openSUSE

Security Update!
This update fixes an integer overflow in libxml2 that could lead to memory corruption and arbitrary code execution. (CVE-2008-4226)
Thanks to: Drew Yao of Apple Product Security

Security Update!
This update fixes an integer overflow in libxml2 that could lead to memory corruption and arbitrary code execution. (CVE-2008-4226)
Thanks to: Drew Yao of Apple Product Security

Security Update!
This update fixes an integer overflow in libxml2 that could lead to memory corruption and arbitrary code execution. (CVE-2008-4226)
Thanks to: Drew Yao of Apple Product Security

Security Update!
This update fixes an integer overflow in libxml2 that could lead to memory corruption and arbitrary code execution. (CVE-2008-4226)
Thanks to: Drew Yao of Apple Product Security

Security Update!
This update of phpMyAdmin fixes the following bugs:
- CVE-2008-1149: SQL injection, CSRF attacks using crafted cookies
- CVE-2008-1567: local users can steal session information/credentials
- CVE-2008-1924: in a shared host environment users with CREAT permissions can read arbitrary files
- CVE-2008-3456: cross-site framing attack
- CVE-2008-3457: user-assisted XSS attack

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Various issues have been fixed in lighttpd.
CVE-2008-4298, CVE-2008-4359 and CVE-2008-4360
have been assigned to thess issues.

Security Update!
Squirrelmail was updated to use the secure flag for its cookies. Otherwise it was possible to hijack a SSL-protected session via leaked cookies. (CVE-2008-3663)

Security Update!
This kernel update fixes various bugs and also several security issues:

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.

Security Update!
This kernel update fixes various bugs and also several security issues:

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.

Security Update!
This kernel update fixes various bugs and also several security issues:

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.

Security Update!
This kernel update fixes various bugs and also several security issues:

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.

Security Update!
This kernel update fixes various bugs and also several security issues:

CVE-2008-4576: Fixed a crash in SCTP INIT-ACK, on mismatch between SCTP
AUTH availability. This might be exploited remotely for a denial of
service (crash) attack.

CVE-2008-3833: The generic_file_splice_write function in fs/splice.c
in the Linux kernel does not properly strip setuid and setgid bits
when there is a write to a file, which allows local users to gain the
privileges of a different group, and obtain sensitive information or
possibly have unspecified other impact, by splicing into an inode in
order to create an executable file in a setgid directory.

CVE-2008-4210: fs/open.c in the Linux kernel before 2.6.22 does not
properly strip setuid and setgid bits when there is a write to a file,
which allows local users to gain the privileges of a different group, and
obtain sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

CVE-2008-4302: fs/splice.c in the splice subsystem in the Linux
kernel before 2.6.22.2 does not properly handle a failure of the
add_to_page_cache_lru function, and subsequently attempts to unlock a page
that was not locked, which allows local users to cause a denial of service
(kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVE-2008-3528: The ext[234] filesystem code fails to properly handle
corrupted data structures. With a mounted filesystem image or partition
that have corrupted dir->i_size and dir->i_blocks, a user performing
either a read or write operation on the mounted image or partition can
lead to a possible denial of service by spamming the logfile.

CVE-2007-6716: fs/direct-io.c in the dio subsystem in the Linux kernel
did not properly zero out the dio struct, which allows local users to
cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVE-2008-3525: Added missing capability checks in sbni_ioctl().

CVE-2008-3272: Fixed range checking in the snd_seq OSS ioctl, which
could be used to leak information from the kernel.

CVE-2008-2931: The do_change_type function in fs/namespace.c did not
verify that the caller has the CAP_SYS_ADMIN capability, which allows
local users to gain privileges or cause a denial of service by modifying
the properties of a mountpoint.

CVE-2008-2812: Various NULL ptr checks have been added to tty op
functions, which might have been used by local attackers to execute
code. We think that this affects only devices openable by root, so the
impact is limited.

CVE-2008-1673: Added range checking in ASN.1 handling for the CIFS and
SNMP NAT netfilter modules.

CVE-2008-3527: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared
Objects (vDSO) implementation in the Linux kernel before 2.6.21 did not
properly check boundaries, which allows local users to gain privileges
or cause a denial of service via unspecified vectors, related to the
install_special_mapping, syscall, and syscall32_nopage functions.

