Debian DSA-1177-1 : usermin - programming error

Hendrik Weimer discovered that it is possible for a normal user to disable the login shell of the root account via usermin, a web-based administration tool. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-1108-1 : mutt - buffer overflow

It was discovered that the mutt mail reader performs insufficient validation of values returned from an IMAP server, which might overflow a buffer and potentially lead to the injection of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...

Debian DSA-1167-1 : apache - missing input sanitising

Several remote vulnerabilities have been discovered in the Apache, the worlds most popular webserver, which may lead to the execution of arbitrary web script. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-3352 A cross-site scripting XSS flaw exist...

Debian DSA-1059-1 : quagga - several vulnerabilities

Konstantin Gavrilenko discovered several vulnerabilities in quagga, the BGP/OSPF/RIP routing daemon. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-2223 Remote attackers may obtain sensitive information via RIPv1 REQUEST packets even if the quagga...

Debian DSA-887-1 : clamav - several vulnerabilities

Several vulnerabilities have been discovered in Clam AntiVirus, the antivirus scanner for Unix, designed for integration with mail servers to perform attachment scanning. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-3239 The OLE2 unpacker allows...

Debian DSA-1140-1 : gnupg - integer overflow

Evgeny Legerov discovered that overly large comments can crash gnupg, the GNU privacy guard - a free PGP replacement. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-1140. The text itself ...

Debian DSA-1002-1 : webcalendar - several vulnerabilities

Several security related problems have been discovered in webcalendar, a PHP based multi-user calendar. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-3949 Multiple SQL injection vulnerabilities allow remote attackers to execute arbitrary SQ...

Debian DSA-1048-1 : asterisk - several vulnerabilities

Several problems have been discovered in Asterisk, an Open Source Private Branch Exchange telephone control center. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-3559 Adam Pointon discovered that due to missing input sanitising it is possible to...

Debian DSA-1166-2 : cheesetracker - buffer overflow

Luigi Auriemma discovered a buffer overflow in the loading component of cheesetracker, a sound module tracking program, which could allow a maliciously constructed input file to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-1181-1 : gzip - several vulnerabilities

Tavis Ormandy from the Google Security Team discovered several vulnerabilities in gzip, the GNU compression utility. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-4334 A NULL pointer dereference may lead to denial of service if gzip is used in an...

Debian DSA-916-1 : inkscape - buffer overflow

Several vulnerabilities have been discovered in Inkscape, a vector-based drawing program. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-3737 Joxean Koret discovered a buffer overflow in the SVG parsing routines that can lead to the execution of...

Debian DSA-903-2 : unzip - race condition

The unzip update in DSA 903 contained a regression so that symbolic links that are resolved later in a zip archive aren't supported anymore. This update corrects this behaviour. For completeness, below please find the original advisory text : Imran Ghory discovered a race condition in the...

Debian DSA-1015-1 : sendmail - programming error

Mark Dowd discovered a flaw in the handling of asynchronous signals in sendmail, a powerful, efficient, and scalable mail transport agent. This allows a remote attacker to exploit a race condition to execute arbitrary code as root. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-1020-1 : flex - buffer overflow

Chris Moore discovered that flex, a scanner generator, generates code, which allocates insufficient memory, if the grammar contains REJECT statements or trailing context rules. This may lead to a buffer overflow and the execution of arbitrary code. If you use code, which is derived from a...

Debian DSA-953-1 : flyspray - missing input sanitising

Several cross-site scripting vulnerabilities have been discovered in flyspray, a lightweight bug tracking system, which allows attackers to insert arbitrary script code into the index page. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Debian DSA-977-1 : heimdal - several vulnerabilities

Two vulnerabilities have been discovered in heimdal, a free implementation of Kerberos 5. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2006-0582 Privilege escalation in the rsh server allows an authenticated attacker to overwrite arbitrary file...

Debian DSA-1101-1 : courier - programming error

A bug has been discovered in the Courier Mail Server that can result in a number of processes to consume arbitrary amounts of CPU power. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-110...

Debian DSA-923-1 : dropbear - buffer overflow

A buffer overflow has been discovered in dropbear, a lightweight SSH2 server and client, that may allow authenticated users to execute arbitrary code as the server user usually root. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-889-1 : enigmail - programming error

Hadmut Danish discovered a bug in enigmail, GPG support for Mozilla MailNews and Mozilla Thunderbird, that can lead to the encryption of mail with the wrong public key, hence, potential disclosure of confidential data to others. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Debian DSA-1163-1 : gtetrinet - programming error

Michael Gehring discovered several potential out-of-bounds index accesses in gtetrinet, a multiplayer Tetris-like game, which may allow a remote server to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...