Fixlet Site - PatchesforSUSELinuxEnterprise
Current Version: 57	Published: Tue, 07 Aug 2007 23:51:10  GMT
***************************************************************
Title: PATCH-11579 - Security update for Qt3 - SLES9
Severity: <Unspecified>
Fixlet ID: 1157901
Fixlet Link: http://support.novell.com/techcenter/psdb/eac35f375ac5bb22efa8b828b221e0bf.html

Fixlet Description: Format string bugs in QTextEdit can be exploited via specially crafted HTML tags to potentially execute code. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11651 - Security update for gimp - SLED10 (Superseded)
Severity: <Unspecified>
Fixlet ID: 1165101
Fixlet Link: http://support.novell.com/techcenter/psdb/b9e7c4039054756c151b18025fe84624.html

Fixlet Description: Note: PATCH-11687 supersedes this patch. Everyone using gimp should install this update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11657 - Security update for Mozilla - SLES9
Severity: <Unspecified>
Fixlet ID: 1165701
Fixlet Link: http://support.novell.com/techcenter/psdb/d91b73c3c1e2666666b5dd6d36be8cbf.html

Fixlet Description: This update fixes several security problems in Mozilla Firefox 1.5.0.12. Following security problems were fixed:            MFSA 2007-18: Crashes with evidence of memory corruption                        The usual collection of stability fixes for crashes that look        suspicious but haven't been proven to be exploitable.                        25 were in the browser engine, reported by Mozilla developers and        community members Bernd Mielke, Boris Zbarsky, David Baron, Daniel        Veditz, Jesse Ruderman, Lukas Loehrer, Martijn Wargers, Mats Palmgren,        Olli Pettay, Paul Nickerson,and Vladimir Sukhoy (CVE-2007-3734)                        7 were in the JavaScript engine reported by Asaf Romano, Jesse        Ruderman, Igor Bukanov (CVE-2007-3735)                    MFSA 2007-19 / CVE-2007-3736: XSS using addEventListener and setTimeout                        moz_bug_r_a4 reported that scripts could be injected into another        site's context by exploiting a timing issue using addEventLstener or        setTimeout.                    MFSA 2007-20 / CVE-2007-3089: frame spoofing                        Ronen Zilberman and Michal Zalewski both reported that it was possible        to exploit a timing issue to inject content into about:blank frames in        a page.                    MFSA 2007-21 / CVE-2007-3737:  Privilege escallation using an event        handler attached to an element not in the document                        Reported by moz_bug_r_a4.                    MFSA 2007-22 / CVE-2007-3285: File type confusion due to %00 in name                        Ronald van den Heetkamp reported that a filename URL containing %00        (encoded null) can cause Firefox to interpret the file extension        differently than the underlying Windows operating system potentially        leading to unsafe actions such as running a program.                    MFSA 2007-23 / CVE-2007-3670: Remote code execution by launching        Firefox from Internet Explorer                        Greg MacManus of iDefense and Billy Rios of Verisign independently        reported that links containing a quote (") character could be used in        Internet Explorer to launch registered URL Protocol handlers with extra        command-line parameters.  Firefox and Thunderbird are among those which        can be launched, and both support a "-chrome" option that could be used        to run malware.                        This problem does not affect Linux.                    MFSA 2007-24 / CVE-2007-3656: unauthorized access to wyciwyg://        documents                Michal Zalewski reported that it was possible to bypass the same-origin        checks and read from cached (wyciwyg) documents                    MFSA 2007-25 / CVE-2007-3738: XPCNativeWrapper pollution                        shutdown and moz_bug_r_a4 reported two separate ways to modify an        XPCNativeWrapper such that subsequent access by the browser would        result in executing user-supplied code. Everyone using Mozilla should update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11663 - Security update for xpdf - SLED10/SLES10
Severity: <Unspecified>
Fixlet ID: 1166301
Fixlet Link: http://support.novell.com/techcenter/psdb/d3ef7a54a3d1b3517386dae046114f94.html

Fixlet Description: A buffer overflow in xpdf could be exploited by attackers to potentially execute arbitrary code. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11665 - Security update for bind,bind-devel,bind-utils - SLES9
Severity: <Unspecified>
Fixlet ID: 1166501
Fixlet Link: http://support.novell.com/techcenter/psdb/c9ea0bc14d84824dc2e54f71907d6322.html

Fixlet Description: The bind nameserver generates predictable DNS query IDs. This could be abused by remote attackers to perform DNS poisoning attacks. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11666 - Security update for PHP4 - SLES9
Severity: <Unspecified>
Fixlet ID: 1166601
Fixlet Link: http://support.novell.com/techcenter/psdb/b1c0b8d3ce8da450fbeea2ef4bac63c3.html

Fixlet Description: Everyone using PHP4 should install this update. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-11687 - Security update for gimp - SLED10
Severity: <Unspecified>
Fixlet ID: 1168701
Fixlet Link: http://support.novell.com/techcenter/psdb/63cd81aa6b64df4df73ab2b6c72b267d.html

Fixlet Description: Multiple import filters of the gimp image manipulation program contain integer overflows. These could be exploited by attackers to potentially execute code by tricking users to open specially crafted files. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7073101 - Security update for kdegraphics3-pdf - SLED10/SLES10
Severity: <Unspecified>
Fixlet ID: 707310101
Fixlet Link: http://support.novell.com/techcenter/psdb/5de2f85d39bfda5a7506072cca8618f3.html

Fixlet Description: A buffer overflow in the xpdf code contained in kpdf could be exploited by attackers to potentially execute arbitrary code. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7073102 - Security update for bind,bind-devel,bind-utils - SLED10
Severity: <Unspecified>
Fixlet ID: 707310201
Fixlet Link: http://support.novell.com/techcenter/psdb/9661e828c0e56d3297ed6fc60453d1e7.html

Fixlet Description: The bind nameserver generates predictable DNS query IDs. This could be abused by remote attackers to perform DNS poisoning attacks. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7073102 - Security update for bind,bind-devel,bind-utils - SLES10
Severity: <Unspecified>
Fixlet ID: 707310202
Fixlet Link: http://support.novell.com/techcenter/psdb/9661e828c0e56d3297ed6fc60453d1e7.html

Fixlet Description: The bind nameserver generates predictable DNS query IDs. This could be abused by remote attackers to perform DNS poisoning attacks. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7080203 - Security update for Qt3 - SLED10/SLES10
Severity: <Unspecified>
Fixlet ID: 708020301
Fixlet Link: http://support.novell.com/techcenter/psdb/72e22bb06c6a063321588b1c9bbedc8c.html

Fixlet Description: Format string bugs in QTextEdit can be exploited via specially crafted HTML tags to potentially execute code. Please see patch page for more detailed information.

***************************************************************
Title: PATCH-B7080301 - Security update for PHP5 - SLES10
Severity: <Unspecified>
Fixlet ID: 708030101
Fixlet Link: http://support.novell.com/techcenter/psdb/e8f7e002557e2c26076baeb5c519d7c2.html

Fixlet Description: Everyone using PHP5 should install this update. Please see patch page for more detailed information.