[BSA-014] New Tor packages fix potential code execution

Willem Pinckaers discovered that Tor, a tool to enable online anonymity, does not correctly handle all data read from the network. By supplying specially crafted packets a remote attacker can cause Tor to overflow its heap, crashing the process in turn. Arbitrary code execution has not been...

BSA-011 Security Update for znc

Patrick Matthäi pmatthaei uploaded new packages for znc which fixed the following security problems: CVE-2010-2934 Multiple unspecified vulnerabilities in ZNC 0.092 allow remote attackers to cause a denial of service exception and daemon crash via unknown vectors related to "unsafe substr calls."...

BSA-011 Security Update for znc

Patrick Matthäi pmatthaei uploaded new packages for znc which fixed the following security problems: CVE-2010-2934 Multiple unspecified vulnerabilities in ZNC 0.092 allow remote attackers to cause a denial of service exception and daemon crash via unknown vectors related to "unsafe substr calls."...

DSA-2125-1 openssl - buffer overflow

Bulletin has no description...

BSA-010 Security Update for iceweasel

Alexander Reichle-Schmehl uploaded new packages for iceweasel which fixed the following security problems: CVE-2010-3174 CVE-2010-3176 Multiple unspecified vulnerabilities in the browser engine in Iceweasel allow remote attackers to cause a denial of service memory corruption and application cras...

BSA-009 Security Update for nss

Alexander Reichle-Schmehl uploaded new packages for nss which fixed the following security problems: CVE-2010-3170 NSS recognizes a wildcard IP address in the subjects Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a...

BSA-010 Security Update for iceweasel

Alexander Reichle-Schmehl uploaded new packages for iceweasel which fixed the following security problems: CVE-2010-3174 CVE-2010-3176 Multiple unspecified vulnerabilities in the browser engine in Iceweasel allow remote attackers to cause a denial of service memory corruption and application cras...

BSA-009 Security Update for nss

Alexander Reichle-Schmehl uploaded new packages for nss which fixed the following security problems: CVE-2010-3170 NSS recognizes a wildcard IP address in the subjects Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a...

Subject: BSA-008 Security Update for pidgin

Jan Wagner uploaded new packages for pidgin which fixed the following security problems: CVE-2010-3711 Fixes multiple remotely-triggered DoSes https://vulners.com/cve/CVE-2010-3711 For the lenny-backports distribution the problems have been fixed in version 2.7.3-1bpo50+2. For the unstable sid...

Subject: BSA-008 Security Update for pidgin

Jan Wagner uploaded new packages for pidgin which fixed the following security problems: CVE-2010-3711 Fixes multiple remotely-triggered DoSes https://vulners.com/cve/CVE-2010-3711 For the lenny-backports distribution the problems have been fixed in version 2.7.3-1bpo50+2. For the unstable sid...

Subject: BSA-007 Security Update for mailscanner

Jan Wagner uploaded new packages for mailscanner which fixed the following security problems: CVE-2010-3095 incomplete fix for CVE-2008-5313 https://vulners.com/cve/CVE-2010-3095 The original text of CVE-2008-5313: mailscanner 4.68.8 and other versions before 4.74.16-1 might allow local users to...

Subject: BSA-007 Security Update for mailscanner

Jan Wagner uploaded new packages for mailscanner which fixed the following security problems: CVE-2010-3095 incomplete fix for CVE-2008-5313 https://vulners.com/cve/CVE-2010-3095 The original text of CVE-2008-5313: mailscanner 4.68.8 and other versions before 4.74.16-1 might allow local users to...

Fedora 14 : krb5-1.8.2-6.fc14 (2010-15803)

This update incorporates the upstream patch to fix an uninitialized pointer crash in the KDC's authorization data handling routines CVE-2010-1322. It also pulls up a few backports and compilation flag changes from F15. Note that Tenable Network Security has extracted the preceding description blo...

BSA-006 Security Update for dovecot

Marco Nenciarini uploaded new packages for dovecot which fixed the following security problems: CVE-2010-3706 plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instea...

BSA-005 Security Update for postgresql-8.4

Gerfried Fuchs uploaded new packages for postgresql-8.4 which fixed the following security problem: CVE-2010-3433 The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before...

BSA-005 Security Update for postgresql-8.4

Gerfried Fuchs uploaded new packages for postgresql-8.4 which fixed the following security problem: CVE-2010-3433 The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before...

BSA-004 Security Update for subversion

Peter Samuelson uploaded new packages for subversion which fixed the following security problems: CVE-2010-3315 When "SVNPathAuthz shortcircuit" is enabled, authz authentication in the moddavsvn module for the Apache HTTP Server is flawed. Remote authenticated users can bypass intended access...

BSA-004 Security Update for subversion

Peter Samuelson uploaded new packages for subversion which fixed the following security problems: CVE-2010-3315 When "SVNPathAuthz shortcircuit" is enabled, authz authentication in the moddavsvn module for the Apache HTTP Server is flawed. Remote authenticated users can bypass intended access...

BSA-003 Security Update for samba

Christian Perrier uploaded new packages for samba which fixed the following security problems: CVE-2010-3069 A vulnerability has been discovered in samba, a SMB/CIFS file, print, and login server for Unix. The sidparse function does not correctly check its input lengths when reading a binary...

Security update for openoffice.org

Rene Engelhard uploaded new packages for openoffice.org which fixed the following security problems: CVE-2010-2935 CVE-2010-2936: Charlie Miller has discovered two vulnerabilities in OpenOffice.org Impress, which can be exploited by malicious people to compromise a users system and execute...