[SECURITY] [DLA 124-1] unzip security update

Package : unzip Version : 6.0-4+deb6u1 CVE ID : CVE-2014-8139 CVE-2014-8140 CVE-2014-8141 Debian Bug : 773722 Michele Spagnuolo of the Google Security Team discovered that unzip, an extraction utility for archives compressed in .zip format, is affected by heap-based buffer overflows within the...

CVE-2014-8141

Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command...

[SECURITY] [DSA 3112-1] sox security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3112-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso December 23, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 119-1] subversion security update

Package : subversion Version : 1.6.12dfsg-7+deb6u1 CVE ID : CVE-2014-3580 Debian Bug : 773263 Evgeny Kotkov discovered a NULL pointer dereference while processing REPORT requests in moddavsvn, the Subversion component which is used to serve repositories with the Apache web server. A remote attack...

[SECURITY] [DLA 116-1] ntp security update

Package : ntp Version : 4.2.6.p2+dfsg-1+deb6u1 CVE ID : CVE-2014-9293 CVE-2014-9294 CVE-2014-9295 CVE-2014-9296 Debian Bug : 773576 Several vulnerabilities were discovered in the ntp package, an implementation of the Network Time Protocol. CVE-2014-9293 ntpd generated a weak key for its internal...

[SECURITY] [DSA 3106-1] jasper security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3106-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso December 20, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 110-1] libyaml security update

Package : libyaml Version : 0.1.3-1+deb6u5 CVE ID : CVE-2014-9130 Debian Bug : 771366 Jonathan Gray and Stanislaw Pitucha found an assertion failure in the way wrapped strings are parsed in LibYAML, a fast YAML 1.1 parser and emitter library. An attacker able to load specially crafted YAML input...

[SECURITY] [DLA 109-1] libyaml-libyaml-perl security update

Package : libyaml-libyaml-perl Version : 0.33-1+squeeze4 CVE ID : CVE-2014-9130 Debian Bug : 771365 Jonathan Gray and Stanislaw Pitucha found an assertion failure in the way wrapped strings are parsed in LibYAML, a fast YAML 1.1 parser and emitter library. An attacker able to load specially craft...

[SECURITY] [DLA 105-1] graphviz security update

Package : graphviz Version : 2.26.3-5+squeeze3 CVE ID : CVE-2014-9157 Debian Bug : 772648 Joshua Rogers discovered a format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz, a rich set of graph drawing tools. An attacker could use this flaw to cause graphviz to crash ...

[SECURITY] [DLA 95-1] clamav security update

this was initially sent on 2014-11-27, but did not reach the list due to a mistake on my side Package : clamav Version : 0.98.1+dfsg-1+deb6u4 CVE ID : CVE-2014-9050 CVE-2013-6497 Debian Bug : 770985 Two bugs were discovered in clamav and are fixed by this release. One issue is in clamscan, the...

[SECURITY] [DSA 3082-1] flac security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3082-1 [email protected] http://www.debian.org/security/ Sebastien Delafond November 30, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3065-1] libxml-security-java security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3065-1 [email protected] http://www.debian.org/security/ Sebastien Delafond November 06, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3058-1] torque security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3058-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 27, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3063-1] quassel security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3063-1 [email protected] http://www.debian.org/security/ Luciano Bello November 02, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 79-1] dokuwiki security update

Package : dokuwiki Version : 0.0.20091225c-10+squeeze3 CVE ID : CVE-2014-8763 CVE-2014-8764 Debian Bug : 766545 This fixes a possibility of bypasswing the wiki authentication when an Active Directory is used for LDAP authentication. These two CVE are almost the same, one apparently being a supers...

[SECURITY] [DSA 3058-1] torque security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3058-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 27, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 74-1] ppp security update

Package : ppp Version : 2.4.5-4+deb6u1 CVE ID : CVE-2014-3158 Debian Bug : http://bugs.debian.org/762789 This updates fixes a potential integer overflow in option parsing. A user in the group "dip" could provide a specially crafted configuration file of more than 2G and generate an integer...

[SECURITY] [DSA 3054-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3054-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 20, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3017-1] php-cas security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3017-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst September 2, 2014 http://www.debian.org/security/faq -...

[DLA 42-1] live-config security update

Package : live-config Version : 2.0.15-1.1+deb6u1 Debian Bug : 741678 A vulnerability against Debian Live, the live systems project, was reported. The default, the live images include a SSH server allowing for log in with default user and password. This fix set PasswordAuthentication in...