Security Update!
Remote attackers could exploit memory leaks in the 'racoon' daemon
to crash it (CVE-2008-3651, CVE-2008-3652)

Security Update!
This update fixes a heap-based buffer overflow in libcdaudio that can be exploited remotely to execute arbitrary code.

Security Update!
This update fixes a heap-based buffer overflow in libcdaudio that can be exploited remotely to execute arbitrary code.

Security Update!
This update of enscript fixes buffer overflows in the setfilename (CVE-2008-3863), process_file and read_special_escape function that can be exploited during file processing.

Security Update!
Missing sanity checks of FTP URLs allowed cross site scripting (XSS)
attacks via the mod_proxy_ftp module (CVE-2008-2939).

Missing precautions allowed cross site request forgery (CSRF) via
the mod_proxy_balancer interface (CVE-2007-6420).

Security Update!
Missing sanity checks of FTP URLs allowed cross site scripting (XSS)
attacks via the mod_proxy_ftp module (CVE-2008-2939).

Missing precautions allowed cross site request forgery (CSRF) via
the mod_proxy_balancer interface (CVE-2007-6420).

Security Update!
Missing sanity checks of FTP URLs allowed cross site scripting (XSS)
attacks via the mod_proxy_ftp module (CVE-2008-2939).

Missing precautions allowed cross site request forgery (CSRF) via
the mod_proxy_balancer interface (CVE-2007-6420).

Security Update!
Missing sanity checks of FTP URLs allowed cross site scripting (XSS)
attacks via the mod_proxy_ftp module (CVE-2008-2939).

Missing precautions allowed cross site request forgery (CSRF) via
the mod_proxy_balancer interface (CVE-2007-6420).

Security Update!
Missing sanity checks of FTP URLs allowed cross site scripting (XSS)
attacks via the mod_proxy_ftp module (CVE-2008-2939).

Missing precautions allowed cross site request forgery (CSRF) via
the mod_proxy_balancer interface (CVE-2007-6420).

Security Update!
Missing sanity checks of FTP URLs allowed cross site scripting (XSS)
attacks via the mod_proxy_ftp module (CVE-2008-2939).

Missing precautions allowed cross site request forgery (CSRF) via
the mod_proxy_balancer interface (CVE-2007-6420).

Security Update!
Spamassassin tagged all incoming mails with DNS_FROM_SECURITYSAGE=1.513
The reason is: The securityusage blacklist was disabled and replies with
127.0.0.1 to *all* queries.

This update removes this rule.

Security Update!
Spamassassin tagged all incoming mails with DNS_FROM_SECURITYSAGE=1.513
The reason is: The securityusage blacklist was disabled and replies with
127.0.0.1 to *all* queries.

This update removes this rule.

Security Update!
This update to Opera 9.62 fixes a security bug that allowed the execution of arbitrary commands remotely. http://www.opera.com/docs/changelogs/linux/962/

Security Update!
This update of libexiv2 solves a denial of service bug that can be triggered by using crafted metadata. (CVE-2008-2696)

Security Update!
This update of libexiv2 solves a denial of service bug that can be triggered by using crafted metadata. (CVE-2008-2696)

Security Update!
This update of tomcat fixes an information leak due to incorrect IP address filtering. (CVE-2008-3271)

Security Update!
This update of tomcat fixes an information leak due to incorrect IP address filtering. (CVE-2008-3271)

Security Update!
This update of tomcat fixes an information leak due to incorrect IP address filtering. (CVE-2008-3271)

Security Update!
This update of graphviz fixes a buffer overflow that occurs while parsing a DOT file. (CVE-2008-4555)

Security Update!
This update of graphviz fixes a buffer overflow that occurs while parsing a DOT file. (CVE-2008-4555)

Security Update!
This update of graphviz fixes a buffer overflow that occurs while parsing a DOT file. (CVE-2008-4555)

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Various timezone information updates:
* DST changes for Indian/Mauritius, Africa/Casablanca, Asia/Karachi,
Asia/Gaza, Asia/Damascus, Argentina and Brazil
* Historical DST information change for Central Europe and America/Nassau
* Leap second introduction for 2008
* Fix location of Pacific/Niue

Also, glibc dladdr() call has been fixed not to return incorrect values
sometimes.

