This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Opensuse First view 2007-10-30
Product Opensuse Last view 2010-10-21
Version 11.0 Type Os
Update *  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:o:opensuse:opensuse

Activity : Overall

Related : CVE

  Date Alert Description
7.8 2010-10-21 CVE-2010-4040

Google Chrome before 7.0.517.41 does not properly handle animated GIF images, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted image.

6.8 2010-05-19 CVE-2010-1321

The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.

4.3 2010-03-03 CVE-2010-0205

The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.

7 2009-11-04 CVE-2009-3547

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.

5.5 2009-10-22 CVE-2009-3621

net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket.

2.1 2009-10-20 CVE-2009-2910

arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.31.4 on the x86_64 platform does not clear certain kernel registers before a return to user mode, which allows local users to read register values from an earlier process by switching an ia32 process to 64-bit mode.

2.1 2009-10-19 CVE-2009-3612

The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2005-4881.

5 2009-09-08 CVE-2009-3095

The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.

5.9 2009-08-18 CVE-2009-2848

The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.

5 2009-08-06 CVE-2009-2625

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

4.3 2009-07-22 CVE-2009-2472

Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass."

4.4 2009-05-14 CVE-2009-1630

The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.

7.5 2009-04-16 CVE-2009-0946

Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large values in certain inputs in (1) smooth/ftsmooth.c, (2) sfnt/ttcmap.c, and (3) cff/cffload.c.

4.9 2009-04-06 CVE-2009-1242

The vmx_set_msr function in arch/x86/kvm/vmx.c in the VMX implementation in the KVM subsystem in the Linux kernel before 2.6.29.1 on the i386 platform allows guest OS users to cause a denial of service (OOPS) by setting the EFER_LME (aka "Long mode enable") bit in the Extended Feature Enable Register (EFER) model-specific register, which is specific to the x86_64 platform.

4.9 2009-03-24 CVE-2009-1072

nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.

4.4 2009-03-11 CVE-2009-0848

Untrusted search path vulnerability in GTK2 in OpenSUSE 11.0 and 11.1 allows local users to execute arbitrary code via a Trojan horse GTK module in an unspecified "relative search path."

3.6 2009-03-06 CVE-2009-0834

The audit_syscall_entry function in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls, a related issue to CVE-2009-0342 and CVE-2009-0343.

7.2 2009-02-18 CVE-2009-0310

Buffer overflow in SUSE blinux (aka sbl) in SUSE openSUSE 10.3 through 11.0 has unknown impact and attack vectors related to "incoming data and authentication-strings."

2.1 2008-08-08 CVE-2008-1945

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.

4.3 2008-08-06 CVE-2008-2939

Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.

5 2008-07-22 CVE-2008-3188

libxcrypt in SUSE openSUSE 11.0 uses the DES algorithm when the configuration specifies the MD5 algorithm, which makes it easier for attackers to conduct brute-force attacks against hashed passwords.

7.8 2008-07-09 CVE-2008-2931

The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint.

7.8 2008-07-08 CVE-2008-2812

The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving NULL pointer dereference of function pointers in (1) hamradio/6pack.c, (2) hamradio/mkiss.c, (3) irda/irtty-sir.c, (4) ppp_async.c, (5) ppp_synctty.c, (6) slip.c, (7) wan/x25_asy.c, and (8) wireless/strip.c in drivers/net/.

4.9 2008-07-02 CVE-2008-2826

Integer overflow in the sctp_getsockopt_local_addrs_old function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) functionality in the Linux kernel before 2.6.25.9 allows local users to cause a denial of service (resource consumption and system outage) via vectors involving a large addr_num field in an sctp_getaddrs_old data structure.

7.2 2007-10-30 CVE-2007-5729

The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to the EN0_TCNT register, which triggers a heap-based buffer overflow in the slirp library, aka NE2000 "mtu" heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the mtu overflow vulnerability.

