Fixlet Site - PatchesforSUSELinuxEnterprise
Current Version: 55	Published: Wed, 01 Aug 2007 17:14:43  GMT
***************************************************************
Title: PATCH-11562 - Security update for Samba - SLES9
Severity: <Unspecified>
Fixlet ID: 1156201
Fixlet Link: http://support.novell.com/techcenter/psdb/030f92e97ede6166fdaf8c9603ef87be.html

Fixlet Description: The previous security fix missed one character in the shell escape handling. Also fixed were some regressions introduced by the previous update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11569 - Security update for libvorbis - SLES9
Severity: <Unspecified>
Fixlet ID: 1156901
Fixlet Link: http://support.novell.com/techcenter/psdb/4698cefcb7095f1da9b8e80af41f9954.html

Fixlet Description: An array boundary problem within libvorbis was fixed. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11569 - Security update for libvorbis - SLED10/SLES10
Severity: <Unspecified>
Fixlet ID: 1156903
Fixlet Link: http://support.novell.com/techcenter/psdb/4698cefcb7095f1da9b8e80af41f9954.html

Fixlet Description: An array boundary problem within libvorbis was fixed. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11574 - Security update for ethereal - SLES9
Severity: <Unspecified>
Fixlet ID: 1157401
Fixlet Link: http://support.novell.com/techcenter/psdb/254e16f8849045414f4aad7942b25e58.html

Fixlet Description: Various security problems were fixed in the wireshark 0.99.6 release, which were backported to ethereal (predecessor of wireshark):    CVE-2007-3389: Wireshark allowed remote attackers to cause a denial of        service (crash) via a crafted chunked encoding in an HTTP response,        possibly related to a zero-length payload.     CVE-2007-3390: Wireshark when running on certain        systems, allowed remote attackers to cause a denial of service (crash)        via crafted iSeries capture files that trigger a SIGTRAP.            CVE-2007-3391: Wireshark allowed remote attackers to cause a denial of        service (memory consumption) via a malformed DCP ETSI packet that        triggers an infinite loop.     CVE-2007-3392: Wireshark allowed remote attackers to cause a denial of        service via malformed (1) SSL or (2) MMS packets that trigger an        infinite loop.     CVE-2007-3393: Off-by-one error in the DHCP/BOOTP dissector in Wireshark        allowed remote attackers to cause a denial of service (crash)        via crafted DHCP-over-DOCSIS packets. 32df407167a77ac06614c5407468ffbe,89bd75656702ed01153697c633d7a0ff,a2ac89797cd19cf7fb4f603cd18ecc53,7343b83b2866e7abf45b8a99446ee1e1,e0325ea41f1bfa15494ac4511ae25749,ed68372df64743127152b6fa7a40a353,c4745f0c0b9184f32b2201f189dc66f6 Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11574 - Security update for ethereal - SLED10
Severity: <Unspecified>
Fixlet ID: 1157403
Fixlet Link: http://support.novell.com/techcenter/psdb/254e16f8849045414f4aad7942b25e58.html

Fixlet Description: Various security problems were fixed in the wireshark 0.99.6 release, which were backported to ethereal (predecessor of wireshark):    CVE-2007-3389: Wireshark allowed remote attackers to cause a denial of        service (crash) via a crafted chunked encoding in an HTTP response,        possibly related to a zero-length payload.     CVE-2007-3390: Wireshark when running on certain        systems, allowed remote attackers to cause a denial of service (crash)        via crafted iSeries capture files that trigger a SIGTRAP.            CVE-2007-3391: Wireshark allowed remote attackers to cause a denial of        service (memory consumption) via a malformed DCP ETSI packet that        triggers an infinite loop.     CVE-2007-3392: Wireshark allowed remote attackers to cause a denial of        service via malformed (1) SSL or (2) MMS packets that trigger an        infinite loop.     CVE-2007-3393: Off-by-one error in the DHCP/BOOTP dissector in Wireshark        allowed remote attackers to cause a denial of service (crash)        via crafted DHCP-over-DOCSIS packets. 32df407167a77ac06614c5407468ffbe,89bd75656702ed01153697c633d7a0ff,a2ac89797cd19cf7fb4f603cd18ecc53,7343b83b2866e7abf45b8a99446ee1e1,e0325ea41f1bfa15494ac4511ae25749,ed68372df64743127152b6fa7a40a353,c4745f0c0b9184f32b2201f189dc66f6 Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11574 - Security update for ethereal - SLES10
Severity: <Unspecified>
Fixlet ID: 1157404
Fixlet Link: http://support.novell.com/techcenter/psdb/254e16f8849045414f4aad7942b25e58.html

