Debian Security Advisory DSA 1998-1 (kdelibs)

The remote host is missing an update to kdelibs announced via advisory DSA 1998-1. OpenVAS Vulnerability Test $Id: deb19981.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 1998-1 kdelibs Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

Debian DSA-1994-1 : ajaxterm - weak session IDs

It was discovered that Ajaxterm, a web-based terminal, generates weak and predictable session IDs, which might be used to hijack a session or cause a denial of service attack on a system that uses Ajaxterm. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

Debian DSA-1974-1 : gzip - several vulnerabilities

Several vulnerabilities have been found in gzip, the GNU compression utilities. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2624 Thiemo Nagel discovered a missing input sanitation flaw in the way gzip used to decompress data blocks for dynamic...

Debian DSA-1870-1 : pidgin - insufficient input validation

Federico Muttis discovered that libpurple, the shared library that adds support for various instant messaging networks to the pidgin IM client, is vulnerable to a heap-based buffer overflow. This issue exists because of an incomplete fix for CVE-2008-2927 and CVE-2009-1376. An attacker can exploi...

Debian DSA-1979-1 : lintian - multiple vulnerabilities

Multiple vulnerabilities have been discovered in lintian, a Debian package checker. The following Common Vulnerabilities and Exposures project ids have been assigned to identify them : - CVE-2009-4013: missing control files sanitation Control field names and values were not sanitised before using...

Debian DSA-1857-1 : camlimages - integer overflow

Tielei Wang discovered that CamlImages, an open source image processing library, suffers from several integer overflows which may lead to a potentially exploitable heap overflow and result in arbitrary code execution. This advisory addresses issues with the reading of JPEG and GIF Images, while D...

Debian DSA-1998-1 : kdelibs - buffer overflow

Maksymilian Arciemowicz discovered a buffer overflow in the internal string routines of the KDE core libraries, which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debi...

Debian DSA-1860-1 : ruby1.8, ruby1.9 - several vulnerabilities

Several vulnerabilities have been discovered in Ruby. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0642 The return value from the OCSPbasicverify function was not checked properly, allowing continued use of a revoked certificate. - CVE-2009-1904 ...

Debian DSA-1838-1 : pulseaudio - privilege escalation

Tavis Ormandy and Julien Tinnes discovered that the pulseaudio daemon does not drop privileges before re-executing itself, enabling local attackers to increase their privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-1879-1 : silc-client/silc-toolkit - several vulnerabilities

Several vulnerabilities have been discovered in the software suite for the SILC protocol, a network protocol designed to provide end-to-end security for conferencing services. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-7159 An incorrect format...

Debian DSA-1952-1 : asterisk - several vulnerabilities, end-of-life announcement in oldstable

Several vulnerabilities have been discovered in asterisk, an Open Source PBX and telephony toolkit. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0041 It is possible to determine valid login names via probing, due to the IAX2 response from asteris...

Debian DSA-1836-1 : fckeditor - missing input sanitising

Vinny Guido discovered that multiple input sanitising vulnerabilities in Fckeditor, a rich text web editor component, may lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-1935-1 : gnutls13 gnutls26 - several vulnerabilities

Dan Kaminsky and Moxie Marlinspike discovered that gnutls, an implementation of the TLS/SSL protocol, does not properly handle a '\0' character in a domain name in the subject's Common Name or Subject Alternative Name SAN field of an X.509 certificate, which allows man-in-the-middle attackers to...

Debian DSA-1972-1 : audiofile - buffer overflow

Max Kellermann discovered a heap-based buffer overflow in the handling of ADPCM WAV files in libaudiofile. This flaw could result in a denial of service application crash or possibly execution of arbitrary code via a crafted WAV file. The old stable distribution etch, this problem will be fixed i...

Debian DSA-1928-1 : linux-2.6.24 - privilege escalation/denial of service/sensitive memory leak

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, sensitive memory leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2846 Michael Buesch noticed a typing issue in the...

Debian DSA-1907-1 : kvm - several vulnerabilities

Several vulnerabilities have been discovered in kvm, a full virtualization system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-5714 Chris Webb discovered an off-by-one bug limiting KVM's VNC passwords to 7 characters. This flaw might make it...

Debian DSA-1901-1 : mediawiki1.7 - several vulnerabilities

Several vulnerabilities have been discovered in mediawiki1.7, a website engine for collaborative work. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-5249 David Remahl discovered that mediawiki1.7 is prone to a cross-site scripting attack. -...

Debian DSA-1971-1 : libthai - integer overflow

Tim Starling discovered that libthai, a set of Thai language support routines, is vulnerable of integer/heap overflow. This vulnerability could allow an attacker to run arbitrary code by sending a very long string. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-1831-1 : djbdns - programming error

Matthew Dempsky discovered that Daniel J. Bernstein's djbdns, a Domain Name System server, does not constrain offsets in the required manner, which allows remote attackers with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary record...

Debian DSA-1825-1 : nagios2, nagios3 - insufficient input validation

It was discovered that the statuswml.cgi script of nagios, a monitoring and management system for hosts, services and networks, is prone to a command injection vulnerability. Input to the ping and traceroute parameters of the script is not properly validated which allows an attacker to execute...