gnome-screensaver using NIS auth will unlock if NIS goes away

gnome-screensaver before 2.22.1, when a remote authentication server is enabled, crashes upon an unlock attempt during a network outage, which allows physically proximate attackers to gain access to the locked session, a related issue to CVE-2007-1859...

[SECURITY] [DSA 1537-1] New xpdf packages fix multiple vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1537-1 [email protected] http://www.debian.org/security/ Devin Carraway April 02, 2008 http://www.debian.org/security/faq -...

Code injection

The arrayShrink function lib/Array.c in Squid 2.6.STABLE17 allows attackers to cause a denial of service process exit via unknown vectors that cause an array to shrink to 0 entries, which triggers an assert error. NOTE: this issue is due to an incorrect fix for CVE-2007-6239...

DSA-1533-2 exiftags

Bulletin has no description...

Debian DSA-1536-1 : libxine - several vulnerabilities

Several local vulnerabilities have been discovered in Xine, a media player library, allowed for a denial of service or arbitrary code execution, which could be exploited through viewing malicious content. The Common Vulnerabilities and Exposures project identifies the following problems : -...

[SECURITY] [DSA 1536-1] New libxine packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1536-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst March 31, 2008 http://www.debian.org/security/faq -...

Microsoft Crypto API X.509 Certificate Validation - Remote Information Disclosure

Microsoft Crypto API X.509 Certificate Validation - Remote Information Disclosure source: https://www.securityfocus.com/bid/28548/info Microsoft's Crypto API library is prone to an information-disclosure vulnerability because HTTP requests to arbitrary hosts and ports may be automatically trigger...

Debian DSA-1532-1 : xulrunner - several vulnerabilities

This shares a lot of text with dsa-1534.wml, dsa-1535.wml, dsa-1574.wml Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-4879 Peter Broderse...

Debian DSA-1533-2 : exiftags - insufficient input sanitizing

Christian Schmid and Meder Kydyraliev Google Security discovered a number of vulnerabilities in exiftags, a utility for extracting EXIF metadata from JPEG images. The Common Vulnerabilities and Exposures project identified the following three problems : - CVE-2007-6354 Inadequate EXIF property...

[SECURITY] [DSA 1534-1] New iceape packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1534-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 28, 2008 http://www.debian.org/security/faq -...

Updated libxml2 service console package

Updated libxml2 package to address a denial of service flaw. Thanks to the Google security team for identifying and reporting this issue. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name CVE-2007-6284 to this issue...

openSUSE 10 Security Update : tomcat55 (tomcat55-5069)

This update of tomcat fixes cross-site-scripting bugs CVE-2007-2449 as well as it improves the list of supported SSL ciphers CVE-2007-1858. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : sdl-image1.2 vulnerabilities (USN-595-1)

Michael Skladnikiewicz discovered that SDLimage did not correctly load GIF images. If a user or automated system were tricked into processing a specially crafted GIF, a remote attacker could execute arbitrary code or cause a crash, leading to a denial of service. CVE-2007-6697 David Raulo...

Ubuntu 6.06 LTS / 6.10 : libnet-dns-perl vulnerability (USN-594-1)

It was discovered that Net::DNS did not correctly validate the size of DNS replies. A remote attacker could send a specially crafted DNS response and cause applications using Net::DNS to abort, leading to a denial of service. Note that Tenable Network Security has extracted the preceding...

[SECURITY] [DSA 1533-1] New exiftags packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1533-1 [email protected] http://www.debian.org/security/ Devin Carraway March 27, 2008 http://www.debian.org/security/faq -...

USN-596-1: Ruby vulnerabilities

Chris Clark discovered that Ruby's HTTPS module did not check for commonName mismatches early enough during SSL negotiation. If a remote attacker were able to perform machine-in-the-middle attacks, this flaw could be exploited to view sensitive information in HTTPS requests coming from Ruby...

USN-595-1: SDL_image vulnerabilities

Michael Skladnikiewicz discovered that SDLimage did not correctly load GIF images. If a user or automated system were tricked into processing a specially crafted GIF, a remote attacker could execute arbitrary code or cause a crash, leading to a denial of service. CVE-2007-6697 David Raulo...

openSUSE 10 Security Update : apache2-mod_jk (apache2-mod_jk-5066)

This update of tomcat improves the list of supported SSL ciphers CVE-2007-1858. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update apache2-modjk-5066. The text description of this plugin is C SUS...

openSUSE 10 Security Update : tomcat5 (tomcat5-5071)

This update of tomcat fixes cross-site-scripting bugs CVE-2007-2449 as well as it improves the list of supported SSL ciphers CVE-2007-1858. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : icu vulnerabilities (USN-591-1)

Will Drewry discovered that libicu did not properly handle '\0' when processing regular expressions. If an application linked against libicu processed a crafted regular expression, an attacker could execute arbitrary code with privileges of the user invoking the program. CVE-2007-4770 Will Drewry...