Debian Security Advisory DSA 3363-1 (owncloud-client - security update)

Johannes Kliemann discovered a vulnerability in ownCloud Desktop Client, the client-side of the ownCloud file sharing services. The vulnerability allows man-in-the-middle attacks in situations where the server is using self-signed certificates and the connection is already established. If the use...

Debian Security Advisory DSA 3353-1 (openslp-dfsg - security update)

Qinghao Tang of QIHU 360 discovered a double free flaw in OpenSLP, an implementation of the IETF Service Location Protocol. This could allow remote attackers to cause a denial of service crash. OpenVAS Vulnerability Test $Id: deb3353.nasl 7739 2017-11-13 05:04:18Z teissa $ Auto-generated from...

Debian DSA-3340-1 : zendframework - security update

Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML External Entity attack via crafted XML data. %NASLMINLEVEL 70300 C...

Debian DLA-296-1 : extplorer security update

Multiple cross-site scripting XSS vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has...

Debian Security Advisory DSA 3340-1 (zendframework - security update)

Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML External Entity attack via crafted XML data. OpenVAS Vulnerability...

Debian Security Advisory DSA 3334-1 (gnutls28 - security update)

Kurt Roeckx discovered that decoding a specific certificate with very long DistinguishedName DN entries leads to double free. A remote attacker can take advantage of this flaw by creating a specially crafted certificate that, when processed by an application compiled against GnuTLS, could cause t...

The vulnerability of the Debian GNU/Linux operating system, which allows a perpetrator to gain access to protected information

The vulnerability of the bufferslowrealign function in the HAProxy package for the Debian GNU/Linux operating system arises due to overflow in the buffer in dynamic memory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to protected information throu...

Debian Security Advisory DSA 3327-1 (squid3 - security update)

Alex Rousskov of The Measurement Factory discovered that Squid3, a fully featured web proxy cache, does not correctly handle CONNECT method peer responses when configured with cachepeer and operating on explicit proxy traffic. This could allow remote clients to gain unrestricted access through a...

The vulnerability of the Debian GNU/Linux operating system allows a perpetrator to execute arbitrary code or cause service interruptions.

The vulnerability of the WriteProlog function in the printing subsystem of the Debian GNU/Linux operating system is caused by a buffer overflow in the dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure by using a specially crafted...

Debian Security Advisory DSA 3319-1 (bind9 - security update)

Jonathan Foote discovered that the BIND DNS server does not properly handle TKEY queries. A remote attacker can take advantage of this flaw to mount a denial of service via a specially crafted query triggering an assertion failure and causing BIND to exit. OpenVAS Vulnerability Test $Id:...

Debian Security Advisory DSA 3316-1 (openjdk-7 - security update)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure, denial of service or insecure cryptography. OpenVAS Vulnerability Test $Id: deb3316.nasl 660...

Debian DSA-3309-1 : tidy - security update

Fernando Munoz discovered that invalid HTML input passed to tidy, an HTML syntax checker and reformatter, could trigger a buffer overflow. This could allow remote attackers to cause a denial of service crash or potentially execute arbitrary code. Geoff McLane also discovered that a similar issue...

Oracle Java SE CVE-2015-2590 Remote Security Vulnerability

Description Oracle Java SE is prone to a remote security vulnerability. The vulnerability can be exploited over multiple protocols. This issue affects the 'Libraries' sub-component. This vulnerability affects the following supported versions: Java SE 6u95, Java SE 7u80, Java SE 8u45, Java SE...

The vulnerability of the Debian GNU\Linux operating system, which allows a perpetrator to trigger a service failure.

The vulnerability of the Debian GNU\Linux operating system is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker, operating remotely, to cause a service failure by closing the SSL session at a certain time...

Debian Security Advisory DSA 3307-1 (pdns-recursor - security update)

Toshifumi Sakaguchi discovered that the patch applied to pdns-recursor, a recursive DNS server, fixing CVE-2015-1868 , was insufficient in some cases, allowing remote attackers to cause a denial of service service-affecting CPU spikes and in some cases a crash. OpenVAS Vulnerability Test $Id:...

Debian Security Advisory DSA 3304-1 (bind9 - security update)

Breno Silveira Soares of Servico Federal de Processamento de Dados SERPRO discovered that the BIND DNS server is prone to a denial of service vulnerability. A remote attacker who can cause a validating resolver to query a zone containing specifically constructed contents can cause the resolver to...

Debian Security Advisory DSA 3300-1 (iceweasel - security update)

Multiple security issues have been found in Iceweasel, Debian OpenVAS Vulnerability Test $Id: deb3300.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3300-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2015 Greenbone Networks Gm...

Koha 3.20.1 - Multiple SQL Injections

Exploit Title: Koha Open Source ILS - Unauthenticated SQL Injection in OPAC Google Dork: Date: 25/06/2015 Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research [email protected] Vendor Homepage: koha-community.or...

Debian Security Advisory DSA 3289-1 (p7zip - security update)

Alexander Cherepanov discovered that p7zip is susceptible to a directory traversal vulnerability. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write files outside the current...

Debian Security Advisory DSA 3283-1 (cups - security update)

It was discovered that CUPS, the Common UNIX Printing System, is vulnerable to a remotely triggerable privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on the CUPS server. OpenVAS Vulnerability Test $Id: deb3283.nasl 6609 2017-07-07 12:05:59Z...