[BSA-061] Security Update for openswan

Harald Jenny uploaded new packages for openswan which fixed the following security problems: CVE-2011-4073 Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through 2.6.36 allows remote authenticated users to cause a denial of service pluto IKE daemo...

[BSA-057] Security update for nss

This update to the NSS cryptographic libraries revokes the trust in the "DigiCert Sdn. Bhd" certificate authority. More information can be found in the Mozilla Security Blog: http://blog.mozilla.com/security/2011/11/03/revoking-trust-in-digicert-sdn-bhd-intermediate-certificate-authority/ This...

[BSA-056] Security update for Iceweasel

I uploaded new packages for icewease which fixed the following security problems: CVE-2011-3647 "mozbugra4" discovered a privilege escalation vulnerability in addon handling. CVE-2011-3648 Yosuke Hasegawa discovered that incorrect handling of Shift-JIS encodings could lead to cross-site scripting...

Fedora 16 : java-1.6.0-openjdk-1.6.0.0-60.1.10.4.fc16 (2011-15020) (BEAST)

Update to latest upstream bugfix release - Security fixes - S7000600, CVE-2011-3547: InputStream skip information leak - S7019773, CVE-2011-3548: mutable static AWTKeyStroke.ctor - S7023640, CVE-2011-3551: Java2D TransformHelper integer overflow - S7032417, CVE-2011-3552: excessive default UDP...

[BSA-052] Security Update for libvirt

Guido Günther uploaded new packages for libvirt which fixed the following security problems: CVE-2011-2511 Integer overflow in VirDomainGetVcpus CVE-2011-1486 Non thread safe error reporting For the squeeze-backports distribution the problems have been fixed in version 0.9.2-7bpo60+1. For the...

[BSA-053] Security update for libreoffice

Rene Engelhard uploaded new packages for libreoffice which fixed the following security problems: CVE-2011-2713 Red Hat, Inc. security researcher Huzaifa Sidhpurwala reported multiple vulnerabilities in the binary Microsoft Word doc file format importer of OpenOffice.org, a full-featured office...

[BSA-048] Security Update for Iceweasel

I uploaded new packages for iceweasel which fixed the following security problems: CVE-2011-2372 Mariusz Mlynski discovered that websites could open a download dialog - which has "open" as the default action -, while a user presses the ENTER key. CVE-2011-2995 Benjamin Smedberg, Bob Clary and Jes...

[BSA-050] Security Update for puppet

Ive uploaded new packages for puppet which fixed the following security problems: CVE-2011-3848 Resist directory traversal attacks through indirections. In various versions of Puppet it was possible to cause a directory traversal attack through the SSLFile indirection base class. This was various...

[BSA-047] Security Update for nss

Several unauthorised SSL certificates have been found in the wild issued for the DigiNotar Certificate Authority, obtained through a security compromise with said company. Debian, like other software distributors, has as a precaution decided to disable the DigiNotar Root CA by default in the NSS...

[BSA-041] Security Update for xml-security-c

Russ Allbery uploaded new packages for xml-security-c which fixed the following security problems: CVE-2011-2516 It has been discovered that xml-security-c, an implementation of the XML Digital Signature and Encryption specifications, is not properly handling RSA keys of sizes on the order of 819...

[BSA-042] Security Update for libapache2-mod-authnz-external

Amaya Rodrigo uploaded new packages for libapache2-mod-authnz-external which fixed the following security problems: CVE-2011-2688 Remotely exploitable SQL injection in the mysql auth module. For the lenny-backports distribution the problems have been fixed in version 3.2.4-2bpo50+1.1. For the...

[BSA-037] Security Update for subversion

Peter Samuelson uploaded new packages for subversion which fixed the following security problems: CVE-2011-1752 Subversions moddavsvn Apache HTTPD server module will dereference a NULL pointer if asked to deliver baselined WebDAV resources...

[BSA-039] Security Update for qemu-kvm

Michael Tokarev uploaded new packages for qemu-kvm which fixed the following security issues: CVE-2011-0011 Setting the VNC password to an empty string silently disabled all authentication. CVE-2011-1750 The virtio-blk driver performed insufficient validation of read/write I/O from the guest...

[BSA-038] Security Update for icedove

Christoph Göhre uploaded new packages for icedove which fixed the following security problems: CVE-2011-0083 Use-after-free vulnerability in the nsSVGPathSegList::ReplaceItem function in the implementation of SVG element lists allows remote attackers to cause a denial of service application crash...

[BSA-036] Security Update for exim4

Andreas Metzler uploaded new packages for exim4 which fixed the following security problems: CVE-2011-1407 command injection attack in DKIM processing code For the lenny-backports distribution the problems have been fixed in version 4.72-6+squeeze2bpo50+1. For the stable distribution squeeze, thi...

[BSA-035] Security Update for exim4

Andreas Metzler uploaded new packages for exim4 which fixed the following security problems: CVE-2011-1764 DKIM related format string vulnerability For the lenny-backports distribution the problems have been fixed in version 4.72-6+squeeze1bpo50+1. For the stable distribution squeeze, this proble...

[BSA-034] Security Update for iceweasel

Mike Hommey uploaded new packages for iceweasel which fixed the following security problems: CVE-2011-0069 CVE-2011-0070 CVE-2011-0072 CVE-2011-0074 CVE-2011-0075 CVE-2011-0077 CVE-2011-0078 CVE-2011-0080 CVE-2011-0081 "Scoobidiver", Ian Beer Bob Clary, Henri Sivonen, Marco Bonardo, Mats Palmgren...

[BSA-033] Security Update for request-tracker3.8

Jan Wagner uploaded new packages for request-tracker3.8 which fixed the following security problems: CVE-2011-1685 If the external custom field feature is enabled, Request Tracker allows authenticated users to execute arbitrary code with the permissions of the web server, possible triggered by a...

[BSA-030] Security update for nss

This update for the Network Security Service libraries marks several fraudulent HTTPS certificates as unstrusted. For the lenny-backports distribution the problems have been fixed in version 3.12,8-1+squeeze1bpo50+1. For the oldstable distribution lenny, this problem has been fixed in version...

[BSA-026] Security Update for subversion

Peter Samuelson uploaded new packages for subversion which fixed the following security problems: CVE-2011-0715 Subversions moddavsvn Apache HTTPD server module will dereference a NULL pointer if a lock token is sent in a HTTP request by a Subversion client which has not authenticated to the...