Debian DSA-2341-1 : iceweasel - several vulnerabilities

Several vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox. The included XULRunner library provides rendering services for several other applications included in Debian. - CVE-2011-3647 'mozbugra4' discovered a privilege escalation vulnerability in addon handling. -...

Debian DSA-2342-1 : iceape - several vulnerabilities

Several vulnerabilities have been found in the Iceape internet suite, an unbranded version of SeaMonkey : - CVE-2011-3647 'mozbugra4' discovered a privilege escalation vulnerability in addon handling. - CVE-2011-3648 Yosuke Hasegawa discovered that incorrect handling of Shift-JIS encodings could...

Debian DSA-2340-1 : postgresql-8.3, postgresql-8.4, postgresql-9.0 - weak password hashing

magnum discovered that the blowfish password hashing used amongst others in PostgreSQL contained a weakness that would give passwords with 8 bit characters the same hash as weaker equivalents. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-2339-1 : nss - several vulnerabilities

This update to the NSS cryptographic libraries revokes the trust in the'DigiCert Sdn. Bhd' certificate authority. More information can be found in the Mozilla Security Blog. This update also fixes an insecure load path for pkcs11.txt configuration file CVE-2011-3640 . %NASLMINLEVEL 70300 C Tenabl...

Debian DSA-2338-1 : moodle - several vulnerabilities

Several cross-site scripting and information disclosure issues have been fixed in Moodle, a course management system for online learning : - MSA-11-0020 Continue links in error messages can lead offsite - MSA-11-0024 reCAPTCHA images were being authenticated from an older server - MSA-11-0025 Gro...

Debian DSA-2336-1 : ffmpeg - several vulnerabilities

Multiple vulnerabilities were found in FFmpeg, a multimedia player, server and encoder : - CVE-2011-3362 An integer signedness error in decoderesidualblock function of the Chinese AVS video CAVS decoder in libavcodec can lead to denial of service memory corruption and application crash or possibl...

Debian DSA-2334-1 : mahara - several vulnerabilities

Several vulnerabilities were discovered in Mahara, an electronic portfolio, weblog, and resume builder : - CVE-2011-2771 Teemu Vesala discovered that missing input sanitising of RSS feeds could lead to cross-site scripting. - CVE-2011-2772 Richard Mansfield discovered that insufficient upload...

Debian DSA-2335-1 : man2html - missing input sanitization

Tim Starling discovered that the Debian-native CGI wrapper for man2html, a program to convert UNIX man pages to HTML, is not properly escaping user-supplied input when displaying various error messages. A remote attacker can exploit this flaw to conduct cross-site scripting XSS attacks...

Debian DSA-2323-1 : radvd - several vulnerabilities

Multiple security issues were discovered by Vasiliy Kulikov in radvd, an IPv6 Router Advertisement daemon : - CVE-2011-3602 setinterfacevar function doesn't check the interface name, which is chosen by an unprivileged user. This could lead to an arbitrary file overwrite if the attacker has local...

Debian DSA-2332-1 : python-django - several issues

Paul McMillan, Mozilla and the Django core team discovered several vulnerabilities in Django, a Python web framework : - CVE-2011-4136 When using memory-based sessions and caching, Django sessions are stored directly in the root namespace of the cache. When user data is stored in the same cache, ...

Debian DSA-2333-1 : phpldapadmin - several vulnerabilities

Two vulnerabilities have been discovered in phpLDAPadmin, a web-based interface for administering LDAP servers. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-4074 Input appended to the URL in cmd.php when 'cmd' is set to 'debug' is not properly...

Debian DSA-2331-1 : tor - several vulnerabilities

It has been discovered by 'frostyun' that a design flaw in Tor, an online privacy tool, allows malicious relay servers to learn certain information that they should not be able to learn. Specifically, a relay that a user connects to directly could learn which other relays that user is connected t...

Debian DSA-2329-1 : torque - buffer overflow

Bartlomiej Balcerek discovered several buffer overflows in TORQUE server, a PBS-derived batch processing server. This allows an attacker to crash the service or execute arbitrary code with privileges of the server via crafted job or host names. The oldstable distribution lenny does not contain...

Debian DSA-2330-1 : simplesamlphp - XML encryption weakness

Issues were found in the handling of XML encryption in simpleSAMLphp, an application for federated authentication. The following two issues have been addressed : It may be possible to use an SP as an oracle to decrypt encrypted messages sent to that SP. It may be possible to use the SP as a key...

Debian DSA-2326-1 : pam - several vulnerabilities

Kees Cook of the ChromeOS security team discovered a buffer overflow in pamenv, a PAM module to set environment variables through the PAM stack, which allowed the execution of arbitrary code. An additional issue in argument parsing allows denial of service. The oldstable distribution lenny is not...

Debian DSA-2328-1 : freetype - missing input sanitising

It was discovered that missing input sanitising in Freetype's glyph handling could lead to memory corruption, resulting in denial of service or the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

Debian DSA-2327-1 : libfcgi-perl - authentication bypass

Ferdinand Smit discovered that FCGI, a Perl module for writing FastCGI applications, is incorrectly restoring environment variables of a prior request in subsequent requests. In some cases this may lead to authentication bypasses or worse. The oldstable distribution lenny is not affected by this...

Debian DSA-2325-1 : kfreebsd-8 - privilege escalation/denial of service

Buffer overflow in the 'Linux emulation' support in FreeBSD kernel allows local users to cause a denial of service panic and possibly execute arbitrary code by calling the bind system call with a long path for a UNIX-domain socket, which is not properly handled when the address is used by other...

Debian DSA-2324-1 : wireshark - programming error

The Microsoft Vulnerability Research group discovered that insecure load path handling could lead to execution of arbitrary Lua script code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian Security Advisory DSA 2319-1 (policykit-1)

The remote host is missing an update to policykit-1 announced via advisory DSA 2319-1. OpenVAS Vulnerability Test $Id: deb23191.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2319-1 policykit-1 Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...