[security-announce] SUSE Security Summary Report: SUSE-SR:2010:004
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Summary Report
Announcement ID: SUSE-SR:2010:004
Date: Tue, 16 Feb 2010 11:00:00 +0000
Cross-References: CVE-2009-1194, CVE-2009-2730, CVE-2009-3236
CVE-2009-3237, CVE-2009-3297, CVE-2009-3701
CVE-2009-4009, CVE-2009-4010, CVE-2009-4035
CVE-2009-4297, CVE-2009-4298, CVE-2009-4299
CVE-2009-4300, CVE-2009-4301, CVE-2009-4302
CVE-2009-4303, CVE-2009-4304, CVE-2009-4305
CVE-2009-4363, CVE-2010-0186, CVE-2010-0187
CVE-2010-0285, CVE-2010-0414, CVE-2010-0422
Content of this advisory:
1) Solved Security Vulnerabilities:
- moodle
- xpdf
- pdns-recursor
- pango
- horde
- gnome-screensaver
- fuse
- gnutls
- flash-player
2) Pending Vulnerabilities, Solutions, and Work-Arounds:
none
3) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Solved Security Vulnerabilities
To avoid flooding mailing lists with SUSE Security Announcements for minor
issues, SUSE Security releases weekly summary reports for the low profile
vulnerability fixes. The SUSE Security Summary Reports do not list or
download URLs like the SUSE Security Announcements that are released for
more severe vulnerabilities.
Fixed packages for the following incidents are already available on our FTP
server and via the YaST Online Update.
- moodle
This patch updates Moodle to the latest stable upstream version (1.9.7)
fixing multiple security issues:
CVE-2009-4297, CVE-2009-4298, CVE-2009-4299, CVE-2009-4300,
CVE-2009-4301, CVE-2009-4302, CVE-2009-4303, CVE-2009-4304,
CVE-2009-4305, MSA-09-0030
(New detection of insecure Flash player plugins)
The new version also has a completely new , more secure password handling.
Beside other features, Admins will be asked to change their passwords next
time they log in after upgrading.
Affected products: openSUSE 11.0-11.1
- xpdf
This update of xpdf fixes an integer overflow that may lead to code
execution. (CVE-2009-4035: CVSS v2 Base Score: 6.8)
Affected products: SLES SDK 9
- pdns-recursor
This update of pdns-rucursor improves the packet parsing code to fix a
possible DNS spoofing vulnerability (CVE-2009-4010) and a remote buffer
overflow that could give the ability to execute arbitrary code (CVE-2009-4009).
Affected products: openSUSE 11.0-11.2
- pango
Long glyph string could trigger a heap-based buffer overflow in pango
(CVE-2009-1194).
Affected products: openSUSE 11.0-11.1, NLD9, SLES9, SLE10, SLE11
- horde
This update of horde fixes:
- CVE-2009-3236: CVSS v2 Base Score: 5.0: Overwrite arbitrary files and
execute PHP code
- CVE-2009-3237: CVSS v2 Base Score: 5.0: Cross-Site Scripting (XSS)
- CVE-2009-3701: CVSS v2 Base Score: 4.3: Cross-Site Scripting (XSS)
- CVE-2009-4363: CVSS v2 Base Score: 4.3: Cross-Site Scripting (XSS)
Affected products: openSUSE 11.0
- gnome-screensaver
gnome-screensaver was updated to the stable release 2.28.3, fixing
various bugs and security issues.
Following security issues have been fixed:
When resuming a system gnome-screensaver does not lock external displays
that got connected while the system was suspended (CVE-2010-0285:
CVSS v2 Base Score: 5.6).
Additionally another bug in gnome-screensaver was fixed that allowed
bypassing the unlock dialog by using a removable monitor. (CVE-2010-0414:
CVSS v2 Base Score: 6.2)
Pressing "return" repeatedly caused a X error which terminated the
lock and so allowed local users to access the underlying session.
CVE-2010-0422: gnome-screensaver can lose its keyboard grab when locked,
exposing the system to intrusion by adding and removing monitors.
Affected products: openSUSE 11.1-11.2
- fuse
A race condition in fusermount allowed users to umount any filesystem
(CVE-2009-3297).
Affected products: SLE SDK 10, SLED10
- gnutls
gnutls did not properly handle embedded '\0' characters in x509
certificates. Attackers using specially crafted certificates could
exploit that to conduct man-in-the-middle attacks (CVE-2009-2730).
Affected products: openSUSE 11.2
- flash-player
Insufficient checks in flash-player allowed malicious flash applets to
create illegal cross-domain requests (CVE-2010-0186). The update also
fixes a denial of service condition (CVE-2010-0187).
Affected products: 11.0-11.2, SLE10, SLE11
______________________________________________________________________________
2) Pending Vulnerabilities, Solutions, and Work-Arounds
none
______________________________________________________________________________
3) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and on Web
sites. The authenticity and integrity of a SUSE security announcement is
guaranteed by a cryptographic signature in each announcement. All SUSE
security announcements are published with a valid signature.
To verify the signature of the announcement, save it as text into a file
and run the command
gpg --verify <file>
replacing <file> with the name of the file containing the announcement.
The output for a valid signature looks like:
gpg: Signature made <DATE> using RSA key ID 3D25D3D9
gpg: Good signature from "SuSE Security Team
participants (1)
-
Thomas Biege