gv.rpm The previous "gv" update to fix a stack overflow did not completely fix the problem spotted. An attacker could still cause the handling to use up all system memory, or open windows much wider than the X display and crash. Code execution however was not possible. lineak_kde.rpm This patch corrects a segmentation fault which prevented klineakconfig from starting. evince.rpm Specially crafted Postscript files could be used to execute arbitrary code by causing a buffer overflow in evince (CVE-2006-5864). privoxy.rpm This patch fixes the problem that privoxy stops working when network connection is switched using the Network Manager. gpg2.rpm - Specially crafted files could overflow a buffer when gpg was used in interactive mode (CVE-2006-6169). - Specially crafted files could modify a function pointer and execute code this way (CVE-2006-6235). krusader.rpm Krusader crashes whenever you try to view the properties for certain file types for which a preview can be provided (eg images). kdeaddons3-konqueror.rpm Konqueror may crash when the user tries to view a file in a new window or a new tab. sysstat.rpm The 'sysstat' package requires the 'lockfile' binary which is provided by the 'procmail' package, but 'sysstat' does not indicate this in it's requires list. pm-utils.rpm During a kernel update, the order of entries in the boot menu may change, causing the suspend routine to eventually choose the failsafe kernel as kernel to boot after resume, which fails. This has been fixed, a kernel with "noresume" is now never considered as a valid resume kernel. Other bugs that are fixed: - cron.daily was never run on machines with wireless mice (bug 226115) - HIBERNATE_METHOD=kernel did not work (bug 221999) - the incorrect bluetooth suspend hook was removed - small documentation updates wxGTK.rpm This update removes unneeded files from source code. sysvinit.rpm This update re-enables startproc to use its -i option in the correct way. This option is used e.g. to start the sendmail client after the sendmail master deamon is up and running. unison.rpm Upon opening additional subwindows (e.g. the "diff" view), the unison window disappeared and could not be restored. lvm2.rpm Fix wrong check when extending size of a logical volume. sax2-libsax.rpm Fix for sax2 users unable to activate the selected resolution on Intel onboard graphics cards sax2-ident.rpm Fix for sax2 users unable to activate the selected resolution on Intel onboard graphics cards sax2-tools.rpm Fix for sax2 users unable to activate the selected resolution on Intel onboard graphics cards sax2.rpm Fix for sax2 users unable to activate the selected resolution on Intel onboard graphics cards sax2-gui.rpm Fix for sax2 users unable to activate the selected resolution on Intel onboard graphics cards sax2-libsax-perl.rpm Fix for sax2 users unable to activate the selected resolution on Intel onboard graphics cards w3m.rpm A format string problem in w3m -dump / -backend mode could be used by a malicious server to crash w3m or execute code. (CVE-2006-6772) cyrus-imapd.rpm The "deliver" tool of the cyrus-imap suite crashed immediately after startup, when delivering mails via LMTP to a Unix Domain Socket. kdeutils3-extra.rpm This update fixes the problem of Superkaramba forgetting its running desktop widgets at every logout. totem.rpm This update enables hal functionality so that audio CD's will be recognized correctly. bluez-libs.rpm This patch fixes a problem if a Bluetooth device is activated while booting and the hci daemon failed to start. bluez-utils.rpm This patch fixes a problem if a Bluetooth device is activated while booting and the hci daemon failed to start. smb4k.rpm This update of smb4k fixes several security bugs that can be exploited locally to get access to confidential data, overwrite file contents, and to overflow process memory. neon-64bit.rpm Fix for incorrect array index handling with non-ASCII characters in the URI parser. (CVE-2007-0157) neon.rpm Fix for incorrect array index handling with non-ASCII characters in the URI parser. (CVE-2007-0157) amarok-libvisual.rpm This update collects various crash fixes for the magnatune.com album browser in album. It also corrects shell quoting issues in amarok's ruby handlers. amarok-xmms.rpm This update collects various crash fixes for the magnatune.com album browser in album. It also corrects shell quoting issues in amarok's ruby handlers. amarok-xine.rpm This update collects various crash fixes for the magnatune.com album browser in album. It also corrects shell quoting issues in amarok's ruby handlers. amarok.rpm This update collects various crash fixes for the magnatune.com album browser in album. It also corrects shell quoting issues in amarok's ruby handlers. gtk2-64bit.rpm A bug in gdk-pixbuf could crash applications such as Evolution when trying to display certain images (CVE-2007-0010) Additionally a bug in the printer dialog prevent the correct display of all connected printers. gtk2.rpm A bug in gdk-pixbuf could crash applications such as Evolution when trying to display certain images (CVE-2007-0010) Additionally a bug in the printer dialog prevent the correct display of all connected printers. powersave-devel.rpm Wait for reply from HAL when setting CPUFreq policy with cmd line client. Also consider conservative governor as dynamic policy governor. Remove united-linux from initscripts (bug 213028). Fix hotkey_handler to exit with 'EXIT', not 'exit' (bug 225643). Remove deprecated config options for CPUFreq (bug 223986). Update documentation. Prerequire hal >= 0.5.8 for update scripts to work (bug 225654). Use old method for scripts to return, don't wait for signals (bug 226397). Add a workaround for perl-Bootloader "feature" (bug 223722). powersave.rpm Wait for reply from HAL when setting CPUFreq policy with cmd line client. Also consider conservative governor as dynamic policy governor. Remove united-linux from initscripts (bug 213028). Fix hotkey_handler to exit with 'EXIT', not 'exit' (bug 225643). Remove deprecated config options for CPUFreq (bug 223986). Update documentation. Prerequire hal >= 0.5.8 for update scripts to work (bug 225654). Use old method for scripts to return, don't wait for signals (bug 226397). Add a workaround for perl-Bootloader "feature" (bug 223722). libsoup.rpm This update fixes a bug in the HTTP header parsing code. Applications using this library maybe vulnerable to a remote denial-of-service attack. (CVE-2006-5876) libsoup-devel.rpm This update fixes a bug in the HTTP header parsing code. Applications using this library maybe vulnerable to a remote denial-of-service attack. (CVE-2006-5876) libsoup-64bit.rpm This update fixes a bug in the HTTP header parsing code. Applications using this library maybe vulnerable to a remote denial-of-service attack. (CVE-2006-5876) libsoup-devel-64bit.rpm This update fixes a bug in the HTTP header parsing code. Applications using this library maybe vulnerable to a remote denial-of-service attack. (CVE-2006-5876) compiz.rpm compiz has been extremely slow on intel graphics hardware due to a missing flush command. compiz also works with XCB now. libgtop.rpm This update fixes a buffer overflow in libgtop's glibtop_get_proc_map_s() function. (CVE-2007-0235) libgtop-devel.rpm This update fixes a buffer overflow in libgtop's glibtop_get_proc_map_s() function. (CVE-2007-0235) libgtop-64bit.rpm This update fixes a buffer overflow in libgtop's glibtop_get_proc_map_s() function. (CVE-2007-0235) rrdtool.rpm This update of rrdtool fixes a denial-of-service problem that occurs when rrdgraph tries to graph data on a logarithmic scale and the data processed is <= 0. yast2-sound.rpm Some early G5 models did work with snd-powermac driver, but the newer ones do now require a new snd-aoa driver. Unfortunately, yast always used snd-powermac driver and snd-aoa was missing in the driver database. This patch adds snd-aoa driver to the database and snd-aoa driver is used instead of snd-powermac if needed. NetworkManager-kde.rpm - Show an appropriate error message when a VPN connection fails. - Fix deadlock with kwallet which prevented KNetworkManager from working. - Add missing dial-up icon. - Fix seldom crash when selecting a wireless network from the context menu. - Make "Cancel" button for VPN connections work. chmlib.rpm This update of chmlib fixes a vulnerability that allowed the execution of arbitrary code. CVE-2007-0619 chmlib-devel.rpm This update of chmlib fixes a vulnerability that allowed the execution of arbitrary code. CVE-2007-0619 pam.rpm A bug in pam_unix module allowed users under certain circumstances to log in although their account was locked. pam_unix is not used on openSUSE by default though (CVE-2007-0003). pam-64bit.rpm A bug in pam_unix module allowed users under certain circumstances to log in although their account was locked. pam_unix is not used on openSUSE by default though (CVE-2007-0003). kdenetwork3-InstantMessenger.rpm Groupwise Messenger SP2 introduces the use of keepalives to conserve server resources. This requires a client update to enable the sending of keepalives. hal-resmgr.rpm This update grants regular users access to the floppy disk drive again. rubygems.rpm This update fixes a vulnerability in rubygems that allowed to overwrite files with root privileges. (CVE-2007-0469) gdm.rpm This update fixes three problems: - Fixes broken default.conf. - Fixes bad SuSEconfig interpretation of DISPLAYMANAGER_REMOTE_ACCESS. - Fixes bad SuSEconfig interpretation of DISPLAYMANAGER_XSERVER_TCP_PORT_6000_OPEN. gnokii.rpm Gnokii on openSUSE 10.2 is compiled with stack-protector turned on, which catches buffer overflows when reading SMS messages from mobile device. Broken code was fixed in upstream CVS, patch backports some of the changes to avoid such overflows. kpowersave.rpm This package update KPowersave to the new version 0.7.2. This include fixes for KPowersave crashes (#225212/#223637/#231184) updated configure dialog (#221715/#223922) to set these settings: create/delete schemes, set per-scheme CPU Freq Policy, define battery warning levels and actions if a level reached, configure button events (lidclose/suspend/sleee/power) and define default schemes if the machine is on AC or battery. Also fixed: compiler warnings (#231709), fixed battery state info in detailed info dialog (#230965), apply DPMS settings from config dialog (#230686), fixed eventhandling to avoid KPowersave to use 100% of CPU (#244052) and several CPU Freq Scaling related bugs (#223517/#223164/#229234/#229960/#245081). KPowersave try now to umount external media on Suspend - you need to update kdebase3 to avoid warnings (215262). Additionally KPowersave show now the current power consumption in the information dialog if the battery is discharging. enlightenment.rpm This patch fixes a bug that causes Enlightenment to crash on start, with message "No themes were found in the default theme directory ${prefix}/share/e16/themes/". Patch also restores Enlightenment as a choice in KDM and GDM. gnome-terminal.rpm This update fixes invalid window resizes while switching between tabs. doxygen.rpm doxygen in version 1.5.0 creates wrong latex code (missing space after \bf) so that latex post processing will crash. quickcam-kmp-default.rpm Since the 2.6.18.8 kernel update changed some symbols it is necessary to publish updated to some Kernel Module Packages related to Video handling. lirc-kmp-default.rpm Since the 2.6.18.8 kernel update changed some symbols it is necessary to publish updated to some Kernel Module Packages related to Video handling. yast2-printer.rpm This patch will fix several bugs: (#240727) - show also remote printers (#220712) - if more PPD's are available, select recommended first (#214243) - suggest PPD file for the selected printer (#223838) - select proper default queue evolution-exchange.rpm Fixes the annoying issue of not remembering passwords if GNOME is not used. Evolution uses GNOME Keyring for password management and the keyring daemon is started automatically only under GNOME. If the user uses KDE or any other desktop environment, Evolution wont remember passwords. This update fixes the issue by providing a fallback to the old private file based encoded password management. syslog-ng.rpm This update provides fixes for following issues: - Bug #250562: Fixed to set signal handlers before the config and thus the log destinations are initialized to avoid the creation of zombie processes when a program (e.g. destination) fails to execute, e.g. because apparmor profile prohibits it. - Bug #249555: Fix for additional log sockets extension (-a option); syslog-ng dropped messages on the sockets after a config file reload. - Bug #240676: Implemented checks to detect recursive filter definitions. rekall-unisql.rpm If rekall initialized the python interpreter, it crashed due to a a Python 2.5.x incompatibility in the code. rekall-postgresql.rpm If rekall initialized the python interpreter, it crashed due to a a Python 2.5.x incompatibility in the code. rekall.rpm If rekall initialized the python interpreter, it crashed due to a a Python 2.5.x incompatibility in the code. rekall-mysql.rpm If rekall initialized the python interpreter, it crashed due to a a Python 2.5.x incompatibility in the code. rekall-xbase.rpm If rekall initialized the python interpreter, it crashed due to a a Python 2.5.x incompatibility in the code. rekall-examples.rpm If rekall initialized the python interpreter, it crashed due to a a Python 2.5.x incompatibility in the code. gpg.rpm When printing a text stream with a GPG signature it was possible for an attacker to create a stream with "unsigned text, signed text" where both unsigned and signed text would be shown without distinction which one was signed and which part wasn't. This is tracked by the Mitre CVE ID CVE-2007-1263. The update introduces a new option --allow-multiple-messages to print out such messages in the future, by default it only prints and handles the first one. pam_ssh.rpm If you are using pam_ssh for authentication, "cron" would crash when trying to execute jobs. This update fixes this problem. unrar.rpm This update fixes a stack-absed buffer overflow in unrar that can be exploited with user-assistence by sending a password-protected archive. (CVE-2007-0855) TeXmacs.rpm Upgrades TeXmacs from version 1.0.6.6 to version 1.0.6.9. This repairs relation between TeXmacs and new guile and thereby shifts away TeXmacs crash on startup. NetworkManager-gnome.rpm This NetworkManager package contains an adjustment required for support of Prism GT/Duette devices (driver "prism54"). Please note that you also need install the kernel update for prism54 operating under NetworkManager. NetworkManager-glib.rpm This NetworkManager package contains an adjustment required for support of Prism GT/Duette devices (driver "prism54"). Please note that you also need install the kernel update for prism54 operating under NetworkManager. NetworkManager-devel.rpm This NetworkManager package contains an adjustment required for support of Prism GT/Duette devices (driver "prism54"). Please note that you also need install the kernel update for prism54 operating