update adds support for RFC5746 TLS renegotiations to address vulnerabilities tracked as CVE-2009-3555. It also fixes a mishandling of OOM conditions in bnwexpand. CVE-2009-3245 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6768)

The following bugs have been fixed : An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. CVE-2009-4136 Embedded null bytes in the common na...

SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6535)

Multiple security vulnerabilities have been fixed in PostgrSQL - allows remote authenticated users to cause a denial of service. CVE-2009-3229 - allows remote authenticated users to gain higher privileges. CVE-2009-3230 - when using LDAP authentication with anonymous binds, allows remote attacker...

SuSE 10 Security Update : the Linux kernel (ZYPP Patch Number 7133)

This SUSE Linux Enterprise 10 SP3 kernel update contains several bug fixes and fixes for the following security issues : - the stack of a process could grow into other mapped areas, therefore overwriting memory instead of terminating the process. CVE-2010-2240 - specially crafted requests could...

SuSE 10 Security Update : tar (ZYPP Patch Number 6922)

A malicious remote tape server could cause a buffer overflow in tar. In order to exploit that an attacker would have to trick the victim to extract a file that causes tar to open a connection to the rmt server CVE-2010-0624. It's advisable to always use tar's -force-local local option to avoid su...

SuSE 10 Security Update : sendmail (ZYPP Patch Number 6860)

This update of sendmail improves the handling of special-characters in the SSL certificate. CVE-2009-4565: CVSS v2 Base Score: 7.5 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : mutt (ZYPP Patch Number 6673)

This update improves the handling of SSL certificates and fixes a minor usability bug introduced with the last security update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : ethereal (ZYPP Patch Number 6628)

Update of wireshark to fix multiple vulnerabilities : - The Paltalk dissector could crash on alignment-sensitive processors. CVE-2009-3549: CVSS v2 Base Score: 5.0 MEDIUM - The DCERPC/NT dissector could crash. CVE-2009-3550: CVSS v2 Base Score: 4.3 MEDIUM - The SMB dissector could crash...

SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 6572)

This update of the Apache webserver fixes various security issues : - the option IncludesNOEXEC could be bypassed via .htaccess. CVE-2009-1195 - modproxy could run into an infinite loop when used as reverse proxy. CVE-2009-1890 - moddeflate continued to compress large files even after a network...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 6666)

The Mozilla Firefox 3.5.5 release fixes some instability issues caused by the 3.5.4 security upgrade. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid49888;...

SuSE 10 Security Update : ethereal (ZYPP Patch Number 6890)

This update of ethereal fixes : - Several buffer overflows in the LWRES dissector. CVE-2010-0304 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid49846;...

SuSE 10 Security Update : freetype2 (ZYPP Patch Number 7168)

When loading specially crafted font files applications linked against freetype2 could crash or potentially even execute arbitrary code CVE-2010-3311 / CVE-2010-3053 / CVE-2010-3054. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...