Debian Security Advisory DSA 2727-1 (openjdk-6 - several vulnerabilities)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service. OpenVAS Vulnerability Test $Id: deb2727.nasl 6611 2017-07-07 12:07:20Z...

Debian Security Advisory DSA 2725-1 (tomcat6 - several vulnerabilities)

Two security issues have been found in the Tomcat servlet and JSP engine: CVE-2012-3544 The input filter for chunked transfer encodings could trigger high resource consumption through malformed CRLF sequences, resulting in denial of service. CVE-2013-2067 The FormAuthenticator module was vulnerab...

Debian Security Advisory DSA 2723-1 (php5 - heap corruption)

It was discovered that PHP could perform an invalid free request when processing crafted XML documents, corrupting the heap and potentially leading to arbitrary code execution. Depending on the PHP application, this vulnerability could be exploited remotely. OpenVAS Vulnerability Test $Id:...

Debian Security Advisory DSA 2722-1 (openjdk-7 - several vulnerabilities)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service. OpenVAS Vulnerability Test $Id: deb2722.nasl 6611 2017-07-07 12:07:20Z...

Debian Security Advisory DSA 2719-1 (poppler - several vulnerabilities)

Multiple vulnerabilities were discovered in the poppler PDF rendering library. CVE-2013-1788 Multiple invalid memory access issues, which could potentially lead to arbitrary code execution if the user were tricked into opening a malformed PDF document. CVE-2013-1790 An uninitialized memory issue,...

Debian Security Advisory DSA 2721-1 (nginx - buffer overflow)

A buffer overflow has been identified in nginx, a small, powerful, scalable web/proxy server, when processing certain chunked transfer encoding requests if proxypass to untrusted upstream HTTP servers is used. An attacker may use this flaw to perform denial of service attacks, disclose worker...

Debian DSA-2715-1 : puppet - code execution

It was discovered that puppet, a centralized configuration management system, did not correctly handle YAML payloads. A remote attacker could use a specially crafted payload to execute arbitrary code on the puppet master. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

Debian Security Advisory DSA 2717-1 (xml-security-c - heap overflow)

Jon Erickson of iSIGHT Partners Labs discovered a heap overflow in xml-security-c, an implementation of the XML Digital Security specification. The fix to address CVE-2013-2154 introduced the possibility of a heap overflow in the processing of malformed XPointer expressions in the XML Signature...

Debian Security Advisory DSA 2716-1 (iceweasel - several vulnerabilities)

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, use-after-free vulnerabilities, missing permission checks, incorrect memory handling and other implementation errors may lead to the execution of arbitrary...

Debian Security Advisory DSA 2714-1 (kfreebsd-9 - programming error)

Konstantin Belousov and Alan Cox discovered that insufficient permission checks in the memory management of the FreeBSD kernel could lead to privilege escalation. OpenVAS Vulnerability Test $Id: deb2714.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2714-1 using nvtgen...

Debian Security Advisory DSA 2713-1 (curl - heap overflow)

Timo Sirainen discovered that cURL, an URL transfer library, is prone to a heap overflow vulnerability due to bad checking of the input data in the curleasyunescape function. The curl command line tool is not affected by this problem as it doesn't use the curleasyunescape function. OpenVAS...

Debian Security Advisory DSA 2711-1 (haproxy - several vulnerabilities)

Multiple security issues have been found in HAProxy, a load-balancing reverse proxy: CVE-2012-2942 Buffer overflow in the header capture code. CVE-2013-1912 Buffer overflow in the HTTP keepalive code. CVE-2013-2175 Denial of service in parsing HTTP headers. OpenVAS Vulnerability Test $Id:...

Debian Security Advisory DSA 2712-1 (otrs2 - privilege escalation)

It was discovered that users with a valid agent login could use crafted URLs to bypass access control restrictions and read tickets to which they should not have access. The oldstable distribution squeeze is not affected by this problem. OpenVAS Vulnerability Test $Id: deb2712.nasl 6611 2017-07-0...

Debian Security Advisory DSA 2698-1 (tiff - buffer overflow)

Multiple issues were discovered in the TIFF tools, a set of utilities for TIFF image file manipulation and conversion. CVE-2013-1960 Emmanuel Bouillon discovered a heap-based buffer overflow in the tpprocessjpegstrip function in the tiff2pdf tool. This could potentially lead to a crash or arbitra...

Debian Security Advisory DSA 2628-1 (nss-pam-ldapd - buffer overflow)

Garth Mollett discovered that a file descriptor overflow issue in the use of FDSET in nss-pam-ldapd, which provides NSS and PAM modules for using LDAP as a naming service, can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process that...

Debian Security Advisory DSA 2709-1 (wireshark - several vulnerabilities)

Multiple vulnerabilities were discovered in the dissectors for CAPWAP, GMR-1 BCCH, PPP, NBAP, RDP, HTTP, DCP ETSI and in the Ixia IxVeriWave file parser, which could result in denial of service or the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2709.nasl 6611 2017-07-07...

Debian Security Advisory DSA 2708-1 (fail2ban - denial of service)

Krzysztof Katowicz-Kowalewski discovered a vulnerability in Fail2ban, a log monitoring and system which can act on attack by preventing hosts to connect to specified services using the local firewall. When using Fail2ban to monitor Apache logs, improper input validation in log parsing could enabl...

Debian Security Advisory DSA 2707-1 (dbus - denial of service)

Alexandru Cornea discovered a vulnerability in libdbus caused by an implementation bug in dbusprintfstringupperbound. This vulnerability can be exploited by a local user to crash system services that use libdbus, causing denial of service. Depending on the dbus services running, it could lead to...

Debian Security Advisory DSA 2705-1 (pymongo - denial of service)

Jibbers McGee discovered that PyMongo, a high-performance schema-free document-oriented data store, is prone to a denial-of-service vulnerability. An attacker can remotely trigger a NULL pointer dereference causing MongoDB to crash. The oldstable distribution squeeze is not affected by this issue...

Debian Security Advisory DSA 2704-1 (mesa - out of bounds access)

It was discovered that applications using the mesa library, a free implementation of the OpenGL API, may crash or execute arbitrary code due to an out of bounds memory access in the library. This vulnerability only affects systems with Intel chipsets. The oldstable distribution squeeze is not...