Debian DSA-3441-1 : perl - security update

David Golden of MongoDB discovered that File::Spec::canonpath in Perl returned untainted strings even if passed tainted input. This defect undermines taint propagation, which is sometimes used to ensure that unvalidated user input does not reach sensitive code. The oldstable distribution wheezy i...

Debian Security Advisory DSA 3436-1 (openssl - security update)

Karthikeyan Bhargavan and Gaetan Leurent at INRIA discovered a flaw in the TLS 1.2 protocol which could allow the MD5 hash function to be used for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker could exploit this flaw to conduct...

Debian DSA-3435-1 : git - security update

Blake Burkhart discovered that the Git git-remote-ext helper incorrectly handled recursive clones of git repositories. A remote attacker could possibly use this issue to execute arbitary code by injecting commands via crafted URLs. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

R.I.P Ian Murdock, Founder of Debian Linux, Dies at 42

Ian Murdock, the founder the Debian Linux operating system and the creator of apt-get, has passed away. Yes, it is very sad to announce that Ian Murdock is not between us. His death has touched the entire software community. He was just 42. The announcement of Murdock death came out via a blog po...

Debian DSA-3420-1 : bind9 - security update

It was discovered that the BIND DNS server does not properly handle the parsing of incoming responses, allowing some records with an incorrect class to be accepted by BIND instead of being rejected as malformed. This can trigger a REQUIRE assertion failure when those records are subsequently...

Debian Security Advisory DSA 3421-1 (grub2 - security update)

Hector Marco and Ismael Ripoll, from Cybersecurity UPV Research Group, found an integer underflow vulnerability in Grub2, a popular bootloader. A local attacker can bypass the Grub2 authentication by inserting a crafted input as username or password. More information:...

Debian Security Advisory DSA 3419-1 (cups-filters - security update)

Adam Chester discovered that missing input sanitising in the foomatic-rip print filter might result in the execution of arbitrary commands. OpenVAS Vulnerability Test $Id: deb3419.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3419-1 using nvtgen 1.0 Script version: 1....

Debian Security Advisory DSA 3412-1 (redis - security update)

Luca Bruno discovered an integer overflow flaw leading to a stack-based buffer overflow in redis, a persistent key-value database. A remote attacker can use this flaw to cause a denial of service application crash. OpenVAS Vulnerability Test $Id: deb3412.nasl 6609 2017-07-07 12:05:59Z cfischer $...

Debian DSA-3405-1 : smokeping - security update

Tero Marttila discovered that the Debian packaging for smokeping installed it in such a way that the CGI implementation of Apache httpd modcgi passed additional arguments to the smokepingcgi program, potentially leading to arbitrary code execution in response to crafted HTTP requests. %NASLMINLEV...

Debian Security Advisory DSA 3405-1 (smokeping - security update)

Tero Marttila discovered that the Debian packaging for smokeping installed it in such a way that the CGI implementation of Apache httpd modcgi passed additional arguments to the smokepingcgi program, potentially leading to arbitrary code execution in response to crafted HTTP requests. OpenVAS...

Debian Security Advisory DSA 3400-1 (lxc - security update)

Roman Fiedler discovered a directory traversal flaw in LXC, the Linux Containers userspace tools. A local attacker with access to a LXC container could exploit this flaw to run programs inside the container that are not confined by AppArmor or expose unintended files in the host to the container...

Debian Security Advisory DSA 3398-1 (strongswan - security update)

Tobias Brunner found an authentication bypass vulnerability in strongSwan, an IKE/IPsec suite. Due to insufficient validation of its local state the server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin can be tricked into successfully concluding the authentication without...

Debian Security Advisory DSA 3392-1 (freeimage - security update)

Pengsu Cheng discovered that FreeImage, a library for graphic image formats, contained multiple integer underflows that could lead to a denial of service: remote attackers were able to trigger a crash by supplying a specially crafted image. OpenVAS Vulnerability Test $Id: deb3392.nasl 6609...

Debian Security Advisory DSA 3385-1 (mariadb-10.0 - security update)

Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.22. Please see the MariaDB 10.0 Release Notes for further details: https://mariadb.com/kb/en/mariadb/mariadb-10021-release-notes...

CVE-2008-5394

/bin/login in shadow 4.0.18.1 in Debian GNU/Linux, and probably other Linux distributions, allows local users in the utmp group to overwrite arbitrary files via a symlink attack on a temporary file referenced in a line aka utline field in a utmp entry...

Vulnerabilities in the Debian GNU/Linux operating system that allow attackers to compromise security of information

The multiple vulnerabilities of the ibfillisqlda function in the DBD-Firebird database driver for the Debian GNU/Linux operating system are caused by a buffer overflow in the stack. Exploitation of these vulnerabilities could allow an attacker to compromise security measures...

Debian Security Advisory DSA 3384-1 (virtualbox - security update)

Two vulnerabilities have been discovered in VirtualBox, an x86 virtualisation solution. OpenVAS Vulnerability Test $Id: deb3384.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3384-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c...

Debian Security Advisory DSA 3370-1 (freetype - security update)

It was discovered that FreeType did not properly handle some malformed inputs. This could allow remote attackers to cause a denial of service crash via crafted font files. OpenVAS Vulnerability Test $Id: deb3370.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3370-1 usi...

Debian DSA-3367-1 : wireshark - security update

Multiple vulnerabilities were discovered in the dissectors/parsers for ZigBee, GSM RLC/MAC, WaveAgent, ptvcursor, OpenFlow, WCCP and in internal functions which could result in denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian Security Advisory DSA 3368-1 (cyrus-sasl2 - security update)

It was discovered that cyrus-sasl2, a library implementing the Simple Authentication and Security Layer, does not properly handle certain invalid password salts. A remote attacker can take advantage of this flaw to cause a denial of service. OpenVAS Vulnerability Test $Id: deb3368.nasl 6609...