Fixlet Description: Various security problems were fixed in the wireshark 0.99.6 release, which were backported to ethereal (predecessor of wireshark):    CVE-2007-3389: Wireshark allowed remote attackers to cause a denial of        service (crash) via a crafted chunked encoding in an HTTP response,        possibly related to a zero-length payload.     CVE-2007-3390: Wireshark when running on certain        systems, allowed remote attackers to cause a denial of service (crash)        via crafted iSeries capture files that trigger a SIGTRAP.            CVE-2007-3391: Wireshark allowed remote attackers to cause a denial of        service (memory consumption) via a malformed DCP ETSI packet that        triggers an infinite loop.     CVE-2007-3392: Wireshark allowed remote attackers to cause a denial of        service via malformed (1) SSL or (2) MMS packets that trigger an        infinite loop.     CVE-2007-3393: Off-by-one error in the DHCP/BOOTP dissector in Wireshark        allowed remote attackers to cause a denial of service (crash)        via crafted DHCP-over-DOCSIS packets. 32df407167a77ac06614c5407468ffbe,89bd75656702ed01153697c633d7a0ff,a2ac89797cd19cf7fb4f603cd18ecc53,7343b83b2866e7abf45b8a99446ee1e1,e0325ea41f1bfa15494ac4511ae25749,ed68372df64743127152b6fa7a40a353,c4745f0c0b9184f32b2201f189dc66f6 Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11575 - Security update for flash-player - SLED10
Severity: <Unspecified>
Fixlet ID: 1157501
Fixlet Link: http://support.novell.com/techcenter/psdb/11185d1d77c266319dacb704d254fd94.html

Fixlet Description: The Adobe Flash Player was updated to version 9.0.48.0 on SUSE Linux Enterprise Desktop 10 to fix several security problems. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11577 - Security update for clamav - SLES9 (Superseded)
Severity: <Unspecified>
Fixlet ID: 1157701
Fixlet Link: http://support.novell.com/techcenter/psdb/13b07581e55105f8d49bd5c3fe0501cb.html

Fixlet Description: Note: PATCH-11582 supersedes this patch. This clamav version update to 0.91 fixes among other things the long startup time of it's predecessor. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11577 - Security update for clamav - SLES10 (Superseded)
Severity: <Unspecified>
Fixlet ID: 1157703
Fixlet Link: http://support.novell.com/techcenter/psdb/13b07581e55105f8d49bd5c3fe0501cb.html

Fixlet Description: Note:  PATCH-11582 Supersedes this patch. This clamav version update to 0.91 fixes among other things the long startup time of it's predecessor. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11578 - Security update for gd - SLES9
Severity: <Unspecified>
Fixlet ID: 1157801
Fixlet Link: http://support.novell.com/techcenter/psdb/0b5233db2a91ad6ad12b126125da3b1f.html

Fixlet Description: This update fixes multiple integer overflows in the gd library. Specially crafted files could leverage them to at least crash gd based applications. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11578 - Security update for gd - SLES10
Severity: <Unspecified>
Fixlet ID: 1157803
Fixlet Link: http://support.novell.com/techcenter/psdb/0b5233db2a91ad6ad12b126125da3b1f.html

Fixlet Description: This update fixes multiple integer overflows in the gd library. Specially crafted files could leverage them to at least crash gd based applications. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11578 - Security update for gd - SLED10
Severity: <Unspecified>
Fixlet ID: 1157804
Fixlet Link: http://support.novell.com/techcenter/psdb/0b5233db2a91ad6ad12b126125da3b1f.html

Fixlet Description: This update fixes multiple integer overflows in the gd library. Specially crafted files could leverage them to at least crash gd based applications. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11582 - Security update for clamav - SLES9
Severity: <Unspecified>
Fixlet ID: 1158201
Fixlet Link: http://support.novell.com/techcenter/psdb/6df6eaf6b7af091f4f24390128e14dae.html

Fixlet Description: This clamav version update to 0.91.1 fixes among other things the long startup time of version 0.90.3 as well as a possibilty to crash clamav with specially crafted rar archives. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11582 - Security update for clamav - SLES10
Severity: <Unspecified>
Fixlet ID: 1158203
Fixlet Link: http://support.novell.com/techcenter/psdb/6df6eaf6b7af091f4f24390128e14dae.html

Fixlet Description: This clamav version update to 0.91.1 fixes among other things the long startup time of version 0.90.3 as well as a possibilty to crash clamav with specially crafted rar archives. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7071801 - Security update for Java - SLED10
Severity: <Unspecified>
Fixlet ID: 707180101
Fixlet Link: http://support.novell.com/techcenter/psdb/dc35750a80dacaad950b2c1075b2b499.html

Fixlet Description: The IBM Java JRE/SDK has been brought to release 1.4.2 SR8, containing several bugfixes and several security fixes. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7071801 - Security update for Java - SLES10
Severity: <Unspecified>
Fixlet ID: 707180102
Fixlet Link: http://support.novell.com/techcenter/psdb/dc35750a80dacaad950b2c1075b2b499.html