under NetworkManager. NetworkManager.rpm This NetworkManager package contains an adjustment required for support of Prism GT/Duette devices (driver "prism54"). Please note that you also need install the kernel update for prism54 operating under NetworkManager. libwpd-tools.rpm CVE-2007-0002: Various problems were fixed in the Wordperfect converter library libwpd in OpenOffice_org which could be used by remote attackers to potentially execute code or crash OpenOffice_org. libwpd-devel.rpm CVE-2007-0002: Various problems were fixed in the Wordperfect converter library libwpd in OpenOffice_org which could be used by remote attackers to potentially execute code or crash OpenOffice_org. libwpd.rpm CVE-2007-0002: Various problems were fixed in the Wordperfect converter library libwpd in OpenOffice_org which could be used by remote attackers to potentially execute code or crash OpenOffice_org. libqt4-devel.rpm qt wrongly accepts overly long UTF-8 sequences due to a bug in the UTF-8 decoder. This may lead to security problems unter certain circumstances. The bug for example allows for script tag injection in konqueror (CVE-2007-0242). libqt4.rpm qt wrongly accepts overly long UTF-8 sequences due to a bug in the UTF-8 decoder. This may lead to security problems unter certain circumstances. The bug for example allows for script tag injection in konqueror (CVE-2007-0242). libqt4-x11.rpm qt wrongly accepts overly long UTF-8 sequences due to a bug in the UTF-8 decoder. This may lead to security problems unter certain circumstances. The bug for example allows for script tag injection in konqueror (CVE-2007-0242). gwenview.rpm This Update fixes a crash during scaling overly large images. mediawiki.rpm This update fixes a cross site scripting (XSS) bug in the AJAX features (CVE-2007-0177). scpm.rpm This patch fixes boot-into-profile support, which failed when using a separate /var partition. xmms-lib-64bit.rpm Two integer overflows when processing BMP skin images potentially allows attackers to execute arbitrary code via specially crafted files (CVE-2007-0653,CVE-2007-0654). xmms-lib.rpm Two integer overflows when processing BMP skin images potentially allows attackers to execute arbitrary code via specially crafted files (CVE-2007-0653,CVE-2007-0654). xmms.rpm Two integer overflows when processing BMP skin images potentially allows attackers to execute arbitrary code via specially crafted files (CVE-2007-0653,CVE-2007-0654). xmms-devel.rpm Two integer overflows when processing BMP skin images potentially allows attackers to execute arbitrary code via specially crafted files (CVE-2007-0653,CVE-2007-0654). spamassassin.rpm This upgrade brings spamassassin to version 3.1.8 with following changes: * fix for CVE-2007-0451: possible DoS due to incredibly long URIs found in the message content. * disable perl module usage in update channels unless --allowplugins is specified * files with names starting/ending in whitespace weren't usable * remove Text::Wrap related code due to upstream issues * update spamassassin and sa-learn to better deal with STDIN * improvements and bug fixes related to DomainKeys and DKIM support * several updates for Received header parsing * several documentation updates and random taint-variable related issues This update also adds some missing dependencies. perl-spamassassin.rpm This upgrade brings spamassassin to version 3.1.8 with following changes: * fix for CVE-2007-0451: possible DoS due to incredibly long URIs found in the message content. * disable perl module usage in update channels unless --allowplugins is specified * files with names starting/ending in whitespace weren't usable * remove Text::Wrap related code due to upstream issues * update spamassassin and sa-learn to better deal with STDIN * improvements and bug fixes related to DomainKeys and DKIM support * several updates for Received header parsing * several documentation updates and random taint-variable related issues This update also adds some missing dependencies. ktorrent.rpm Ktorrent insufficiently validated the target file name. A malicious Server could therefore overwrite arbitary files of the user (CVE-2007-1384,CVE-2007-1799). Another bug could be exploited to crash Ktorrent (CVE-2007-1385). digikam.rpm This update fixes digikam calling dcraw with the option -2, which it does not support. cron.rpm By setting hard links to /etc/crontab users were able to prevent cron from running scheduled jobs (CVE-2007-1856). A re-emerged symlink bug allowed users to edit the crontab of other users (CVE-2005-1038). xorg-x11-libX11.rpm Integer overflows in the XC-MISC extension of the X-server could potentially be exploited to execute code with root privileges (CVE-2007-1003). Integer overflows in libX11 could cause crashes (CVE-2007-1667). Integer overflows in the font handling of the X-server could potentially be exploited to execute code with root privileges (CVE-2007-1352, CVE-2007-1351). xorg-x11-libX11-64bit.rpm Integer overflows in the XC-MISC extension of the X-server could potentially be exploited to execute code with root privileges (CVE-2007-1003). Integer overflows in libX11 could cause crashes (CVE-2007-1667). Integer overflows in the font handling of the X-server could potentially be exploited to execute code with root privileges (CVE-2007-1352, CVE-2007-1351). man.rpm A heap based buffer overflow in the 'man' command could potentially be exploited by users to run code as root (CVE-2006-4250). dovecot.rpm A bug in dovecot allowed users to read compressed mailboxes of other users under certain circumstances. radiusclient.rpm MD5 code in radiusclient is broken on 64 bit architectures. This issue was fixed by replacing broken code with recent version from freeradius-client. ipsec-tools.rpm A bug in the IKE daemon "racoon" allowed remote attackers shut down established tunnels (CVE-2007-1841). inkscape.rpm Several format string problems where fixed in inkscape. CVE-2007-1463: A format string vulnerability in Inkscape allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a URI, which is not properly handled by certain dialogs. CVE-2007-1464: Format string vulnerability in the whiteboard Jabber protocol in Inkscape allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. rarpd.rpm rarpd was sending reply packets with increasing leading in the end to rarpd not being able to send packets at all anymore and so disabling itself. This bug has been fixed. libvisual.rpm This update recommends additional gstreamer packages to be able to play as much as possible by GStreamer-enabled applications. gstreamer010-plugins-base-visual-64bit.rpm This update recommends additional gstreamer packages to be able to play as much as possible by GStreamer-enabled applications. gstreamer010-plugins-base.rpm This update recommends additional gstreamer packages to be able to play as much as possible by GStreamer-enabled applications. libvisual-64bit.rpm This update recommends additional gstreamer packages to be able to play as much as possible by GStreamer-enabled applications. gstreamer010-plugins-base-64bit.rpm This update recommends additional gstreamer packages to be able to play as much as possible by GStreamer-enabled applications. liboil-64bit.rpm This update recommends additional gstreamer packages to be able to play as much as possible by GStreamer-enabled applications. liboil.rpm This update recommends additional gstreamer packages to be able to play as much as possible by GStreamer-enabled applications. gstreamer010-plugins-base-oil.rpm This update recommends additional gstreamer packages to be able to play as much as possible by GStreamer-enabled applications. gstreamer010-plugins-base-oil-64bit.rpm This update recommends additional gstreamer packages to be able to play as much as possible by GStreamer-enabled applications. gstreamer010-plugins-base-visual.rpm This update recommends additional gstreamer packages to be able to play as much as possible by GStreamer-enabled applications. resmgr.rpm Under certain circumstances hal-resmgr and resmgrd could run into a deadlock situation. resmgr-64bit.rpm Under certain circumstances hal-resmgr and resmgrd could run into a deadlock situation. audit.rpm This update of the audit package contains following fixes: - On receiving the SIGUSR1 signal, audit was going into an infinite loop and locked up. - audispd has been moved to the audit-libs-python package. audit-libs-python.rpm This update of the audit package contains following fixes: - On receiving the SIGUSR1 signal, audit was going into an infinite loop and locked up. - audispd has been moved to the audit-libs-python package. audit-libs.rpm This update of the audit package contains following fixes: - On receiving the SIGUSR1 signal, audit was going into an infinite loop and locked up. - audispd has been moved to the audit-libs-python package. audit-libs-64bit.rpm This update of the audit package contains following fixes: - On receiving the SIGUSR1 signal, audit was going into an infinite loop and locked up. - audispd has been moved to the audit-libs-python package. audit-devel.rpm This update of the audit package contains following fixes: - On receiving the SIGUSR1 signal, audit was going into an infinite loop and locked up. - audispd has been moved to the audit-libs-python package. ekiga.rpm This update fixes format string problems in ekiga. (CVE-2007-1006) xscreensaver.rpm xscreensaver could crash under certain circumstances and so cause unlocking the screen. That could happen for example when LDAP is used for authentication and the network connection gets interrupted for a long time (CVE-2007-1859). banshee.rpm This update brings Helix(r) Banshee(tm) and its dependend packages ipod-sharp and helix-dbus-server to version 0.12.0. This update contains lots of bugfixes and also support for new iPod revisions. banshee-plugins-extra.rpm This update brings Helix(r) Banshee(tm) and its dependend packages ipod-sharp and helix-dbus-server to version 0.12.0. This update contains lots of bugfixes and also support for new iPod revisions. banshee-engine-gst.rpm This update brings Helix(r) Banshee(tm) and its dependend packages ipod-sharp and helix-dbus-server to version 0.12.0. This update contains lots of bugfixes and also support for new iPod revisions. libipoddevice-devel.rpm This update brings Helix(r) Banshee(tm) and its dependend packages ipod-sharp and helix-dbus-server to version 0.12.0. This update contains lots of bugfixes and also support for new iPod revisions. libipoddevice.rpm This update brings Helix(r) Banshee(tm) and its dependend packages ipod-sharp and helix-dbus-server to version 0.12.0. This update contains lots of bugfixes and also support for new iPod revisions. banshee-plugins-DAAP.rpm This update brings Helix(r) Banshee(tm) and its dependend packages ipod-sharp and helix-dbus-server to version 0.12.0. This update contains lots of bugfixes and also support for new iPod revisions. banshee-devel.rpm This update brings Helix(r) Banshee(tm) and its dependend packages ipod-sharp and helix-dbus-server to version 0.12.0. This update contains lots of bugfixes and also support for new iPod revisions. libipoddevice-64bit.rpm This update brings Helix(r) Banshee(tm) and its dependend packages ipod-sharp and helix-dbus-server to version 0.12.0. This update contains lots of bugfixes and also support for new iPod revisions. ipod-sharp.rpm This update brings Helix(r) Banshee(tm) and its dependend packages ipod-sharp and helix-dbus-server to version 0.12.0. This update contains lots of bugfixes and also support for new iPod revisions. banshee-plugins-default.rpm This update brings Helix(r) Banshee(tm) and its dependend packages ipod-sharp and helix-dbus-server to version 0.12.0. This update contains lots of bugfixes and also support for new iPod revisions. quagga-devel.rpm Remote attackers could crash quagga via specially crafted "UPDATE" messages (CVE-2007-1995). quagga.rpm Remote attackers could crash quagga via specially crafted "UPDATE" messages (CVE-2007-1995). libjasper.rpm This update fixes two problems in libjasper that occured while parsing image files. Both bugs lead to memory corruption. libjasper-64bit.rpm This update fixes two problems in libjasper that occured while parsing image files. Both bugs lead to memory corruption. jasper.rpm This update fixes two problems in libjasper that occured while parsing image files. Both bugs lead to memory corruption. rdesktop.rpm After installing the latest security updates of X.org, rdesktop crashed with segmentation fault. freeradius-devel.rpm A memory leak in the code for handling EAP-TTLS tunnels could be exploited by attackers to crash freeradius (CVE-2007-2028). freeradius.rpm A memory leak in the code for handling EAP-TTLS tunnels could be exploited by attackers to crash freeradius (CVE-2007-2028). xfsdump.rpm The program xfs_fsr created a temporary directory with unrestricted read and write permissions. qemu.rpm USB passthrough in QEMU did not work because it relies on the obsolete usbdevfs infrastructure. This fix converts QEMU to using sysfs instead, making USB passthrough work again. valgrind.rpm This patch updates to valgrind version 3.2.3 to fix various bugs in the CPU simulation, especially on ppc32. perl-Archive-Tar.rpm A earlier spamassassin update added a new dependency for perl-Archive-Tar. This causes illegible errormessages from the update stack which are not do not point to this problem. Since it requires the package to be pulled from the installation media which might not be listed anymore this update just contains the package to fulfill the new dependencies. It contains no changes compared to the original shipping version. gnash.rpm This update fixes a denial of service problem in the free flash player gnash. (CVE-2007-2500) hal-devel.rpm This updated fixes several problems with the HAL package: - allow gid=/uid= mount option for removable media with hfs filesystem (#232235). - add/allow the -o flush mount option for vfat partitions (#230737). - contains a fix for broken ACPI batteries which report wrong charging/discharging states to allow guess the remaining time (#258755). - contains and a fix to solve race conditions between HAL and pam_mount if the user automatically mount LUKS partitions on login (#225135). hal-64bit.rpm This updated fixes several problems with the HAL package: - allow gid=/uid= mount option for removable media with hfs filesystem (#232235). - add/allow the -o flush mount option for vfat partitions (#230737). - contains a fix for broken ACPI batteries which report wrong charging/discharging states to allow guess the remaining time (#258755). - contains and a fix to solve race conditions between HAL and pam_mount if the user automatically mount LUKS partitions on login (#225135). hal.rpm This updated fixes several problems with the HAL package: - allow gid=/uid= mount option for removable media with hfs filesystem (#232235). - add/allow the -o flush mount option for vfat partitions (#230737). - contains a fix for broken ACPI batteries which report wrong charging/discharging states to allow guess the remaining time (#258755). - contains and a fix to solve race conditions between