Debian DSA-1998-1 : kdelibs - buffer overflow

Maksymilian Arciemowicz discovered a buffer overflow in the internal string routines of the KDE core libraries, which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debi...

Debian DSA-1994-1 : ajaxterm - weak session IDs

It was discovered that Ajaxterm, a web-based terminal, generates weak and predictable session IDs, which might be used to hijack a session or cause a denial of service attack on a system that uses Ajaxterm. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

Debian DSA-1830-1 : icedove - several vulnerabilities

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird mail client. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0040 The execution of arbitrary code might be possible via a crafted...

Debian DSA-1828-1 : ocsinventory-agent - insecure module search path

It was discovered that the ocsinventory-agent which is part of the ocsinventory suite, a hardware and software configuration indexing service, is prone to an insecure perl module search path. As the agent is started via cron and the current directory / in this case is included in the default perl...

Debian DSA-1984-1 : libxerces2-java - denial of service

It was discovered that libxerces2-java, a validating XML parser for Java, does not properly process malformed XML files. This vulnerability could allow an attacker to cause a denial of service while parsing a malformed XML file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Debian DSA-1903-1 : graphicsmagick - several vulnerabilities

Several vulnerabilities have been discovered in graphicsmagick, a collection of image processing tool, which can lead to the execution of arbitrary code, exposure of sensitive information or cause DoS. The Common Vulnerabilities and Exposures project identifies the following problems : -...

Debian DSA-1877-1 : mysql-dfsg-5.0 - denial of service/execution of arbitrary code

In MySQL 4.0.0 through 5.0.83, multiple format string vulnerabilities in the dispatchcommand function in libmysqld/sqlparse.cc in mysqld allow remote authenticated users to cause a denial of service daemon crash and potentially the execution of arbitrary code via format string specifiers in a...

Debian DSA-1973-1 : glibc, eglibc - information disclosure

Christoph Pleger has discovered that the GNU C Library aka glibc and its derivatives add information from the passwd.adjunct.byname map to entries in the passwd map, which allows local users to obtain the encrypted passwords of NIS accounts by calling the getpwnam function. %NASLMINLEVEL 70300 C...

Debian DSA-1938-1 : php-mail - programming error

It was discovered that php-mail, a PHP PEAR module for sending email, has insufficient input sanitising, which might be used to obtain sensitive data from the system that uses php-mail. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...

Debian DSA-1978-1 : phpgroupware - several vulnerabilities

Several remote vulnerabilities have been discovered in phpgroupware, a Web-based groupware system written in PHP. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-4414 A SQL injection vulnerability was found in the authentication module. -...

Debian DSA-1960-1 : acpid - programming error

It was discovered that acpid, the Advanced Configuration and Power Interface event daemon, on the oldstable distribution etch creates its log file with weak permissions, which might expose sensitive information or might be abused by a local user to consume all free disk space on the same partitio...

Debian DSA-1918-1 : phpmyadmin - several vulnerabilities

Several remote vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3696 Cross-site scripting XSS vulnerability allows remote attackers to inject arbitrary web...

Debian DSA-1967-1 : transmission - directory traversal

Dan Rosenberg discovered that Transmission, a lightwight client for the Bittorrent filesharing protocol, performs insufficient sanitising of file names specified in .torrent files. This could lead to the overwrite of local files with the privileges of the user running Transmission if the user is...

Debian DSA-1826-1 : eggdrop - several vulnerabilities

Several vulnerabilities have been discovered in eggdrop, an advanced IRC robot. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-2807 It was discovered that eggdrop is vulnerable to a buffer overflow, which could result in a remote user executing...

Debian DSA-1896-1 : opensaml, shibboleth-sp - several vulnerabilities

Several vulnerabilities have been discovered in the opensaml and shibboleth-sp packages, as used by Shibboleth 1.x : - Chris Ries discovered that decoding a crafted URL leads to a crash and potentially, arbitrary code execution. - Ian Young discovered that embedded NUL characters in certificate...

Debian DSA-1991-1 : squid/squid3 - denial of service

Two denial of service vulnerabilities have been discovered in squid and squid3, a web proxy. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2855 Bastian Blank discovered that it is possible to cause a denial of service via a crafted auth header wit...

Debian DSA-1921-1 : expat - denial of service

Peter Valchev discovered an error in expat, an XML parsing C library, when parsing certain UTF-8 sequences, which can be exploited to crash an application using the library. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Debian DSA-1842-1 : openexr - several vulnerabilities

Several vulnerabilities have been discovered in the OpenEXR image library, which can lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-1720 Drew Yao discovered integer overflows in the preview and compression...

Debian DSA-1995-1 : openoffice.org - several vulnerabilities

Several vulnerabilities have been discovered in the OpenOffice.org office suite. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0136 It was discovered that macro security settings were insufficiently enforced for VBA macros. - CVE-2009-0217 It was...

Debian DSA-1890-1 : wxwindows2.4 wxwidgets2.6 wxwidgets2.8 - integer overflow

Tielei Wang has discovered an integer overflow in wxWidgets, the wxWidgets Cross-platform C++ GUI toolkit, which allows the execution of arbitrary code via a crafted JPEG file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...