SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 5740)

This update fixes an integer overflow in the WMF handler CVE-2008-2237 and multiple bugs in the EMF parser CVE-2008-2238. Additionally multiple non-security bugs were fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 5767)

Missing sanity checks of FTP URLs allowed cross-site scripting XSS attacks via the modprodyftp module. CVE-2008-2939 Missing precautions allowed cross-site request forgery CSRF via the modproxybalancer interface. CVE-2007-6420 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : MySQL (ZYPP Patch Number 5618)

Empty bit-strings in a query could crash the MySQL server. CVE-2008-3963 Due to another flaw users could access tables of other users. CVE-2008-4097 / CVE-2008-4098 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL 3000 exit0;...

SuSE 10 Security Update : enscript (ZYPP Patch Number 5715)

This update of enscript fixes buffer overflows in the setfilename CVE-2008-3863, processfile and readspecialescape function that can be exploited during file processing. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : IBM Java 5 (ZYPP Patch Number 5662)

IBM Java 5 was updated to SR8a to fix a security issue : - A vulnerability in the Java Management Extensions JMX agent when local monitoring is enabled, allowed remote attackers to 'perform unauthorized operations'. CVE-2008-3103 This update also includes new timezone data and fixes missing...

SuSE 10 Security Update : the OpenLDAP client (ZYPP Patch Number 5704)

The last security update for openldap2-client introduced a problem in libldap that could cause LDAP clients to prematurely truncate search results. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : OpenLDAP 2 (ZYPP Patch Number 5511)

This update fixes a security problem in the liblber client library of openldap that allowed remote attackers to cause a denial of service program termination via crafted ASN.1 BER datagrams, which triggers an assertion error. CVE-2008-2952 Additionally a bug was fixed in ldapfreeconnection which...

SuSE 10 Security Update : hplip (ZYPP Patch Number 5556)

This update of hplip does not allow to send alert mails as user anymore CVE-2008-2940 and fixes a denial-of-service defect. CVE-2008-2941 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc...

SuSE 10 Security Update : CUPS (ZYPP Patch Number 5653)

Specially crafted print jobs could trigger buffer overflows in the 'imagetops', 'texttops' and 'hpgltops' filters. Attackers could potentially exploit that to execute arbitrary code on the cups server. CVE-2008-3639 / CVE-2008-3640 / CVE-2008-3641 %NASLMINLEVEL 70300 C Tenable Network Security,...

SuSE 10 Security Update : OpenSSH (ZYPP Patch Number 5627)

Due to a faulty signal handler repeated login attempts could exhaust the maximum allowed connections and prevent further logins. CVE-2008-4109 A problem where utmp entries where not deleted when users logged out was also fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : Bluetooth utilities (ZYPP Patch Number 5437)

Missing length checks in bluez-libs could cause a buffer overflow in Bluetooth applications. Malicious bluetooth devices could potentially exploit that to execute arbitrary code. CVE-2008-2374 Note: The source code of each application that uses vulnerable functions of bluez-libs needs to be adapt...

SuSE 10 Security Update : opensc, opensc-devel (ZYPP Patch Number 5588)

This update fixes a security issues with opensc that occured when initializing blank smart cards with Siemens CardOS M4. After the initialization anyone could set the PIN of the smart card without authorization. CVE-2008-2235 NOTE: Already initialized cards are still vulnerable after this update...

SuSE 10 Security Update : pam_mount (ZYPP Patch Number 5602)

pammount allowed users to mount arbitrary devices to any directory when the 'luserconf' configuration directive was set. CVE-2008-3970 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ...

SuSE 10 Security Update : xntp (ZYPP Patch Number 5489)

The ntp daemon did not use supplied keys. The cause of the problem is that the authentication system is initialized after the config is parsed and that the keyfile option is parsed only by storing the keyfile name for later use when the authentication system is initialized. The trustedkey option ...

SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 5601)

Multiple issues have been fixed in gnutls. CVE-2008-1948 GNUTLS-SA-2008-1-1, CVE-2008-1949 GNUTLS-SA-2008-1-2 and CVE-2008-1950 GNUTLS-SA-2008-1-3 have been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : libxml2 (ZYPP Patch Number 5583)

Specially crafted xml files could cause a crash or a heap based buffer overlow in libxml2. CVE-2008-3281 / CVE-2008-3529 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : imlib2 (ZYPP Patch Number 5572)

This update fixes two security problems in imlib2. Specially crafted xpm files could trigger a stack based buffer overflow in imlib2 which could potentially be exploited to execute arbitrary code. CVE-2008-2426 A crash in PNM handling due to a NULL pointer dereference was fixed. %NASLMINLEVEL 703...

SuSE 10 Security Update : clamav (ZYPP Patch Number 5579)

This version update to 0.94 fixes numerous problems including some security relevant ones. CVE-2008-3912 / CVE-2008-1389 / CVE-2008-3913 / CVE-2008-3914 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL 3000 exit0;...

SuSE 10 Security Update : libxslt (ZYPP Patch Number 5457)

A heap overflow in the RC4 cryptographic routines in libxslt was fixed which could be used by attackers to potentially execute code. CVE-2008-2935 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : Mono (ZYPP Patch Number 5560)

This patch fixes two security problems and one critical bug : Makes sure that values of all the tags which can be exploited are encoded to make sure no exploit is possible. CVE-2008-3422 A header injection problem in Sys.Web was fixed. Fix a problem with the Novell.Directory.Ldap.dll as exposed b...