[DLA 40-1] cacti security update

Package : cacti Version : 0.8.7g-1+squeeze5 CVE ID : CVE-2014-5025 CVE-2014-5026 CVE-2014-5261 CVE-2014-5262 Debian Bug : 755032 Multiple security issues cross-site scripting, missing input sanitizing and SQL injection have been discovered in Cacti, a web interface for graphing of monitoring...

[DLA 39-1] gpgme1.0 security update

Package : gpgme1.0 Version : 1.2.0-1.2+deb6u1 CVE ID : CVE-2014-3564 Debian Bug : 756651 Tomas Trnka discovered a heap-based buffer overflow within the gpgsm status handler of GPGME, a library designed to make access to GnuPG easier for applications. An attacker could use this issue to cause an...

CVE-2014-5203

wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data...

[SECURITY] [DSA 3005-1] gpgme1.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3005-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso August 14, 2014 http://www.debian.org/security/faq -...

[DLA 35-1] lzo2 security update

Package : lzo2 Version : 2.03-2+deb6u1 CVE ID : CVE-2014-4607 Debian Bug : 752861 Fix integer overflow in lzo1xdecompresssafe allowing denial of service or code execution...

[SECURITY] [DSA 2995-1] lzo2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2995-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso August 03, 2014 http://www.debian.org/security/faq -...

[DLA 28-1] augeas security update

Package : augeas Version : 0.7.2-1+deb6u1 CVE ID : CVE-2012-0786 CVE-2012-0787 CVE-2013-6412 Debian Bug : 731111 731132 Multiple race conditions were discovered in augeas when saving configuration files which expose it to symlink attacks. Write access to the directory where the configuration file...

[DLA 26-1] python-scipy security update

Package : python-scipy Version : 0.7.2+dfsg1-1+deb6u1 CVE ID : CVE-2013-4251 Debian Bug : 726093 It was discovered that python-scipy did not correctly handle temporary directories, which may allow arbitrary code execution...

cacti security update

Package : cacti Version : 0.8.7g-1+squeeze4 CVE ID : CVE-2014-2326 CVE-2014-2327 CVE-2014-2328 CVE-2014-2708 CVE-2014-2709 CVE-2014-4002 Debian Bug : 742768 743565 752573 Multiple security issues cross-site scripting, cross-site request forgery, SQL injections, missing input sanitising have been...

tiff security update

Package : tiff Version : 3.9.4-5+squeeze11 CVE ID : CVE-2013-4243 Debian Bug : 742917 Murray McAllister discovered a heap-based buffer overflow in the gif2tiff command line tool. Executing gif2tiff on a malicious tiff image could result in arbitrary code execution...

gnupg security update

Package : gnupg Version : 1.4.10-4+squeeze5 CVE ID : CVE-2014-4617 Debian Bug : 752497 Jean-Rene Reinhard, Olivier Levillain and Florian Maury reported that GnuPG, the GNU Privacy Guard, did not properly parse certain garbled compressed data packets. A remote attacker could use this flaw to mount...

lxml security update

Package : lxml Version : 2.2.8-2+deb6u1 CVE ID : CVE-2014-3146 Debian Bug : 746812 It was discovered that cleanhtml function of lxml pythonic bindings for the libxml2 and libxslt libraries performed insufficient sanitisation for some non-printable characters. This could lead to cross-site scripti...

[SECURITY] [DSA 2965-1] tiff security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2965-1 [email protected] http://www.debian.org/security/ Michael Gilbert June 22, 2014 http://www.debian.org/security/faq -...

CVE-2014-4021

Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors...

CVE-2014-4038

ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to 1 rtaserrd/diagsupport.c and /tmp/getdtfiles, 2 scripts/ppc64diagmkrsrc and /tmp/diagSEsnap/snapH.tar.gz, or 3 lpd/test/lpdelatest.sh and /var/tmp/ras...

scheme48 security update

Package : scheme48 Version : 1.8+dfsg-1+deb6u1 CVE ID : CVE-2014-4150 Debian Bug : 748766 The function scheme48-send-definition in cmuscheme48.el blindly overwrites the file /tmp/s48lose.tmp prior to sending it to the inferior scheme process. This action will blindly overwrite files the user has...

dovecot security update

Package : dovecot Version : 1:1.2.15-7+deb6u1 CVE ID : CVE-2014-3430 Debian Bug : 747549 It was discovered that the Dovecot email server is vulnerable to a denial of service attack against imap/pop3-login processes due to incorrect handling of the closure of inactive SSL/TLS connections...

CVE-2014-3944

The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via unspecified vectors...

CVE-2014-3421

lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/gnus.face.ppm temporary file...

[SECURITY] [DSA 2919-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2919-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso May 03, 2014 http://www.debian.org/security/faq -...