Debian DSA-2395-1 : wireshark - buffer underflow

Laurent Butti discovered a buffer underflow in the LANalyzer dissector of the Wireshark network traffic analyzer, which could lead to the execution of arbitrary code CVE-2012-0068 . This update also addresses several bugs, which can lead to crashes of Wireshark. These are not treated as security...

Debian DSA-2393-1 : bip - buffer overflow

Julien Tinnes reported a buffer overflow in the Bip multiuser IRC proxy which may allow arbitrary code execution by remote users. The oldstable distribution lenny is not affected by this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-2392-1 : openssl - out-of-bounds read

Antonio Martin discovered a denial-of-service vulnerability in OpenSSL, an implementation of TLS and related protocols. A malicious client can cause the DTLS server implementation to crash. Regular, TCP-based TLS is not affected by this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DSA-2391-1 : phpmyadmin - several vulnerabilities

Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-4107 The XML import plugin allowed a remote attacker to read arbitrary files via XML data containing...

Debian DSA-2388-1 : t1lib - several vulnerabilities

Several vulnerabilities were discovered in t1lib, a Postscript Type 1 font rasterizer library, some of which might lead to code execution through the opening of files embedding bad fonts. - CVE-2010-2642 A heap-based buffer overflow in the AFM font metrics parser potentially leads to the executio...

Debian DSA-2375-1 : krb5, krb5-appl - buffer overflow

It was discovered that the encryption support for BSD telnetd contains a pre-authentication buffer overflow, which may enable remote attackers who can connect to the Telnet port to execute arbitrary code with root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive te...

Debian DSA-2371-1 : jasper - buffer overflows

Two buffer overflows were discovered in JasPer, a library for handling JPEG-2000 images, which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian DSA-2365-1 : dtc - several vulnerabilities

Ansgar Burchardt, Mike O'Connor and Philipp Kern discovered multiple vulnerabilities in DTC, a web control panel for admin and accounting hosting services : - CVE-2011-3195 A possible shell insertion has been found in the mailing list handling. - CVE-2011-3196 Unix rights for the apache2.conf wer...

Debian DSA-2359-1 : mojarra - EL injection

It was discovered that Mojarra, an implementation of JavaServer Faces, evaluates untrusted values as EL expressions if includeViewParameters is set to true. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-2374-1 : openswan - implementation error

The information security group at ETH Zurich discovered a denial of service vulnerability in the crypto helper handler of the IKE daemon pluto. More information can be found in the upstream advisory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-2387-1 : simplesamlphp - insufficient input sanitation

'timtai1' discovered that simpleSAMLphp, an authentication and federation platform, is vulnerable to a cross site scripting attack, allowing a remote attacker to access sensitive client data. The oldstable distribution lenny does not contain a simplesamlphp package. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-2383-1 : super - buffer overflow

Robert Luberda discovered a buffer overflow in the syslog logging code of Super, a tool to execute scripts or other commands as if they were root. The default Debian configuration is not affected. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-2373-1 : inetutils - buffer overflow

It was discovered that the Kerberos support for telnetd contains a pre-authentication buffer overflow, which may enable remote attackers who can connect to TELNET to execute arbitrary code with root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-773-1 : amd64 - several vulnerabilities

This advisory adds security support for the stable amd64 distribution. It covers all security updates since the release of sarge, which were missing updated packages for the not yet official amd64 port. Future security advisories will include updates for this port as well. %NASLMINLEVEL 70300 C...

Debian DSA-2369-1 : libsoup2.4 - insufficient input sanitization

It was discovered that libsoup, a HTTP library implementation in C, is not properly validating input when processing requests made to SoupServer. A remote attacker can exploit this flaw to access system files via a directory traversal attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

Debian DSA-2363-1 : tor - buffer overflow

It was discovered that Tor, an online privacy tool, incorrectly computes buffer sizes in certain cases involving SOCKS connections. Malicious parties could use this to cause a heap-based buffer overflow, potentially allowing execution of arbitrary code. In Tor's default configuration this issue c...

Debian DSA-2358-1 : openjdk-6 - several vulnerabilities (BEAST)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Java platform. This combines the two previous openjdk-6 advisories, DSA-2311-1 and DSA-2356-1. - CVE-2011-0862 Integer overflow errors in the JPEG and font parser allow untrusted code including applets to elevate it...

Debian DSA-2376-2 : ipmitool - insecure PID file

It was discovered that OpenIPMI, the Intelligent Platform Management Interface library and tools, used too wide permissions PID file, which allows local users to kill arbitrary processes by writing to this file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-2362-1 : acpid - several vulnerabilities

Multiple vulnerabilities were found in the ACPI Daemon, the Advanced Configuration and Power Interface event daemon : - CVE-2011-1159 Vasiliy Kulikov of OpenWall discovered that the socket handling is vulnerable to denial of service. - CVE-2011-2777 Oliver-Tobias Ripka discovered that incorrect...

Debian DSA-2364-1 : xorg - incorrect permission check

The Debian X wrapper enforces that the X server can only be started from a console. 'vladz' discovered that this wrapper could be bypassed. The oldstable distribution lenny is not affected. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...