Debian DSA-2520-1 : openoffice.org - Multiple heap-based buffer overflows

Timo Warns from PRE-CERT discovered multiple heap-based buffer overflows in OpenOffice.org, an office productivity suite. The issues lies in the XML manifest encryption tag parsing code. Using specially crafted files, an attacker can cause application crash and could cause arbitrary code executio...

Scientific Linux Security Update : bind on SL3.x, SL4.x, SL5.x i386/x86_64

A flaw was discovered in the way BIND checked the return value of the OpenSSL DSAdoverify function. On systems using DNSSEC, a malicious zone could present a malformed DSA certificate and bypass proper certificate validation, allowing spoofing attacks. CVE-2009-0025 For users of Red Hat Enterpris...

Debian DSA-2508-1 : kfreebsd-8 - privilege escalation

Rafal Wojtczuk from Bromium discovered that FreeBSD wasn't handling correctly uncanonical return addresses on Intel amd64 CPUs, allowing privilege escalation to kernel for local users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-2510-1 : extplorer - Cross-site request forgery

John Leitch has discovered a vulnerability in eXtplorer, a very feature rich web server file manager, which can be exploited by malicious people to conduct cross-site request forgery attacks. The vulnerability allows users to perform certain actions via HTTP requests without performing any validi...

Debian DSA-2507-1 : openjdk-6 - several vulnerabilities

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform. - CVE-2012-1711 CVE-2012-1719 Multiple errors in the CORBA implementation could lead to breakouts of the Java sandbox. - CVE-2012-1713 Missing input sanitising in the font manager could lead to...

Debian DSA-2505-1 : zendframework - information disclosure

An XML External Entities inclusion vulnerability was discovered in Zend Framework, a PHP library. This vulnerability may allow attackers to access to local files, depending on how the framework is used. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks i...

Debian DSA-2483-1 : strongswan - authentication bypass

An authentication bypass issue was discovered by the Codenomicon CROSS project in strongSwan, an IPsec-based VPN solution. When using RSA-based setups, a missing check in the gmp plugin could allow an attacker presenting a forged signature to successfully authenticate against a strongSwan...

Debian DSA-2495-1 : openconnect - buffer overflow

A buffer overflow was discovered in OpenConnect, a client for the Cisco AnyConnect VPN, which could result in denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-2495. The...

Debian DSA-2494-1 : ffmpeg - several vulnerabilities

It was discovered that FFmpeg, Debian's version of the Libav media codec suite, contains vulnerabilities in the DPCM codecs CVE-2011-3951 , H.264 CVE-2012-0851 , ADPCM CVE-2012-0852 , and the KMVC decoder CVE-2011-3952 . In addition, this update contains bug fixes from the Libav 0.5.9 upstream...

Debian DSA-2498-1 : dhcpcd - remote stack overflow

It was discovered that dhcpcd, a DHCP client, was vulnerable to a stack overflow. A malformed DHCP message could crash the client, causing a denial of service, and potentially remote code execution through properly designed malicous DHCP packets. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Debian DSA-2496-1 : mysql-5.1 - several vulnerabilities

Due to the non-disclosure of security patch information from Oracle, we are forced to ship an upstream version update of MySQL 5.1. There are several known incompatible changes, which are listed in /usr/share/doc/mysql-server/NEWS.Debian.gz. Several issues have been discovered in the MySQL databa...

Debian DSA-2504-1 : libspring-2.5-java - information disclosure

It was discovered that the Spring Framework contains an information disclosure vulnerability in the processing of certain Expression Language EL patterns, allowing attackers to access sensitive information using HTTP requests. NOTE: This update adds a springJspExpressionSupport context parameter...

Debian DSA-2492-1 : php5 - buffer overflow

The Phar extension for PHP does not properly handle crafted tar files, leading to a heap-based buffer overflow. PHP applications processing tar files could crash or, potentially, execute arbitrary code. In addition, this update addresses a regression which caused a crash when accessing a global...

Debian DSA-2497-1 : quagga - denial of service

It was discovered that Quagga, a routing daemon, contains a vulnerability in processing the ORF capability in BGP OPEN messages. A malformed OPEN message from a previously configured BGP peer could cause bgpd to crash, causing a denial of service. %NASLMINLEVEL 70300 C Tenable Network Security,...

Debian DSA-2487-1 : openoffice.org - buffer overflow

It was discovered that OpenOffice.org would not properly process crafted document files, possibly leading to arbitrary code execution. - CVE-2012-1149 Integer overflows in PNG image handling. - CVE-2012-2334 Integer overflow in operator new invocation and heap-based buffer overflow inside the...

Debian DSA-2489-1 : iceape - several vulnerabilities

Several vulnerabilities have been found in the Iceape internet suite, an unbranded version of SeaMonkey. - CVE-2012-1937 Mozilla developers discovered several memory corruption bugs, which may lead to the execution of arbitrary code. - CVE-2012-1940 Abhishek Arya discovered a use-after-free probl...

Debian DSA-2484-1 : nut - denial of service

Sebastian Pohle discovered that UPSD, the server of Network UPS Tools NUT is vulnerable to a remote denial of service attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-2484. The text...

Debian DSA-2490-1 : nss - denial of service

Kaspar Brand discovered that Mozilla's Network Security Services NSS libraries did insufficient length checking in the QuickDER decoder, allowing to crash a program using the libraries. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...

Debian DSA-2493-1 : asterisk - denial of service

Several vulnerabilities were discovered in Asterisk, a PBX and telephony toolkit. - CVE-2012-2947 The IAX2 channel driver allows remote attackers to cause a denial of service daemon crash by placing a call on hold when a certain mohinterpret setting is enabled. - CVE-2012-2948 The Skinny channel...

Debian DSA-2491-1 : postgresql-8.4 - several vulnerabilities

Two vulnerabilities were discovered in PostgreSQL, a SQL database server : - CVE-2012-2143 The crypttext, text function in the pgcrypto contrib module did not handle certain passwords correctly when producing traditional DES-based hashes. Characters after the first 0x80 byte were ignored. -...