SuSE: Weekly Summary 2008:024
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Summary Report
Announcement ID: SUSE-SR:2008:024
Date: Fri, 07 Nov 2008 14:00:00 +0000
Cross-References: CVE-2007-6420,
CVE-2008-1678,
CVE-2008-2939,
CVE-2008-3533,
CVE-2008-3863
Content of this advisory:
1) Solved Security Vulnerabilities:
- yelp
- apache2
- enscript
- libcdaudio
2) Pending Vulnerabilities, Solutions, and Work-Arounds:
none
3) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Solved Security Vulnerabilities
To avoid flooding mailing lists with SUSE Security Announcements for minor
issues, SUSE Security releases weekly summary reports for the low profile
vulnerability fixes. The SUSE Security Summary Reports do not list or
download URLs like the SUSE Security Announcements that are released for
more severe vulnerabilities.
Fixed packages for the following incidents are already available on our FTP
server and via the YaST Online Update.
- yelp
Package yelp was updated to fix a format string bug. (CVE-2008-3533)
Affected products: openSUSE 11.0
- apache2
Missing sanity checks of FTP URLs allowed cross site scripting (XSS)
attacks via the mod_proxy_ftp module (CVE-2008-2939).
Missing precautions allowed cross site request forgery (CSRF) via
the mod_proxy_balancer interface (CVE-2007-6420).
A memory leak in the SSL module could crash apache (CVE-2008-1678)
Affected products: openSUSE 10.2-11.0, SLES10, SLES9, NLD9, OES, NLPOS9,
SLED
- enscript
This update of enscript fixes buffer overflows in the setfilename
(CVE-2008-3863), process_file and read_special_escape function
(CVE-2008-4306) that can be exploited during file processing.
Affected products: openSUSE 10.2-11.0, SLES10, SLES9, NLD9, OES, NLPOS9,
SLED
- libcdaudio
A remote attacker can modify a CDDB entry on a CDDB server or just
intercept a connection from the CDDB client to the server to execute
arbitrary code on the client machine.
Affected products: openSUSE 10.2-11.0
______________________________________________________________________________
2) Pending Vulnerabilities, Solutions, and Work-Arounds
none
______________________________________________________________________________
3) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and on Web
sites. The authenticity and integrity of a SUSE security announcement is
guaranteed by a cryptographic signature in each announcement. All SUSE
security announcements are published with a valid signature.
To verify the signature of the announcement, save it as text into a file
and run the command
gpg --verify
References
![Dist Suse](/images/distros/dist-suse.gif)