Debian DSA-2026-1 : netpbm-free - stack-based buffer overflow

Marc Schoenefeld discovered a stack-based buffer overflow in the XPM reader implementation in netpbm-free, a suite of image manipulation utilities. An attacker could cause a denial of service application crash or possibly execute arbitrary code via an XPM image file that contains a crafted header...

Debian DSA-2024-1 : moin - insufficient input sanitising

Jamie Strandboge discovered that moin, a python clone of WikiWiki, does not sufficiently sanitize the page name in 'Despam' action, allowing remote attackers to perform cross-site scripting XSS attacks. In addition, this update fixes a minor issue in the 'textcha' protection, it could be triviall...

Debian DSA-2025-1 : icedove - several vulnerabilities

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird mail client. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2408 Dan Kaminsky and Moxie Marlinspike discovered that icedove does...

Debian DSA-2023-1 : curl - buffer overflow

Wesley Miaw discovered that libcurl, a multi-protocol file transfer library, is prone to a buffer overflow via the callback function when an application relies on libcurl to automatically uncompress data. Note that this only affects applications that trust libcurl's maximum limit for a fixed buff...

Debian DSA-2022-1 : mediawiki - several vulnerabilities

Several vulnerabilities have been discovered in mediawiki, a web-based wiki engine. The following issues have been identified : - Insufficient input sanitization in the CSS validation code allows editors to display external images in wiki pages. This can be a privacy concern on public wikis as it...

Debian DSA-2021-1 : spamass-milter - missing input sanitization

A missing input sanitization in spamass-milter, a milter used to filter mail through spamassassin, was discovered. This allows a remote attacker to inject and execute arbitrary shell commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-2018-1 : php5 - DoS (crash)

Auke van Slooten discovered that PHP 5, an hypertext preprocessor, crashes because of a NULL pointer dereference when processing invalid XML-RPC requests. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securit...

Debian DSA-2015-1 : drbd8 - privilege escalation

A local vulnerability has been discovered in drbd8. Philipp Reisner fixed an issue in the drbd kernel module that allows local users to send netlink packets to perform actions that should be restricted to users with CAPSYSADMIN privileges. This is a similar issue to those described by...

Debian Security Advisory DSA 2012-1 (linux-2.6)

The remote host is missing an update to linux-2.6 announced via advisory DSA 2012-1. OpenVAS Vulnerability Test $Id: deb20121.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2012-1 linux-2.6 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

Debian Security Advisory DSA 2004-1 (samba)

The remote host is missing an update to samba announced via advisory DSA 2004-1. OpenVAS Vulnerability Test $Id: deb20041.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2004-1 samba Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

Debian DSA-2012-1 : linux-2.6 - privilege escalation/denial of service

Two vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3725 Philipp Reisner reported an issue in the connector subsystem which allows...

Debian DSA-2014-1 : moin - several vulnerabilities

Several vulnerabilities have been discovered in moin, a python clone of WikiWiki. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0668 Multiple security issues in MoinMoin related to configurations that have a non-empty superuser list, the xmlrpc...

Debian DSA-2011-1 : dpkg - path traversal

William Grant discovered that the dpkg-source component of dpkg, the low-level infrastructure for handling the installation and removal of Debian software packages, is vulnerable to path traversal attacks. A specially crafted Debian source package can lead to file modification outside of the...

Debian DSA-2010-1 : kvm - privilege escalation/denial of service

Several local vulnerabilities have been discovered in kvm, a full virtualization system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0298 CVE-2010-0306 Gleb Natapov discovered issues in the KVM subsystem where missing permission checks CPL/IOPL...

Debian DSA-2006-1 : sudo - several vulnerabilities

Several vulnerabilities have been discovered in sudo, a program designed to allow a sysadmin to give limited root privileges to users. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0426 It was discovered that sudo when a pseudo-command is enabled,...

Debian DSA-2005-1 : linux-2.6.24 - privilege escalation/denial of service/sensitive memory leak

NOTE: This kernel update marks the final planned kernel security update for the 2.6.24 kernel in the Debian release 'etch'. Although security support for 'etch' officially ended on Feburary 15th, 2010, this update was already in preparation before that date. Several vulnerabilities have been...

Firefox浏览器引擎远程内存破坏漏洞

BUGTRAQ ID: 38286 CVE ID: CVE-2010-0159 Firefox是一款流行的开源WEB浏览器。 Firefox浏览器引擎的layout/generic/nsBlockFrame.cpp文件中的nsBlockFrame::StealFrame 函数中存在内存破坏漏洞。用户受骗访问了恶意网页就可能触发这个漏洞，导致浏览器崩溃或执行任意代码。 Mozilla Firefox 3.5.x Mozilla Firefox 3.0.x Mozilla Thunderbird 3.0 Mozilla SeaMonkey 2.0 临时解决方法： 禁用JavaScript。...

Debian: Security Advisory (DSA-2003-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-1998-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 1999-1 (xulrunner)

The remote host is missing an update to xulrunner announced via advisory DSA 1999-1. OpenVAS Vulnerability Test $Id: deb19991.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 1999-1 xulrunner Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...