SuSE 10 Security Update : libxslt (ZYPP Patch Number 5457)

A heap overflow in the RC4 cryptographic routines in libxslt was fixed which could be used by attackers to potentially execute code. CVE-2008-2935 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : ethereal (ZYPP Patch Number 5520)

Various vulnerabilities have been fixed in wireshark: CVE-2008-3137 / CVE-2008-3138 / CVE-2008-3139 / CVE-2008-3140 / CVE-2008-3141 / CVE-2008-3145 / CVE-2008-3146. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL 3000 exit0;...

SuSE 10 Security Update : Perl (ZYPP Patch Number 5444)

Specially crafted regular expressions could crash perl. CVE-2008-1927 Additionally problem in the CGI module was fixed that could result in an endless loop if uploads were cancelled. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Python (ZYPP Patch Number 5490)

This update of python fixes several security vulnerabilities. CVE-2008-1679 / CVE-2008-1887 / CVE-2008-3143 / CVE-2008-3142 / CVE-2008-3144 / CVE-2008-2315 / CVE-2008-2316 Note: for SLE10 a non-security bug in mmap was fixed too. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : rdesktop (ZYPP Patch Number 5272)

Multiple problems have been fixed in rdesktop. CVE-2008-1801 / CVE-2008-1802 / CVE-2008-1803 have been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : Postfix (ZYPP Patch Number 5500)

A local privilege escalation vulnerability as well as a mailbox ownership problem has been fixed in postfix. CVE-2008-2936 / CVE-2008-2937 have been assigned to this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : Subversion (ZYPP Patch Number 5362)

This update of subversion fixes multiple vulnerabilities. - list CVS or SVN commits on 'all-forbidden' files. CVE-2008-1290 - directly access hidden CVSROOT folders. CVE-2008-1291 - expose restricted content via the revision view, the log history, or the diff view. CVE-2008-1292 %NASLMINLEVEL 703...

SuSE 10 Security Update : net-snmp (ZYPP Patch Number 5422)

This security update of net-snmp fixes a denial of service vulnerability CVE-2008-2292, an authentication bypass CVE-2008-0960 and several memory leaks. In addition net-snmp was patched to allow customization of the agent address set. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...

SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5450)

MozillaFirefox was updated to version 2.0.0.16, which fixes various bugs and following security issues : - An anonymous researcher, via TippingPoint's Zero Day Initiative program, reported a vulnerability in Mozilla CSS reference counting code. The vulnerability was caused by an insufficiently...

CVE-2008-3187

zypp-refresh-patches in zypper in SUSE openSUSE 10.2, 10.3, and 11.0 does not ask the user before accepting repository keys, which allows remote repositories to cause a denial of service package data corruption via a spoofed key...

CVE-2008-3187

This CVE affects SUSE/openSUSE’s zypper/zypp-refresh-patches workflow. Specifically, in SUSE openSUSE 10.2, 10.3, and 11.0, the component does not prompt before accepting repository keys, allowing a remote repository to trigger a denial of service (package data corruption) via a spoofed key. The ...

CVE-2008-3187: Improper Input Validation

zypp-refresh-patches in zypper in SUSE openSUSE 10.2, 10.3, and 11.0 does not ask the user before accepting repository keys, which allows remote repositories to cause a denial of service package data corruption via a spoofed key...

zypp-refresh-patches wrapper XML库破坏漏洞

BUGTRAQ ID: 30293 CVE ID：CVE-2008-3187 CNCVE ID：CNCVE-20083187 zypp-refresh-patches是一款关于包管理补丁相关的程序。 zypp-refresh-patches wrapper存在一个安全问题，远程攻击者可以利用漏洞破坏XML库。 攻击者可以注入恶意库KEY草HTTP请求来触发此漏洞，导致使目标用户不仅能升级或者下载新的包。 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 可联系供应商升级到最新程序：...

SuSE 10 Security Update : clamav (ZYPP Patch Number 5416)

This update brings clamav to version 0.93.3. It lists CVE-2008-2713 as fixed, but this was fixed in 0.93.1 already, but not mentioned. The update contains stability and bugfixes. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : bind (ZYPP Patch Number 5409)

The transaction id and the udp source port used for DNS queries by the bind nameserver were predicatable. Attackers could potentially exploit that weakness to manipulate the DNS cache 'DNS cache poisoning', CVE-2008-1447. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description o...

SuSE 10 Security Update : freetype2, (ZYPP Patch Number 5361)

This update of freetype2 fixes several potential vulnerabilities reported by iDefense. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid33431; scriptversion"1.18...

SuSE 10 Security Update : speex (ZYPP Patch Number 5364)

Specially crafted files or streams could potentially be abused to trick applications that support speex into executing arbitrary code. CVE-2008-1686 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 5278)

ImageMagick and GraphicsMagick are affected by two security problems : - Buffer overflow in the handling of XCF files CVE-2008-1097: Heap buffer overflow in the handling of PCX files. CVE-2008-1096 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novel...

SuSE 10 Security Update : mtr (ZYPP Patch Number 5291)

This update fixes a stack-based buffer overflow which could potentially be exploited by a remote attacker to execute arbitrary code. CVE-2008-2357 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : clamav (ZYPP Patch Number 5359)

Clamav was updated to version 0.93.1. It fixes various bugs and one security issue : - libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read. CVE-2008-2713 %NASLMINLEVEL 70300 C Tenable Network...