CWE : Common Weakness Enumeration

%idName
9% (2) CWE-476 NULL Pointer Dereference
9% (2) CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
9% (2) CWE-269 Improper Privilege Management
9% (2) CWE-200 Information Exposure
9% (2) CWE-190 Integer Overflow or Wraparound
9% (2) CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
9% (2) CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting')
9% (2) CWE-20 Improper Input Validation
4% (1) CWE-362 Race Condition
4% (1) CWE-326 Inadequate Encryption Strength
4% (1) CWE-264 Permissions, Privileges, and Access Controls
4% (1) CWE-78 Improper Sanitization of Special Elements used in an OS Command ('O...
4% (1) CWE-16 Configuration

CAPEC : Common Attack Pattern Enumeration & Classification

id Name
CAPEC-20 Encryption Brute Forcing
CAPEC-97 Cryptanalysis

Open Source Vulnerability Database (OSVDB)

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
70083 Oracle Database MIT Kerberos 5 kg_accept_krb5 Remote Denial of Service
68841 Google Chrome Crafted Animated GIF Handling Memory Corruption
64744 Kerberos GSS-API AP-REQ Authenticator NULL Dereference Remote DoS
62670 libpng pngrutil.c png_decompress_chunk Function Ancillary Chunks PNG File Dec...
59654 Linux Kernel fs/pipe.c Multiple Function Locking Error NULL Dereference Local...
59222 Linux Kernel Netlink Subsystem net/sched/cls_api.c tcf_fill_node Function Loc...
59210 Linux Kernel net/unix/af_unix.c AF_UNIX Socket Reconnect Local DoS
59082 Linux Kernel on x86_64 arch/x86/ia32/ia32entry.S 64-bit Mode ia32 Process Loc...
57882 Apache HTTP Server mod_proxy_ftp Authorization HTTP Header Arbitrary FTP Comm...
57264 Linux Kernel execve Function current->clear_child_tid Pointer Handling Loc...
56984 Apache Xerces2 Java Malformed XML Input DoS
56232 Mozilla Firefox Multiple Method XPCCrossOriginWrapper Bypass
55818 openSUSE blinux Unspecified Data / Authentication Strings Remote Overflow
55230 Linux Kernel KVM Subsystem VMX Implementation arch/x86/kvm/vmx.c vmx_set_msr(...
54537 GTK2 in OpenSUSE Unspecified Search Path Subversion Arbitrary Local Code Exec...
54492 Linux Kernel fs/nfs/dir.c nfs_permission() Function NFSv4 Share Permission By...
54070 FreeType cff/cffload.c cff_charset_compute_cids() Function Overflow
54069 FreeType sfnt/ttcmap.c Multiple Validation Functions Overflow
54068 FreeType smooth/ftsmooth.c ft_smooth_render_generic() Function Overflow
52861 Linux Kernel nfsd CAP_MKNOD Unprivileged Device Node Creation
52461 Linux Kernel 32bit/64bit audit_syscall_entry Function 32/64 Bit Syscall Cross...
52201 Linux Kernel syscall Filtering 32/64-bit Switching Bypass
48798 QEMU -usbdevice Option diskformat: Parameter Host OS Arbitrary File Access
48114 Linux Kernel SCTP net/sctp/socket.c sctp_getsockopt_local_addrs_old Function ...
47501 openSUSE Linux libxcrypt MD5 Password Hash Configuration Weakness