HAL and pam_mount if the user automatically mount LUKS partitions on login (#225135). gnome-main-menu-devel.rpm The main-menu applet starts hanging/slowing down after system has been running multiple applications after 1-2 hours of system uptime. Menu becomes extremely slow, and unusable. This package updates the gnome-main-menu to a newer version which addresses these issues. This problem is tracked at https://bugzilla.novell.com/show_bug.cgi?id=229190 (BNC #229190). gnome-main-menu.rpm The main-menu applet starts hanging/slowing down after system has been running multiple applications after 1-2 hours of system uptime. Menu becomes extremely slow, and unusable. This package updates the gnome-main-menu to a newer version which addresses these issues. This problem is tracked at https://bugzilla.novell.com/show_bug.cgi?id=229190 (BNC #229190). file-64bit.rpm This update fixes an integer overflow in function file_printf() of file. This bug can be used to execute arbitrary code. file.rpm This update fixes an integer overflow in function file_printf() of file. This bug can be used to execute arbitrary code. file-devel.rpm This update fixes an integer overflow in function file_printf() of file. This bug can be used to execute arbitrary code. dhcp-server.rpm This updated fixes several problems with the DHCP-Server in LDAP mode: - Fixed ldap_read_function to avoid returning of an empty strings causing parsing errors while parsing (of static host declarations) in ldap-dynamic mode (#267966). - Fix to generate proper "host ... {" block begin brace even when no hardware address is specified in the host declaration (#265337). - Fix for object order related parse error, that occurred in case an dhcp-ldap object referencing an dhcp-class object is parsed before the declaration of the dhcp-class (#250153). - Added a check for EOF in parse_pool_statement to avoid endless recursion loop, when a closing right brace "}" was missed at the end of a pool declaration (#162186). pulseaudio.rpm This update of pulseaudio fixes a denial-of-service bug that can be triggered remotely. (CVE-2007-1804) pulseaudio-devel.rpm This update of pulseaudio fixes a denial-of-service bug that can be triggered remotely. (CVE-2007-1804) pulseaudio-libs.rpm This update of pulseaudio fixes a denial-of-service bug that can be triggered remotely. (CVE-2007-1804) fox16.rpm Support for Japanese, Chinese and Korean Input is disabled with this update. After enabling this support a xim server must be running even for all other languages - otherwise keyboard input is disabled. fox16-devel.rpm Support for Japanese, Chinese and Korean Input is disabled with this update. After enabling this support a xim server must be running even for all other languages - otherwise keyboard input is disabled. kaffeine.rpm When kaffeine is installed, the konqueror embedding frequently causes crashes in X due to multithreading issues. These cannot be fixed properly for older products, so as a workaround the embedding is disabled. mutt.rpm This update of mutt fixes a vulnerability in the APOP implementation that allows an active attacker to guess three bytes of the password. (CVE-2007-1558) avahi-compat-mDNSResponder-devel.rpm Local attackers could send empty TXT data via D-BUS, causing the avahi daemon to exit. CVE-2007-3372 has been assigned to this issue. avahi-compat-mDNSResponder.rpm Local attackers could send empty TXT data via D-BUS, causing the avahi daemon to exit. CVE-2007-3372 has been assigned to this issue. avahi-devel.rpm Local attackers could send empty TXT data via D-BUS, causing the avahi daemon to exit. CVE-2007-3372 has been assigned to this issue. avahi-qt3.rpm Local attackers could send empty TXT data via D-BUS, causing the avahi daemon to exit. CVE-2007-3372 has been assigned to this issue. avahi-mono.rpm Local attackers could send empty TXT data via D-BUS, causing the avahi daemon to exit. CVE-2007-3372 has been assigned to this issue. avahi-qt4.rpm Local attackers could send empty TXT data via D-BUS, causing the avahi daemon to exit. CVE-2007-3372 has been assigned to this issue. avahi-glib.rpm Local attackers could send empty TXT data via D-BUS, causing the avahi daemon to exit. CVE-2007-3372 has been assigned to this issue. avahi-compat-howl-devel.rpm Local attackers could send empty TXT data via D-BUS, causing the avahi daemon to exit. CVE-2007-3372 has been assigned to this issue. avahi.rpm Local attackers could send empty TXT data via D-BUS, causing the avahi daemon to exit. CVE-2007-3372 has been assigned to this issue. avahi-compat-howl.rpm Local attackers could send empty TXT data via D-BUS, causing the avahi daemon to exit. CVE-2007-3372 has been assigned to this issue. gd.rpm This update fixes multiple integer overflows in the gd library. Specially crafted files could leverage them to at least crash gd based applications (CVE-2007-3472, CVE-2007-3475, CVE-2007-3476, CVE-2007-3477, CVE-2007-3478). gd-devel.rpm This update fixes multiple integer overflows in the gd library. Specially crafted files could leverage them to at least crash gd based applications (CVE-2007-3472, CVE-2007-3475, CVE-2007-3476, CVE-2007-3477, CVE-2007-3478). kvirc.rpm A bug in the IRC-URI parser allowed attackers to execute arbitrary commands by tricking a user into opening a specially crafted URI in kvirc (CVE-2007-2951). evolution-pilot.rpm Format string problems in the Memo Viewer of evolution could be used to potentially execute code when viewing shared memos. (CVE-2007-1002) evolution.rpm Format string problems in the Memo Viewer of evolution could be used to potentially execute code when viewing shared memos. (CVE-2007-1002) evolution-devel.rpm Format string problems in the Memo Viewer of evolution could be used to potentially execute code when viewing shared memos. (CVE-2007-1002) freetype2-devel-64bit.rpm Freetype <= 2.3.0rc1 ran in an endless loop when opening some malformed font files like those which come with Rosegarden or TeXmacs. This update to freetype 2.3.5 includes a fix for the problem. freetype2.rpm Freetype <= 2.3.0rc1 ran in an endless loop when opening some malformed font files like those which come with Rosegarden or TeXmacs. This update to freetype 2.3.5 includes a fix for the problem. freetype2-devel.rpm Freetype <= 2.3.0rc1 ran in an endless loop when opening some malformed font files like those which come with Rosegarden or TeXmacs. This update to freetype 2.3.5 includes a fix for the problem. freetype2-64bit.rpm Freetype <= 2.3.0rc1 ran in an endless loop when opening some malformed font files like those which come with Rosegarden or TeXmacs. This update to freetype 2.3.5 includes a fix for the problem. icewm-gnome.rpm This update fixes a crash in icewm that happened when exiting any qt4 application. icewm-default.rpm This update fixes a crash in icewm that happened when exiting any qt4 application. icewm-lite.rpm This update fixes a crash in icewm that happened when exiting any qt4 application. perl-File-HomeDir.rpm When a perl script uses AppConfig, it will abort because HomeDir.pm is missing. This package adds that module. libarchive.rpm Specially crafted tar-archives could cause programs based on libarchive to crash, to run into an enless loop or potentially to even execute arbitrary code (CVE-2007-3641, CVE-2007-3644, CVE-2007-3645). libarchive-devel.rpm Specially crafted tar-archives could cause programs based on libarchive to crash, to run into an enless loop or potentially to even execute arbitrary code (CVE-2007-3641, CVE-2007-3644, CVE-2007-3645). bsdtar.rpm Specially crafted tar-archives could cause programs based on libarchive to crash, to run into an enless loop or potentially to even execute arbitrary code (CVE-2007-3641, CVE-2007-3644, CVE-2007-3645). asterisk.rpm This update fixes multiple bugs in asterisk that allowed remote attackers to crash the asterisk server or even execute arbitrary code (CVE-2007-3762, CVE-2007-3763, CVE-2007-3764). bind-utils.rpm The bind nameserver generated predicatable DNS query IDs. Remote attackers could use that to perform DNS poisoning attacks (CVE-2007-2926). bind-libs-64bit.rpm The bind nameserver generated predicatable DNS query IDs. Remote attackers could use that to perform DNS poisoning attacks (CVE-2007-2926). bind.rpm The bind nameserver generated predicatable DNS query IDs. Remote attackers could use that to perform DNS poisoning attacks (CVE-2007-2926). bind-libs.rpm The bind nameserver generated predicatable DNS query IDs. Remote attackers could use that to perform DNS poisoning attacks (CVE-2007-2926). gimp-devel.rpm Multiple gimp import filters contained integer overflows. Attackers could exploit that to potentially execute code by tricking users into opening specially crafted files (CVE-2006-4519). gimp-unstable.rpm Multiple gimp import filters contained integer overflows. Attackers could exploit that to potentially execute code by tricking users into opening specially crafted files (CVE-2006-4519). gimp.rpm Multiple gimp import filters contained integer overflows. Attackers could exploit that to potentially execute code by tricking users into opening specially crafted files (CVE-2006-4519). gimp-unstable-devel.rpm Multiple gimp import filters contained integer overflows. Attackers could exploit that to potentially execute code by tricking users into opening specially crafted files (CVE-2006-4519). aaa_base.rpm Firefox (and konqueror) try to download aspx pages rather than rendering them. Bug reproduced by visting http://www.jobcentreplus.gov.uk/JCP/Customers/index.html and clicking on the search for a job link. Open file dialogue will come up with no way to render the page Bug has been discussed and a work around found in the mozilla bugzilla but as bug is to do with opensuse I have filed it here too as bug has been carried forward from Suse 10.1 to opensuse 10.2 Work around is to comment out the "application/x-aspx aspx" line in /etc/mime.types by placing a # before that line tcpdump.rpm This update fixes a buffer overlow that could be triggered when displaying BGP packets (CVE-2007-3798). perl-Net-DNS.rpm perl-Net-DNS used sequential IDs for DNS lookups which could cause problem with some programs like spamassassin. It potentially also simplified DNS spoofing attacks against perl-Net-DNS (CVE-2007-3377). Additionally malformed compressed DNS packets could trigger an endless loop in perl-Net-DNS (CVE-2007-3409). open-iscsi.rpm This update fixes insecure privileges and credential verification with the iscsi daemon. (CVE-2007-3099, CVE-2007-3100) opensuse-updater.rpm Fixes a lot of bugs: - opensuseupdater says there is one update, fires YOU, and this says there is none. (#279355) - opensuseupdater detail window uses default icon (#279879) - doesn't refresh (to no updated needed) after update installed (#227795) - should wait for initial update until (K)NetworkManager has established connection (#231203) - missing one German translation (#244583) - unfortune default column width (#262332) - text cut off (#220870) - warning message on STDOUT (224548) - Software strings / Window names (#221236) - text cut off (#220870) yast2-gtk.rpm - Patches which are broken will be installed again. - Required kmp packges FOR EACH installed/to_be_installed kernel will be installed too. - Upgrade: Do NOT delete packages which have unresolved dependencies. yast2-pkg-bindings.rpm - Patches which are broken will be installed again. - Required kmp packges FOR EACH installed/to_be_installed kernel will be installed too. - Upgrade: Do NOT delete packages which have unresolved dependencies. libzypp-devel.rpm - Patches which are broken will be installed again. - Required kmp packges FOR EACH installed/to_be_installed kernel will be installed too. - Upgrade: Do NOT delete packages which have unresolved dependencies. libzypp-zmd-backend.rpm - Patches which are broken will be installed again. - Required kmp packges FOR EACH installed/to_be_installed kernel will be installed too. - Upgrade: Do NOT delete packages which have unresolved dependencies. libzypp.rpm - Patches which are broken will be installed again. - Required kmp packges FOR EACH installed/to_be_installed kernel will be installed too. - Upgrade: Do NOT delete packages which have unresolved dependencies. yast2-perl-bindings.rpm - Patches which are broken will be installed again. - Required kmp packges FOR EACH installed/to_be_installed kernel will be installed too. - Upgrade: Do NOT delete packages which have unresolved dependencies. yast2-qt.rpm - Patches which are broken will be installed again. - Required kmp packges FOR EACH installed/to_be_installed kernel will be installed too. - Upgrade: Do NOT delete packages which have unresolved dependencies. ruby-zypp.rpm - Patches which are broken will be installed again. - Required kmp packges FOR EACH installed/to_be_installed kernel will be installed too. - Upgrade: Do NOT delete packages which have unresolved dependencies. procmail.rpm With newer kernels procmail can not use both fcntl(2) and flock(2) to get a lock on a data file located on a NFS. Both locking schemes can not be used together on NFS with this kernels. RealPlayer.rpm The media player RealPlayer was updated to version 10.0.9. pfstools.rpm A buffer overflow when processing RGBE file could potentially allow attackers to execute arbitrary code by tricking the victim into running 'pfsinrgbe' on a specially crafted file (CVE-2007-2956). vim-enhanced.rpm This update of Vim addresses a format-string bug in "helptags". This bug can be exploited to execute code with the privileges of the user running Vim. (CVE-2007-2953) vim.rpm This update of Vim addresses a format-string bug in "helptags". This bug can be exploited to execute code with the privileges of the user running Vim. (CVE-2007-2953) gvim.rpm This update of Vim addresses a format-string bug in "helptags". This bug can be exploited to execute code with the privileges of the user running Vim. (CVE-2007-2953) star.rpm This update fixes a directory traversal bug in star. (CVE-2007-4131) tar.rpm This update fixes a bug in function safer_name_suffix() of tar which leads to a crashing stack. Exploitability is unknown. cpio.rpm This update fixes a bug in function safer_name_suffix() of cpio which leads to a crashing stack. Exploitability is unknown. (CVE-2007-4476) mxml.rpm The shared library of mxml was included in the update so linking into other shared libraries/plugins works. kdenetwork3.rpm The Kopete Yahoo plugin had two issues: that it was not always possible to add buddies to an account; and that Kopete crashed if an account was disconnected due to a duplicate login. This update fixes those issues. pptpd.rpm This update fixes a bug found by regression tests. The error appears in code processing out-of-order sequence numbers of some MPPE implementations. id3lib-devel.rpm This update fixes a bug that allows local attackers to overwrite arbitrary files. (CVE-2007-4460) id3lib-examples.rpm This update fixes a bug that allows local attackers to overwrite arbitrary files. (CVE-2007-4460) id3lib.rpm This update fixes a bug that allows local attackers to overwrite arbitrary files. (CVE-2007-4460) qt3-devel-tools-64bit.rpm