Debian Security Advisory DSA 2686-1 (libxcb - several vulnerabilities)

Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to...

Debian Security Advisory DSA 2677-1 (libxrender - several vulnerabilities)

Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to...

Debian Security Advisory DSA 2685-1 (libxp - several vulnerabilities)

Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to...

Debian Security Advisory DSA 2684-1 (libxrandr - several vulnerabilities)

Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to...

Debian Security Advisory DSA 2681-1 (libxcursor - several vulnerabilities)

Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to...

Debian Security Advisory DSA 2679-1 (xserver-xorg-video-openchrome - several vulnerabilities)

Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to...

Debian Security Advisory DSA 2672-1 (kfreebsd-9 - interpretation conflict)

Adam Nowacki discovered that the new FreeBSD NFS implementation processes a crafted READDIR request which instructs to operate a file system on a file node as if it were a directory node, leading to a kernel crash or potentially arbitrary code execution. The kfreebsd-8 kernel in the oldstable...

Debian Security Advisory DSA 2667-1 (mysql-5.5 - several vulnerabilities)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.5.31, which includes additional changes, such as performance improvements and corrections for data loss defects. OpenVAS Vulnerability Test $Id:...

Debian Security Advisory DSA 2663-1 (tinc - stack based buffer overflow)

Martin Schobert discovered a stack-based vulnerability in tinc, a Virtual Private Network VPN daemon. When packets are forwarded via TCP, packet length is not checked against the stack buffer length. Authenticated peers could use this to crash the tinc daemon and maybe execute arbitrary code. Not...

Debian Security Advisory DSA 2660-1 (curl - exposure of sensitive information)

Yamada Yasuharu discovered that cURL, an URL transfer library, is vulnerable to expose potentially sensitive information when doing requests across domains with matching tails. Due to a bug in the tailmatch function when matching domain names, it was possible that cookies set for a domain ample.c...

PostgreSQL 临时文件创建漏洞(CVE-2013-1902)

BUGTRAQ ID: 58877 CVECAN ID: CVE-2013-1902 PostgreSQL是一款高级对象－关系型数据库管理系统，支持扩展的SQL标准子集。 PostgreSQL 9.2.4, 9.1.9, 9.0.13之前版本存用可预测的文件名生成了不安全的临时文件，本地攻击者可以进行符号链接攻击。 0 Debian Linux 6.0 x PostgreSQL 9.x 厂商补丁： PostgreSQL ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.postgresql.org...

Debian Security Advisory DSA 2657-1 (postgresql-8.4 - guessable random numbers)

A vulnerability was discovered in PostgreSQL database server. Random numbers generated by contrib/pgcrypto functions may be easy for another database user to guess. OpenVAS Vulnerability Test $Id: deb2657.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2657-1 using nvtg...

Debian Security Advisory DSA 2654-1 (libxslt - denial of service)

Nicolas Gregoire discovered that libxslt, an XSLT processing runtime library, is prone to denial of service vulnerabilities via crafted XSL stylesheets. OpenVAS Vulnerability Test $Id: deb2654.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2654-1 using nvtgen 1.0 Scrip...

Debian Security Advisory DSA 2656-1 (bind9 - denial of service)

Matthew Horsfall of Dyn, Inc. discovered that BIND, a DNS server, is prone to a denial of service vulnerability. A remote attacker could use this flaw to send a specially-crafted DNS query to named that, when processed, would cause named to use an excessive amount of memory, or possibly crash...

Debian Security Advisory DSA 2655-1 (rails - several vulnerabilities)

Several cross-site-scripting and denial of service vulnerabilities were discovered in Ruby on Rails, a Ruby framework for web application development. OpenVAS Vulnerability Test $Id: deb2655.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2655-1 using nvtgen 1.0 Script...

Debian Security Advisory DSA 2653-1 (icinga - buffer overflow)

It was discovered that Icinga, a host and network monitoring system, contains several buffer overflows in the history.cgi CGI program. OpenVAS Vulnerability Test $Id: deb2653.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2653-1 using nvtgen 1.0 Script version: 1.0...

Debian Security Advisory DSA 2652-1 (libxml2 - external entity expansion)

Brad Hill of iSEC Partners discovered that many XML implementations are vulnerable to external entity expansion issues, which can be used for various purposes such as firewall circumvention, disguising an IP address, and denial-of-service. libxml2 was susceptible to these problems when performing...

Debian Security Advisory DSA 2651-1 (smokeping - cross-site scripting vulnerability)

A cross-site scripting vulnerability was discovered in smokeping, a latency logging and graphing system. Input passed to the displaymode parameter was not properly sanitized. An attacker could use this flaw to execute arbitrary HTML and script code in a user's browser session in the context of an...

Debian Security Advisory DSA 2641-2 (perl - rehashing flaw)

Yves Orton discovered a flaw in the rehashing code of Perl. This flaw could be exploited to carry out a denial of service attack against code that uses arbitrary user input as hash keys. Specifically an attacker could create a set of keys of a hash causing a denial of service via memory exhaustio...

Debian Security Advisory DSA 2650-2 (libvirt - files and device nodes ownership change to kvm group)

Bastian Blank discovered that libvirtd, a daemon for management of virtual machines, network and storage, would change ownership of devices files so they would be owned by user libvirt-qemu and group kvm , which is a general purpose group not specific to libvirt, allowing unintended write access ...