Security Update!
This update fixes a security problem in the liblber client library of
openldap that allowed remote attackers to cause a denial of service
(program termination) via crafted ASN.1 BER datagrams, which triggers
an assertion error. (CVE-2008-2952)
Additionally a bug was fixed in ldap_free_connection which could result in client crashes when the server closed a connection while an operation is active.

Security Update!
This update fixes a security problem in the liblber client library of
openldap that allowed remote attackers to cause a denial of service
(program termination) via crafted ASN.1 BER datagrams, which triggers
an assertion error. (CVE-2008-2952)
Additionally a bug was fixed in ldap_free_connection which could result in client crashes when the server closed a connection while an operation is active.

Security Update!
This update fixes a security problem in the liblber client library of
openldap that allowed remote attackers to cause a denial of service
(program termination) via crafted ASN.1 BER datagrams, which triggers
an assertion error. (CVE-2008-2952)
Additionally a bug was fixed in ldap_free_connection which could result in client crashes when the server closed a connection while an operation is active.

Security Update!
This update fixes a security problem in the liblber client library of
openldap that allowed remote attackers to cause a denial of service
(program termination) via crafted ASN.1 BER datagrams, which triggers
an assertion error. (CVE-2008-2952)
Additionally a bug was fixed in ldap_free_connection which could result in client crashes when the server closed a connection while an operation is active.

Security Update!
This update fixes a security problem in the liblber client library of
openldap that allowed remote attackers to cause a denial of service
(program termination) via crafted ASN.1 BER datagrams, which triggers
an assertion error. (CVE-2008-2952)
Additionally a bug was fixed in ldap_free_connection which could result in client crashes when the server closed a connection while an operation is active.

Security Update!
This update fixes a security problem in the liblber client library of
openldap that allowed remote attackers to cause a denial of service
(program termination) via crafted ASN.1 BER datagrams, which triggers
an assertion error. (CVE-2008-2952)
Additionally a bug was fixed in ldap_free_connection which could result in client crashes when the server closed a connection while an operation is active.

Security Update!
This update fixes a security problem in the liblber client library of
openldap that allowed remote attackers to cause a denial of service
(program termination) via crafted ASN.1 BER datagrams, which triggers
an assertion error. (CVE-2008-2952)
Additionally a bug was fixed in ldap_free_connection which could result in client crashes when the server closed a connection while an operation is active.

Security Update!
This update fixes a possible symlink attack in the script freeradius-dialupadmin. (CVE-2008-4474)

Security Update!
This update fixes a possible symlink attack in the script freeradius-dialupadmin. (CVE-2008-4474)

Security Update!
This update fixes a possible symlink attack in the script freeradius-dialupadmin. (CVE-2008-4474)

Security Update!
This update fixes a denial of service bug in dbus. (CVE-2008-3834)

Security Update!
This update fixes a denial of service bug in dbus. (CVE-2008-3834)

Security Update!
This update fixes a denial of service bug in dbus. (CVE-2008-3834)

Security Update!
This update fixes a denial of service bug in dbus. (CVE-2008-3834)

Security Update!
This update fixes a denial of service bug in dbus. (CVE-2008-3834)

Security Update!
This update of hplip does not allow to send alert mails as user anymore (CVE-2008-2940) and fixes a denial-of-service defect (CVE-2008-2941).

Security Update!
This update of hplip does not allow to send alert mails as user anymore (CVE-2008-2940) and fixes a denial-of-service defect (CVE-2008-2941).

Security Update!
This patch backports security fixes found in MozillaThunderbird
2.0.0.17 back to the 1.5 Thunderbird used in openSUSE 10.2.

MFSA 2008-34 / CVE-2008-2785: An anonymous researcher, via
TippingPoint's Zero Day Initiative program, reported a
vulnerability in Mozilla CSS reference counting code. The
vulnerability was caused by an insufficiently sized
variable being used as a reference counter for CSS objects.
By creating a very large number of references to a common
CSS object, this counter could be overflowed which could
cause a crash when the browser attempts to free the CSS
object while still in use. An attacker could use this crash
to run arbitrary code on the victim's computer

Security Update!
This patch backports security fixes found in MozillaThunderbird
2.0.0.17 back to the 1.5 Thunderbird used in openSUSE 10.2.

