SuSE Essential and Critical Security Patch Updates - Page 806

SuSE: 2004-031: cups Security Update

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

The Common Unix Printing System (CUPS) enables local and remote users to The Common Unix Printing System (CUPS) enables local and remote users to obtain printing functionallity via the Internet Printing Protocol (IPP). obtain printing functionallity via the Internet Printing Protocol (IPP). Alvaro Martinez Echevarria has found a remote Denial of Service condition within CUPS which allows remote [More...]

LinuxSecurity.com Team
Sep 15, 2004

SuSE: 2004-030: apache2 Security Update

The mod_ssl apache module, as part of our apache2 package, enables The mod_ssl apache module, as part of our apache2 package, enables the apache webserver to handle the HTTPS protocol. the apache webserver to handle the HTTPS protocol. Within the mod_ssl module, two Denial of Service conditions in the input filter have been found. The CVE project assigned the identifiers CAN-2004-0748 and CA [More...]

LinuxSecurity.com Team
Sep 06, 2004

SuSE: 2004-029: zlib Security Update

zlib is a widely used data compression library. Programs linked against it zlib is a widely used data compression library. Programs linked against it include most desktop applications as well as servers such as Apache and include most desktop applications as well as servers such as Apache and OpenSSH. The 'inflate' function of zlib handles certain input data incorrectly which could lead to a deni [More...]

LinuxSecurity.com Team
Sep 02, 2004

SuSE: 2004-028: kernel Security Update

Various signedness issues and integer overflows have been fixed within Various signedness issues and integer overflows have been fixed within kNFSd and the XDR decode functions of kernel 2.6. kNFSd and the XDR decode functions of kernel 2.6. These bugs can be triggered remotely by sending a package with a trusted source IP address and a write request with a size greater then 2^31. The resul [More...]

LinuxSecurity.com Team
Sep 01, 2004

SuSE: 2004-027: qt3 Security Update

The QT-library is an environment for GUI-programming and is used in The QT-library is an environment for GUI-programming and is used in various well-known projects, like KDE. various well-known projects, like KDE. Chris Evans found a heap overflow in the BMP image format parser (CAN-2004-0691) which can probably be abused by remote attackers to execute arbitrary code with the privileges of [More...]

LinuxSecurity.com Team
Aug 19, 2004

SuSE: 2004-026: rsync Security Update

The rsync-team released an advisory about a security problem in rsync. The rsync-team released an advisory about a security problem in rsync. If rsync is running in daemon-mode and without a chroot environment it If rsync is running in daemon-mode and without a chroot environment it is possible for a remote attacker to trick rsyncd into creating an absolute pathname while sanitizing it. As [More...]

LinuxSecurity.com Team
Aug 16, 2004

SuSE: 2004-025: gaim Security Update

Gaim is an instant messaging client which supports a wide range of Gaim is an instant messaging client which supports a wide range of protocols. protocols. Sebastian Krahmer of the SuSE Security Team discovered various remotely exploitable buffer overflows in the MSN-protocol parsing functions during a code review of the MSN protocol handling code.

LinuxSecurity.com Team
Aug 12, 2004

SuSE: 2004-024: kernel Security Update

Paul Starzetz from iSEC informed us about a race condition in the 64bit Paul Starzetz from iSEC informed us about a race condition in the 64bit file offset handling code of the kernel. file offset handling code of the kernel. The file offset pointer (f_pos) is changed during reading, writing, and seeking through a file to point to the current position in a file. The Linux kernel offers a 3 [More...]

LinuxSecurity.com Team
Aug 09, 2004

SuSE: 2004-023: libpng Security Update

Several different security vulnerabilities were found in the PNG Several different security vulnerabilities were found in the PNG library which is used by applications to support the PNG image format. library which is used by applications to support the PNG image format. A remote attacker is able to execute arbitrary code by triggering a buffer overflow due to the incorrect handling of the [More...]

LinuxSecurity.com Team
Aug 04, 2004

SuSE: 2004-022: samba Security Update

The Samba Web Administration Tool (SWAT) was found vulnerable to The Samba Web Administration Tool (SWAT) was found vulnerable to a buffer overflow in its base64 code. This buffer overflow can possibly a buffer overflow in its base64 code. This buffer overflow can possibly be exploited remotely before any authentication took place to execute arbitrary code. The same piece of vulnerable code [More...]

