[BSA-027] Security Update for iceweasel

Mike Hommey uploaded new packages for iceweasel which fixed the following security problems: CVE-2010-1585 Roberto Suggi Liverani discovered that the sanitising performed by ParanoidFragmentSink was incomplete. CVE-2011-0053 Crashes in the layout engine may lead to the execution of arbitrary code...

[BSA-023] Security Update for drupal6

Gerfried Fuchs uploaded new packages for drupal6 which fixed the following security problems: CVE-2010-2250 A user-supplied value is directly output during installation allowing a malicious user to craft a URL and perform a cross-site scripting attack. The exploit can only be conducted on sites n...

[BSA-022] Security Update for request-tracker3.8

Jan Wagner uploaded new packages for request-tracker3.8 which fixed the following security problems: CVE-2011-0009 It was discovered that Request Tracker, an issue tracking system, stored passwords in its database by using an insufficiently strong hashing method. If an attacker would have access ...

[BSA-019] Removal of kvm

Following the removal of kvm source package from testing and unstable because of being obsoleted by qemu-kvm and having a fair amount of outstanding security issues since a while the package now got removed from lenny-backports, too. If you have installed the kvm and related packages from...

[BSA-018] Removal of egroupware

Following the removal of the egroupware packages from testing and unstable because they were unmaintained and have outstanding unaddressed security issues for a while the packages got now removed from lenny-backports, too. If you have installed the egroupware suite please be aware that they arent...

[BSA-017] Security Update for subversion

Sven Hoexter uploaded new packages for subversion which fixed the following security problems: CVE-2010-4539 A NULL pointer dereference flaw exisits in moddavsvn, the Apache httpd module for the Subversion server, when listing of repositories SVNListParentPath directive is enabled. A remote user...

[BSA-016] Security Update for exim4

Andreas Metzler uploaded new packages for exim4 which fixed the following security problems: CVE-2010-4345 exim privilege escalation Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a...

[BSA-015] Security Update for wordpress

Matt Taggart uploaded new packages for wordpress which fixed the following security problem: Critical core security bug in the HTML sanitation library more info: http://wp.me/pZhYe-qt For the lenny-backports distribution the problems have been fixed in version 3.0.4+dfsg-1bpo50+1. Upgrade...

[BSA-014] New Tor packages fix potential code execution

Willem Pinckaers discovered that Tor, a tool to enable online anonymity, does not correctly handle all data read from the network. By supplying specially crafted packets a remote attacker can cause Tor to overflow its heap, crashing the process in turn. Arbitrary code execution has not been...

BSA-011 Security Update for znc

Patrick Matthäi pmatthaei uploaded new packages for znc which fixed the following security problems: CVE-2010-2934 Multiple unspecified vulnerabilities in ZNC 0.092 allow remote attackers to cause a denial of service exception and daemon crash via unknown vectors related to "unsafe substr calls."...

BSA-011 Security Update for znc

Patrick Matthäi pmatthaei uploaded new packages for znc which fixed the following security problems: CVE-2010-2934 Multiple unspecified vulnerabilities in ZNC 0.092 allow remote attackers to cause a denial of service exception and daemon crash via unknown vectors related to "unsafe substr calls."...

DSA-2125-1 openssl - buffer overflow

Bulletin has no description...

BSA-010 Security Update for iceweasel

Alexander Reichle-Schmehl uploaded new packages for iceweasel which fixed the following security problems: CVE-2010-3174 CVE-2010-3176 Multiple unspecified vulnerabilities in the browser engine in Iceweasel allow remote attackers to cause a denial of service memory corruption and application cras...

BSA-009 Security Update for nss

Alexander Reichle-Schmehl uploaded new packages for nss which fixed the following security problems: CVE-2010-3170 NSS recognizes a wildcard IP address in the subjects Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a...

BSA-010 Security Update for iceweasel

Alexander Reichle-Schmehl uploaded new packages for iceweasel which fixed the following security problems: CVE-2010-3174 CVE-2010-3176 Multiple unspecified vulnerabilities in the browser engine in Iceweasel allow remote attackers to cause a denial of service memory corruption and application cras...

BSA-009 Security Update for nss

Alexander Reichle-Schmehl uploaded new packages for nss which fixed the following security problems: CVE-2010-3170 NSS recognizes a wildcard IP address in the subjects Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a...

Subject: BSA-008 Security Update for pidgin

Jan Wagner uploaded new packages for pidgin which fixed the following security problems: CVE-2010-3711 Fixes multiple remotely-triggered DoSes https://vulners.com/cve/CVE-2010-3711 For the lenny-backports distribution the problems have been fixed in version 2.7.3-1bpo50+2. For the unstable sid...

Subject: BSA-008 Security Update for pidgin

Jan Wagner uploaded new packages for pidgin which fixed the following security problems: CVE-2010-3711 Fixes multiple remotely-triggered DoSes https://vulners.com/cve/CVE-2010-3711 For the lenny-backports distribution the problems have been fixed in version 2.7.3-1bpo50+2. For the unstable sid...

Subject: BSA-007 Security Update for mailscanner

Jan Wagner uploaded new packages for mailscanner which fixed the following security problems: CVE-2010-3095 incomplete fix for CVE-2008-5313 https://vulners.com/cve/CVE-2010-3095 The original text of CVE-2008-5313: mailscanner 4.68.8 and other versions before 4.74.16-1 might allow local users to...

Subject: BSA-007 Security Update for mailscanner

Jan Wagner uploaded new packages for mailscanner which fixed the following security problems: CVE-2010-3095 incomplete fix for CVE-2008-5313 https://vulners.com/cve/CVE-2010-3095 The original text of CVE-2008-5313: mailscanner 4.68.8 and other versions before 4.74.16-1 might allow local users to...