MFSA 2008-34 / CVE-2008-2785: An anonymous researcher, via
TippingPoint's Zero Day Initiative program, reported a
vulnerability in Mozilla CSS reference counting code. The
vulnerability was caused by an insufficiently sized
variable being used as a reference counter for CSS objects.
By creating a very large number of references to a common
CSS object, this counter could be overflowed which could
cause a crash when the browser attempts to free the CSS
object while still in use. An attacker could use this crash
to run arbitrary code on the victim's computer

Updates the client IDs used by Kopete to login to ICQ. Solve potential crash with Yahoo! on login.

This patch updates epiphany to match the current mozilla-xulrunner181 package.

This patch updates epiphany to match the current mozilla-xulrunner181 package.

This patch updates epiphany to match the current mozilla-xulrunner181 package.

This patch updates epiphany to match the current mozilla-xulrunner181 package.

Security Update!
This update brings mozilla-xulrunner181 to security fix version 1.8.1.17.

It contains the following security fixes:
MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading

MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities

MFSA 2008-43: BOM characters stripped from JavaScript before execution
CVE-2008-4065: Stripped BOM characters bug
CVE-2008-4066: HTML escaped low surrogates bug

MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17):
CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine.
CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski,
and Antoine Labour reported crashes in the
JavaScript engine.
CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers
reported crashes in the layout engine which only
affected Firefox 3.
CVE-2008-4064: David Maciejak and Drew Yao reported crashes in
graphics rendering which only affected Firefox 3.

MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution
CVE-2008-4058: XPCnativeWrapper pollution bugs
CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2)
CVE-2008-4060: Documents without script handling objects

MFSA 2008-40 / CVE-2008-3837: Forced mouse drag

MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw

MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation

MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow

For more details:
http://www.mozilla.org/security/known-vulnerabilities/firefox20.html

Security Update!
This update brings mozilla-xulrunner181 to security fix version 1.8.1.17.

It contains the following security fixes:
MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading

MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities

MFSA 2008-43: BOM characters stripped from JavaScript before execution
CVE-2008-4065: Stripped BOM characters bug
CVE-2008-4066: HTML escaped low surrogates bug

MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17):
CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine.
CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski,
and Antoine Labour reported crashes in the
JavaScript engine.
CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers
reported crashes in the layout engine which only
affected Firefox 3.
CVE-2008-4064: David Maciejak and Drew Yao reported crashes in
graphics rendering which only affected Firefox 3.

MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution
CVE-2008-4058: XPCnativeWrapper pollution bugs
CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2)
CVE-2008-4060: Documents without script handling objects

MFSA 2008-40 / CVE-2008-3837: Forced mouse drag

MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw

MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation

MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow

For more details:
http://www.mozilla.org/security/known-vulnerabilities/firefox20.html

Security Update!
This update brings mozilla-xulrunner181 to security fix version 1.8.1.17.

It contains the following security fixes:
MFSA 2008-45 / CVE-2008-4069: XBM image uninitialized memory reading

MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068: resource: traversal vulnerabilities

MFSA 2008-43: BOM characters stripped from JavaScript before execution
CVE-2008-4065: Stripped BOM characters bug
CVE-2008-4066: HTML escaped low surrogates bug

MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17):
CVE-2008-4061: Jesse Ruderman reported a crash in the layout engine.
CVE-2008-4062: Igor Bukanov, Philip Taylor, Georgi Guninski,
and Antoine Labour reported crashes in the
JavaScript engine.
CVE-2008-4063: Jesse Ruderman, Bob Clary, and Martijn Wargers
reported crashes in the layout engine which only
affected Firefox 3.
CVE-2008-4064: David Maciejak and Drew Yao reported crashes in
graphics rendering which only affected Firefox 3.

MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution
CVE-2008-4058: XPCnativeWrapper pollution bugs
CVE-2008-4059: XPCnativeWrapper pollution (Firefox 2)
CVE-2008-4060: Documents without script handling objects

MFSA 2008-40 / CVE-2008-3837: Forced mouse drag

MFSA 2008-39 / CVE-2008-3836: Privilege escalation using feed preview page and XSS flaw

MFSA 2008-38 / CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation

MFSA 2008-37 / CVE-2008-0016: UTF-8 URL stack buffer overflow

For more details:
http://www.mozilla.org/security/known-vulnerabilities/firefox20.html