Rapid7 Advisory R7-0022: Symantec Scan Engine Known Immutable DSA Private Key

Rapid7, LLC Security Advisory Rapid7 Advisory R7-0022 Symantec Scan Engine Known Immutable DSA Private Key Published: April 21, 2006 Revision: 1.0 http://www.rapid7.com/advisories/R7-0022.html CVE: CVE-2006-0231 1. Affected systems: KNOWN VULNERABLE: o Symantec Scan Engine v5.0.0.24 KNOWN FIXED: ...

[SECURITY] [DSA 1019-1] New kpdf packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 1019-1 [email protected] http://www.debian.org/security/ Martin Schulze March 24th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 979-1] New pdfkit.framework packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 979-1 [email protected] http://www.debian.org/security/ Martin Schulze February 17th, 2006 http://www.debian.org/security/faq -...

[Full-disclosure] [SECURITY] [DSA 968-1] New noweb packages fix insecure temporary file creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 968-1 [email protected] http://www.debian.org/security/ Martin Schulze February 13th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 809-3] New squid packages fix regression

-------------------------------------------------------------------------- Debian Security Advisory DSA 809-3 [email protected] http://www.debian.org/security/ Martin Schulze November 7th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 809-3] New squid packages fix regression

-------------------------------------------------------------------------- Debian Security Advisory DSA 809-3 [email protected] http://www.debian.org/security/ Martin Schulze November 7th, 2005 http://www.debian.org/security/faq -...

Debian DSA-869-1 : eric - missing input sanitising

The developers of eric, a full featured Python IDE, have fixed a bug in the processing of project files that could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securi...

Debian DSA-867-1 : module-assistant - insecure temporary file

Eduard Bloch discovered that a rule file in module-assistant, a tool to ease the creation of module packages, creates a temporary file in an insecure fashion. It is usually executed from other packages as well. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-866-1 : mozilla - several vulnerabilities

Several security-related problems have been discovered in Mozilla and derived programs. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-2871 Tom Ferris discovered a bug in the IDN hostname handling of Mozilla that allows remote attackers to cause a...

Debian DSA-864-1 : ruby1.8 - programming error

Yutaka Oiwa discovered a bug in Ruby, the interpreter for the object-oriented scripting language, that can cause illegal program code to bypass the safe level and taint flag protections check and be executed. The following matrix lists the fixed versions in our distributions : old stable woody...

Fedora Core 3 : openssl-0.9.7a-42.2 / openssl096b-0.9.6b-21.2 (2005-985)

The remote Fedora Core host is missing one or more security updates : openssl-0.9.7a-42.2 : - Tue Oct 11 2005 Tomas Mraz 0.9.7a-42.2 - fix CVE-2005-2969 - remove SSLOPMSIESSLV2RSAPADDING which disables the countermeasure against man in the middle attack in SSLv2 169863 - more fixes for constant...

Fedora Core 4 : openssl-0.9.7f-7.10 / openssl097a-0.9.7a-3.1 (2005-986)

The remote Fedora Core host is missing one or more security updates : openssl-0.9.7f-7.10 : - Wed Oct 12 2005 Tomas Mraz 0.9.7f-7.10 - fix CVE-2005-2969 - remove SSLOPMSIESSLV2RSAPADDING which disables the countermeasure against man in the middle attack in SSLv2 169863 - more fixes for constant...

Moderate: Red Hat Security Advisory: openssl security update

Updated OpenSSL packages that fix various security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. OpenSSL is a toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols as we...

Debian DSA-861-1 : uw-imap - buffer overflow

'infamous41md' discovered a buffer overflow in uw-imap, the University of Washington's IMAP Server that allows attackers to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

Debian DSA-862-1 : ruby1.6 - programming error

Yutaka Oiwa discovered a bug in Ruby, the interpreter for the object-oriented scripting language, that can cause illegal program code to bypass the safe level and taint flag protections check and be executed. The following matrix lists the fixed versions in our distributions : old stable woody...

Debian DSA-855-1 : weex - format string vulnerability

Ulf Harnhammar from the Debian Security Audit Project discovered a format string vulnerability in weex, a non-interactive FTP client for updating web pages, that could be exploited to execute arbitrary code on the clients machine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

Debian DSA-848-1 : masqmail - several vulnerabilities

Jens Steube discovered two vulnerabilities in masqmail, a mailer for hosts without permanent internet connection. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-2662 When sending failed mail messages, the address is not sanitised, which allows a...

Debian DSA-849-1 : shorewall - programming error

'Supernaut' noticed that shorewall, the Shoreline Firewall, could generate an iptables configuration which is significantly more permissive than the rule set given in the shorewall configuration, if MAC verification are used in a non-default manner. When MACLISTDISPOSITION is set to ACCEPT in the...

Debian DSA-847-1 : dia - missing input sanitising

Joxean Koret discovered that the Python SVG import plugin in dia, a vector-oriented diagram editor, does not properly sanitise data read from an SVG file and is hence vulnerable to execute arbitrary Python code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-854-1 : tcpdump - infinite loop

Simon Nielsen discovered that the BGP dissector in tcpdump, a powerful tool for network monitoring and data acquisition, does not properly handle a -1 return value from an internal function that decodes data packets. A specially crafted BGP packet can cause a denial of service via an infinite loo...