This update fixes a buffer overflow in qt3 while handling UTF8 characters. (CVE-2007-4137) qt3-devel-tools.rpm This update fixes a buffer overflow in qt3 while handling UTF8 characters. (CVE-2007-4137) qt3-devel.rpm This update fixes a buffer overflow in qt3 while handling UTF8 characters. (CVE-2007-4137) qt3-64bit.rpm This update fixes a buffer overflow in qt3 while handling UTF8 characters. (CVE-2007-4137) qt3.rpm This update fixes a buffer overflow in qt3 while handling UTF8 characters. (CVE-2007-4137) qt3-static.rpm This update fixes a buffer overflow in qt3 while handling UTF8 characters. (CVE-2007-4137) qt3-devel-64bit.rpm This update fixes a buffer overflow in qt3 while handling UTF8 characters. (CVE-2007-4137) balsa.rpm This update of balsa fixes a buffer overflow that occurs while reading data from an IMAP server. python-pyx.rpm The python module pyx throws an exception when imported, which is caused by badly created configuration file. This update fixes the config file, thereby making pyx functional again. yast2-ncurses.rpm There is a bug in yast2-ncurses disk space calculation which causes a floating point exception for partitions with zero size (e.g. nfs shares, mounted cluster volumes). This bugfix solves the problem. perl-Bootloader.rpm This update of perl-Bootloader fixes various problems found since the last maintenance update: - Determine md device corresponding to md member device - Avoid duplicate entries in lilolike bootloaders - Added YaST2 comment to sections created by perl-Bootloader - Fixed boot entries of self compiled kernels - Implemented a mechanism to not throw out any user defined sections in menu.lst - Fixed default value handling - Fixed resolution of kernel and initrd symlinks - Remove entries with non existing initrd - Fix section names properly - Fixed creation of failsafe sections in boot menu - Fixed label naming scheme for boot entries so that debug or vanilla kernel entries for instance get named correctly - Fixed failsafe parameters - Implemented enhanced logging mechanism tk-devel.rpm This update fixes a buffer overflow that occurs while processing interlaced/animatedGIF images. (CVE-2007-4851) This bug could be used to execute code remotely. tk-64bit.rpm This update fixes a buffer overflow that occurs while processing interlaced/animatedGIF images. (CVE-2007-4851) This bug could be used to execute code remotely. tk.rpm This update fixes a buffer overflow that occurs while processing interlaced/animatedGIF images. (CVE-2007-4851) This bug could be used to execute code remotely. xorg-x11-doc.rpm This update fixes the following issues: X Font Server build_range() Integer Overflow Vulnerability [IDEF2708], X Font Server swap_char2b() Heap Overflow Vulnerability [IDEF2709], Composite extension buffer overflow. xorg-x11.rpm This update fixes the following issues: X Font Server build_range() Integer Overflow Vulnerability [IDEF2708], X Font Server swap_char2b() Heap Overflow Vulnerability [IDEF2709], Composite extension buffer overflow. lighttpd-mod_rrdtool.rpm This update fixes a buffer overflow in the fcgi_env_add() function. Under some circumstances this bug allows remote code execution. (CVE-2007-4727) lighttpd-mod_mysql_vhost.rpm This update fixes a buffer overflow in the fcgi_env_add() function. Under some circumstances this bug allows remote code execution. (CVE-2007-4727) lighttpd-mod_cml.rpm This update fixes a buffer overflow in the fcgi_env_add() function. Under some circumstances this bug allows remote code execution. (CVE-2007-4727) lighttpd.rpm This update fixes a buffer overflow in the fcgi_env_add() function. Under some circumstances this bug allows remote code execution. (CVE-2007-4727) lighttpd-mod_webdav.rpm This update fixes a buffer overflow in the fcgi_env_add() function. Under some circumstances this bug allows remote code execution. (CVE-2007-4727) lighttpd-mod_trigger_b4_dl.rpm This update fixes a buffer overflow in the fcgi_env_add() function. Under some circumstances this bug allows remote code execution. (CVE-2007-4727) lighttpd-mod_magnet.rpm This update fixes a buffer overflow in the fcgi_env_add() function. Under some circumstances this bug allows remote code execution. (CVE-2007-4727) zypper.rpm This update of zypper fixes some security related bugs that occur while handling files. These bugs can be abused to get access to log-files for reading and writing as well as causing denial-of-service conditions. Thanks to Stefan Nordhausen for reporting this. hplip-hpijs.rpm The deamon 'hpssd' could be exploited by users to execute arbitrary commands as root. hpssd only runs on systems that have HP all-in-one devices configured. In the default configuration the problem is not remotely exploitable as hpssd only listens on local interfaces (CVE-2007-5208). hplip.rpm The deamon 'hpssd' could be exploited by users to execute arbitrary commands as root. hpssd only runs on systems that have HP all-in-one devices configured. In the default configuration the problem is not remotely exploitable as hpssd only listens on local interfaces (CVE-2007-5208). festival.rpm The festival daemon runs as root. The default config doesn't have a password set. A local attacker could therefore connect to the daemon to have commands executed as root (CVE-2007-4074). festival-devel.rpm The festival daemon runs as root. The default config doesn't have a password set. A local attacker could therefore connect to the daemon to have commands executed as root (CVE-2007-4074). opal.rpm A bug in the SIP protocol handler could be exploited by attackers to crash applications using opal (CVE-2007-4924). opal-devel.rpm A bug in the SIP protocol handler could be exploited by attackers to crash applications using opal (CVE-2007-4924). openssl-64bit.rpm A buffer overflow in the DTLS implementation of openssl could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4995). openssl-doc.rpm A buffer overflow in the DTLS implementation of openssl could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4995). openssl-devel.rpm A buffer overflow in the DTLS implementation of openssl could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4995). openssl.rpm A buffer overflow in the DTLS implementation of openssl could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4995). openssl-devel-64bit.rpm A buffer overflow in the DTLS implementation of openssl could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4995). flac-devel.rpm Multiple integer overflows in flac could potentially be exploited by attackers via specially crafted files to execute code in the context of the user opening the file (CVE-2007-4619). flac.rpm Multiple integer overflows in flac could potentially be exploited by attackers via specially crafted files to execute code in the context of the user opening the file (CVE-2007-4619). flac-64bit.rpm Multiple integer overflows in flac could potentially be exploited by attackers via specially crafted files to execute code in the context of the user opening the file (CVE-2007-4619). fetchmailconf.rpm This update fixes a remote denial-of-service attack. (CVE-2007-4565) fetchmail.rpm This update fixes a remote denial-of-service attack. (CVE-2007-4565) openssh.rpm This update fixes a bug in ssh's cookie handling code. It does not properly handle the situation when an untrusted cookie cannot be created and uses a trusted X11 cookie instead. This allows attackers to violate the intended policy and gain privileges by causing an X client to be treated as trusted. (CVE-2007-4752) Additionally this update fixes a bug introduced with the last security update for openssh. When the SSH daemon wrote to stderr (for instance, to warn about the presence of a deprecated option like PAMAuthenticationViaKbdInt in its configuration file), SIGALRM was blocked for SSH sessions. This resulted in problems with processes which rely on SIGALRM, such as ntpdate. openssh-askpass.rpm This update fixes a bug in ssh's cookie handling code. It does not properly handle the situation when an untrusted cookie cannot be created and uses a trusted X11 cookie instead. This allows attackers to violate the intended policy and gain privileges by causing an X client to be treated as trusted. (CVE-2007-4752) Additionally this update fixes a bug introduced with the last security update for openssh. When the SSH daemon wrote to stderr (for instance, to warn about the presence of a deprecated option like PAMAuthenticationViaKbdInt in its configuration file), SIGALRM was blocked for SSH sessions. This resulted in problems with processes which rely on SIGALRM, such as ntpdate. mono-nunit.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-extras.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. ibm-data-db2.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-data-sqlite.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-devel.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-jscript.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-data.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. bytefx-data-mysql.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-data-oracle.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-data-postgresql.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-web.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-core.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-locale-extras.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-winforms.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-data-sybase.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. mono-data-firebird.rpm This update fixes a buffer overflow in Mono's BigInteger implementation. GraphicsMagick.rpm This update of GraphicsMagick fixes several vulnerabilities. - CVE-2007-4985: infinite loop while parsing images - CVE-2007-4986: integer overflows that can lead to code execution - CVE-2007-4987: one-byte buffer overflow that can lead to code execution - CVE-2007-4988: integer overflows that can lead to code execution perl-GraphicsMagick.rpm This update of GraphicsMagick fixes several vulnerabilities. - CVE-2007-4985: infinite loop while parsing images - CVE-2007-4986: integer overflows that can lead to code execution - CVE-2007-4987: one-byte buffer overflow that can lead to code execution - CVE-2007-4988: integer overflows that can lead to code execution GraphicsMagick-devel.rpm This update of GraphicsMagick fixes several vulnerabilities. - CVE-2007-4985: infinite loop while parsing images - CVE-2007-4986: integer overflows that can lead to code execution - CVE-2007-4987: one-byte buffer overflow that can lead to code execution - CVE-2007-4988: integer overflows that can lead to code execution GraphicsMagick-c++-devel.rpm This update of GraphicsMagick fixes several vulnerabilities. - CVE-2007-4985: infinite loop while parsing images - CVE-2007-4986: integer overflows that can lead to code execution - CVE-2007-4987: one-byte buffer overflow that can lead to code execution - CVE-2007-4988: integer overflows that can lead to code execution GraphicsMagick-c++.rpm This update of GraphicsMagick fixes several vulnerabilities. - CVE-2007-4985: infinite loop while parsing images - CVE-2007-4986: integer overflows that can lead to code execution - CVE-2007-4987: one-byte buffer overflow that can lead to code execution - CVE-2007-4988: integer overflows that can lead to code execution ImageMagick.rpm This update of ImageMagick fixes several vulnerabilities. - CVE-2007-4985: infinite loop while parsing images - CVE-2007-4986: integer overflows that can lead to code execution - CVE-2007-4987: one-byte buffer overflow that can lead to code execution (SLES8- and SLES9-based products are not affected) - CVE-2007-4988: integer overflows that can lead to code execution perl-PerlMagick.rpm This update of ImageMagick fixes several vulnerabilities. - CVE-2007-4985: infinite loop while parsing images - CVE-2007-4986: integer overflows that can lead to code execution - CVE-2007-4987: one-byte buffer overflow that can lead to code execution (SLES8- and SLES9-based products are not affected) - CVE-2007-4988: integer overflows that can lead to code execution ImageMagick-devel.rpm This update of ImageMagick fixes several vulnerabilities. - CVE-2007-4985: infinite loop while parsing images - CVE-2007-4986: integer overflows that can lead to code execution - CVE-2007-4987: one-byte buffer overflow that can lead to code execution (SLES8- and SLES9-based products are not affected) - CVE-2007-4988: integer overflows that can lead to code execution ImageMagick-Magick++-devel.rpm This update of ImageMagick fixes several vulnerabilities. - CVE-2007-4985: infinite loop while parsing images - CVE-2007-4986: integer overflows that can lead to code execution - CVE-2007-4987: one-byte buffer overflow that can lead to code execution (SLES8- and SLES9-based products are not affected) - CVE-2007-4988: integer overflows that can lead to code execution ImageMagick-Magick++.rpm This update of ImageMagick fixes several vulnerabilities. - CVE-2007-4985: infinite loop while parsing images - CVE-2007-4986: integer overflows that can lead to code execution - CVE-2007-4987: one-byte buffer overflow that can lead to code execution (SLES8- and SLES9-based products are not affected) - CVE-2007-4988: integer overflows that can lead to code execution t1lib-devel.rpm A buffer overflow in t1lib could potentially be exploited to execute arbitrary code via specially crafted files (CVE-2007-4033). t1lib.rpm A buffer overflow in t1lib could potentially be exploited to execute arbitrary code via specially crafted files (CVE-2007-4033). libvorbis-64bit.rpm Specially crafted OGG files could crash libvorbis or make it run into an endless loop (CVE-2007-4029, CVE-2007-4065, CVE-2007-4066). libvorbis-devel.rpm Specially crafted OGG files could crash libvorbis or make it run into an endless loop (CVE-2007-4029, CVE-2007-4065, CVE-2007-4066). libvorbis.rpm Specially crafted OGG files could crash libvorbis or make it run into an endless loop (CVE-2007-4029, CVE-2007-4065, CVE-2007-4066). librpcsecgss.rpm This update fixes a security problem in the librpcsecgss library used by NFSv4 also found in krb5. A invalid packet could underflow and potentially cause memory corruption and code execution. (CVE-2007-3999) xpdf.rpm A buffer overflow in xpdf could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). xpdf-tools.rpm A buffer overflow in xpdf could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). yast2-control-center-gnome.rpm Update needed to work with version 0.9.8 of gnome-main-menu liblcms-64bit.rpm This update addresses security bugs in liblcms that occurred while parsing ICC profiles in JPEG images. (CVE-2007-2741) Remote attackers can exploit this bug to execute arbitrary commands or cause denial-of-service. liblcms-devel-64bit.rpm This update addresses security bugs in liblcms that occurred while parsing ICC profiles in JPEG images. (CVE-2007-2741) Remote attackers can exploit this bug to execute arbitrary commands or cause denial-of-service. liblcms.rpm This update addresses security bugs in liblcms that occurred while parsing ICC profiles in JPEG images. (CVE-2007-2741) Remote attackers can exploit this bug to execute arbitrary commands or cause denial-of-service. liblcms-devel.rpm This update addresses security bugs in liblcms that occurred while parsing ICC profiles in JPEG images. (CVE-2007-2741) Remote attackers can exploit this bug to execute arbitrary commands or cause denial-of-service. nautilus-64bit.rpm This fixes https://bugzilla.novell.com/show_bug.cgi?id=222490 - Nautilus would use 100% CPU and freeze when unmounting a CD-ROM. nautilus-devel.rpm This fixes https://bugzilla.novell.com/show_bug.cgi?id=222490 - Nautilus would use 100% CPU and freeze when unmounting a CD-ROM. nautilus.rpm This fixes https://bugzilla.novell.com/show_bug.cgi?id=222490 - Nautilus would use 100% CPU and freeze when unmounting a CD-ROM. koffice-database.