[SUSE-Announcements] BES Auto Notification: New Fixlets Published in Fixlet Site: PatchesforSUSELinuxEnterprise

Tue Nov 17 03:10:07 PST 2009

Fixlet Site - PatchesforSUSELinuxEnterprise
Current Version: 273	Published: Tue, 17 Nov 2009 00:46:59  GMT

New Fixlets:
============

***************************************************************
Title: PATCH-B9111001 - Security update for Linux kernel - SLES10 SP2
Severity: <Unspecified>
Fixlet ID: 911100101
Fixlet Link: http://download.novell.com/Download?buildid=ttdUAC2uWLs~

Fixlet Description: This update fixes a several security issues and various bugs in the SUSE Linux Enterprise 10 SP 2 kernel. Following security issues were fixed:     CVE-2009-3547: A race condition during pipe open could be used by local attackers to elevate privileges.   CVE-2009-2910: On x86_64 systems a information leak of high register contents (upper 32bit) was fixed.   CVE-2009-3238: The randomness of the ASLR methods used in the kernel was increased.   CVE-2009-1192: A information leak from the kernel due to uninitialized memory in AGP handling was fixed.   CVE-2009-2909: A signed comparison in the ax25 sockopt handler was fixed which could be used to crash the kernel or potentially execute code.   CVE-2009-2848: The execve function in the Linux kernel did not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.   CVE-2009-3002: Fixed various sockethandler getname leaks, which could disclose memory previously used by the kernel or other userland processes to the local attacker.   CVE-2009-1633: Multiple buffer overflows in the cifs subsystem in the Linux kernel allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess. c; or (2) long Unicode characters, related to fs/cifs/cifssmb. c and the cifs_readdir function in fs/cifs/readdir. c. See the RPM changelog for more changes. Everyone using the Linux Kernel on x86 architecture should update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B9111001 - Security update for Linux kernel - SLED10 SP2
Severity: <Unspecified>
Fixlet ID: 911100103
Fixlet Link: http://download.novell.com/Download?buildid=MEwkUY4L21U~

Fixlet Description: This update fixes a several security issues and various bugs in the SUSE Linux Enterprise 10 SP 2 kernel. Following security issues were fixed:     CVE-2009-3547: A race condition during pipe open could be used by local attackers to elevate privileges.   CVE-2009-2910: On x86_64 systems a information leak of high register contents (upper 32bit) was fixed.   CVE-2009-3238: The randomness of the ASLR methods used in the kernel was increased.   CVE-2009-1192: A information leak from the kernel due to uninitialized memory in AGP handling was fixed.   CVE-2009-2909: A signed comparison in the ax25 sockopt handler was fixed which could be used to crash the kernel or potentially execute code.   CVE-2009-2848: The execve function in the Linux kernel did not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.   CVE-2009-3002: Fixed various sockethandler getname leaks, which could disclose memory previously used by the kernel or other userland processes to the local attacker.   CVE-2009-1633: Multiple buffer overflows in the cifs subsystem in the Linux kernel allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess. c; or (2) long Unicode characters, related to fs/cifs/cifssmb. c and the cifs_readdir function in fs/cifs/readdir. c. See the RPM changelog for more changes. Everyone using the Linux Kernel on x86 architecture should update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B9111202 - Security update for Qt3 - SLED10 SP3
Severity: <Unspecified>
Fixlet ID: 911120203
Fixlet Link: http://download.novell.com/Download?buildid=1i1OBbLCAkY~

Fixlet Description: This update fixes the handling of the subjectAltName field in SSL certificates. (CVE-2009-2700) Everyone should update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B9111202 - Security update for Qt3 - SLES10 SP3
Severity: <Unspecified>
Fixlet ID: 911120205
Fixlet Link: http://download.novell.com/Download?buildid=cn1nLZQigrw~

Fixlet Description: This update fixes the handling of the subjectAltName field in SSL certificates. (CVE-2009-2700) Everyone should update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B9111301 - Security update for kdegraphics3-pdf - SLES10 SP2
Severity: <Unspecified>
Fixlet ID: 911130101
Fixlet Link: http://download.novell.com/Download?buildid=sOzaSxg5PTU~

Fixlet Description: Specially crafted PDF files could cause buffer overflows in the pdftops filter when printing such a document. CVE-2009-3608: CVSS v2 Base Score: 9.3 CVE-2009-3609: CVSS v2 Base Score: 4. Everyone should update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B9111301 - Security update for kdegraphics3-pdf - SLED10 SP2
Severity: <Unspecified>
Fixlet ID: 911130103
Fixlet Link: http://download.novell.com/Download?buildid=3YK0Dz0Bha4~

Fixlet Description: Specially crafted PDF files could cause buffer overflows in the pdftops filter when printing such a document. CVE-2009-3608: CVSS v2 Base Score: 9.3 CVE-2009-3609: CVSS v2 Base Score: 4. Everyone should update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B9111302 - Security update for kdegraphics3-pdf - SLES10 SP3
Severity: <Unspecified>
Fixlet ID: 911130201
Fixlet Link: http://download.novell.com/Download?buildid=rlAMcGNWtHo~

Fixlet Description: Specially crafted PDF files could cause buffer overflows in the pdftops filter when printing such a document. CVE-2009-3608: CVSS v2 Base Score: 9.3 CVE-2009-3609: CVSS v2 Base Score: 4. Everyone should update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B9111302 - Security update for kdegraphics3-pdf - SLED10 SP3
Severity: <Unspecified>
Fixlet ID: 911130203
Fixlet Link: http://download.novell.com/Download?buildid=MhPnwY9lVPc~

Fixlet Description: Specially crafted PDF files could cause buffer overflows in the pdftops filter when printing such a document. CVE-2009-3608: CVSS v2 Base Score: 9.3 CVE-2009-3609: CVSS v2 Base Score: 4. Everyone should update. Please see patch page for more detailed information.