CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Suse : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2012-0435 2013-01-26 2013-01-28
5.8
 None Remote Medium Not required Partial Partial None
SUSE WebYaST before 1.2 0.2.63-0.6.1 allows remote attackers to modify the hosts list, and subsequently conduct man-in-the-middle attacks, via a crafted /host request on TCP port 4984.
2 CVE-2011-2660 20 Exec Code 2011-09-06 2011-10-25
7.5
 None Remote Low Not required Partial Partial Partial
The modify_resolvconf_suse script in the vpnc package before 0.5.1-55.10.1 in SUSE Linux Enterprise Desktop 11 SP1 might allow remote attackers to execute arbitrary commands via a crafted DNS domain name.
3 CVE-2010-0230 264 Bypass 2010-01-22 2011-04-28
7.5
 User Remote Low Not required Partial Partial Partial
SUSE Linux Enterprise 10 SP3 (SLE10-SP3) and openSUSE 11.2 configures postfix to listen on all network interfaces, which might allow remote attackers to bypass intended access restrictions.
4 CVE-2009-1648 16 2009-07-05 2009-07-06
7.5
 None Remote Low Not required Partial Partial Partial
The YaST2 LDAP module in yast2-ldap-server on SUSE Linux Enterprise Server 11 (aka SLE11) does not enable the firewall in certain circumstances involving reboots during online updates, which makes it easier for remote attackers to access network services.
5 CVE-2008-4636 20 +Priv 2008-11-26 2008-12-03
7.2
 None Local Low Not required Complete Complete Complete
yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process.
6 CVE-2008-3949 94 Exec Code 2008-09-22 2009-09-01
7.2
 None Local Low Not required Complete Complete Complete
emacs/lisp/progmodes/python.el in Emacs 22.1 and 22.2 imports Python script from the current working directory during editing of a Python file, which allows local users to execute arbitrary code via a Trojan horse Python file.
7 CVE-2008-3067 255 2008-07-07 2008-09-10
2.1
 None Local Low Not required Partial None None
sudo in SUSE openSUSE 10.3 does not clear the stdin buffer when password entry times out, which might allow local users to obtain a password by reading stdin from the parent process after a sudo child process exits.
8 CVE-2008-2667 89 Exec Code Sql 2008-07-07 2009-04-14
5.1
 None Remote High Not required Partial Partial Partial
SQL injection vulnerability in the Courier Authentication Library (aka courier-authlib) before 0.60.6 on SUSE openSUSE 10.3 and 11.0, and other platforms, when MySQL and a non-Latin character set are used, allows remote attackers to execute arbitrary SQL commands via the username and unspecified other vectors.
9 CVE-2007-6167 264 Exec Code 2007-11-28 2008-11-15
7.2
 Admin Local Low Not required Complete Complete Complete
Untrusted search path vulnerability in yast2-core in SUSE Linux might allow local users to execute arbitrary code by creating a malicious yast2 module in the current working directory.
10 CVE-2007-5471 DoS 2007-10-15 2008-11-15
7.8
 None Remote Low Not required None None Complete
libgssapi before 0.6-13.7, as used by the ISC BIND named daemon in SUSE Linux Enterprise Server 10 SP 1, terminates upon an initialization error, which allows remote attackers to cause a denial of service (daemon exit) via a GSS-TSIG request. NOTE: this issue probably affects other daemons that attempt to initialize this library within a chroot configuration or other invalid configuration.
11 CVE-2007-5196 310 2007-10-14 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the SSL implementation in Groupwise client system in the novell-groupwise-client package in SUSE Linux Enterprise Desktop 10 allows remote attackers to obtain credentials via a man-in-the-middle attack, a different vulnerability than CVE-2007-5195.
12 CVE-2007-5195 310 2007-10-14 2008-11-15
6.8
 User Remote Medium Not required Partial Partial Partial
Unspecified vulnerability in the SSL implementation in Groupwise client system in the novell-groupwise-client package in SUSE Linux Enterprise Desktop 10 allows remote attackers to obtain credentials via a man-in-the-middle attack, a different vulnerability than CVE-2007-5196.
13 CVE-2007-4432 +Priv 2007-08-20 2008-11-15
4.6
 User Local Low Not required Partial Partial Partial
Untrusted search path vulnerability in the wrapper scripts for the (1) rug, (2) zen-updater, (3) zen-installer, and (4) zen-remover programs on SUSE Linux 10.1 and Enterprise 10 allows local users to gain privileges via modified (a) LD_LIBRARY_PATH and (b) MONO_GAC_PREFIX environment variables.
14 CVE-2007-4394 2007-08-17 2008-11-15
2.1
 None Local Low Not required None None Partial
Unspecified vulnerability in a "core clean" cron job created by the findutils-locate package on SUSE Linux 10.0 and 10.1 and Enterprise Server 9 and 10 before 20070810 allows local users to delete of arbitrary files via unknown vectors.