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). koffice-wordprocessing.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). koffice-planning.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). koffice-presentation.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). koffice-spreadsheet.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). koffice-extra.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). koffice-illustration.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). koffice-ruby.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). koffice-database-psql.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). koffice.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). koffice-database-mysql.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). koffice-python.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). koffice-devel.rpm A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). poppler-tools.rpm A buffer overflow in the xpdf code contained in poppler could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). poppler-qt.rpm A buffer overflow in the xpdf code contained in poppler could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). poppler-glib.rpm A buffer overflow in the xpdf code contained in poppler could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). poppler-devel.rpm A buffer overflow in the xpdf code contained in poppler could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). poppler.rpm A buffer overflow in the xpdf code contained in poppler could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). gpdf.rpm A buffer overflow in the xpdf code contained in gpdf could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393). yast2-core-devel.rpm This update fixes a security bug in yast2-core that allowed local attackers to provide malicious yast2 modules to yast2 that are executed with root privileges. To trigger this vulnerability root has to execute yast2 in an untrusted directory (i.e. /tmp). Thanks to Stefan Nordhausen for reporting this to us. yast2-core.rpm This update fixes a security bug in yast2-core that allowed local attackers to provide malicious yast2 modules to yast2 that are executed with root privileges. To trigger this vulnerability root has to execute yast2 in an untrusted directory (i.e. /tmp). Thanks to Stefan Nordhausen for reporting this to us. kdegraphics3-pdf.rpm A buffer overflow in the xpdf code contained in kpdf could be exploited by attackers to potentially execute arbitrary code (CVE-2007-5393). rubygem-activesupport.rpm A cross site scripting (XSS) bug allowed attackers to execute Javascript code in the context of other web sites (CVE-2007-3227). apache2-doc.rpm Several bugs were fixed in the Apache2 webserver: These include the following security issues: - CVE-2006-5752: mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset "detection". - CVE-2007-1863: mod_cache: Prevent a segmentation fault if attributes are listed in a Cache-Control header without any value. - CVE-2007-3304: prefork, worker, event MPMs: Ensure that the parent process cannot be forced to kill processes outside its process group. - CVE-2007-3847: mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers. PR 41144. - CVE-2007-4465: mod_autoindex: Add in ContentType and Charset options to IndexOptions directive. This allows the admin to explicitly set the content-type and charset of the generated page. and the following non-security issues: - get_module_list: replace loadmodule.conf atomically - Use File::Temp to create good tmpdir in logresolve.pl2 (httpd-2.x.x-logresolve.patchs) apache2-devel.rpm Several bugs were fixed in the Apache2 webserver: These include the following security issues: - CVE-2006-5752: mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset "detection". - CVE-2007-1863: mod_cache: Prevent a segmentation fault if attributes are listed in a Cache-Control header without any value. - CVE-2007-3304: prefork, worker, event MPMs: Ensure that the parent process cannot be forced to kill processes outside its process group. - CVE-2007-3847: mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers. PR 41144. - CVE-2007-4465: mod_autoindex: Add in ContentType and Charset options to IndexOptions directive. This allows the admin to explicitly set the content-type and charset of the generated page. and the following non-security issues: - get_module_list: replace loadmodule.conf atomically - Use File::Temp to create good tmpdir in logresolve.pl2 (httpd-2.x.x-logresolve.patchs) apache2-example-pages.rpm Several bugs were fixed in the Apache2 webserver: These include the following security issues: - CVE-2006-5752: mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset "detection". - CVE-2007-1863: mod_cache: Prevent a segmentation fault if attributes are listed in a Cache-Control header without any value. - CVE-2007-3304: prefork, worker, event MPMs: Ensure that the parent process cannot be forced to kill processes outside its process group. - CVE-2007-3847: mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers. PR 41144. - CVE-2007-4465: mod_autoindex: Add in ContentType and Charset options to IndexOptions directive. This allows the admin to explicitly set the content-type and charset of the generated page. and the following non-security issues: - get_module_list: replace loadmodule.conf atomically - Use File::Temp to create good tmpdir in logresolve.pl2 (httpd-2.x.x-logresolve.patchs) apache2.rpm Several bugs were fixed in the Apache2 webserver: These include the following security issues: - CVE-2006-5752: mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset "detection". - CVE-2007-1863: mod_cache: Prevent a segmentation fault if attributes are listed in a Cache-Control header without any value. - CVE-2007-3304: prefork, worker, event MPMs: Ensure that the parent process cannot be forced to kill processes outside its process group. - CVE-2007-3847: mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers. PR 41144. - CVE-2007-4465: mod_autoindex: Add in ContentType and Charset options to IndexOptions directive. This allows the admin to explicitly set the content-type and charset of the generated page. and the following non-security issues: - get_module_list: replace loadmodule.conf atomically - Use File::Temp to create good tmpdir in logresolve.pl2 (httpd-2.x.x-logresolve.patchs) apache2-worker.rpm Several bugs were fixed in the Apache2 webserver: These include the following security issues: - CVE-2006-5752: mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset "detection". - CVE-2007-1863: mod_cache: Prevent a segmentation fault if attributes are listed in a Cache-Control header without any value. - CVE-2007-3304: prefork, worker, event MPMs: Ensure that the parent process cannot be forced to kill processes outside its process group. - CVE-2007-3847: mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers. PR 41144. - CVE-2007-4465: mod_autoindex: Add in ContentType and Charset options to IndexOptions directive. This allows the admin to explicitly set the content-type and charset of the generated page. and the following non-security issues: - get_module_list: replace loadmodule.conf atomically - Use File::Temp to create good tmpdir in logresolve.pl2 (httpd-2.x.x-logresolve.patchs) apache2-prefork.rpm Several bugs were fixed in the Apache2 webserver: These include the following security issues: - CVE-2006-5752: mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset "detection". - CVE-2007-1863: mod_cache: Prevent a segmentation fault if attributes are listed in a Cache-Control header without any value. - CVE-2007-3304: prefork, worker, event MPMs: Ensure that the parent process cannot be forced to kill processes outside its process group. - CVE-2007-3847: mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers. PR 41144. - CVE-2007-4465: mod_autoindex: Add in ContentType and Charset options to IndexOptions directive. This allows the admin to explicitly set the content-type and charset of the generated page. and the following non-security issues: - get_module_list: replace loadmodule.conf atomically - Use File::Temp to create good tmpdir in logresolve.pl2 (httpd-2.x.x-logresolve.patchs) perl.rpm This update fixes a buffer overflow in perl's regex engine. (CVE-2007-5116) perl-64bit.rpm This update fixes a buffer overflow in perl's regex engine. (CVE-2007-5116) ruby-examples.rpm This update of ruby improves the SSL certificate verification process. (CVE-2007-5162, CVE-2007-5770) Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack. ruby-doc-html.rpm This update of ruby improves the SSL certificate verification process. (CVE-2007-5162, CVE-2007-5770) Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack. ruby-devel.rpm This update of ruby improves the SSL certificate verification process. (CVE-2007-5162, CVE-2007-5770) Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack. ruby-test-suite.rpm This update of ruby improves the SSL certificate verification process. (CVE-2007-5162, CVE-2007-5770) Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack. ruby.rpm This update of ruby improves the SSL certificate verification process. (CVE-2007-5162, CVE-2007-5770) Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack. ruby-doc-ri.rpm This update of ruby improves the SSL certificate verification process. (CVE-2007-5162, CVE-2007-5770) Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack. ruby-tk.rpm This update of ruby improves the SSL certificate verification process. (CVE-2007-5162, CVE-2007-5770) Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack. openldap2-devel-64bit.rpm This update fixes multiple flaws that could cause slapd to crash (CVE-2007-5707, CVE-2007-5708). openldap2-devel.rpm This update fixes multiple flaws that could cause slapd to crash (CVE-2007-5707, CVE-2007-5708). openldap2-back-perl.rpm This update fixes multiple flaws that could cause slapd to crash (CVE-2007-5707, CVE-2007-5708). openldap2-back-meta.rpm This update fixes multiple flaws that could cause slapd to crash (CVE-2007-5707, CVE-2007-5708). openldap2.rpm This update fixes multiple flaws that could cause slapd to crash (CVE-2007-5707, CVE-2007-5708). libpng-devel-64bit.rpm Speciall crafted png files could crash applications when attempting to open such a file (CVE-2007-5269). libpng-64bit.rpm Speciall crafted png files could crash applications when attempting to open such a file (CVE-2007-5269). libpng-devel.rpm Speciall crafted png files could crash applications when attempting to open such a file (CVE-2007-5269). libpng.rpm Speciall crafted png files could crash applications when attempting to open such a file (CVE-2007-5269). glibc-locale-64bit.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. glibc.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. glibc-locale.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. glibc-profile-64bit.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. glibc-64bit.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. glibc-profile.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. glibc-info.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. glibc-devel.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. glibc-html.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. glibc-obsolete.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. glibc-devel-64bit.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. nscd.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. glibc-i18ndata.rpm The patch to fix a gettext race in the previous glibc maintenance update might cause random applications to hang in futex() calls indefinitely. Since the original race condition was not very serious, this update simply reverts the original buggy patch and restores the previous behaviour. nagios-plugins-extras.rpm fix possible buffer overflow during HTTP Location header parsing in check_http (CVE-2007-5198) fix possible buffer overflow during snmpget parsing in check_snmp (CVE-2007-5623) nagios-plugins.rpm fix possible buffer overflow during HTTP Location header parsing in check_http (CVE-2007-5198) fix possible buffer overflow during snmpget parsing in check_snmp (CVE-2007-5623) pcre-devel.rpm Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code (CVE-2006-7230). pcre-64bit.rpm Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code (CVE-2006-7230). pcre.rpm Specially crafted regular expressions could lead to a buffer overflow in the pcre library. Applications using pcre to process regular expressions from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code (CVE-2006-7230). emacs-nox.rpm This update fixes a buffer overflow in emacs that can be triggered over the command-line. emacs-info.rpm This update fixes a buffer overflow in emacs that can be triggered over the command-line. emacs-x11.rpm This update fixes a buffer overflow in emacs that can be triggered over the command-line. emacs-el.rpm This update fixes a buffer overflow in emacs that can be triggered over the command-line. emacs.rpm This update fixes a buffer overflow in emacs that can be triggered over the command-line. MozillaFirefox-translations.rpm This update brings Mozilla Firefox to security update version 2.0.0.10 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. MozillaFirefox.rpm This update brings Mozilla Firefox to security update version 2.0.0.10 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. rubygem-actionpack.rpm Malicious users could specify their session-ID in the URL and could gain access to an authenticated session that way (CVE-2007-5380). net-snmp.rpm This update of net-snmp fixes the following bugs: - default and configurable maximum number of varbinds returnable to a GETBULK request (CVE-2007-5846) - crash when smux peers were configured with empty passwords - the UCD-SNMP-MIB::memCached.0 SNMP object was missing - the snmptrap command from the net-snmp package sends traps per default on the wrong port. perl-SNMP.rpm This update of net-snmp fixes the following bugs: - default and configurable maximum number of varbinds returnable to a GETBULK request (CVE-2007-5846) - crash when smux peers were configured with empty passwords - the UCD-SNMP-MIB::memCached.0 SNMP object was missing - the snmptrap command from the net-snmp package sends traps per default on the wrong port. net-snmp-devel-64bit.rpm