SuSE 10 Security Update : icu (ZYPP Patch Number 6422)

icu does not properly handle invalid byte sequences during Unicode conversion. Remote attackers could potentially exploit that to conduct conduct cross-site scripting XSS attacks. CVE-2009-0153 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell,...

SuSE 10 Security Update : NetworkManager (ZYPP Patch Number 6027)

The NetworkManager configuration was too permissive and allowed any user to read secrets CVE-2009-0365 or manipulate the configuration of other users. CVE-2009-0578 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : audiofile (ZYPP Patch Number 5948)

A heap-overflow in libaudiofile was fixed. The overflow existsed in the WAV processing code and can be exploited to execute arbitrary code. CVE-2008-5824 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : Recommended update for Linux Kernel (x86) (ZYPP Patch Number 5725)

This update fixes lots of bugs in the SUSE Linux Enterprise 10 Service Pack 2 kernel. No security fixes are contained in this round. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : Java Struts (ZYPP Patch Number 6122)

Insufficient quoting of parameters allowed attackers to conduct cross-site scripting XSS attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41590;...

SuSE 10 Security Update : ClamAV (ZYPP Patch Number 6188)

This clamav version upgrade to 0.95.1 fixes a buffer overflow error in the cliurlcanon function and a denial of service condition occuring while parsing malformed UPack archives. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : strongswan (ZYPP Patch Number 5693)

This update of strongswan fixes a denial of service problem that occurs while parsing a IKESAINIT message dursing key exchange. This allows an remote attacker to crash the daemon. CVE-2008-4551 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell,...

SuSE 10 Security Update : compat-curl2 (ZYPP Patch Number 6408)

This update of libcurl2 fixes the 0-character handling in the subject name of a SSL certificate. This bug could be used to execute an undetected man-in-the-middle-attack. CVE-2009-2417 Additionally the arbitrary file access problem was fixed. CVE-2009-0037 %NASLMINLEVEL 70300 C Tenable Network...

SuSE 10 Security Update : libpng (ZYPP Patch Number 6024)

A allocation mistake in libpng's pngread.c has been fixed CVE-2009-0040. The previous update was using an incomplete patch so it needed to be reissued. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : libpng (ZYPP Patch Number 6003)

A allocation mistake in libpng's pngread.c has been fixed. CVE-2009-0040 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid41547;...

SuSE 10 Security Update : Python (ZYPP Patch Number 5837)

Integer Overflows in the python imageop module and in the expandtabs method potentially allowed attackers to execute arbitrary code. CVE-2008-4864 / CVE-2008-5031 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : OpenLDAP2 (ZYPP Patch Number 6485)

This update of openldap2 makes SSL certificate verification more robust against uses of the special character \0 in the subjects name. CVE-2009-2408 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : fetchmail (ZYPP Patch Number 6409)

This update of fetchmail improves SSL certificate validation to stop possible man-in-the-middle attacks by inserting \0-character in the certificate's subject name. CVE-2009-2666 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6296)

OpenSSL DTLS remote DoS in ChangeCipherSpec CVE-2009-1386 and in out-of-sequence message handling CVE-2009-1387 have been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : libxml2 (ZYPP Patch Number 5755)

This update fixes an integer overflow in libxml2 that could lead to memory corruption and arbitrary code execution. CVE-2008-4226 Thanks to: Drew Yao of Apple Product Security %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6267)

Three remote DoS vulnerabilities have been fixed in OpenSSL: a DTLS epoch record buffer memory DoS CVE-2009-1377, a DTLS fragment handling memory DoS CVE-2009-1378 and a DTLS fragment read after a free DoS. CVE-2009-1379 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of...

SuSE 10 Security Update : OpenSC (ZYPP Patch Number 6053)

Private data objects on smartcards initialized with OpenSC could be accessed without authentication. CVE-2009-0368 Only blank cards initialized with OpenSC are affected by this problem. Affected cards need to be manually fixed, updating the opensc package alone is not sufficient! Please carefully...

SuSE 10 Security Update : ipsec-tools (ZYPP Patch Number 6301)

This update of ipsec-tools fixes a crash of racoon in ISAKMP's de-fragmentation code due to a NULL pointer dereference. CVE-2009-1574 Additionally multiple memory leaks were fixed that allowed to execute a remote denial of service attack. CVE-2009-1632 %NASLMINLEVEL 70300 C Tenable Network...

SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 6453)

This update fixes a single critical security issues in the SUSE Linux Enterprise 10 SP 2 kernel. - A missing check in the MSGPROBE handling can be used to execute privileges to root. CVE-2009-2698 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell...

SuSE 10 Security Update : strongswan (ZYPP Patch Number 6286)

This update fixes two denial of service bugs that can lead to a remote pre-auth crash while processing a IKESAINIT or a IKEAUTH request. CVE-2009-1957 / CVE-2009-1958 have been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...