OpenVAS Exploits

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2012-06-06 Name : RedHat Update for xerces-j2 RHSA-2011:0858-01
File : nvt/gb_RHSA-2011_0858-01_xerces-j2.nasl
2012-04-16 Name : VMSA-2010-0009: ESXi utilities and ESX Service Console third party updates
File : nvt/gb_VMSA-2010-0009.nasl
2012-03-16 Name : VMSA-2011-0003.2 Third party component updates for VMware vCenter Server, vCe...
File : nvt/gb_VMSA-2011-0003.nasl
2012-03-15 Name : VMSA-2010-0016 VMware ESXi and ESX third party updates for Service Console an...
File : nvt/gb_VMSA-2010-0016.nasl
2012-03-15 Name : VMSA-2011-0013.2 VMware third party component updates for VMware vCenter Serv...
File : nvt/gb_VMSA-2011-0013.nasl
2012-02-12 Name : Gentoo Security Advisory GLSA 201201-13 (mit-krb5)
File : nvt/glsa_201201_13.nasl
2011-09-07 Name : Mac OS X v10.6.4 Multiple Vulnerabilities (2010-007)
File : nvt/gb_macosx_su10-007.nasl
2011-08-27 Name : Ubuntu Update for webkit USN-1195-1
File : nvt/gb_ubuntu_USN_1195_1.nasl
2011-08-09 Name : CentOS Update for freetype CESA-2009:0329 centos3 i386
File : nvt/gb_CESA-2009_0329_freetype_centos3_i386.nasl
2011-08-09 Name : CentOS Update for kernel CESA-2009:0459 centos4 i386
File : nvt/gb_CESA-2009_0459_kernel_centos4_i386.nasl
2011-08-09 Name : CentOS Update for kernel CESA-2009:0473 centos5 i386
File : nvt/gb_CESA-2009_0473_kernel_centos5_i386.nasl
2011-08-09 Name : CentOS Update for freetype CESA-2009:1061 centos5 i386
File : nvt/gb_CESA-2009_1061_freetype_centos5_i386.nasl
2011-08-09 Name : CentOS Update for kernel CESA-2009:1106 centos5 i386
File : nvt/gb_CESA-2009_1106_kernel_centos5_i386.nasl
2011-08-09 Name : CentOS Update for firefox CESA-2009:1162 centos5 i386
File : nvt/gb_CESA-2009_1162_firefox_centos5_i386.nasl
2011-08-09 Name : CentOS Update for java CESA-2009:1201 centos5 i386
File : nvt/gb_CESA-2009_1201_java_centos5_i386.nasl
2011-08-09 Name : CentOS Update for kernel CESA-2009:1243 centos5 i386
File : nvt/gb_CESA-2009_1243_kernel_centos5_i386.nasl
2011-08-09 Name : CentOS Update for kernel CESA-2009:1438 centos4 i386
File : nvt/gb_CESA-2009_1438_kernel_centos4_i386.nasl
2011-08-09 Name : CentOS Update for kernel CESA-2009:1541 centos4 i386
File : nvt/gb_CESA-2009_1541_kernel_centos4_i386.nasl
2011-08-09 Name : CentOS Update for kernel CESA-2009:1548 centos5 i386
File : nvt/gb_CESA-2009_1548_kernel_centos5_i386.nasl
2011-08-09 Name : CentOS Update for kernel CESA-2009:1550 centos3 i386
File : nvt/gb_CESA-2009_1550_kernel_centos3_i386.nasl
2011-08-09 Name : CentOS Update for httpd CESA-2009:1579 centos3 i386
File : nvt/gb_CESA-2009_1579_httpd_centos3_i386.nasl
2011-08-09 Name : CentOS Update for httpd CESA-2009:1579 centos5 i386
File : nvt/gb_CESA-2009_1579_httpd_centos5_i386.nasl
2011-08-09 Name : CentOS Update for httpd CESA-2009:1580 centos4 i386
File : nvt/gb_CESA-2009_1580_httpd_centos4_i386.nasl
2011-08-09 Name : CentOS Update for xerces-j2 CESA-2009:1615 centos5 i386
File : nvt/gb_CESA-2009_1615_xerces-j2_centos5_i386.nasl
2011-08-09 Name : CentOS Update for kernel CESA-2009:1670 centos5 i386
File : nvt/gb_CESA-2009_1670_kernel_centos5_i386.nasl

Information Assurance Vulnerability Management (IAVM)

id Description
2011-A-0160 Multiple Vulnerabilities in VMware vCenter Server 4.0 and vCenter Update Mana...
Severity: Category I - VMSKEY: V0030769
2011-A-0066 Multiple Vulnerabilities in VMware Products
Severity: Category I - VMSKEY: V0027158
2010-A-0015 Multiple Vulnerabilities in Red Hat Linux Kernel
Severity: Category I - VMSKEY: V0022631
2009-A-0105 Multiple Vulnerabilities in VMware Products
Severity: Category I - VMSKEY: V0021867

