Debian DSA-3355-1 : libvdpau - security update

Florian Weimer of Red Hat Product Security discovered that libvdpau, the VDPAU wrapper library, did not properly validate environment variables, allowing local attackers to gain additional privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-3354-1 : spice - security update

Frediano Ziglio of Red Hat discovered a race condition flaw in spice's workerupdatemonitorsconfig function, leading to a heap-based memory corruption. A malicious user in a guest can take advantage of this flaw to cause a denial of service QEMU process crash or, potentially execute arbitrary code...

Debian DSA-3353-1 : openslp-dfsg - security update

Qinghao Tang of QIHU 360 discovered a double free flaw in OpenSLP, an implementation of the IETF Service Location Protocol. This could allow remote attackers to cause a denial of service crash. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-3352-1 : screen - security update

A vulnerability was found in screen causing a stack overflow which results in crashing the screen server process, resulting in denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisor...

[SECURITY] [DLA 305-1] screen security update

Package : screen Version : 4.0.3-14+deb6u1 CVE ID : CVE-2015-6806 Debian Bug :797624 A vulnerability was found in screen causing a stack overflow which results in crashing the screen server process, resulting in denial of service. See DSA-3352-1 for information on other Debian releases. We...

Debian DSA-3351-1 : chromium-browser - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2015-1291 A cross-origin bypass issue was discovered in DOM. - CVE-2015-1292 Mariusz Mlynski discovered a cross-origin bypass issue in ServiceWorker. - CVE-2015-1293 Mariusz Mlynski discovered a cross-origin bypass...

Debian Security Advisory DSA 3352-1 (screen - security update)

A vulnerability was found in screen causing a stack overflow which results in crashing the screen server process, resulting in denial of service. OpenVAS Vulnerability Test $Id: deb3352.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3352-1 using nvtgen 1.0 Script...

Debian DSA-3348-1 : qemu - security update

Several vulnerabilities were discovered in qemu, a fast processor emulator. - CVE-2015-3214 Matt Tait of Google's Project Zero security team discovered a flaw in the QEMU i8254 PIT emulation. A privileged guest user in a guest with QEMU PIT emulation enabled could potentially use this flaw to...

Debian DSA-3350-1 : bind9 - security update

Hanno Boeck discovered that incorrect validation of DNSSEC-signed records in the Bind DNS server could result in denial of service. Updates for the oldstable distribution wheezy will be released shortly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...

Debian: Security Advisory (DSA-3351-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 3350-1 (bind9 - security update)

Hanno Boeck discovered that incorrect validation of DNSSEC-signed records in the Bind DNS server could result in denial of service. Updates for the oldstable distribution wheezy will be released shortly. OpenVAS Vulnerability Test $Id: deb3350.nasl 6609 2017-07-07 12:05:59Z cfischer $...

Debian DSA-3345-1 : iceweasel - security update

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2015-4497 Jean-Max Reymond and Ucha Gobejishvili discovered a use-after-free vulnerability which...

Debian: Security Advisory (DSA-3346-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-3344-1 : php5 - security update

Multiple vulnerabilities have been discovered in the PHP language : - CVE-2015-4598 thoger at redhat dot com discovered that paths containing a NUL character were improperly handled, thus allowing an attacker to manipulate unexpected files on the server. - CVE-2015-4643 Max Spelsberg discovered a...

Debian Security Advisory DSA 3344-1 (php5 - security update)

Multiple vulnerabilities have been discovered in the PHP language: CVE-2015-4598 thoger at redhat dot com discovered that paths containing a NUL character were improperly handled, thus allowing an attacker to manipulate unexpected files on the server. CVE-2015-4643 Max Spelsberg discovered an...

Debian DSA-3343-1 : twig - security update

James Kettle, Alain Tiemblo, Christophe Coevoet and Fabien Potencier discovered that twig, a templating engine for PHP, did not correctly process its input. End users allowed to submit twig templates could use specially crafted code to trigger remote code execution, even in sandboxed templates...

Debian Security Advisory DSA 3343-1 (twig - security update)

James Kettle, Alain Tiemblo, Christophe Coevoet and Fabien Potencier discovered that twig, a templating engine for PHP, did not correctly process its input. End users allowed to submit twig templates could use specially crafted code to trigger remote code execution, even in sandboxed templates...

Debian DSA-3340-1 : zendframework - security update

Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML External Entity attack via crafted XML data. %NASLMINLEVEL 70300 C...

Debian DSA-3338-1 : python-django - security update

Lin Hua Cheng discovered that a session could be created when anonymously accessing the django.contrib.auth.views.logout view. This could allow remote attackers to saturate the session store or cause other users' session records to be evicted. Additionally the...

Debian DSA-3339-1 : openjdk-6 - security update (Bar Mitzvah) (Logjam)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure, denial of service or insecure cryptography. %NASLMINLEVEL 70300 C Tenable Network Security,...