Debian DSA-2134-1 : upcoming changes in advisory format

Traditionally Debian Security Advisories have included MD5 check sums of the updated packages. This was introduced at a time when apt didn't exist yet and BIND was at version 4. Since apt cryptographically enforces the integrity of the archive for quite some time now, we've decided to finally dro...

[SECURITY] [DSA 2134-1] Upcoming changes in advisory format

------------------------------------------------------------------------ Debian Security Advisory DSA-2134-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 18th, 2010 http://www.debian.org/security/faq -...

Injecting Fake Updates: Evilgrade

Evilgrade is a modular framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates. It comes with pre-made binaries agents, a working default configuration for fast pentests, and has it’s own WebServer and DNSServer modules. Easy to set up new...

BSA-009 Security Update for nss

Alexander Reichle-Schmehl uploaded new packages for nss which fixed the following security problems: CVE-2010-3170 NSS recognizes a wildcard IP address in the subjects Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a...

BSA-009 Security Update for nss

Alexander Reichle-Schmehl uploaded new packages for nss which fixed the following security problems: CVE-2010-3170 NSS recognizes a wildcard IP address in the subjects Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a...

Subject: BSA-007 Security Update for mailscanner

Jan Wagner uploaded new packages for mailscanner which fixed the following security problems: CVE-2010-3095 incomplete fix for CVE-2008-5313 https://vulners.com/cve/CVE-2010-3095 The original text of CVE-2008-5313: mailscanner 4.68.8 and other versions before 4.74.16-1 might allow local users to...

Fedora 14 : rekonq-0.6.1-1.fc14 (2010-15874)

Mem leak fixed in the bars - Bookmarklets support - No more focus stealing on external url calls - Chinese sites right encoding - OpenSearch suggestions localized - Fixed urlbar crash in disconnected mode - AdBlock performance improvements - UrlBar Improvements - Suggestions - History Review -...

[SECURITY] [DSA-2102-1] New barnowl packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - ------------------------------------------------------------------------ Debian Security Advisory DSA-2102-1 [email protected] http://www.debian.org/security/ Sebastien Delafond Sep 3, 2010 http://www.debian.org/security/faq - -...

APT-WEBSHOP-SYSTEM modules.php SQL injection

Exploit for php platform in category web applications ========================================================== APT-WEBSHOP-SYSTEM modules.php SQL Injection Vulnerability ========================================================== / // // // \ / // / / // \ / | / |/ / \ \ / / / / / , // / / / / /...

APT-WEBSHOP-SYSTEM - modules.php SQL Injection

APT-WEBSHOP-SYSTEM - modules.php SQL Injection =============================================== APT-WEBSHOP-SYSTEM modules.php SQL injection =============================================== / // // // \ / // / / // \ / | / |/ / \ \ / / / / / , // / / / / / / , // | / / //// ///||// //////||// ||//|...

APT-WEBSHOP-SYSTEM - 'modules.php' SQL Injection

=============================================== APT-WEBSHOP-SYSTEM modules.php SQL injection =============================================== / // // // \ / // / / // \ / | / |/ / \ \ / / / / / , // / / / / / / , // | / / //// ///||// //////||// ||//|/ // APT-WEBSHOP-SYSTEM modules.php SQL...

[SECURITY] [DSA 2076-1] New gnupg2 packages fix potential code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2076-1 [email protected] http://www.debian.org/security/ Florian Weimer July 27, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2063-1] New pmount packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2063-1 [email protected] http://www.debian.org/security/ Giuseppe Iuculano June 17, 2010 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2057-1] New mysql-dfsg-5.0 packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-2057-1 [email protected] http://www.debian.org/security/ Giuseppe Iuculano June 07, 2010 http://www.debian.org/security/faq -...

[Backports-security-announce] Security update for openoffice.org

Rene Engelhard uploaded a new package for openoffice.org which fixed the following security problem: CVE-2010-0395 It was discovered that OpenOffice.org, a full-featured office productivity suite that provides a near drop-in replacement for MicrosoftR Office, is not properly handling python macro...

[Backports-security-announce] Security Update for postgresql-8.4

Gerfried Fuchs uploaded new packages for postgresql-8.4 which fixed the following security problems: CVE-2010-1169 PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 does not properly restrict...

xwine 1.0.1 - .exe Local Crash (PoC)

xwine 1.0.1 - .exe Local Crash PoC xwine v1.0.1 .exe file Local Crash PoC Exploit Install: sudo apt-get install xwine Author: JosS mail: sys-projectathotmaildotcom site: http://hack0wn.com/ team: Spanish Hackers Team - SHT This was written for educational purpose. Use it at your own risk. Author...

[Backports-security-announce] Security Update for drupal6

Luigi Gangitano uploaded new packages for drupal6 which fixed the following security problems: SA-CORE-2010-001 Multiple vulnerabilities and weaknesses were discovered in Drupal. Installation cross site scripting A user-supplied value is directly output during installation allowing a malicious us...

Debian DSA-1961-1 : bind9 - DNS cache poisoning

Michael Sinatra discovered that the DNS resolver component in BIND does not properly check DNS records contained in additional sections of DNS responses, leading to a cache poisoning vulnerability. This vulnerability is only present in resolvers which have been configured with DNSSEC trust anchor...

[Backports-security-announce] Security Update for dokuwiki

Gerfried Fuchs uploaded new packages for dokuwiki which fixed the following security problems: CVE-2010-0287 It was discovered that an internal variable is not properly sanitized before being used to list directories. This can be exploited to list contents of arbitrary directories. CVE-2010-0288,...