This update of net-snmp fixes the following bugs: - default and configurable maximum number of varbinds returnable to a GETBULK request (CVE-2007-5846) - crash when smux peers were configured with empty passwords - the UCD-SNMP-MIB::memCached.0 SNMP object was missing - the snmptrap command from the net-snmp package sends traps per default on the wrong port. net-snmp-devel.rpm This update of net-snmp fixes the following bugs: - default and configurable maximum number of varbinds returnable to a GETBULK request (CVE-2007-5846) - crash when smux peers were configured with empty passwords - the UCD-SNMP-MIB::memCached.0 SNMP object was missing - the snmptrap command from the net-snmp package sends traps per default on the wrong port. net-snmp-64bit.rpm This update of net-snmp fixes the following bugs: - default and configurable maximum number of varbinds returnable to a GETBULK request (CVE-2007-5846) - crash when smux peers were configured with empty passwords - the UCD-SNMP-MIB::memCached.0 SNMP object was missing - the snmptrap command from the net-snmp package sends traps per default on the wrong port. htdig.rpm A flaw in the htsearch Program could be exploited by attackers to conduct cross site scripting (XSS) attacks. e2fsprogs.rpm This update of e2fsprogs fixes several integer overflows in memory allocating code. Programs that use libext2fs are therefore vulnerable to memory corruptions that can lead to arbitrary code execution while loading a specially crafted image. (CVE-2007-5497) libcom_err.rpm This update of e2fsprogs fixes several integer overflows in memory allocating code. Programs that use libext2fs are therefore vulnerable to memory corruptions that can lead to arbitrary code execution while loading a specially crafted image. (CVE-2007-5497) libcom_err-64bit.rpm This update of e2fsprogs fixes several integer overflows in memory allocating code. Programs that use libext2fs are therefore vulnerable to memory corruptions that can lead to arbitrary code execution while loading a specially crafted image. (CVE-2007-5497) e2fsprogs-64bit.rpm This update of e2fsprogs fixes several integer overflows in memory allocating code. Programs that use libext2fs are therefore vulnerable to memory corruptions that can lead to arbitrary code execution while loading a specially crafted image. (CVE-2007-5497) e2fsprogs-devel-64bit.rpm This update of e2fsprogs fixes several integer overflows in memory allocating code. Programs that use libext2fs are therefore vulnerable to memory corruptions that can lead to arbitrary code execution while loading a specially crafted image. (CVE-2007-5497) e2fsprogs-devel.rpm This update of e2fsprogs fixes several integer overflows in memory allocating code. Programs that use libext2fs are therefore vulnerable to memory corruptions that can lead to arbitrary code execution while loading a specially crafted image. (CVE-2007-5497) dmapi-devel.rpm dmapi: provide dmapi via update repository to solve new samba dependency dmapi.rpm dmapi: provide dmapi via update repository to solve new samba dependency libsmbclient-64bit.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) samba-krb-printing.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) samba-client-64bit.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) libsmbclient.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) samba-64bit.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) samba-pdb.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) libsmbclient-devel.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) cifs-mount.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) ldapsmb.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) samba-winbind-64bit.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) samba-winbind.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) samba-python.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) libmsrpc-devel.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) libmsrpc.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) samba-client.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) samba-vscan.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) samba.rpm This update of samba fixes a buffer overflow in function send_mailslot() that allows to overwrite the stack with zero-bytes. (CVE-2007-6015) OpenOffice_org-sv.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-ca.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-zh-CN.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-pl.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-el.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-sdk.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-gnome.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-ko.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-hi-IN.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-et.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-cs.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-zu.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-da.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-pt.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-bg.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-mono.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-ru.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-it.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-galleries.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-xh.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-cy.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-sr-CS.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-km.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-lt.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-nb.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-rw.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-sk.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-be-BY.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-nn.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-af.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-fi.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-hr.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-zh-TW.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-fr.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-ja.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-st.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-sl.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-pt-BR.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-tr.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-hu.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-officebean.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-es.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-en-GB.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-mk.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-vi.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-de.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-kde.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-nl.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-ts.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-sdk-doc.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-pa-IN.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-gu-IN.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) OpenOffice_org-ar.rpm This update of OpenOffice_org adds restrictions to SQL statements of Java-based databases to avoid the execution of native Jave code by creating procedures. (CVE-2007-4575) libnetpbm.rpm This update of netpbm fixes a security vulnerability in the included libjasper. This bug can be triggered while processing image files and can lead to remote code execution. (CVE-2007-2721) netpbm.rpm This update of netpbm fixes a security vulnerability in the included libjasper. This bug can be triggered while processing image files and can lead to remote code execution. (CVE-2007-2721) libnetpbm-64bit.rpm This update of netpbm fixes a security vulnerability in the included libjasper. This bug can be triggered while processing image files and can lead to remote code execution. (CVE-2007-2721) seamonkey-spellchecker.rpm This update brings Mozilla Seamonkey to security update version 1.1.7 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. Also enigmail was upgraded to 0.95.5. seamonkey-venkman.rpm This update brings Mozilla Seamonkey to security update version 1.1.7 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. Also enigmail was upgraded to 0.95.5. seamonkey-mail.rpm This update brings Mozilla Seamonkey to security update version 1.1.7 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. Also enigmail was upgraded to 0.95.5. seamonkey-irc.rpm This update brings Mozilla Seamonkey to security update version 1.1.7 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. Also enigmail was upgraded to 0.95.5. seamonkey-dom-inspector.rpm This update brings Mozilla Seamonkey to security update version 1.1.7 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. Also enigmail was upgraded to 0.95.5. seamonkey.rpm This update brings Mozilla Seamonkey to security update version 1.1.7 Following security problems were fixed: MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. Also enigmail was upgraded to 0.95.5. timezone.rpm This update updates timezone database according to last-minute change of time shift date by Venezuelan government from 2008-01-01 to 2007-12-09. Venezulea will move from UTC-4:00 to UTC-4:30. America/Caracas * Other timezones have been updated as well: Asia/Damascus (time change in effect since start of November) America/Havana (dtto) America/St_Barthelemy, America/Marigot (new) kdepim3.rpm This update fixes a crash in GroupWise I/Os slave which is used by korganizer to retrive the calendar. kdepim3-networkstatus.rpm This update fixes a crash in GroupWise I/Os slave which is used by korganizer to retrive the calendar. kdepim3-mobile.rpm This update fixes a crash in GroupWise I/Os slave which is used by korganizer to retrive the calendar. kdepim3-devel.rpm This update fixes a crash in GroupWise I/Os slave which is used by korganizer to retrive the calendar. kdepim3-notes.rpm This update fixes a crash in GroupWise I/Os slave which is used by korganizer to retrive the calendar. kdepim3-time-management.rpm This update fixes a crash in GroupWise I/Os slave which is used by korganizer to retrive the calendar. kdepim3-kpilot.rpm This update fixes a crash in GroupWise I/Os slave which is used by korganizer to retrive the calendar. clamav-db.rpm This version upgrade to 0.92 fixes numerous flaws including some security problems (CVE-2007-6335, CVE-2007-6336, CVE-2007-6337). Please note that the version number of the clamav library has changed. Programs linked against libclamav therefore need to be updated as well. clamav.rpm This version upgrade to 0.92 fixes numerous flaws including some security problems (CVE-2007-6335, CVE-2007-6336, CVE-2007-6337). Please note that the version number of the clamav library has changed. Programs linked against libclamav therefore need to be updated as well. klamav.rpm clamav has been updated due to security problem. The version number of the clamav library has been changed with that update. Therefore programs like klamav that are linked against libclamav need to be updated as well. libexiv2-devel.rpm Specially crafted files could trigger an integer overflow in libexiv2 (CVE-2007-6353). libexiv2.rpm Specially crafted files could trigger an integer overflow in libexiv2 (CVE-2007-6353). rsync.rpm This update fixes a bug in rsync that allowed remote attackers to access restricted files outside a module's hierarchy if no chroot setup was used. (CVE-2007-6199) Please read http://rsync.samba.org/security.html entry from November 28th, 2007 to get more information about a secure configuration of rsync that also covers the bug tracked with CVE-2007-6200. This update also fixes some crashes that only affect rsync-2.6.8 on SLES10. squid.rpm This update of squid fixes a denial-of-service bug during cache update reply processing. (CVE-2007-6239) postfix.rpm receive_override_options = no_address_mappings in main.cf is a bad idea in general. This is set by SuSEconfig.postfix if amavisd is used. Problem with that is that it applies not only to mail delivered via SMTP but also delivered by sendmail/maildrop/pickup and sending mail that way will fail when adressed to a virtual recipient. That parameter should be set in master.cf instead for the smtpd process only. postfix-postgresql.rpm receive_override_options = no_address_mappings in main.cf is a bad idea in general. This is set by SuSEconfig.postfix if amavisd is used. Problem with that is that it applies not only to mail delivered via SMTP but also delivered by sendmail/maildrop/pickup and sending mail that way will fail when adressed to a virtual recipient. That parameter should be set in master.cf instead for the smtpd process only. postfix-devel.rpm receive_override_options = no_address_mappings in main.cf is a bad idea in general. This is set by SuSEconfig.postfix if amavisd is used. Problem with that is that it applies not only to mail delivered via SMTP but also delivered by sendmail/maildrop/pickup and sending mail that way will fail when adressed to a virtual recipient. That parameter should be set in master.cf instead for the smtpd process only. postfix-mysql.rpm receive_override_options = no_address_mappings in main.cf is a bad idea in general. This is set by SuSEconfig.postfix if amavisd is used. Problem with that is that it applies not only to mail delivered via SMTP but also delivered by sendmail/maildrop/pickup and sending mail that way will fail when adressed to a virtual recipient. That parameter should be set in master.cf instead for the smtpd process only. libsndfile-progs.rpm This update fixes a possible buffer overflow that occurs while reading decoded PCM data from the FLAC library. (CVE-2007-4974) libsndfile-devel.rpm This update fixes a possible buffer overflow that occurs while reading decoded PCM data from the FLAC library. (CVE-2007-4974) libsndfile-64bit.rpm This update fixes a possible buffer overflow that occurs while reading decoded PCM data from the FLAC library. (CVE-2007-4974) libsndfile.rpm This update fixes a possible buffer overflow that occurs while reading decoded PCM data from the FLAC library. (CVE-2007-4974) libsndfile-octave.rpm This update fixes a possible buffer overflow that occurs while reading decoded PCM data from the FLAC library. (CVE-2007-4974) sylpheed-claws.rpm The new clamav provides a new libclamav major version, this update contains just a rebuild of sylpheed-claws against this new major version. opera.rpm Opera released version 9.25 of their browser to fix various security problems. CVE-2007-6520: Fixed an issue where plug-ins could be used to allow cross domain scripting, as reported by David Bloom. Details will be disclosed at a later date. CVE-2007-6521: Fixed an issue with TLS certificates that could be used to execute arbitrary code, as reported by Alexander Klink (Cynops GmbH). Details will be disclosed at a later date. CVE-2007-6522: Rich text