CVE-1999-1411

The vulnerability CVE-1999-1411 affects the fsp package 2.71-10 on Debian GNU/Linux 2.0. During installation, an anonymous FTP user is added without administrator notification, which could automatically enable anonymous FTP on servers such as wu-ftp. Impact described as enabling anonymous FTP acc...

[SECURITY] Corrected advisory on wu-ftpd-academ buffer overflow

The previous advisory concerning wu-ftpd-academ contained an error: the md5sum given for wu-ftpd-academ2.4.2.16-12.2i386.deb was incorrect. The correct md5sum is b851adb345917a6f92e8b03f8cc97ff2. I apologize for the confusion this has caused. The complete, updated, text of the advisory follows...

[SECURITY] New version of ssh may fix buffer overflows

There has been a lot of confusion over ssh lately: some people think their systems have been hacked through ssh, although nobody has been able to produce an exploit. To avoid any possible problems we have patched ssh to fix any possible buffer overruns. We think this will stop any attack that mig...

[SECURITY] New version of fte fixes access problems

We have found that the fte package as supplied in our slink frozen and potato unstable archives does not drop its root priviliges after initializing the virtual console device. This allows all users to read and write files with root priviliges, and execute all programs as root. A new package...

[SECURITY] New versions of tcsh fixes buffer overflows

We have found that the tcsh shell had a problem with very long pathnames. When a very long path was encountered tcsh failed to check the result of getcwd in all places, which could be exploited. We recommend you upgrade your tcsh package immediately. wget url will fetch the file for you dpkg -i...

[SECURITY] New versions of apache fixes denial of services

We have received a report from Dag-Erling Coidan Smørgrav who says that the apache as distributed with Debian GNU/Linux 2.0 is vulnerable to a denial of services exploit, where repeated, identical headers can consume On^2 memory. We recommend you upgrade your apache package immediately. wget url...

[SECURITY] New versions of hylafax avoid security problem

We have received a report that the faxsurvey script that was included in former releases of hylafax would execute arbitrary commands. Please be warned that this package doesnt contain a fix, the offending script is just removed. We recommend you upgrade your hylafax-doc package immediately. dpkg ...