15 CVE-2007-4393 2007-08-17 2008-11-15
4.6
 User Local Low Not required Partial Partial Partial
The installation script for orarun on SUSE Linux before 20070810 places the oracle user into the disk group, which allows the local oracle user to read or write raw disk partitions.
16 CVE-2007-4074 16 Exec Code 2007-07-30 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
The default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) on Gentoo Linux, SUSE Linux, and possibly other distributions, is run locally with elevated privileges without requiring authentication, which allows local and remote attackers to execute arbitrary commands via the local daemon on port 1314, a different vulnerability than CVE-2001-0956. NOTE: this issue is local in some environments, but remote on others.
17 CVE-2007-2654 362 2007-05-14 2008-11-13
4.4
 None Local Medium Not required Partial Partial Partial
xfs_fsr in xfsdump creates a .fsr temporary directory with insecure permissions, which allows local users to read or overwrite arbitrary files on xfs filesystems.
18 CVE-2007-0460 119 Overflow 2007-01-23 2010-09-15
10.0
 Admin Remote Low Not required Complete Complete Complete
Multiple buffer overflows in ulogd for SUSE Linux 9.3 up to 10.1, and possibly other distributions, have unknown impact and attack vectors related to "improper string length calculations."
19 CVE-2006-6662 264 2006-12-20 2008-09-05
4.1
 User Local Medium Single system Partial Partial Partial
Unspecified vulnerability in Linux User Management (novell-lum) on SUSE Linux Enterprise Desktop 10 and Open Enterprise Server 9, under unspecified conditions, allows local users to log in to the console without a password.
20 CVE-2006-5616 Exec Code 2006-10-30 2011-09-02
10.0
 Admin Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in OpenPBS, as used in SUSE Linux 9.2 through 10.1, allow attackers to execute arbitrary code via unspecified vectors.
21 CVE-2006-2752 2006-06-01 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
The RedCarpet /etc/ximian/rcd.conf configuration file in Novell Linux Desktop 9 and SUSE SLES 9 has world-readable permissions, which allows attackers to obtain the rc (RedCarpet) password.
22 CVE-2006-2703 Exec Code 2006-06-01 2008-09-05
5.0
 None Remote Low Not required Partial None None
The RedCarpet command-line client (rug) does not verify SSL certificates from a server, which allows remote attackers to read network traffic and execute commands via a man-in-the-middle (MITM) attack.
23 CVE-2006-2658 Dir. Trav. 2006-09-12 2008-09-05
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in the xsp component in mod_mono in Mono/C# web server, as used in SUSE Open-Enterprise-Server 1 and SUSE Linux 9.2 through 10.0, allows remote attackers to read arbitrary files via a .. (dot dot) sequence in an HTTP request.
24 CVE-2006-0803 2006-02-23 2008-09-05
5.0
 None Remote Low Not required None Partial None
The signature verification functionality in the YaST Online Update (YOU) script handling relies on a gpg feature that is not intended for signature verification, which prevents YOU from detecting malicious scripts or code that do not pass the signature check when gpg 1.4.x is being used.
25 CVE-2006-0745 Exec Code Bypass 2006-03-20 2010-04-02
7.2
 Admin Local Low Not required Complete Complete Complete
X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid, which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile.
26 CVE-2006-0646 Exec Code 2006-02-11 2008-09-05
4.4
 User Local Medium Not required Partial Partial Partial
ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory, which could contain an attacker-controlled library file.
27 CVE-2006-0043 Exec Code Overflow 2006-01-30 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
Buffer overflow in the realpath function in nfs-server rpc.mountd, as used in SUSE Linux 9.1 through 10.0, allows local users to execute arbitrary code via unspecified vectors involving mount requests and symlinks.
28 CVE-2005-4791 Exec Code 2005-12-31 2008-11-15
2.1
 None Local Low Not required None Partial None
Multiple untrusted search path vulnerabilities in SUSE Linux 10.0 cause the working directory to be added to LD_LIBRARY_PATH, which might allow local users to execute arbitrary code via (1) liferea or (2) banshee.
29 CVE-2005-4790 Exec Code 2005-12-31 2010-11-11
6.9
 None Local Medium Not required Complete Complete Complete
Multiple untrusted search path vulnerabilities in SUSE Linux 9.3 and 10.0, and possibly other distributions, cause the working directory to be added to LD_LIBRARY_PATH, which might allow local users to execute arbitrary code via (1) beagle, (2) tomboy, or (3) blam. NOTE: in August 2007, the tomboy vector was reported for other distributions.
30 CVE-2005-4789 Bypass 2005-12-31 2008-09-05
2.1
 None Local Low Not required Partial None None
resmgr in SUSE Linux 9.2 and 9.3, and possibly other distributions, does not properly enforce class-specific exclude rules in some situations, which allows local users to bypass intended access restrictions for USB devices that set their class ID at the interface level.
