SuSE 10 Security Update : kdelibs3,kdelibs3-devel,CVE-2007-1564 (ZYPP Patch Number 3988)

A bug in konqueror allowed attackers to abuse the FTP passive mode for portscans. CVE-2007-1564 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29483;...

SuSE 10 Security Update : libexif (ZYPP Patch Number 3721)

A denial of service problem crash was fixed in the EXIF Loader of libexif, which could be used to crash the browser or image viewer when it interprets the EXIF tags in prepared JPEG files. CVE-2007-2645 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 4559)

A buffer overflow in the DTLS implementation of openssl could be exploited by attackers to potentially execute arbitrary code. CVE-2007-4995 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : ImageMagick (ZYPP Patch Number 3131)

This update of ImageMagick fixes three integer overflow in DCM and XWD code. These bugs can be exploited remotely via other application. CVE-2007-1667 / CVE-2007-1797 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : texinfo (ZYPP Patch Number 2263)

Specially crafted texinfo files could crash texinfo utilities like texi2dvi and potentially execute code. CVE-2006-4810 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 10 Security Update : screen (ZYPP Patch Number 2199)

A special formed UTF-8 sequence in text could be used to crash the terminal multitasker screen by overwriting memory in the heap. This is potentially exploitable to execute code. CVE-2006-4573 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, In...

SuSE 10 Security Update : cron (ZYPP Patch Number 3093)

By setting hard links to /etc/crontab users were able to prevent cron from running scheduled jobs. CVE-2007-1856 A re-emerged symlink bug allowed users to edit the crontab of other users. CVE-2005-1038 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...

SuSE 10 Security Update : bind (ZYPP Patch Number 2041)

This update fixes two vulnerabilities in bind that allow a remote attacker to trigger a denial-of-service attack. VU697164 - BIND INSIST failure due to excessive recursive queries, VU915404 - BIND assertion failure during SIG query processing %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

SuSE 10 Security Update : cpio (ZYPP Patch Number 4184)

This update fixes a bug in function safernamesuffix of cpio which leads to a crashing stack. Exploitability is unknown. CVE-2007-4476 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; i...

SuSE 10 Security Update : RealPlayer (ZYPP Patch Number 4081)

The media player RealPlayer was updated to version 10.0.9. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29369; scriptversion"1.13";...

SuSE 10 Security Update : Qt3 (ZYPP Patch Number 3052)

qt wrongly accepts overly long UTF-8 sequences due to a bug in the UTF-8 decoder. This may lead to security problems unter certain circumstances. The bug for example allows for script tag injection in konqueror. CVE-2007-0242 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text descripti...

SuSE 10 Security Update : LUM (ZYPP Patch Number 2274)

A security problem was fixed in 'novell-lum', the eDirectory based 'Linux User Management'. Under certain circumstances it was possible to login to the console without any password. ssh is not affected, since it rejects empty passwords. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The tex...

SuSE 10 Security Update : fetchmail (ZYPP Patch Number 4462)

This update fixes a remote denial-of-service attack. CVE-2007-4565 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29426; scriptversion"1.16";...

SuSE 10 Security Update : htdig (ZYPP Patch Number 4761)

A flaw in the htsearch Program could be exploited by attackers to conduct cross-site scripting XSS attacks. CVE-2007-6110 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

SuSE 10 Security Update : poppler (ZYPP Patch Number 4630)

A buffer overflow in the xpdf code contained in poppler could be exploited by attackers to potentially execute arbitrary code. CVE-2007-4352 / CVE-2007-5392 / CVE-2007-5393 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : gpg (ZYPP Patch Number 2994)

When printing a text stream with a GPG signature it was possible for an attacker to create a stream with 'unsigned text, signed text' where both unsigned and signed text would be shown without distinction which one was signed and which part wasn't. This is tracked by the Mitre CVE ID CVE-2007-126...

SuSE 10 Security Update : evince (ZYPP Patch Number 2358)

Specially crafted Postscript files could be used to execute arbitrary code by causing a buffer overflow in evince. CVE-2006-5864 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : apache2-mod_python (ZYPP Patch Number 4449)

This update fixes a buffer overflow in apache2-modpython that occurs while using python-based output-filter. This bug can be triggered remotely to read possibly confidential data from the process space of the web-server and in rare cases to execute arbitrary code. CVE-2004-2680 %NASLMINLEVEL 7030...

SuSE 10 Security Update : w3m (ZYPP Patch Number 2439)

A format string problem in w3m -dump / -backend mode could be used by a malicious server to crash w3m or execute code. CVE-2006-6772 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 3980)

This update fixes multiple bugs in php : - predictable generaton of an initialization vector IV in the mcrypt extension - additional cookie attributes could be injected via a session id - specially crafted files could cause integer overflows in gd and leverage them to at least crash gd based...