SuSE: Weekly Summary 2008:021
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Summary Report
Announcement ID: SUSE-SR:2008:021
Date: Fri, 17 Oct 2008 14:00:00 +0000
Cross-References: CVE-2008-2940, CVE-2008-2941, CVE-2008-2952
CVE-2008-3658, CVE-2008-3659
Content of this advisory:
1) Solved Security Vulnerabilities:
- cups
- hplip
- apache2-mod_php5
- openldap2
2) Pending Vulnerabilities, Solutions, and Work-Arounds:
none
3) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Solved Security Vulnerabilities
To avoid flooding mailing lists with SUSE Security Announcements for minor
issues, SUSE Security releases weekly summary reports for the low profile
vulnerability fixes. The SUSE Security Summary Reports do not list or
download URLs like the SUSE Security Announcements that are released for
more severe vulnerabilities.
Fixed packages for the following incidents are already available on our FTP
server and via the YaST Online Update.
- cups
Specially crafted print jobs could trigger buffer overflows in the
'imagetops', 'texttops' and 'hpgltops' filters. Attackers could
potentially exploit that to execute arbitrary code on the cups
server (CVE-2008-3639, CVE-2008-3640, CVE-2008-3641).
Affected products: openSUSE 10.2-11.0, SLED 10 SP1,SLED 10 SP2,
SLES 10 SP1,SLES 10 SP2,SuSE Linux Enterprise Server 8 for IBM
S/390 and IBM zSeries,SuSE Linux Enterprise Server 8 for x86,
Novell Linux Desktop 9,Novell Linux POS 9,Open Enterprise Server,SLES 9
- hplip,hplip-hpijs,hplip17,hplip17-hpijs
hplip was updated because it does allow to send alert mails as user
(CVE-2008-2940) and was affected by a denial-of-service bug
(CVE-2008-2941).
Affected products: openSUSE 10.2-10.3,SLED 10 SP1,SLED 10 SP2,SLES 10 SP1,
SLES 10 SP2
- apache2-mod_php5,php5*
The current update of apache2-mod_php5 fixes some overflows in the
gd extension and in the memnstr() function that could crash php or
possibly allow remote code execution (CVE-2008-3658, CVE-2008-3659)
Affected products: openSUSE 10.2-11.0 (previously released), SLE SDK 10
SP1,SLES 10 SP1
- openldap2
This update fixes a security problem in the liblber client library of
openldap that allowed remote attackers to cause a denial of service
(program termination) via crafted ASN.1 BER datagrams, which triggers an assertion error. (CVE-2008-2952)
Additionally a bug was fixed in ldap_free_connection which could result
in client crashes when the server closed a connection while an operation
is active.
Affected products: openSUSE 10.2-11.0, Novell Linux Desktop 9, Novell
Linux POS 9,Open Enterprise Server,SLE 10 DEBUGINFO SP2,SLE SDK 10 SP1,
SLE SDK 10 SP2,SLED 10 SP1,SLED 10 SP2,SLES 10 SP1,SLES 10 SP2,SLES 9,
SuSE Linux Enterprise Server 8 for IBM S/390 and IBM zSeries,
SuSE Linux Enterprise Server 8 for x86
______________________________________________________________________________
2) Pending Vulnerabilities, Solutions, and Work-Arounds
none
______________________________________________________________________________
3) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and on Web
sites. The authenticity and integrity of a SUSE security announcement is
guaranteed by a cryptographic signature in each announcement. All SUSE
security announcements are published with a valid signature.
To verify the signature of the announcement, save it as text into a file
and run the command
gpg --verify
References
![Dist Suse](/images/distros/dist-suse.gif)