Debian DSA-803-1 : apache - programming error

A vulnerability has been discovered in the Apache web server. When it is acting as an HTTP proxy, it allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct cross-site scripting attacks, which causes Apache to incorrectly handle and forward the bod...

[SECURITY] [DSA 803-1] New Apache packages fix HTTP request smuggling

-------------------------------------------------------------------------- Debian Security Advisory DSA 803-1 [email protected] http://www.debian.org/security/ Martin Schulze September 8th, 2005 http://www.debian.org/security/faq -...

Debian DSA-801-1 : ntp - programming error

SuSE developers discovered that ntp confuses the given group id with the group id of the given user when called with a group id on the commandline that is specified as a string and not as a numeric gid, which causes ntpd to run with different privileges than intended. %NASLMINLEVEL 70300 C Tenabl...

Debian DSA-790-1 : phpldapadmin - programming error

Alexander Gerasiov discovered that phpldapadmin, a web-based interface for administering LDAP servers, allows anybody to access the LDAP server anonymously, even if this is disabled in the configuration with the 'disableanonbind' statement. The old stable distribution woody is not vulnerable to...

Debian DSA-791-1 : maildrop - missing privilege release

Max Vozeler discovered that the lockmail program from maildrop, a simple mail delivery agent with filtering abilities, does not drop group privileges before executing commands given on the commandline, allowing an attacker to execute arbitrary commands with privileges of the group mail...

Debian DSA-793-1 : courier - missing input sanitising

Jakob Balle discovered a vulnerability in the handling of attachments in sqwebmail, a web mail application provided by the courier mail suite, which can be exploited by an attacker to conduct script insertion attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-794-1 : polygen - programming error

Justin Rye noticed that polygen generates precompiled grammar objects world-writable, which can be exploited by a local attacker to at least fill up the filesystem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debi...

Debian DSA-799-1 : webcalendar - remote code execution

A trivially-exploitable bug was discovered in webcalendar that allows an attacker to execute arbitrary code with the privileges of the HTTP daemon on a system running a vulnerable version. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Debian DSA-796-1 : affix - remote command execution

Kevin Finisterre reports that affix, a package used to manage bluetooth sessions under Linux, uses the popen call in an unsafe fashion. A remote attacker can exploit this vulnerability to execute arbitrary commands on a vulnerable system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-800-1 : pcre3 - integer overflow

An integer overflow with subsequent buffer overflow has been detected in PCRE, the Perl Compatible Regular Expressions library, which allows an attacker to execute arbitrary code. Since several packages link dynamically to this library you are advised to restart the corresponding services or...

Debian DSA-792-1 : pstotext - missing input sanitising

Max Vozeler discovered that pstotext, a utility to extract text from PostScript and PDF files, did not execute ghostscript with the -dSAFER argument, which prevents potential malicious operations to happen. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

Debian DSA-787-1 : backup-manager - insecure permissions and tempfile

Two bugs have been found in backup-manager, a command-line driven backup utility. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-1855 Jeroen Vermeulen discovered that backup files are created with default permissions making them world readable, eve...

Debian DSA-784-1 : courier - programming error

A problem has been discovered in the Courier Mail Server. DNS failures were not handled properly when looking up Sender Policy Framework SPF records, which could allow attackers to cause memory corruption. The default configuration on Debian has SPF checking disabled, so most machines are not...

Debian DSA-789-1 : php4 - several vulnerabilities

Several security related problems have been found in PHP4, the server-side, HTML-embedded scripting language. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-1751 Eric Romang discovered insecure temporary files in the shtool utility shipped with PHP...

Debian DSA-786-1 : simpleproxy - format string vulnerability

Ulf Harnhammar from the Debian Security Audit Project discovered a format string vulnerability in simpleproxy, a simple TCP proxy, that can be exploited via replies from remote HTTP proxies. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

Debian DSA-783-1 : mysql-dfsg-4.1 - insecure temporary file

Eric Romang discovered a temporary file vulnerability in a script accompanied with MySQL, a popular database, that allows an attacker to execute arbitrary SQL commands when the server is installed or updated. The old stable distribution woody as well as mysql-dfsg are not affected by this problem...

[Full-disclosure] [SECURITY] [DSA 786-1] New simpleproxy packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 786-1 [email protected] http://www.debian.org/security/ Martin Schulze August 26th, 2005 http://www.debian.org/security/faq -...

Debian DSA-779-2 : mozilla-firefox - several vulnerabilities

We experienced that the update for Mozilla Firefox from DSA 779-1 unfortunately was a regression in several cases. Since the usual praxis of backporting apparently does not work, this update is basically version 1.0.6 with the version number rolled back, and hence still named 1.0.4-. For...

Debian DSA-782-1 : bluez-utils - missing input sanitising

Henryk Plotz discovered a vulnerability in bluez-utils, tools and daemons for Bluetooth. Due to missing input sanitising it is possible for an attacker to execute arbitrary commands supplied as device name from the remote device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

Debian DSA-778-1 : mantis - missing input sanitising

Two security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-2556 A remote attacker could supply a specially crafted URL to scan arbitrary ports on arbitrary hosts tha...