Debian DSA-2163-1 : python-django - multiple vulnerabilities

Several vulnerabilities were discovered in the Django web development framework : - CVE-2011-0696 For several reasons the internal CSRF protection was not used to validate AJAX requests in the past. However, it was discovered that this exception can be exploited with a combination of browser...

Debian DSA-2162-1 : openssl - invalid memory access

Neel Mehta discovered that an incorrectly formatted ClientHello handshake message could cause OpenSSL to parse past the end of the message. This allows an attacker to crash an application using OpenSSL by triggering an invalid memory access. Additionally, some applications may be vulnerable to...

Debian DSA-2161-1 : openjdk-6 - denial of service

It was discovered that the floating point parser in OpenJDK, an implementation of the Java platform, can enter an infinite loop when processing certain input strings. Such input strings represent valid numbers and can be contained in data supplied by an attacker over the network, leading to a...

Debian DSA-2160-1 : tomcat6 - several vulnerabilities

Several vulnerabilities were discovered in the Tomcat Servlet and JSP engine : - CVE-2010-3718 It was discovered that the SecurityManager insufficiently restricted the working directory. - CVE-2011-0013 It was discovered that the HTML manager interface is affected by cross-site scripting. -...

Debian DSA-2159-1 : vlc - missing input sanitising

Dan Rosenberg discovered that insufficient input validation in VLC's processing of Matroska/WebM containers could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securit...

Debian DSA-2158-1 : cgiirc - XSS

Michael Brooks Sitewatch discovered a reflective XSS flaw in CGI:IRC, a web-based IRC client, which could lead to the execution of arbitrary JavaScript. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

Debian DSA-2157-1 : postgresql-8.3, postgresql-8.4, postgresql-9.0 - buffer overflow

It was discovered that PostgreSQL's intarray contrib module does not properly handle integers with a large number of digits, leading to a server crash and potentially arbitrary code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-2155-1 : freetype - several vulnerabilities

Two buffer overflows were found in the Freetype font library, which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-2155. The text itself is...

Debian DSA-2153-1 : linux-2.6 - privilege escalation/denial of service/information leak

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0435 Gleb Napatov reported an issue in the KVM subsystem...

Debian DSA-2154-1 : exim4 - privilege escalation

A design flaw CVE-2010-4345 in exim4 allowed the local Debian-exim user to obtain root privileges by specifying an alternate configuration file using the -C option or by using the macro override facility -D option. Unfortunately, fixing this vulnerability is not possible without some changes in...

Debian DSA-2152-1 : hplip - buffer overflow

Sebastian Krahmer discovered a buffer overflow in the SNMP discovery code of the HP Linux Printing and Imaging System, which could result in the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Debian DSA-2151-1 : openoffice.org - several vulnerabilities

Several security related problems have been discovered in the OpenOffice.org package that allows malformed documents to trick the system into crashes or even the execution of arbitrary code. - CVE-2010-3450 During an internal security audit within Red Hat, a directory traversal vulnerability has...

Debian DSA-2150-1 : request-tracker3.6 - unsalted password hashing

It was discovered that Request Tracker, an issue tracking system, stored passwords in its database by using an insufficiently strong hashing method. If an attacker would have access to the password database, he could decode the passwords stored in it. %NASLMINLEVEL 70300 C Tenable Network Securit...

Debian Security Advisory DSA 2126-1 (linux-2.6)

The remote host is missing an update to linux-2.6 announced via advisory DSA 2126-1. OpenVAS Vulnerability Test $Id: deb21261.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2126-1 linux-2.6 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

Debian Security Advisory DSA 2132-1 (xulrunner)

The remote host is missing an update to xulrunner announced via advisory DSA 2132-1. OpenVAS Vulnerability Test $Id: deb21321.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2132-1 xulrunner Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

Debian: Security Advisory (DSA-2038)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-2149-1 : dbus - denial of service

Remi Denis-Courmont discovered that dbus, a message bus application, is not properly limiting the nesting level when examining messages with extensive nested variants. This allows an attacker to crash the dbus system daemon due to a call stack overflow via crafted messages. %NASLMINLEVEL 70300 C...

Debian DSA-2145-1 : libsmi - buffer overflow

Andres Lopez Luksenberg discovered a buffer overflow in the OID parser of libsmi, a library to access SMI MIB data. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-2145. The text itself is...

Debian DSA-2148-1 : tor - several vulnerabilities

The developers of Tor, an anonymizing overlay network for TCP, found three security issues during a security audit. A heap overflow allowed the execution of arbitrary code CVE-2011-0427 , a denial of service vulnerability was found in the zlib compression handling and some key memory was...

Debian DSA-2146-1 : mydms - directory traversal

D. Fabian and L. Weichselbaum discovered a directory traversal vulnerability in MyDMS, an open source document management system based on PHP and MySQL. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...