Debian Security Advisory DSA 3186-1 (nss - security update)

It was discovered that the Mozilla Network Security Service library nss incorrectly handled certain ASN.1 lengths. A remote attacker could possibly use this issue to perform a data-smuggling attack. OpenVAS Vulnerability Test $Id: deb3186.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated...

Debian Security Advisory DSA 3179-1 (icedove - security update)

Multiple security issues have been found in Icedove, Debian OpenVAS Vulnerability Test $Id: deb3179.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3179-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2015 Greenbone Networks GmbH...

Debian Security Advisory DSA 3178-1 (unace - security update)

Jakub Wilk discovered that unace, an utility to extract, test and view .ace archives, contained an integer overflow leading to a buffer overflow. If a user or automated system were tricked into processing a specially crafted ace archive, an attacker could cause a denial of service application cra...

Debian Security Advisory DSA 3172-1 (cups - security update)

Peter De Wachter discovered that CUPS, the Common UNIX Printing System, did not correctly parse compressed raster files. By submitting a specially crafted raster file, a remote attacker could use this vulnerability to trigger a buffer overflow. OpenVAS Vulnerability Test $Id: deb3172.nasl 6609...

Debian Security Advisory DSA 3165-1 (xdg-utils - security update)

Jiri Horner discovered a way to cause xdg-open, a tool that automatically opens URLs in a user OpenVAS Vulnerability Test $Id: deb3165.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3165-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright:...

Debian Security Advisory DSA 3160-1 (xorg-server - security update)

Olivier Fourdan discovered that missing input validation in the Xserver OpenVAS Vulnerability Test $Id: deb3160.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3160-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2015 Greenbone...

Debian Security Advisory DSA 3161-1 (dbus - security update)

Simon McVittie discovered a local denial of service flaw in dbus, an asynchronous inter-process communication system. On systems with systemd-style service activation, dbus-daemon does not prevent forged ActivationFailure messages from non-root processes. A malicious local user could use this fla...

Debian Security Advisory DSA 3145-1 (privoxy - security update)

Multiple vulnerabilities were discovered in Privoxy, a privacy enhancing HTTP proxy, which might result in denial of service. OpenVAS Vulnerability Test $Id: deb3145.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3145-1 using nvtgen 1.0 Script version: 1.0 Author:...

Debian Security Advisory DSA 3144-1 (openjdk-7 - security update)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, information disclosure or denial of service. OpenVAS Vulnerability Test $Id: deb3144.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from...

Debian Security Advisory DSA 3139-1 (squid - security update)

Matthew Daley discovered that squid, a web proxy cache, does not properly perform input validation when parsing requests. A remote attacker could use this flaw to mount a denial of service attack, by sending specially crafted Range requests. OpenVAS Vulnerability Test $Id: deb3139.nasl 6609...

Debian Security Advisory DSA 3137-1 (websvn - security update)

James Clawson discovered that websvn, a web viewer for Subversion repositories, would follow symlinks in a repository when presenting a file for download. An attacker with repository write access could thereby access any file on disk readable by the user the webserver runs as. OpenVAS Vulnerabili...

Debian Security Advisory DSA 3135-1 (mysql-5.5 - security update)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.41. Please see the MySQL 5.5 Release Notes and Oracle OpenVAS Vulnerability Test $Id: deb3135.nasl 6609 2017-07-07 12:05:59Z cfischer $...

Debian Security Advisory DSA 3129-1 (rpm - security update)

Two vulnerabilities have been discovered in the RPM package manager. CVE-2013-6435 Florian Weimer discovered a race condition in package signature validation. CVE-2014-8118 Florian Weimer discovered an integer overflow in parsing CPIO headers which might result in the execution of arbitrary code...

Debian Security Advisory DSA 3127-1 (iceweasel - security update)

Multiple security issues have been found in Iceweasel, Debian OpenVAS Vulnerability Test $Id: deb3127.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3127-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2015 Greenbone Networks Gm...

Debian Security Advisory DSA 3126-1 (php5 - security update)

It was discovered that libmagic as used by PHP, would trigger an out of bounds memory access when trying to identify a crafted file. Additionally, this updates fixes a potential dependency loop in dpkg trigger handling. OpenVAS Vulnerability Test $Id: deb3126.nasl 8972 2018-02-28 07:02:10Z cfisch...

Debian Security Advisory DSA 3124-1 (otrs2 - security update)

Thorsten Eckel of Znuny GMBH and Remo Staeuble of InfoGuard discovered a privilege escalation vulnerability in otrs2, the Open Ticket Request System. An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is...

Debian DSA-3122-1 : curl - security update

Andrey Labunets of Facebook discovered that cURL, an URL transfer library, fails to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl to access a specially crafted URL via an HTTP proxy could use this flaw to do additional requests in...

Debian Security Advisory DSA 3122-1 (curl - security update)

Andrey Labunets of Facebook discovered that cURL, an URL transfer library, fails to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl to access a specially crafted URL via an HTTP proxy could use this flaw to do additional requests in...

Debian DSA-3120-1 : mantis - security update

Multiple security issues have been found in the Mantis bug tracking system, which may result in phishing, information disclosure, CAPTCHA bypass, SQL injection, cross-site scripting or the execution of arbitrary PHP code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

Debian Security Advisory DSA 3114-1 (mime-support - security update)

Timothy D. Morgan discovered that run-mailcap, an utility to execute programs via entries in the mailcap file, is prone to shell command injection via shell meta-characters in filenames. In specific scenarios this flaw could allow an attacker to remotely execute arbitrary code. OpenVAS...