editing can no longer be used to allow cross domain scripting, as reported by David Bloom. See our advisory. CVE-2007-6523: Fixed a problem where malformed BMP files could cause Opera to temporarily freeze. CVE-2007-6524: Prevented bitmaps from revealing random data from memory, as reported by Gynvael Coldwind. Details will be disclosed at a later date. te_dvilj.rpm Buffer overflows in dvips and dviljk could be triggered by specially crafted dvi files (CVE-2007-5935, CVE-2007-5937). dvips additionally created temporary files in an insecure manner (CVE-2007-5936). te_cont.rpm Buffer overflows in dvips and dviljk could be triggered by specially crafted dvi files (CVE-2007-5935, CVE-2007-5937). dvips additionally created temporary files in an insecure manner (CVE-2007-5936). te_omega.rpm Buffer overflows in dvips and dviljk could be triggered by specially crafted dvi files (CVE-2007-5935, CVE-2007-5937). dvips additionally created temporary files in an insecure manner (CVE-2007-5936). tetex.rpm Buffer overflows in dvips and dviljk could be triggered by specially crafted dvi files (CVE-2007-5935, CVE-2007-5937). dvips additionally created temporary files in an insecure manner (CVE-2007-5936). te_kpath.rpm Buffer overflows in dvips and dviljk could be triggered by specially crafted dvi files (CVE-2007-5935, CVE-2007-5937). dvips additionally created temporary files in an insecure manner (CVE-2007-5936). te_ptex.rpm Buffer overflows in dvips and dviljk could be triggered by specially crafted dvi files (CVE-2007-5935, CVE-2007-5937). dvips additionally created temporary files in an insecure manner (CVE-2007-5936). te_mpost.rpm Buffer overflows in dvips and dviljk could be triggered by specially crafted dvi files (CVE-2007-5935, CVE-2007-5937). dvips additionally created temporary files in an insecure manner (CVE-2007-5936). te_web.rpm Buffer overflows in dvips and dviljk could be triggered by specially crafted dvi files (CVE-2007-5935, CVE-2007-5937). dvips additionally created temporary files in an insecure manner (CVE-2007-5936). te_eplai.rpm Buffer overflows in dvips and dviljk could be triggered by specially crafted dvi files (CVE-2007-5935, CVE-2007-5937). dvips additionally created temporary files in an insecure manner (CVE-2007-5936). te_ams.rpm Buffer overflows in dvips and dviljk could be triggered by specially crafted dvi files (CVE-2007-5935, CVE-2007-5937). dvips additionally created temporary files in an insecure manner (CVE-2007-5936). te_latex.rpm Buffer overflows in dvips and dviljk could be triggered by specially crafted dvi files (CVE-2007-5935, CVE-2007-5937). dvips additionally created temporary files in an insecure manner (CVE-2007-5936). te_nfs.rpm Buffer overflows in dvips and dviljk could be triggered by specially crafted dvi files (CVE-2007-5935, CVE-2007-5937). dvips additionally created temporary files in an insecure manner (CVE-2007-5936). MozillaThunderbird-translations.rpm This update brings Mozilla Thunderbird to security update version 1.5.0.14 Following security problems were fixed: - MFSA 2007-29: Crashes with evidence of memory corruption As part of the Firefox 2.0.0.8 update releases Mozilla developers fixed many bugs to improve the stability of the product. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2007-5339 Browser crashes - CVE-2007-5340 JavaScript engine crashes MozillaThunderbird.rpm This update brings Mozilla Thunderbird to security update version 1.5.0.14 Following security problems were fixed: - MFSA 2007-29: Crashes with evidence of memory corruption As part of the Firefox 2.0.0.8 update releases Mozilla developers fixed many bugs to improve the stability of the product. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2007-5339 Browser crashes - CVE-2007-5340 JavaScript engine crashes mozilla-xulrunner181.rpm This update brings the Mozilla XUL runner engine to security update version 1.8.1.10 MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. epiphany.rpm This update brings the Mozilla XUL runner engine to security update version 1.8.1.10 MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. mozilla-xulrunner181-l10n.rpm This update brings the Mozilla XUL runner engine to security update version 1.8.1.10 MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. epiphany-doc.rpm This update brings the Mozilla XUL runner engine to security update version 1.8.1.10 MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. epiphany-devel.rpm This update brings the Mozilla XUL runner engine to security update version 1.8.1.10 MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. mozilla-xulrunner181-devel.rpm This update brings the Mozilla XUL runner engine to security update version 1.8.1.10 MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. epiphany-extensions.rpm This update brings the Mozilla XUL runner engine to security update version 1.8.1.10 MFSA 2007-37 / CVE-2007-5947: The jar protocol handler in Mozilla Firefox retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. MFSA 2007-38 / CVE-2007-5959: The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code. MFSA 2007-39 / CVE-2007-5960: Gregory Fleischer demonstrated that it was possible to generate a fake HTTP Referer header by exploiting a timing condition when setting the window.location property. This could be used to conduct a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header as protection against such attacks. cups-client.rpm This update fixes a buffer overflow that can be exploited by users that are allowed to configure CUPS. (CVE-2007-5848) Additionally a buffer overflow in the SNMP backend of CUPS was fixed that allowed remote attackers to execute arbitrary code by sending specially crafted SNMP responses. (CVE-2007-5849) This vulnerability affects 10.2 and 10.3 only. cups-devel.rpm This update fixes a buffer overflow that can be exploited by users that are allowed to configure CUPS. (CVE-2007-5848) Additionally a buffer overflow in the SNMP backend of CUPS was fixed that allowed remote attackers to execute arbitrary code by sending specially crafted SNMP responses. (CVE-2007-5849) This vulnerability affects 10.2 and 10.3 only. cups.rpm This update fixes a buffer overflow that can be exploited by users that are allowed to configure CUPS. (CVE-2007-5848) Additionally a buffer overflow in the SNMP backend of CUPS was fixed that allowed remote attackers to execute arbitrary code by sending specially crafted SNMP responses. (CVE-2007-5849) This vulnerability affects 10.2 and 10.3 only. cups-libs.rpm This update fixes a buffer overflow that can be exploited by users that are allowed to configure CUPS. (CVE-2007-5848) Additionally a buffer overflow in the SNMP backend of CUPS was fixed that allowed remote attackers to execute arbitrary code by sending specially crafted SNMP responses. (CVE-2007-5849) This vulnerability affects 10.2 and 10.3 only. cups-libs-64bit.rpm This update fixes a buffer overflow that can be exploited by users that are allowed to configure CUPS. (CVE-2007-5848) Additionally a buffer overflow in the SNMP backend of CUPS was fixed that allowed remote attackers to execute arbitrary code by sending specially crafted SNMP responses. (CVE-2007-5849) This vulnerability affects 10.2 and 10.3 only. libexif-64bit.rpm Two bugs in libexif were identified by a Google Security Audit done by Meder Kydyraliev. CVE-2007-6351: Loading EXIF data could be used to cause a infinite recursion and crash CVE-2007-6352: Integer overflows in the thumbnail handler could be used to overflow buffers and potentially execute code or crash a program using libexif. libexif.rpm Two bugs in libexif were identified by a Google Security Audit done by Meder Kydyraliev. CVE-2007-6351: Loading EXIF data could be used to cause a infinite recursion and crash CVE-2007-6352: Integer overflows in the thumbnail handler could be used to overflow buffers and potentially execute code or crash a program using libexif. libexif5.rpm One bug in libexif5 was identified by a Google Security Audit done by Meder Kydyraliev. CVE-2007-6352: Integer overflows in the thumbnail handler could be used to overflow buffers and potentially execute code or crash a program using libexif. krb5-client.rpm This update fixes multiple vulnerabilties in krb5. It's unlikely that those vulnerabilties can actually be exploited. (CVE-2007-5894, CVE-2007-5902, CVE-2007-5971, CVE-2007-5972) krb5.rpm This update fixes multiple vulnerabilties in krb5. It's unlikely that those vulnerabilties can actually be exploited. (CVE-2007-5894, CVE-2007-5902, CVE-2007-5971, CVE-2007-5972) krb5-64bit.rpm This update fixes multiple vulnerabilties in krb5. It's unlikely that those vulnerabilties can actually be exploited. (CVE-2007-5894, CVE-2007-5902, CVE-2007-5971, CVE-2007-5972) krb5-devel-64bit.rpm This update fixes multiple vulnerabilties in krb5. It's unlikely that those vulnerabilties can actually be exploited. (CVE-2007-5894, CVE-2007-5902, CVE-2007-5971, CVE-2007-5972) krb5-apps-servers.rpm This update fixes multiple vulnerabilties in krb5. It's unlikely that those vulnerabilties can actually be exploited. (CVE-2007-5894, CVE-2007-5902, CVE-2007-5971, CVE-2007-5972) krb5-server.rpm This update fixes multiple vulnerabilties in krb5. It's unlikely that those vulnerabilties can actually be exploited. (CVE-2007-5894, CVE-2007-5902, CVE-2007-5971, CVE-2007-5972) krb5-apps-clients.rpm This update fixes multiple vulnerabilties in krb5. It's unlikely that those vulnerabilties can actually be exploited. (CVE-2007-5894, CVE-2007-5902, CVE-2007-5971, CVE-2007-5972) krb5-devel.rpm This update fixes multiple vulnerabilties in krb5. It's unlikely that those vulnerabilties can actually be exploited. (CVE-2007-5894, CVE-2007-5902, CVE-2007-5971, CVE-2007-5972) xorg-x11-libs.rpm This update fixes various Xserver security issues. File existence disclosure vulnerability (CVE-2007-5958). XInput Extension Memory Corruption Vulnerability [IDEF2888 CVE-2007-6427]. TOG-CUP Extension Memory Corruption Vulnerability [IDEF2901 CVE-2007-6428]. EVI Extension Integer Overflow Vulnerability [IDEF2902 CVE-2007-6429]. MIT-SHM Extension Integer Overflow Vulnerability [IDEF2904 CVE-2007-6429]. XFree86-MISC Extension Invalid Array Index Vulnerability [IDEF2903 CVE-2007-5760]. PCF font parser vulnerability. xorg-x11-devel.rpm This update fixes various Xserver security issues. File existence disclosure vulnerability (CVE-2007-5958). XInput Extension Memory Corruption Vulnerability [IDEF2888 CVE-2007-6427]. TOG-CUP Extension Memory Corruption Vulnerability [IDEF2901 CVE-2007-6428]. EVI Extension Integer Overflow Vulnerability [IDEF2902 CVE-2007-6429]. MIT-SHM Extension Integer Overflow Vulnerability [IDEF2904 CVE-2007-6429]. XFree86-MISC Extension Invalid Array Index Vulnerability [IDEF2903 CVE-2007-5760]. PCF font parser vulnerability. xorg-x11-libs-64bit.rpm This update fixes various Xserver security issues. File existence disclosure vulnerability (CVE-2007-5958). XInput Extension Memory Corruption Vulnerability [IDEF2888 CVE-2007-6427]. TOG-CUP Extension Memory Corruption Vulnerability [IDEF2901 CVE-2007-6428]. EVI Extension Integer Overflow Vulnerability [IDEF2902 CVE-2007-6429]. MIT-SHM Extension Integer Overflow Vulnerability [IDEF2904 CVE-2007-6429]. XFree86-MISC Extension Invalid Array Index Vulnerability [IDEF2903 CVE-2007-5760]. PCF font parser vulnerability. xorg-x11-devel-64bit.rpm This update fixes various Xserver security issues. File existence disclosure vulnerability (CVE-2007-5958). XInput Extension Memory Corruption Vulnerability [IDEF2888 CVE-2007-6427]. TOG-CUP Extension Memory Corruption Vulnerability [IDEF2901 CVE-2007-6428]. EVI Extension Integer Overflow Vulnerability [IDEF2902 CVE-2007-6429]. MIT-SHM Extension Integer Overflow Vulnerability [IDEF2904 CVE-2007-6429]. XFree86-MISC Extension Invalid Array Index Vulnerability [IDEF2903 CVE-2007-5760]. PCF font parser vulnerability. xine-ui-64bit.rpm A security update of xorg-x11 revealed a bug in xine-ui. The xine user interface didn't display properly due to that. xine-ui.rpm A security update of xorg-x11 revealed a bug in xine-ui. The xine user interface didn't display properly due to that. kdelibs3.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdelibs3-arts-64bit.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdelibs3-doc.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdelibs3-64bit.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdelibs3-devel.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdelibs3-arts.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdebase3-devel.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdebase3-64bit.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdebase3.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdebase3-ksysguardd.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdebase3-beagle.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdebase3-session.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. fileshareset.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdebase3-extra.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdebase3-kdm.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdebase3-samba.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. kdebase3-nsplugin.rpm This update is necessary to support the new FlashPlayer version, which required XEmbed support. gtk-qt-engine.rpm The gtk-qt-engine had bugs and needed to be updated for the newest flash-player release. gtk-qt-engine-64bit.rpm The gtk-qt-engine had bugs and needed to be updated for the newest flash-player release. wireshark.rpm This update fixes several security bugs in wireshark that can be used to crash the application and to possibly execute arbitrary code remotely. wireshark-devel.rpm This update fixes several security bugs in wireshark that can be used to crash the application and to possibly execute arbitrary code remotely. libxml2-devel-64bit.rpm libxml2 contained a DoS condition in xmlCurrentChar()'s UTF-8 processing. CVE-2007-6284 has been assigned to this problem. libxml2-64bit.rpm libxml2 contained a DoS condition in xmlCurrentChar()'s UTF-8 processing. CVE-2007-6284 has been assigned to this problem. libxml2-devel.rpm libxml2 contained a DoS condition in xmlCurrentChar()'s UTF-8 processing. CVE-2007-6284 has been assigned to this problem. libxml2-python.rpm libxml2 contained a DoS condition in xmlCurrentChar()'s UTF-8 processing. CVE-2007-6284 has been assigned to this problem. libxml2.rpm libxml2 contained a DoS condition in xmlCurrentChar()'s UTF-8 processing. CVE-2007-6284 has been assigned to this problem. xine-lib.rpm Specially crafted rtsp-Streams could cause a buffer overflow in xine. Attackers could potentially exploit that to execute arbitrary code (CVE-2008-0225). xine-extra.rpm Specially crafted rtsp-Streams could cause a buffer overflow in xine. Attackers could potentially exploit that to execute arbitrary code (CVE-2008-0225). xine-lib-64bit.rpm Specially crafted rtsp-Streams could cause a buffer overflow in xine. Attackers could potentially exploit that to execute arbitrary code (CVE-2008-0225). xine-devel.rpm Specially crafted rtsp-Streams could cause a buffer overflow in xine. Attackers could potentially exploit that to execute arbitrary code (CVE-2008-0225). libxfcegui4.rpm A possible double-free bug has been fixed, in case the application free's the passed data arguments. xorg-x11-server-sdk.rpm The previous xorg-x11 security update contained a flaw. Due to this some applications using the X shared memory extension did not work properly anymore. xorg-x11-server.rpm The previous xorg-x11 security update contained a flaw. Due to this some applications using the X shared memory extension did not work properly anymore. xorg-x11-Xvnc.rpm The previous xorg-x11 security update contained a flaw. Due to this some applications using the X shared memory extension did not work properly anymore. php5-exif.