-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________

                        SUSE Security Summary Report

        Announcement ID:        SUSE-SR:2009:006
        Date:                   Tue, 10 Mar 2009 15:00:00 +0000
        Cross-References:       CVE-2007-6720, CVE-2008-2364, CVE-2008-5101
                                CVE-2008-5347, CVE-2008-5348, CVE-2008-5349
                                CVE-2008-5350, CVE-2008-5351, CVE-2008-5352
                                CVE-2008-5353, CVE-2008-5354, CVE-2008-5356
                                CVE-2008-5357, CVE-2008-5358, CVE-2008-5359
                                CVE-2008-5360, CVE-2008-6393, CVE-2009-0037
                                CVE-2009-0179, CVE-2009-0749, CVE-2009-0848

    Content of this advisory:
        1) Solved Security Vulnerabilities:
            - curl
            - libmikmod
            - apache2
            - optipng
            - psi
            - java-1_6_0-openjdk
            - gtk2
        2) Pending Vulnerabilities, Solutions, and Work-Arounds:
            none
        3) Authenticity Verification and Additional Information

______________________________________________________________________________

1) Solved Security Vulnerabilities

   To avoid flooding mailing lists with SUSE Security Announcements for minor
   issues, SUSE Security releases weekly summary reports for the low profile
   vulnerability fixes. The SUSE Security Summary Reports do not list or
   download URLs like the SUSE Security Announcements that are released for
   more severe vulnerabilities.

   Fixed packages for the following incidents are already available on our FTP
   server and via the YaST Online Update.

   - curl
     When HTTP-redirect following was enabled curl followed any URL, even
     one to e.g. local files (CVE-2009-0037).
     
     Affected Products: openSUSE 10.3-11.1, SLES9, SLES10

   - libmikmod
     Specially crafted XM files or playing mod files with varying number
     of channels could crash applications using libmikmod
     (CVE-2009-0179, CVE-2007-6720).
     
     Affected Products: openSUSE 10.3-11.1, SLES9, SLES10

   - apache2
     A DoS condition in apache2's mod_proxy has
     been fixed  (CVE-2008-2364).
     
     Affected Products: SLES10

   - optipng
     Specially crafted BMP files could overflow a buffer in optipng
     (CVE-2008-5101), specially crafted GIF files could crash optipng
     (CVE-2009-0749).
     
     Affected Products: openSUSE 10.3-11.1

   - psi
     Remote attackers could crash the Psi instant messaging client via
     the file transfer port (CVE-2008-6393).
     
     Affected Products: openSUSE 10.3-11.1

   - java-1_6_0-openjdk
     OpenJDK Java 1.6.0 was upgraded to build b14, fixing quite a lot of security issues.
     
     It fixes at least:
     4486841 UTF8 decoder should adhere to corrigendum to Unicode 3.0.1
             CVE-2008-5351
     6484091 FileSystemView leaks directory info
             CVE-2008-5350 aka SUN SOLVE 246266
     6497740 Limit the size of RSA public keys
             CVE-2008-5349
     6588160 jaas krb5 client leaks OS-level UDP sockets (all platforms)
             CVE-2008-5348
     6592792 Add com.sun.xml.internal to the "package.access" property in $JAVA_HOME/lib/security/java.security
             CVE-2008-5347 aka SUN SOLVE 246366
     6721753 File.createTempFile produces guessable file names
             CVE-2008-5360
     6726779 ConvolveOp on USHORT raster can cause the JVM crash.
             CVE-2008-5359 aka SUN SOLVE 244987
     6733336 Crash on malformed font
             CVE-2008-5356 aka SUN SOLVE 244987
     6733959 Insufficient checks for "Main-Class" manifest entry in JAR files
             CVE-2008-5354 aka SUN SOLVE 244990
     6734167 Calendar.readObject allows elevation of privileges
             CVE-2008-5353
     6751322 Vulnerability report: Sun Java JRE TrueType Font Parsing Heap Overflow
             CVE-2008-5357 aka SUN SOLVE 244987
     6755943 Java JAR Pack200 Decompression should enforce stricter header checks
             CVE-2008-5352 aka SUN SOLVE 244992
     6766136 corrupted gif image may cause crash in java splashscreen library.
             CVE-2008-5358 aka SUN SOLVE 244987
     
     Affected Products: openSUSE 11.0,11.1

   - gtk2
     A SUSE specific patch to GTK2 accidentally added a relative search
     path for gtk modules therefore allowed local attackers have gtk
     programs load modules from untrusted places (CVE-2009-0848).
     
     Affected Products: openSUSE 11.0,11.1


______________________________________________________________________________

2) Pending Vulnerabilities, Solutions, and Work-Arounds

   none
______________________________________________________________________________

3) Authenticity Verification and Additional Information

  - Announcement authenticity verification:

    SUSE security announcements are published via mailing lists and on Web
    sites. The authenticity and integrity of a SUSE security announcement is
    guaranteed by a cryptographic signature in each announcement. All SUSE
    security announcements are published with a valid signature.

    To verify the signature of the announcement, save it as text into a file
    and run the command

      gpg --verify 

    replacing  with the name of the file containing the announcement.
    The output for a valid signature looks like:

      gpg: Signature made  using RSA key ID 3D25D3D9
      gpg: Good signature from "SuSE Security Team "

    where  is replaced by the date the document was signed.

    If the security team's key is not contained in your key ring, you can
    import it from the first installation CD. To import the key, use the
    command

      gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc

  - Package authenticity verification:

    SUSE update packages are available on many mirror FTP servers all over the
    world. While this service is considered valuable and important to the free
    and open source software community, the authenticity and integrity of a
    package needs to be verified to ensure that it has not been tampered with.

    The internal RPM package signatures provide an easy way to verify the
    authenticity of an RPM package. Use the command

      rpm -v --checksig 

    to verify the signature of the package, replacing  with the
    filename of the RPM package downloaded. The package is unmodified if it
    contains a valid signature from build@suse.de with the key ID 9C800ACA.

    This key is automatically imported into the RPM database (on RPMv4-based
    distributions) and the gpg key ring of 'root' during installation. You can
    also find it on the first installation CD and included at the end of this
    announcement.

  - SUSE runs two security mailing lists to which any interested party may
    subscribe:

    opensuse-security@opensuse.org
        -   General Linux and SUSE security discussion.
            All SUSE security announcements are sent to this list.
            To subscribe, send an e-mail to
                .

    opensuse-security-announce@opensuse.org
        -   SUSE's announce-only mailing list.
            Only SUSE's security announcements are sent to this list.
            To subscribe, send an e-mail to
                .

    ====================================================================    SUSE's security contact is  or .
    The  public key is listed below.
    ====================================================================