Exim alternate configuration privilege escalation vulnerability

Overview A vulnerability in the way that the Exim mail server handles configuration files may allow a local attacker to gain escalated privileges on an affected system. Description Exim is a message transfer agent MTA developed at the University of Cambridge for use on Unix systems connected to t...

Debian Security Advisory DSA 2061-1 (samba)

The remote host is missing an update to samba announced via advisory DSA 2061-1. OpenVAS Vulnerability Test $Id: deb20611.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2061-1 samba Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

DSA-2061-1 samba - arbitrary code execution

Bulletin has no description...

flash-plugin: multiple security flaws (APSB10-14)

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service memory corruption or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-2160, CVE-2010-2165, CVE-2010-2166,...

IT-Grundschutz M4.026: Regelmäßiger Sicherheitscheck des Unix-Systems

IT-Grundschutz M4.026: Regelmäßiger Sicherheitscheck des Unix-Systems. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94198 Diese Prüfung bezieht sich auf die 10...

IT-Grundschutz M4.026: Regelmäßiger Sicherheitscheck des Unix-Systems

IT-Grundschutz M4.026: Regelmäßiger Sicherheitscheck des Unix-Systems. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94198 Diese Prüfung bezieht sich auf die 11...

IT-Grundschutz M4.026: Regelmäßiger Sicherheitscheck des Unix-Systems

IT-Grundschutz M4.026: Regelmäßiger Sicherheitscheck des Unix-Systems. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94198 Diese Prüfung bezieht sich auf die 11...

PDF JBIG2 invalid free()

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of invalid data...

Debian Security Advisory DSA 1908-1 (samba)

The remote host is missing an update to samba announced via advisory DSA 1908-1. OpenVAS Vulnerability Test $Id: deb19081.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1908-1 samba Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

DSA-1908-1 samba - several vulnerabilities

Bulletin has no description...

deprecate MD2 in SSL cert validation (Kaminsky)

The Network Security Services NSS library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash...

Debian DSA-1811-1 : cups, cupsys - null ptr dereference

Anibal Sacco discovered that cups, a general printing system for UNIX systems, suffers from NULL pointer dereference because of its handling of two consecutive IPP packets with certain tag attributes that are treated as IPPTAGUNSUPPORTED tags. This allows unauthenticated attackers to perform deni...

security flaw

Multiple unspecified vulnerabilities in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0 allow remote attackers to execute arbitrary code via unknown vectors related to "input validation errors."...

ruby: Memory allocation failure in Ruby regex engine (remotely exploitable DoS)

The regular expression engine regex.c in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service infinite loop and crash via multiple long requests to a Ruby socket, related to memory allocation failure...

DEBIAN-CVE-2008-4609

The TCP implementation in 1 Linux, 2 platforms based on BSD Unix, 3 Microsoft Windows, 4 Cisco products, and probably other operating systems allows remote attackers to cause a denial of service connection queue exhaustion via multiple vectors that manipulate information in the TCP state table, a...

Mozilla XBM decoder information disclosure

The XBM decoder in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to read uninitialized memory, and possibly obtain sensitive information in opportunistic circumstances, via a crafted XBM image file...

Postfix local privilege escalation via hardlinked symlinks

Summary: Solaris and Linux file system behavior has changed over time, breaking one of the assumptions in Postfix. See below for a description of the behavior and how it disagrees with standards. Postfix is not affected on systems with standard POSIX, X/Open file system behavior, i.e. BSD, AIX,...

Untrusted applet and application XSLT processing privilege escalation

Unspecified vulnerability in Sun Java Runtime Environment JRE and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.216 and earlier allows remote attackers to cause a denial of service JRE crash and possibly execute arbitrary code via unknown vectors related to XSLT transform...

pcre integer overflow

Integer overflow in Perl-Compatible Regular Expression PCRE library before 6.7 might allow context-dependent attackers to execute arbitrary code via a regular expression that involves large 1 min, 2 max, or 3 duplength values that cause an incorrect length calculation and trigger a buffer overflo...

tomcat handling of cookies

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...