Snort® IPS/IDS

Date Description
2014-01-10 Multiple Products IFRAME src javascript code execution
RuleID : 3679 - Type : INDICATOR-OBFUSCATION - Revision : 18
2014-01-10 Linux Kernel nfsd v4 CAP_MKNOD security bypass attempt
RuleID : 17749 - Type : PROTOCOL-RPC - Revision : 7
2014-01-10 Linux Kernel nfsd v3 tcp CAP_MKNOD security bypass attempt
RuleID : 16702 - Type : PROTOCOL-RPC - Revision : 7
2014-01-10 Linux Kernel nfsd v3 udp CAP_MKNOD security bypass attempt
RuleID : 16701 - Type : PROTOCOL-RPC - Revision : 8
2014-01-10 Linux Kernel nfsd v2 tcp CAP_MKNOD security bypass attempt
RuleID : 16700 - Type : PROTOCOL-RPC - Revision : 7
2014-01-10 Linux Kernel nfsd v2 udp CAP_MKNOD security bypass attempt
RuleID : 16699 - Type : PROTOCOL-RPC - Revision : 8

Nessus® Vulnerability Scanner

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2016-11-30 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_18449f92ab3911e68011005056925db4.nasl - Type: ACT_GATHER_INFO
2016-03-08 Name: The remote VMware ESX host is missing a security-related patch.
File: vmware_VMSA-2010-0002_remote.nasl - Type: ACT_GATHER_INFO
2016-03-08 Name: The remote VMware ESX host is missing a security-related patch.
File: vmware_VMSA-2010-0004_remote.nasl - Type: ACT_GATHER_INFO
2016-03-08 Name: The remote VMware ESX / ESXi host is missing a security-related patch.
File: vmware_VMSA-2010-0009_remote.nasl - Type: ACT_GATHER_INFO
2016-03-08 Name: The remote VMware ESX host is missing a security-related patch.
File: vmware_VMSA-2010-0013_remote.nasl - Type: ACT_GATHER_INFO
2016-03-04 Name: The remote VMware ESX / ESXi host is missing a security-related patch.
File: vmware_VMSA-2011-0003_remote.nasl - Type: ACT_GATHER_INFO
2016-03-04 Name: The remote VMware ESX / ESXi host is missing a security-related patch.
File: vmware_VMSA-2011-0013_remote.nasl - Type: ACT_GATHER_INFO
2016-03-03 Name: The remote host is missing a security-related patch.
File: vmware_VMSA-2009-0014_remote.nasl - Type: ACT_GATHER_INFO
2016-03-03 Name: The remote host is missing a security-related patch.
File: vmware_VMSA-2009-0016_remote.nasl - Type: ACT_GATHER_INFO
2014-12-15 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL15905.nasl - Type: ACT_GATHER_INFO
2014-12-15 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201412-08.nasl - Type: ACT_GATHER_INFO
2014-11-26 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2008-2005.nasl - Type: ACT_GATHER_INFO
2014-11-26 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2008-2006.nasl - Type: ACT_GATHER_INFO
2014-11-26 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2008-2007.nasl - Type: ACT_GATHER_INFO
2014-11-26 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2009-0009.nasl - Type: ACT_GATHER_INFO
2014-11-26 Name: The remote OracleVM host is missing a security update.
File: oraclevm_OVMSA-2009-0012.nasl - Type: ACT_GATHER_INFO
2014-11-26 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2009-0014.nasl - Type: ACT_GATHER_INFO
2014-11-26 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2009-0033.nasl - Type: ACT_GATHER_INFO
2014-11-26 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2011-0015.nasl - Type: ACT_GATHER_INFO
2014-11-26 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2013-0039.nasl - Type: ACT_GATHER_INFO
2014-11-08 Name: The remote Red Hat host is missing a security update.
File: redhat-RHSA-2012-1537.nasl - Type: ACT_GATHER_INFO
2014-06-13 Name: The remote openSUSE host is missing a security update.
File: suse_11_3_java-1_6_0-sun-101019.nasl - Type: ACT_GATHER_INFO
2014-06-13 Name: The remote openSUSE host is missing a security update.
File: suse_11_3_libwebkit-110104.nasl - Type: ACT_GATHER_INFO
2013-07-12 Name: The remote Oracle Linux host is missing one or more security updates.
File: oraclelinux_ELSA-2008-0612.nasl - Type: ACT_GATHER_INFO
2013-07-12 Name: The remote Oracle Linux host is missing one or more security updates.
File: oraclelinux_ELSA-2008-0885.nasl - Type: ACT_GATHER_INFO