Debian DSA-1876-1 : dnsmasq - buffer overflow

Several remote vulnerabilities have been discovered in the TFTP component of dnsmasq. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2957 A buffer overflow in TFTP processing may enable arbitrary code execution to attackers which are permitted to u...

Debian DSA-1894-1 : newt - buffer overflow

Miroslav Lichvar discovered that newt, a windowing toolkit, is prone to a buffer overflow in the content processing code, which can lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Debian DSA-1874-1 : nss - several vulnerabilities

Several vulnerabilities have been discovered in the Network Security Service libraries. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2404 Moxie Marlinspike discovered that a buffer overflow in the regular expression parser could lead to the...

Debian DSA-1951-1 : firefox-sage - insufficient input sanitising

It was discovered that firefox-sage, a lightweight RSS and Atom feed reader for Firefox, does not sanitise the RSS feed information correctly, which makes it prone to a cross-site scripting and a cross-domain scripting attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Debian DSA-1866-1 : kdegraphics - several vulnerabilities

Two security issues have been discovered in kdegraphics, the graphics apps from the official KDE release. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0945 It was discovered that the KSVG animation element implementation suffers from a NULL point...

Debian DSA-1832-1 : camlimages - integer overflow

Tielei Wang discovered that CamlImages, an open source image processing library, suffers from several integer overflows which may lead to a potentially exploitable heap overflow and result in arbitrary code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-2002-1 : polipo - denial of service

Several denial of service vulnerabilities have been discovered in polipo, a small, caching web proxy. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3305 A malicous remote server could cause polipo to crash by sending an invalid Cache-Control heade...

Debian DSA-1855-1 : subversion - heap overflow

Matt Lewis discovered that Subversion performs insufficient input validation of svndiff streams. Malicious servers could cause heap overflows in clients, and malicious clients with commit access could cause heap overflows in servers, possibly leading to arbitrary code execution in both cases...

Debian DSA-1982-1 : hybserv - denial of service

Julien Cristau discovered that hybserv, a daemon running IRC services for IRCD-Hybrid, is prone to a denial of service attack via the commands option. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

Debian DSA-1902-1 : elinks - buffer overflow

Jakub Wilk discovered an off-by-one buffer overflow in the charset handling of elinks, a feature-rich text-mode WWW browser, which might lead to the execution of arbitrary code if the user is tricked into opening a malformed HTML page. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-1980-1 : ircd-hybrid/ircd-ratbox - integer underflow/denial of service

David Leadbeater discovered an integer underflow that could be triggered via the LINKS command and can lead to a denial of service or the execution of arbitrary code CVE-2009-4016 . This issue affects both, ircd-hybrid and ircd-ratbox. It was discovered that the ratbox IRC server is prone to a...

Debian DSA-1993-1 : otrs2 - sql injection

It was discovered that otrs2, the Open Ticket Request System, does not properly sanitise input data that is used on SQL queries, which might be used to inject arbitrary SQL to, for example, escalate privileges on a system that uses otrs2. The oldstable distribution etch is not affected...

Debian DSA-1839-1 : gst-plugins-good0.10 - integer overflow

It has been discovered that gst-plugins-good0.10, the GStreamer plugins from the 'good' set, are prone to an integer overflow, when processing a large PNG file. This could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packag...

Debian DSA-1920-1 : nginx - denial of service

A denial of service vulnerability has been found in nginx, a small and efficient web server. Jasson Bell discovered that a remote attacker could cause a denial of service segmentation fault by sending a crafted request. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-1981-1 : maildrop - privilege escalation

Christoph Anton Mitterer discovered that maildrop, a mail delivery agent with filtering abilities, is prone to a privilege escalation issue that grants a user root group privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-1850-1 : libmodplug - several vulnerabilities

Several vulnerabilities have been discovered in libmodplug, the shared libraries for mod music based on ModPlug. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-1438 It was discovered that libmodplug is prone to an integer overflow when processing a...

Debian DSA-1835-1 : tiff - several vulnerabilities

Several vulnerabilities have been discovered in the library for the Tag Image File Format TIFF. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2285 It was discovered that malformed TIFF images can lead to a crash in the decompression code, resultin...

Debian DSA-1988-1 : qt4-x11 - several vulnerabilities

Several vulnerabilities have been discovered in qt4-x11, a cross-platform C++ application framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0945 Array index error in the insertItemBefore method in WebKit, as used in qt4-x11, allows remote...

Debian DSA-1962-1 : kvm - several vulnerabilities

Several vulnerabilities have been discovered in kvm, a full virtualization system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3638 It was discovered an Integer overflow in the kvmdevioctlgetsupportedcpuid function. This allows local users to ha...

Debian DSA-1931-1 : nspr - several vulnerabilities

Several vulnerabilities have been discovered in the NetScape Portable Runtime Library, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-1563 A programming error in the string handling code may lead t...