1048 matches found
Debian DLA-333-1 : cakephp security update
CakePHP, an open source web application framework for PHP, was vulnerable to SSRF Server Side Request Forgery attacks. Remote attacker can utilize it for at least DoS Denial of Service attacks, if the target application accepts XML as an input. It is caused by insecure design of Cake's Xml class...
[SECURITY] [DLA 333-1] cakephp security update
Package : cakephp Version : 1.3.2-1.1+deb6u11 CakePHP, an open-source web application framework for PHP, was vulnerable to SSRF Server Side Request Forgery attacks. Remote attacker can utilize it for at least DoS Denial of Service attacks, if the target application accepts XML as an input. It is...
Debian DLA-331-1 : polarssl security update
A flaw was found in PolarSSl and mbed TLS : When the client creates its ClientHello message, due to insufficient bounds checking it can overflow the heap-based buffer containing the message while writing some extensions. Two extensions in particular could be used by a remote attacker to trigger t...
DLA-333-1 cakephp - security update
Bulletin has no description...
DLA-332-1 optipng - security update
Bulletin has no description...
DLA-330-1 unzip - security update
Bulletin has no description...
[SECURITY] [DLA-329-1] postgresql-8.4 update
Package : postgresql-8.4 Version : 8.4.22lts5-0+deb6u1 Several bugs were discovered in PostgreSQL, a relational database server system. The 8.4 branch is EOLed upstream, but still present in Debian squeeze. This new LTS minor version contains the fixes that were applied upstream to the 9.0.22...
DLA-329-1 postgresql-8.4 - security update
Bulletin has no description...
DLA-328-1 tzdata - new upstream version
Bulletin has no description...
[SECURITY] [DLA 326-1] zendframework security update
Package : zendframework Version : 1.10.6-1squeeze6 CVE ID : CVE-2015-7695 The PDO adapters of Zend Framework 1 did not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte,...
DLA-326-1 zendframework - security update
Bulletin has no description...
DLA-325-1 linux-2.6 - security update
Bulletin has no description...
[SECURITY] [DLA 323-1] fuseiso security update
Package : fuseiso Version : 20070708-2+deb6u1 Debian Bug : 779047 The following two issues have recently been fixed in Debian LTS squeeze for the fuseiso package. Issue 1 An integer overflow, leading to a heap-based buffer overflow flaw was found in the way FuseISO, a FUSE module to mount ISO...
DLA-323-1 fuseiso - security update
Bulletin has no description...
Debian DLA-321-1 : wordpress security update
Various security issue have been fixed in the Debian LTS squeeze version of the Wordpress content management system. CVE-2015-5714 A cross-site scripting vulnerability when processing shortcode tags has been discovered. The issue has been fixed by not allowing unclosed HTML elements in attributes...
[SECURITY] [DLA 319-1] freetype security update
Package : freetype Version : 2.4.2-2.1+squeeze6 CVE ID : CVE-2014-9745 CVE-2014-9746 CVE-2014-9747 Debian Bug : 798619 798620 Sergey Gorbaty reported issues related to the FreeType font engine. FreeType improperly handled certain malformed font files, allowing remote attackers to cause a Denial o...
[SECURITY] [DLA 288-2] openssh regression update
Package : openssh Version : 1:5.5p1-6+squeeze7 CVE ID : CVE-2015-5600 In Debian LTS squeeze, the fix for CVE-2015-56001 in openssh 1:5.5p1-6+squeeze7 breaks authentication mechanisms that rely on the keyboard-interactive method. Thanks to Colin Watson for making aware of that. The patch fixing...
Debian DLA-317-1 : vorbis-tools security update
Various issues have been fixed in Debian LTS squeeze for package vorbis-tools. CVE-2014-9638 A crafted WAV file with number of channels set to 0 will cause oggenc to crash due to a division by zero issue. This issue has been fixed upstream by providing a fix for CVE-2014-9639. Reported upstream b...
[SECURITY] [DLA 317-1] vorbis-tools security update
Package : vorbis-tools Version : 1.4.0-1+deb6u1 CVE ID : CVE-2014-9638 CVE-2014-9639 CVE-2014-9640 CVE-2015-6749 Debian Bug : 771363 797461 776086 Various issues have been fixed in Debian LTS squeeze for package vorbis-tools. CVE-2014-9638 A crafted WAV file with number of channels set to 0 will...