LinuxSecurity.com Team
Jul 23, 2004

SuSE: 2004-021: php4 Security Update

PHP is a well known, widely-used scripting language often used within PHP is a well known, widely-used scripting language often used within web server setups. web server setups. Stefan Esser found a problem with the "memory_limit" handling of PHP which allows remote attackers to execute arbitrary code as the user running the PHP interpreter. This problem has been fixed. Additionally a prob [More...]

LinuxSecurity.com Team
Jul 16, 2004

SuSE: 2004-020: kernel Security Update

Multiple security vulnerabilities are being addressed with this security update of the Linux kernel.Kernel memory access vulnerabilities are fixed in the e1000, decnet,acpi_asus, alsa, airo/WLAN, pss and mpu401 drivers. Thesevulnerabilities can lead to kernel memory read access, write accessand local denial of service conditions, resulting in access to theroot account for an attacker with a loca [More...]

LinuxSecurity.com Team
Jul 02, 2004

SuSE: 2004-019: dhcp-server Security Update

The Dynamic Host Configuration Protocol (DHCP) server is used to The Dynamic Host Configuration Protocol (DHCP) server is used to configure clients that dynamically connect to a network (WLAN configure clients that dynamically connect to a network (WLAN hotspots, customer networks, ...). The CERT informed us about a buffer overflow in the logging code of the server that can be triggered by [More...]

LinuxSecurity.com Team
Jun 23, 2004

SuSE: 2004-018: subversion Security Update

Subversion is a version control system like the well known CVS. Subversion is a version control system like the well known CVS. The subversion code is vulnerable to a remotely exploitable buffer The subversion code is vulnerable to a remotely exploitable buffer overflow on the heap. The bug appears before any authentication took place. An attacker is able to execute arbitray code by abusing [More...]

LinuxSecurity.com Team
Jun 17, 2004

SuSE: 2004-017: kernel Security Update

The Linux kernel is vulnerable to a local denial-of-service attack. By using a C program it is possible to trigger a floating point exception that puts the kernel into an unusable state. To execute this attack a malicious user needs shell access to the victim's machine. The severity of this bug is considered low because local denial-of- service attacks are hard to prevent in general. Addit [More...]

LinuxSecurity.com Team
Jun 16, 2004

SuSE: 2004-016: squid Security Update

Squid is a feature-rich web-proxy with support for various web-related Squid is a feature-rich web-proxy with support for various web-related protocols. protocols. The NTLM authentication helper application of Squid is vulnerable to a buffer overflow that can be exploited remotely by using a long password to execute arbitrary code. NTLM authentication is enabled by default in the Squid pac [More...]

LinuxSecurity.com Team
Jun 09, 2004

SuSE: 2004-015: cvs Security Update

The Concurrent Versions System (CVS) offers tools which allow developers The Concurrent Versions System (CVS) offers tools which allow developers to share and maintain large software projects. to share and maintain large software projects. Various remotely exploitable conditions have been found during a source code review of CVS done by Stefan Esser and Sebastian Krahmer (SuSE Security-Team) [More...]

LinuxSecurity.com Team
Jun 09, 2004

SuSE: 2004-014: kdelibs Security Update

The kdelibs3 (kdelibs for SLES7 based products) package is a core package The kdelibs3 (kdelibs for SLES7 based products) package is a core package for the K desktop environment (KDE). The URI handler of the kdelibs3 for the K desktop environment (KDE). The URI handler of the kdelibs3 and kdelibs class library contains a flaw which allows remote attackers to create arbitrary files as the use [More...]

LinuxSecurity.com Team
May 26, 2004

SuSE: 2004-013: cvs Security Update

The Concurrent Versions System (CVS) offers tools which allow developers The Concurrent Versions System (CVS) offers tools which allow developers to share and maintain large software projects. to share and maintain large software projects. Stefan Esser reported buffer overflow conditions within the cvs program. They allow remote attackers to execute arbitrary code as the user the cvs server [More...]

LinuxSecurity.com Team
May 19, 2004

SuSE: 2004-012: mc Security Update

The Midnight Commander (mc) is a file manager for the console. The Midnight Commander (mc) is a file manager for the console. The mc code is vulnerable to several security related bugs like buffer The mc code is vulnerable to several security related bugs like buffer overflows, incorrect format string handling and insecure usage of temporary files. These bugs can be exploited by local users [More...]

LinuxSecurity.com Team
May 14, 2004