31 CVE-2005-4788 Bypass 2005-12-31 2008-09-05
2.1
 None Local Low Not required Partial None None
resmgr in SUSE Linux 9.2 and 9.3, and possibly other distributions, allows local users to bypass access control rules for USB devices via "alternate syntax for specifying USB devices."
32 CVE-2005-4778 2005-12-31 2008-09-05
2.1
 None Local Low Not required None None Partial
The powersave daemon in SUSE Linux 10.0 before 20051007 has an unspecified "configuration problem," which allows local users to suspend the computer and possibly perform certain other unauthorized actions.
33 CVE-2005-4772 2005-12-31 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
liby2util in Yet another Setup Tool (YaST) in SUSE Linux before 20051007 preserves permissions and ownerships when copying a remote repository, which might allow local users to read or modify sensitive files, possibly giving local users the ability to exploit CVE-2005-3013.
34 CVE-2005-3625 399 DoS 2005-12-31 2010-10-18
10.0
 None Remote Low Not required Complete Complete Complete
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."
35 CVE-2005-3624 189 Overflow 2005-12-31 2010-11-19
5.0
 None Remote Low Not required None Partial None
The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.
36 CVE-2005-3322 DoS 2005-10-27 2008-09-10
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in Squid on SUSE Linux 9.0 allows remote attackers to cause a denial of service (crash) via HTTPs (SSL).
37 CVE-2005-3321 2005-10-27 2008-09-10
4.6
 None Local Low Not required Partial Partial Partial
chkstat in SuSE Linux 9.0 through 10.0 allows local users to modify permissions of files by creating a hardlink to a file from a world-writable directory, which can cause the link count to drop to 1 when the file is deleted or replaced, which is then modified by chkstat to use weaker permissions.
38 CVE-2005-3298 Exec Code Overflow 2005-10-23 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple buffer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.
39 CVE-2005-3297 Exec Code Overflow 2005-10-23 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple integer overflows in OpenWBEM on SuSE Linux 9 allow remote attackers to execute arbitrary code via unknown vectors.
40 CVE-2005-3148 2005-10-05 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
StoreBackup before 1.19 does not properly set the uid and guid for symbolic links (1) that are backed up by storeBackup.pl, or (2) recovered by storeBackupRecover.pl, which could cause files to be restored with incorrect ownership.
41 CVE-2005-3147 +Info 2005-10-05 2008-09-05
2.1
 None Local Low Not required Partial None None
StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information.
42 CVE-2005-3146 2005-10-05 2008-09-05
2.1
 None Local Low Not required None Partial None
StoreBackup before 1.19 allows local users to perform unauthorized operations on arbitrary files via a symlink attack on temporary files.
43 CVE-2005-3013 Exec Code Overflow 2005-09-21 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
Buffer overflow in liby2util in Yet another Setup Tool (YaST) for SuSE Linux 9.3 allows local users to execute arbitrary code via a long Loc entry.
44 CVE-2005-2023 2005-06-17 2008-09-10
10.0
 None Remote Low Not required Complete Complete Complete
The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pinentry from being found and causes S/MIME signing to fail.
45 CVE-2005-1767 DoS 2005-08-05 2010-08-21
2.1
 None Local Low Not required None None Partial
traps.c in the Linux kernel 2.6.x and 2.4.x executes stack segment faults on an exception stack, which allows local users to cause a denial of service (oops and stack fault exception).
46 CVE-2005-1763 Overflow 2005-06-09 2010-08-21
7.2
 Admin Local Low Not required Complete Complete Complete
Buffer overflow in ptrace in the Linux Kernel for 64-bit architectures allows local users to write bytes into kernel memory.
47 CVE-2005-1761 20 DoS 2005-08-05 2010-08-21
2.1
 None Local Low Not required None None Partial
Linux kernel 2.6 and 2.4 on the IA64 architecture allows local users to cause a denial of service (kernel crash) via ptrace and the restore_sigcontext function.
48 CVE-2005-1043 DoS 2005-04-14 2010-08-21
5.0
 None Remote Low Not required None None Partial
exif.c in PHP before 4.3.11 allows remote attackers to cause a denial of service (memory consumption and crash) via an EXIF header with a large IFD nesting level, which causes significant stack recursion.
49 CVE-2005-0750 +Priv 2005-03-27 2010-08-21
7.2
 Admin Local Low Not required Complete Complete Complete
The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call with a negative protocol value.
50 CVE-2005-0639 Exec Code Overflow 2005-03-02 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple vulnerabilities in xli before 1.17 may allow remote attackers to execute arbitrary code via "buffer management errors" from certain image properties, some of which may be related to integer overflows in PPM files.
Total number of vulnerabilities : 215   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.