Fixlet Description: The IBM Java JRE/SDK has been brought to release 1.4.2 SR8, containing several bug fixes and several security fixes. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7071901 - Security update for cups - SLED10/SLES10
Severity: <Unspecified>
Fixlet ID: 707190101
Fixlet Link: http://support.novell.com/techcenter/psdb/a4dc2e5a5a512f2786a784605f8dac27.html

Fixlet Description: The previous cups update was incomplete and could lead to cupsd crashing. Everyone using an SSL enabled cups server should  update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7071902 - Security update for Samba - SLED10
Severity: <Unspecified>
Fixlet ID: 707190201
Fixlet Link: http://support.novell.com/techcenter/psdb/93bf9086e7a4649fa3810ce2e719463c.html

Fixlet Description: The previous security fix for Samba missed one character in the shell escape handling. Also fixed were some regressions introduced by the previous update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7071902 - Security update for Samba - SLES10
Severity: <Unspecified>
Fixlet ID: 707190202
Fixlet Link: http://support.novell.com/techcenter/psdb/93bf9086e7a4649fa3810ce2e719463c.html

Fixlet Description: The previous security fix for CVE-2007-2447 missed one character in the shell escape handling. Also fixed were some regressions introduced by the previous update. Everyone should update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7071902 - Dependencies Needed - SLES10
Severity: <Unspecified>
Fixlet ID: 707190205
Fixlet Link: http://support.novell.com/techcenter/psdb/93bf9086e7a4649fa3810ce2e719463c.html

Fixlet Description: Updated packages for Samba are now available. However, this update requires that the package "libiniparser" be installed and at least version "2.14-6.2".

***************************************************************
Title: PATCH-B7071903 - Security update for madwifi - SLED10
Severity: <Unspecified>
Fixlet ID: 707190301
Fixlet Link: http://support.novell.com/techcenter/psdb/e359f84108f33e47c88b77987c15390b.html

Fixlet Description: The madwifi driver and userland packages were updated to 0.9.3.1. Please note that while the RPM version still says "0.9.3", the content is the 0.9.3.1 version. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7072501 - Security update for MozillaFirefox - SLED10/SLES10
Severity: <Unspecified>
Fixlet ID: 707250101
Fixlet Link: http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

Fixlet Description: This update brings Mozilla Firefox to security update version 2.0.0.5 Following security problems were fixed:                   MFSA 2007-18: Crashes with evidence of memory corruption                         The usual collection of stability fixes for crashes that look        suspicious but haven't been proven to be exploitable.                         25 were in the browser engine, reported by Mozilla developers and        community members Bernd Mielke, Boris Zbarsky, David Baron, Daniel        Veditz, Jesse Ruderman, Lukas Loehrer, Martijn Wargers, Mats Palmgren,        Olli Pettay, Paul Nickerson,and Vladimir Sukhoy (CVE-2007-3734)                        7 were in the JavaScript engine reported by Asaf Romano, Jesse        Ruderman, Igor Bukanov (CVE-2007-3735)                    MFSA 2007-19 / CVE-2007-3736: XSS using addEventListener and setTimeout                        moz_bug_r_a4 reported that scripts could be injected into another site's        context by exploiting a timing issue using addEventLstener or        setTimeout.                    MFSA 2007-20 / CVE-2007-3089: frame spoofing                        Ronen Zilberman and Michal Zalewski both reported that it was possible        to exploit a timing issue to inject content into about:blank frames in        a page.                    MFSA 2007-21 / CVE-2007-3737:  Privilege escallation using an event        handler attached to an element not in the document                        Reported by moz_bug_r_a4.                    MFSA 2007-22 / CVE-2007-3285: File type confusion due to %00 in name                        Ronald van den Heetkamp reported that a filename URL containing %00        (encoded null) can cause Firefox to interpret the file extension        differently than the underlying Windows operating system potentially        leading to unsafe actions such as running a program.                        MFSA 2007-23 / CVE-2007-3670: Remote code execution by launching Firefox      from Internet Explorer                  Greg MacManus of iDefense and Billy Rios of Verisign independently      reported that links containing a quote (") character could be used in      Internet Explorer to launch registered URL Protocol handlers with extra      command-line parameters. Firefox and Thunderbird are among those which      can be launched, and both support a "-chrome" option that could be used      to run malware.                  This problem does not affect Linux.               MFSA 2007-24 / CVE-2007-3656: unauthorized access to wyciwyg:// documents                  Michal Zalewski reported that it was possible to bypass the same-origin      checks and read from cached (wyciwyg) documents               MFSA 2007-25 / CVE-2007-3738: XPCNativeWrapper pollution                  shutdown and moz_bug_r_a4 reported two separate ways to modify an      XPCNativeWrapper such that subsequent access by the browser would result      in executing user-supplied code. Install this update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7072501 - Dependencies Needed - SLED10/SLES10
Severity: <Unspecified>
Fixlet ID: 707250103
Fixlet Link: http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

Fixlet Description: Updated packages for Mozilla Firefox are now available. However, this update requires that the package "mozilla-nspr" be installed and at least version "4.6.4"