Debian DSA-2601-1 : gnupg, gnupg2 - missing input sanitation

KB Sriram discovered that GnuPG, the GNU Privacy Guard did not sufficiently sanitise public keys on import, which could lead to memory and keyring corruption. The problem affects both version 1, in the 'gnupg' package, and version two, in the 'gnupg2' package. %NASLMINLEVEL 70300 C Tenable Networ...

Debian Security Advisory DSA 2600-1 (cups - privilege escalation)

Jann Horn discovered that users of the CUPS printing system who are part of the lpadmin group could modify several configuration parameters with security impact. Specifically, this allows an attacker to read or write arbitrary files as root which can be used to elevate privileges. This update...

Debian: Security Advisory (DSA-2598-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-2597-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-2593-1 : moin - several vulnerabilities

It was discovered that missing input validation in the twikidraw and anywikidraw actions can result in the execution of arbitrary code. This security issue is being actively exploited. This update also addresses path traversal in AttachFile. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...

Debian DSA-2596-1 : mediawiki-extensions - XSS

Thorsten Glaser discovered that the RSSReader extension for MediaWiki, a website engine for collaborative work, does not properly escape tags in feeds. This could allow a malicious feed to inject JavaScript into the MediaWiki pages. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-2594-1 : virtualbox-ose - programming error

'halfdog' discovered that incorrect interrupt handling in VirtualBox, a x86 virtualization solution, can lead to denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-2594. Th...

Debian DSA-2595-1 : ghostscript - integer overflow

Marc Schoenefeld discovered that an integer overflow in the ICC parsing code of Ghostscript can lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-259...

Debian DSA-2590-1 : wireshark - several vulnerabilities

Bjorn Mork and Laurent Butti discovered crashes in the PPP and RTPS2 dissectors, which could potentially result in the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

Debian DSA-2586-1 : perl - several vulnerabilities

Two vulnerabilities were discovered in the implementation of the Perl programming language : - CVE-2012-5195 The 'x' operator could cause the Perl interpreter to crash if very long strings were created. - CVE-2012-5526 The CGI module does not properly escape LF characters in the Set-Cookie and P3...

Debian DSA-2585-1 : bogofilter - buffer overflow

A heap-based buffer overflow was discovered in bogofilter, a software package for classifying mail messages as spam or non-spam. Crafted mail messages with invalid base64 data could lead to heap corruption and, potentially, arbitrary code execution. %NASLMINLEVEL 70300 C Tenable Network Security,...

Debian DSA-2587-1 : libcgi-pm-perl - HTTP header injection

It was discovered that the CGI module for Perl does not filter LF characters in the Set-Cookie and P3P headers, potentially allowing attackers to inject HTTP headers. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Debian DSA-2584-1 : iceape - several vulnerabilities

Multiple vulnerabilities have been found in Iceape, the Debian Internet suite based on Mozilla SeaMonkey : - CVE-2012-5829 Heap-based buffer overflow in the nsWindow::OnExposeEvent function could allow remote attackers to execute arbitrary code. - CVE-2012-5842 Multiple unspecified vulnerabilitie...

Debian DSA-2581-1 : mysql-5.1 - several vulnerabilities

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.1.66, which includes additional changes, such as performance improvements and corrections for data loss defects. These changes are described in the...

Debian: Security Advisory (DSA-2578-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-2579-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 2580-1 (libxml2)

The remote host is missing an update to libxml2 announced via advisory DSA 2580-1. OpenVAS Vulnerability Test $Id: deb25801.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2580-1 libxml2 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Debian DSA-2577-1 : libssh - several vulnerabilities

Multiple vulnerabilities were discovered in libssh by Florian Weimer and Xi Wang : - CVE-2012-4559: multiple double free flaws - CVE-2012-4561: multiple invalid free flaws - CVE-2012-4562: multiple improper overflow checks Those could lead to a denial of service by making an SSH client linked to...

Debian DSA-2579-1 : apache2 - Multiple issues

A vulnerability has been found in the Apache HTTPD Server : - CVE-2012-4557 A flaw was found when modproxyajp connects to a backend server that takes too long to respond. Given a specific configuration, a remote attacker could send certain requests, putting a backend server into an error state...

Debian DSA-2578-1 : rssh - insufficient filtering of rsync command line

James Clawson discovered that rssh, a restricted shell for OpenSSH to be used with scp, sftp, rdist and cvs, was not correctly filtering command line options. This could be used to force the execution of a remote script and thus allow arbitrary command execution. Two CVE were assigned : -...