Debian Security Advisory DSA 2991-1 (modsecurity-apache - security update)

Martin Holst Swende discovered a flaw in the way chunked requests are handled in ModSecurity, an Apache module whose purpose is to tighten the Web application security. A remote attacker could use this flaw to bypass intended modsecurity restrictions by using chunked transfer coding with a...

Debian Security Advisory DSA 2990-1 (cups - security update)

It was discovered that the web interface in CUPS, the Common UNIX Printing System, incorrectly validated permissions on rss files and directory index files. A local attacker could possibly use this issue to bypass file permissions and read arbitrary files, possibly leading to a privilege...

Debian Security Advisory DSA 2988-1 (transmission - security update)

Ben Hawkes discovered that incorrect handling of peer messages in the Transmission bittorrent client could result in denial of service or the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2988.nasl 6724 2017-07-14 09:57:17Z teissa $ Auto-generated from advisory DSA 2988-1 using...

Debian Security Advisory DSA 2986-1 (iceweasel - security update)

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and use-after-frees may lead to the execution of arbitrary code or denial of service. OpenVAS Vulnerability Test $Id: deb2986.nasl 6692 2017-07-12 09:57:43Z...

Debian Security Advisory DSA 2987-1 (openjdk-7 - security update)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service. OpenVAS Vulnerability Test $Id: deb2987.nasl 6663 2017-07-11 09:58:05Z...

Debian Security Advisory DSA 2984-1 (acpi-support - security update)

CESG discovered a root escalation flaw in the acpi-support package. An unprivileged user can inject the DBUSSESSIONBUSADDRESS environment variable to run arbitrary commands as root user via the policy-funcs script. OpenVAS Vulnerability Test $Id: deb2984.nasl 6724 2017-07-14 09:57:17Z teissa $...

Debian Security Advisory DSA 2985-1 (mysql-5.5 - security update)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.38. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:...

Debian Security Advisory DSA 2983-1 (drupal7 - security update)

Multiple security issues have been discovered in the Drupal content management system, ranging from denial of service to cross-site scripting. More information can be found at https://www.drupal.org/SA-CORE-2014-003 . OpenVAS Vulnerability Test $Id: deb2983.nasl 8972 2018-02-28 07:02:10Z cfischer...

Debian Security Advisory DSA 2982-1 (ruby-activerecord-3.2 - security update)

Sean Griffin discovered two vulnerabilities in the PostgreSQL adapter for Active Record which could lead to SQL injection. OpenVAS Vulnerability Test $Id: deb2982.nasl 6724 2017-07-14 09:57:17Z teissa $ Auto-generated from advisory DSA 2982-1 using nvtgen 1.0 Script version: 1.1 Author: Greenbone...

Debian Security Advisory DSA 2981-1 (polarssl - security update)

A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS library, which can be exploited by a remote unauthenticated attacker to mount a denial of service against PolarSSL servers that offer GCM ciphersuites. Potentially clients are affected too if a malicious server decides to execute...

Debian Security Advisory DSA 2979-1 (fail2ban - security update)

Two vulnerabilities were discovered in Fail2ban, a solution to ban hosts that cause multiple authentication errors. When using Fail2ban to monitor Postfix or Cyrus IMAP logs, improper input validation in log parsing could enable a remote attacker to trigger an IP ban on arbitrary addresses,...

Debian Security Advisory DSA 2980-1 (openjdk-6 - security update)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service. OpenVAS Vulnerability Test $Id: deb2980.nasl 6663 2017-07-11 09:58:05Z...

Debian Security Advisory DSA 2978-1 (libxml2 - security update)

Daniel P. Berrange discovered a denial of service vulnerability in libxml2 entity substitution. OpenVAS Vulnerability Test $Id: deb2978.nasl 6724 2017-07-14 09:57:17Z teissa $ Auto-generated from advisory DSA 2978-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright:...

Debian Security Advisory DSA 2977-1 (libav - security update)

Don A. Baley discovered an integer overflow in the lzo compression handler which could result in the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2977.nasl 6750 2017-07-18 09:56:47Z teissa $ Auto-generated from advisory DSA 2977-1 using nvtgen 1.0 Script version: 1.0 Author:...

Debian Security Advisory DSA 2976-1 (eglibc - security update)

Stephane Chazelas discovered that the GNU C library, glibc, processed '..' path segments in locale-related environment variables, possibly allowing attackers to circumvent intended restrictions, such as ForceCommand in OpenSSH, assuming that they can supply crafted locale settings. OpenVAS...

Debian Security Advisory DSA 2973-1 (vlc - security update)

Multiple buffer overflows have been found in the VideoLAN media player. Processing malformed subtitles or movie files could lead to denial of service and potentially the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2973.nasl 6663 2017-07-11 09:58:05Z teissa $ Auto-generated fro...

Debian Linux <= 2.1 Print Queue Control Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/508/info The LPRng software is an enhanced, extended, and portable version of the Berkeley LPR software the standard UNIX printer spooler that ships with Debian GNU/Linux. When root controls the print queue, the...

Debian Linux 2.0 Super Syslog Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/342/info After the first super buffer overflow vulnerability was discovered, another appeared shortly after. This vulnerability exists when the syslog option is enabled. The overflow is in the file error.c, in the Error...

Salim Gasmi GLD 1.x Postfix Greylisting Daemon Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13129/info It is reported that GLD contains a buffer overflow vulnerability. This issue is due to a failure of the application to properly ensure that a fixed-size memory buffer is sufficiently large prior to copying...

Debian Linux 2.2 splitvt Format String Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2210/info splitvt is a VT100 window splitter, designed to allow the user two command line interfaces in one terminal window, originally written by Sam Lantinga. It is freely available, open source, and included with many...