SuSE 10 Security Update : DHCP (ZYPP Patch Number 5975)

This update contains a backported patch from dhcp-3.0.7 to fix a buffer overflow which could lead to a denial-of-service condition in cases when the dhcp server is configured to send many DHCP options to clients. CVE-2007-0062 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : audiofile (ZYPP Patch Number 5948)

A heap-overflow in libaudiofile was fixed. The overflow existsed in the WAV processing code and can be exploited to execute arbitrary code. CVE-2008-5824 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : NetworkManager (ZYPP Patch Number 6027)

The NetworkManager configuration was too permissive and allowed any user to read secrets CVE-2009-0365 or manipulate the configuration of other users. CVE-2009-0578 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : strongswan (ZYPP Patch Number 5693)

This update of strongswan fixes a denial of service problem that occurs while parsing a IKESAINIT message dursing key exchange. This allows an remote attacker to crash the daemon. CVE-2008-4551 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell,...

SuSE 10 Security Update : libsoup (ZYPP Patch Number 6223)

Large strings could lead to a heap overflow in the base64 encoding and decoding functions. Attackers could potentially exploit that to execute arbitrary code. CVE-2009-0585 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Java Struts (ZYPP Patch Number 6122)

Insufficient quoting of parameters allowed attackers to conduct cross-site scripting XSS attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41590;...

SuSE 10 Security Update : icu (ZYPP Patch Number 6422)

icu does not properly handle invalid byte sequences during Unicode conversion. Remote attackers could potentially exploit that to conduct conduct cross-site scripting XSS attacks. CVE-2009-0153 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell,...

SuSE 10 Security Update : libpng (ZYPP Patch Number 6003)

A allocation mistake in libpng's pngread.c has been fixed. CVE-2009-0040 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41547;...

SuSE 10 Security Update : ethereal (ZYPP Patch Number 6443)

Flaws in the AFS dissector allowed attackers to crash ethereal via specially crafted network traffic. CVE-2009-2562 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : hal (ZYPP Patch Number 6036)

The dbus package used a too permissive configuration. Therefore intended access control for some services was not applied. CVE-2008-4311 The new configuration denies access by default. Some dbus services may break due to this setting and need an updated configuration as well. Additionally a bug i...

SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6114)

Remote authenticated users could crash the postgresql server by requesting a conversion with an inappropriate encoding. CVE-2009-0922 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; i...

SuSE 10 Security Update : OpenSC (ZYPP Patch Number 6053)

Private data objects on smartcards initialized with OpenSC could be accessed without authentication. CVE-2009-0368 Only blank cards initialized with OpenSC are affected by this problem. Affected cards need to be manually fixed, updating the opensc package alone is not sufficient! Please carefully...

SuSE 10 Security Update : Python (ZYPP Patch Number 5837)

Integer Overflows in the python imageop module and in the expandtabs method potentially allowed attackers to execute arbitrary code. CVE-2008-4864 / CVE-2008-5031 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Emacs (ZYPP Patch Number 5297)

Xemacs automatically loaded fast-lock files which allowed local attackers to execute arbitrary code as the user editing the associated files. CVE-2008-2142 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 6136)

This update brings the IBM Java 1.4.2 JDK and JRE to Service Release 13. It fixes lots of bugs and various %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL 3000 exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : Recommended update for Linux Kernel (x86) (ZYPP Patch Number 5725)

This update fixes lots of bugs in the SUSE Linux Enterprise 10 Service Pack 2 kernel. No security fixes are contained in this round. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : openswan (ZYPP Patch Number 6478)

The previous fix for a flaw in the ASN.1 parser was incomplete and had to be reworked. CVE-2009-2661 This could lead to crashes of the pluto IKE daemon. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : MySQL (ZYPP Patch Number 6446)

the COMCREATEDB and COMDROPDB suffered from format string vulnerabilities. CVE-2009-2446 - the command line client was prone to cross-site scripting XSS attacks. CVE-2008-4456 Additionally a problem that sometimes prevented slave hosts from reconnecting to the master server has been fixed...

SuSE 10 Security Update : IBM Java (ZYPP Patch Number 6380)

The IBM JRE/JDK version 5 was updated to Service Release 10. It fixes a number of bugs and likely also several security issues. As usual IBM does not publish fixed security issues on the release date so a detailed list cannot be given at this time. Please check...

SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5235)

This kernel update fixes the following security problems : - tunneled ipv6 packets SIT could trigger a memory leak in the kernel. Remote attackers could exploit that to crash machines. CVE-2008-2136 Additionally the following bugfixes have been included for all platforms : -...