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-soap.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-sysvmsg.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-ftp.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-dba.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-imap.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-fastcgi.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-ctype.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-mhash.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-mcrypt.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-xmlrpc.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-suhosin.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-ldap.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-pcntl.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-zip.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-sqlite.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-devel.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-sysvsem.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-shmop.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-snmp.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-xmlwriter.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-posix.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-odbc.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-pspell.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-json.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-mbstring.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-bz2.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-openssl.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-wddx.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-dom.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-dbase.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-tidy.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-mysql.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-sysvshm.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-gettext.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-gmp.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-pdo.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-tokenizer.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-gd.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-ncurses.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-zlib.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-pgsql.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-bcmath.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-xmlreader.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-hash.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-pear.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-calendar.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-xsl.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-sockets.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-curl.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems php5-iconv.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems apache2-mod_php5.rpm This update fixes multiple bugs in php by upgrading it to version 5.2.5. - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars (CVE-2007-5898) - overly long arguments to the dl() function could crash php (CVE-2007-4825) - overy long arguments to the glob() function could crash php (CVE-2007-4782) - overly long arguments to some iconv functions could crash php (CVE-2007-4840) - overy long arguments to the setlocale() function could crash php (CVE-2007-4784) - the wordwrap-Function could cause a floating point exception (CVE-2007-3998) - overy long arguments to the fnmatch() function could crash php (CVE-2007-4782) - incorrect size calculation in the chunk_split function could lead to a buffer overflow (CVE-2007-4661, CVE-2007-2872) - Flaws in the GD extension could lead to integer overflows (CVE-2007-3996) - The money_format function contained format string flaws (CVE-2007-4658) - Data for some time zones has been updated - php5 has been updated to version 5.2.5 to fix those problems NX.rpm This update fixes various Xserver security issues that are also present in NX: XInput Extension Memory Corruption Vulnerability [IDEF2888 CVE-2007-6427]. TOG-CUP Extension Memory Corruption Vulnerability [IDEF2901 CVE-2007-6428]. EVI Extension Integer Overflow Vulnerability [IDEF2902 CVE-2007-6429]. MIT-SHM Extension Integer Overflow Vulnerability [IDEF2904 CVE-2007-6429]. xfsprogs-devel.rpm This is an update to xfsprogs-2.9.4 which fixes some bugs in xfs_repair (among others). xfsprogs.rpm This is an update to xfsprogs-2.9.4 which fixes some bugs in xfs_repair (among others). autofs.rpm This patch adds support for the standard maptype separator (':') for the auto.master configuration file. I evolution-data-server-devel.rpm Timezone updates for the locations argentina and venezuela. Fixes a crash while using timezone Perth and Jerusalem. evolution-data-server.rpm Timezone updates for the locations argentina and venezuela. Fixes a crash while using timezone Perth and Jerusalem. evolution-data-server-64bit.rpm Timezone updates for the locations argentina and venezuela. Fixes a crash while using timezone Perth and Jerusalem. SDL_image-devel.rpm Specially crafted GIF files could crash the SDL_image library (CVE-2006-4484). SDL_image.rpm Specially crafted GIF files could crash the SDL_image library (CVE-2006-4484). python-idle.rpm Specially crafted images could trigger an integer overflow in the imageop module (CVE-2007-4965). python-devel.rpm Specially crafted images could trigger an integer overflow in the imageop module (CVE-2007-4965). python-64bit.rpm Specially crafted images could trigger an integer overflow in the imageop module (CVE-2007-4965). python.rpm Specially crafted images could trigger an integer overflow in the imageop module (CVE-2007-4965). python-gdbm.rpm Specially crafted images could trigger an integer overflow in the imageop module (CVE-2007-4965). python-demo.rpm Specially crafted images could trigger an integer overflow in the imageop module (CVE-2007-4965). python-tk.rpm Specially crafted images could trigger an integer overflow in the imageop module (CVE-2007-4965). python-xml.rpm Specially crafted images could trigger an integer overflow in the imageop module (CVE-2007-4965). python-curses.rpm Specially crafted images could trigger an integer overflow in the imageop module (CVE-2007-4965). mysql-bench.rpm This update fixes several security vulnerabilities (note: not all versions are affected by every bug): - CVE-2007-2583 - CVE-2007-2691 - CVE-2007-2692 - CVE-2007-5925 - CVE-2007-5969 - CVE-2007-6303 - CVE-2007-6304 mysql-debug.rpm This update fixes several security vulnerabilities (note: not all versions are affected by every bug): - CVE-2007-2583 - CVE-2007-2691 - CVE-2007-2692 - CVE-2007-5925 - CVE-2007-5969 - CVE-2007-6303 - CVE-2007-6304 mysql-shared-64bit.rpm This update fixes several security vulnerabilities (note: not all versions are affected by every bug): - CVE-2007-2583 - CVE-2007-2691 - CVE-2007-2692 - CVE-2007-5925 - CVE-2007-5969 - CVE-2007-6303 - CVE-2007-6304 mysql.rpm This update fixes several security vulnerabilities (note: not all versions are affected by every bug): - CVE-2007-2583 - CVE-2007-2691 - CVE-2007-2692 - CVE-2007-5925 - CVE-2007-5969 - CVE-2007-6303 - CVE-2007-6304 mysql-devel.rpm This update fixes several security vulnerabilities (note: not all versions are affected by every bug): - CVE-2007-2583 - CVE-2007-2691 - CVE-2007-2692 - CVE-2007-5925 - CVE-2007-5969 - CVE-2007-6303 - CVE-2007-6304 mysql-client.rpm This update fixes several security vulnerabilities (note: not all versions are affected by every bug): - CVE-2007-2583 - CVE-2007-2691 - CVE-2007-2692 - CVE-2007-5925 - CVE-2007-5969 - CVE-2007-6303 - CVE-2007-6304 mysql-shared.rpm This update fixes several security vulnerabilities (note: not all versions are affected by every bug): - CVE-2007-2583 - CVE-2007-2691 - CVE-2007-2692 - CVE-2007-5925 - CVE-2007-5969 - CVE-2007-6303 - CVE-2007-6304 mysql-Max.rpm This update fixes several security vulnerabilities (note: not all versions are affected by every bug): - CVE-2007-2583 - CVE-2007-2691 - CVE-2007-2692 - CVE-2007-5925 - CVE-2007-5969 - CVE-2007-6303 - CVE-2007-6304 mkinitrd.rpm When booting a Xen-enabled kernel the initrd fails to load all modules. Additionally not all command-line parameter have been passed to the loaded modules. nss_ldap.rpm nss_ldap returned incorrect data under certain circumstances to the calling process. Some applications could therefore work with wrong user data (CVE-2007-5794). nss_ldap-64bit.rpm nss_ldap returned incorrect data under certain circumstances to the calling process. Some applications could therefore work with wrong user data (CVE-2007-5794). postgresql.rpm This version update to 8.1.11 fixes among other things several security issues: - Index Functions Privilege Escalation: CVE-2007-6600 - Regular Expression Denial-of-Service: CVE-2007-4772, CVE-2007-6067, CVE-2007-4769 - DBLink Privilege Escalation: CVE-2007-6601 postgresql-docs.rpm This version update to 8.1.11 fixes among other things several security issues: - Index Functions Privilege Escalation: CVE-2007-6600 - Regular Expression Denial-of-Service: CVE-2007-4772, CVE-2007-6067, CVE-2007-4769 - DBLink Privilege Escalation: CVE-2007-6601 postgresql-pl.rpm This version update to 8.1.11 fixes among other things several security issues: - Index Functions Privilege Escalation: CVE-2007-6600 - Regular Expression Denial-of-Service: CVE-2007-4772, CVE-2007-6067, CVE-2007-4769 - DBLink Privilege Escalation: CVE-2007-6601 postgresql-libs.rpm This version update to 8.1.11 fixes among other things several security issues: - Index Functions Privilege Escalation: CVE-2007-6600 - Regular Expression Denial-of-Service: CVE-2007-4772, CVE-2007-6067, CVE-2007-4769 - DBLink Privilege Escalation: CVE-2007-6601 postgresql-contrib.rpm This version update to 8.1.11 fixes among other things several security issues: - Index Functions Privilege Escalation: CVE-2007-6600 - Regular Expression Denial-of-Service: CVE-2007-4772, CVE-2007-6067, CVE-2007-4769 - DBLink Privilege Escalation: CVE-2007-6601 postgresql-server.rpm This version update to 8.1.11 fixes among other things several security issues: - Index Functions Privilege Escalation: CVE-2007-6600 - Regular Expression Denial-of-Service: CVE-2007-4772, CVE-2007-6067, CVE-2007-4769 - DBLink Privilege Escalation: CVE-2007-6601 postgresql-devel.rpm This version update to 8.1.11 fixes among other things several security issues: - Index Functions Privilege Escalation: CVE-2007-6600 - Regular Expression Denial-of-Service: CVE-2007-4772, CVE-2007-6067, CVE-2007-4769 - DBLink Privilege Escalation: CVE-2007-6601 postgresql-libs-64bit.rpm This version update to 8.1.11 fixes among other things several security issues: - Index Functions Privilege Escalation: CVE-2007-6600 - Regular Expression Denial-of-Service: CVE-2007-4772, CVE-2007-6067, CVE-2007-4769 - DBLink Privilege Escalation: CVE-2007-6601 cairo-64bit.rpm This update of cairo fixes several integer overflows while decoding PNG images. This can be exploited remotely with user-assistance to execute arbitrary code. (CVE-2007-5503) cairo-devel.rpm This update of cairo fixes several integer overflows while decoding PNG images. This can be exploited remotely with user-assistance to execute arbitrary code. (CVE-2007-5503) cairo.rpm This update of cairo fixes several integer overflows while decoding PNG images. This can be exploited remotely with user-assistance to execute arbitrary code. (CVE-2007-5503) cairo-doc.rpm This update of cairo fixes several integer overflows while decoding PNG images. This can be exploited remotely with user-assistance to execute arbitrary code. (CVE-2007-5503) kernel-default.rpm This kernel update fixes the following security problems: - CVE-2008-0600: A local privilege escalation was found in the vmsplice_pipe system call, which could be used by local attackers to gain root access. - CVE-2007-6151: The isdn_ioctl function in isdn_common.c allowed local users to cause a denial of service via a crafted ioctl struct in which iocts is not null terminated, which triggers a buffer overflow. kernel-syms.rpm This kernel update fixes the following security problems: - CVE-2008-0600: A local privilege escalation was found in the vmsplice_pipe system call, which could be used by local attackers to gain root access. - CVE-2007-6151: The isdn_ioctl function in isdn_common.c allowed local users to cause a denial of service via a crafted ioctl struct in which iocts is not null terminated, which triggers a buffer overflow. kernel-source.rpm This kernel update fixes the following security problems: - CVE-2008-0600: A local privilege escalation was found in the vmsplice_pipe system call, which could be used by local attackers to gain root access. - CVE-2007-6151: The isdn_ioctl function in isdn_common.c allowed local users to cause a denial of service via a crafted ioctl struct in which iocts is not null terminated, which triggers a buffer overflow. kernel-ppc64.rpm This kernel update fixes the following security problems: - CVE-2008-0600: A local privilege escalation was found in the vmsplice_pipe system call, which could be used by local attackers to gain root access. - CVE-2007-6151: The isdn_ioctl function in isdn_common.c allowed local users to cause a denial of service via a crafted ioctl struct in which iocts is not null terminated, which triggers a buffer overflow. kernel-kdump.rpm This kernel update fixes the following security problems: - CVE-2008-0600: A local privilege escalation was found in the vmsplice_pipe system call, which could be used by local attackers to gain root access. - CVE-2007-6151: The isdn_ioctl function in isdn_common.c allowed local users to cause a denial of service via a crafted ioctl struct in which iocts is not null terminated, which triggers a buffer overflow. kernel-iseries64.rpm This kernel update fixes the following security problems: - CVE-2008-0600: A local privilege escalation was found in the vmsplice_pipe system call, which could be used by local attackers to gain root access. - CVE-2007-6151: The isdn_ioctl function in isdn_common.c allowed local users to cause a denial of service via a crafted ioctl struct in which iocts is not null terminated, which triggers a buffer overflow.