Debian Security Advisory DSA 3161-1 (dbus - security update)

Simon McVittie discovered a local denial of service flaw in dbus, an asynchronous inter-process communication system. On systems with systemd-style service activation, dbus-daemon does not prevent forged ActivationFailure messages from non-root processes. A malicious local user could use this fla...

Debian Security Advisory DSA 3145-1 (privoxy - security update)

Multiple vulnerabilities were discovered in Privoxy, a privacy enhancing HTTP proxy, which might result in denial of service. OpenVAS Vulnerability Test $Id: deb3145.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3145-1 using nvtgen 1.0 Script version: 1.0 Author:...

Debian Security Advisory DSA 3144-1 (openjdk-7 - security update)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, information disclosure or denial of service. OpenVAS Vulnerability Test $Id: deb3144.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from...

Debian Security Advisory DSA 3139-1 (squid - security update)

Matthew Daley discovered that squid, a web proxy cache, does not properly perform input validation when parsing requests. A remote attacker could use this flaw to mount a denial of service attack, by sending specially crafted Range requests. OpenVAS Vulnerability Test $Id: deb3139.nasl 6609...

Debian Security Advisory DSA 3137-1 (websvn - security update)

James Clawson discovered that websvn, a web viewer for Subversion repositories, would follow symlinks in a repository when presenting a file for download. An attacker with repository write access could thereby access any file on disk readable by the user the webserver runs as. OpenVAS Vulnerabili...

Debian Security Advisory DSA 3135-1 (mysql-5.5 - security update)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.41. Please see the MySQL 5.5 Release Notes and Oracle OpenVAS Vulnerability Test $Id: deb3135.nasl 6609 2017-07-07 12:05:59Z cfischer $...

Debian Security Advisory DSA 3129-1 (rpm - security update)

Two vulnerabilities have been discovered in the RPM package manager. CVE-2013-6435 Florian Weimer discovered a race condition in package signature validation. CVE-2014-8118 Florian Weimer discovered an integer overflow in parsing CPIO headers which might result in the execution of arbitrary code...

Debian Security Advisory DSA 3127-1 (iceweasel - security update)

Multiple security issues have been found in Iceweasel, Debian OpenVAS Vulnerability Test $Id: deb3127.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3127-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2015 Greenbone Networks Gm...

Debian Security Advisory DSA 3126-1 (php5 - security update)

It was discovered that libmagic as used by PHP, would trigger an out of bounds memory access when trying to identify a crafted file. Additionally, this updates fixes a potential dependency loop in dpkg trigger handling. OpenVAS Vulnerability Test $Id: deb3126.nasl 8972 2018-02-28 07:02:10Z cfisch...

Debian Security Advisory DSA 3124-1 (otrs2 - security update)

Thorsten Eckel of Znuny GMBH and Remo Staeuble of InfoGuard discovered a privilege escalation vulnerability in otrs2, the Open Ticket Request System. An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is...

Debian DSA-3122-1 : curl - security update

Andrey Labunets of Facebook discovered that cURL, an URL transfer library, fails to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl to access a specially crafted URL via an HTTP proxy could use this flaw to do additional requests in...

Debian Security Advisory DSA 3122-1 (curl - security update)

Andrey Labunets of Facebook discovered that cURL, an URL transfer library, fails to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl to access a specially crafted URL via an HTTP proxy could use this flaw to do additional requests in...

Debian DSA-3120-1 : mantis - security update

Multiple security issues have been found in the Mantis bug tracking system, which may result in phishing, information disclosure, CAPTCHA bypass, SQL injection, cross-site scripting or the execution of arbitrary PHP code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

Debian Security Advisory DSA 3114-1 (mime-support - security update)

Timothy D. Morgan discovered that run-mailcap, an utility to execute programs via entries in the mailcap file, is prone to shell command injection via shell meta-characters in filenames. In specific scenarios this flaw could allow an attacker to remotely execute arbitrary code. OpenVAS...

Debian Security Advisory DSA 3113-1 (unzip - security update)

Michele Spagnuolo of the Google Security Team discovered that unzip, an extraction utility for archives compressed in .zip format, is affected by heap-based buffer overflows within the CRC32 verification function CVE-2014-8139, the testcompreb function CVE-2014-8140 and the getZip64Data function...

Debian Security Advisory DSA 3111-1 (cpio - security update)

Michal Zalewski discovered an out of bounds write issue in cpio, a tool for creating and extracting cpio archive files. In the process of fixing that issue, the cpio developers found and fixed additional range checking and null pointer dereference issues. OpenVAS Vulnerability Test $Id:...

Debian DSA-3098-1 : graphviz - security update

Joshua Rogers discovered a format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz, a rich set of graph drawing tools. An attacker could use this flaw to cause graphviz to crash or possibly execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

Debian Security Advisory DSA 3102-1 (libyaml - security update)

Jonathan Gray and Stanislaw Pitucha found an assertion failure in the way wrapped strings are parsed in LibYAML, a fast YAML 1.1 parser and emitter library. An attacker able to load specially crafted YAML input into an application using libyaml could cause the application to crash. OpenVAS...

Debian Security Advisory DSA 3083-1 (mutt - security update)

A flaw was discovered in mutt, a text-based mailreader. A specially crafted mail header could cause mutt to crash, leading to a denial of service condition. OpenVAS Vulnerability Test $Id: deb3083.nasl 6769 2017-07-20 09:56:33Z teissa $ Auto-generated from advisory DSA 3083-1 using nvtgen 1.0...

Debian Security Advisory DSA 3081-1 (libvncserver - security update)

Several vulnerabilities have been discovered in libvncserver, a library to implement VNC server functionality. These vulnerabilities might result in the execution of arbitrary code or denial of service in both the client and the server side. OpenVAS Vulnerability Test $Id: deb3081.nasl 6995...