Debian Security Advisory DSA 3885-1 (irssi - security update)

Multiple vulnerabilities have been discovered in Irssi, a terminal based IRC client. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2017-9468 Joseph Bisch discovered that Irssi does not properly handle DCC messages without source nick/host. A malicious IRC...

Debian: Security Advisory (DSA-3885-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-3883-1 : rt-authen-externalauth - security update

It was discovered that RT::Authen::ExternalAuth, an external authentication module for Request Tracker, is vulnerable to timing side-channel attacks for user passwords. Only ExternalAuth in DBI database mode is vulnerable. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Debian DSA-3882-1 : request-tracker4 - security update

Multiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-6127 It was discovered that Request Tracker is vulnerable to a cross-site scripting XSS...

Debian DSA-3881-1 : firefox-esr - security update

Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service or domain spoofing. Debian follows the extended support...

Debian Security Advisory DSA 3883-1 (rt-authen-externalauth - security update)

It was discovered that RT::Authen::ExternalAuth, an external authentication module for Request Tracker, is vulnerable to timing side-channel attacks for user passwords. Only ExternalAuth in DBI database mode is vulnerable. OpenVAS Vulnerability Test $Id: deb3883.nasl 6682 2017-07-12 09:00:18Z...

Debian DSA-3879-1 : libosip2 - security update

Multiple security vulnerabilities have been found in oSIP, a library implementing the Session Initiation Protocol, which might result in denial of service through malformed SIP messages. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin we...

Debian: Security Advisory (DSA-3883-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 3880-1 (libgcrypt20 - security update)

It was discovered that a side channel attack in the EdDSA session key handling in Libgcrypt may result in information disclosure. OpenVAS Vulnerability Test $Id: deb3880.nasl 6607 2017-07-07 12:04:25Z cfischer $ Auto-generated from advisory DSA 3880-1 using nvtgen 1.0 Script version: 1.0 Author:...

Debian DSA-3880-1 : libgcrypt20 - security update

It was discovered that a side channel attack in the EdDSA session key handling in Libgcrypt may result in information disclosure. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-3880. The...

Debian DSA-3878-1 : zziplib - security update

Agostino Sarubbo discovered multiple vulnerabilities in zziplib, a library to access Zip archives, which could result in denial of service and potentially the execution of arbitrary code if a malformed archive is processed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Debian: Security Advisory (DSA-3881-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 3879-1 (libosip2 - security update)

Multiple security vulnerabilities have been found in oSIP, a library implementing the Session Initiation Protocol, which might result in denial of service through malformed SIP messages. OpenVAS Vulnerability Test $Id: deb3879.nasl 6607 2017-07-07 12:04:25Z cfischer $ Auto-generated from advisory...

Debian DSA-3874-1 : ettercap - security update

Agostino Sarubbo and AromalUllas discovered that ettercap, a network security tool for traffic interception, contains vulnerabilities that allowed an attacker able to provide maliciously crafted filters to cause a denial-of-service via application crash. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-3877-1 : tor - security update

It has been discovered that Tor, a connection-based low-latency anonymous communication system, contain a flaw in the hidden service code when receiving a BEGINDIR cell on a hidden service rendezvous circuit. A remote attacker can take advantage of this flaw to cause a hidden service to crash wit...

Debian DSA-3876-1 : otrs2 - security update

Joerg-Thomas Vogt discovered that the SecureMode was insufficiently validated in the OTRS ticket system, which could allow agents to escalate their privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-3875-1 : libmwaw - security update

It was discovered that a buffer overflow in libmwaw, a library to open old Mac text documents might result in the execution of arbitrary code if a malformed document is opened. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

Debian Security Advisory DSA 3874-1 (ettercap - security update)

Agostino Sarubbo and AromalUllas discovered that ettercap, a network security tool for traffic interception, contains vulnerabilities that allowed an attacker able to provide maliciously crafted filters to cause a denial-of-service via application crash. OpenVAS Vulnerability Test $Id: deb3874.na...

F5 Networks BIG-IP : OpenSSL vulnerability (K53084033)

The dsasignsetup function in crypto/dsa/dsaossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack. CVE-2016-2178 File data f5bigipSOL53084033.nasl...

Debian: Security Advisory (DSA-3875-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...