Debian DLA-24-1 : poppler security update

It was discovered that poppler did return program execution to the libjpeg library under error conditions, which is not expected by the library and results in application crash and possibly code execution. NOTE: Tenable Network Security has extracted the preceding description block directly from...

Debian Security Advisory DSA 3201-1 (iceweasel - security update)

Multiple security issues have been found in Iceweasel, Debian OpenVAS Vulnerability Test $Id: deb3201.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3201-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2015 Greenbone Networks Gm...

Debian Security Advisory DSA 3190-1 (putty - security update)

Patrick Coleman discovered that the Putty SSH client failed to wipe out unused sensitive memory. In addition Florent Daigniere discovered that exponential values in Diffie Hellman exchanges were insufficienty restricted. OpenVAS Vulnerability Test $Id: deb3190.nasl 6609 2017-07-07 12:05:59Z...

Debian Security Advisory DSA 3188-1 (freetype - security update)

Mateusz Jurczyk discovered multiple vulnerabilities in Freetype. Opening malformed fonts may result in denial of service or the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb3188.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3188-1 using nvtgen 1.0...

Debian Security Advisory DSA 3186-1 (nss - security update)

It was discovered that the Mozilla Network Security Service library nss incorrectly handled certain ASN.1 lengths. A remote attacker could possibly use this issue to perform a data-smuggling attack. OpenVAS Vulnerability Test $Id: deb3186.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated...

Debian Security Advisory DSA 3179-1 (icedove - security update)

Multiple security issues have been found in Icedove, Debian OpenVAS Vulnerability Test $Id: deb3179.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3179-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2015 Greenbone Networks GmbH...

Debian Security Advisory DSA 3178-1 (unace - security update)

Jakub Wilk discovered that unace, an utility to extract, test and view .ace archives, contained an integer overflow leading to a buffer overflow. If a user or automated system were tricked into processing a specially crafted ace archive, an attacker could cause a denial of service application cra...

Debian Security Advisory DSA 3172-1 (cups - security update)

Peter De Wachter discovered that CUPS, the Common UNIX Printing System, did not correctly parse compressed raster files. By submitting a specially crafted raster file, a remote attacker could use this vulnerability to trigger a buffer overflow. OpenVAS Vulnerability Test $Id: deb3172.nasl 6609...

Debian Security Advisory DSA 3165-1 (xdg-utils - security update)

Jiri Horner discovered a way to cause xdg-open, a tool that automatically opens URLs in a user OpenVAS Vulnerability Test $Id: deb3165.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3165-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright:...

Debian Security Advisory DSA 3160-1 (xorg-server - security update)

Olivier Fourdan discovered that missing input validation in the Xserver OpenVAS Vulnerability Test $Id: deb3160.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3160-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2015 Greenbone...

Debian Security Advisory DSA 3161-1 (dbus - security update)

Simon McVittie discovered a local denial of service flaw in dbus, an asynchronous inter-process communication system. On systems with systemd-style service activation, dbus-daemon does not prevent forged ActivationFailure messages from non-root processes. A malicious local user could use this fla...

Debian Security Advisory DSA 3145-1 (privoxy - security update)

Multiple vulnerabilities were discovered in Privoxy, a privacy enhancing HTTP proxy, which might result in denial of service. OpenVAS Vulnerability Test $Id: deb3145.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3145-1 using nvtgen 1.0 Script version: 1.0 Author:...

Debian Security Advisory DSA 3144-1 (openjdk-7 - security update)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, information disclosure or denial of service. OpenVAS Vulnerability Test $Id: deb3144.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from...

Debian Security Advisory DSA 3139-1 (squid - security update)

Matthew Daley discovered that squid, a web proxy cache, does not properly perform input validation when parsing requests. A remote attacker could use this flaw to mount a denial of service attack, by sending specially crafted Range requests. OpenVAS Vulnerability Test $Id: deb3139.nasl 6609...

Debian Security Advisory DSA 3137-1 (websvn - security update)

James Clawson discovered that websvn, a web viewer for Subversion repositories, would follow symlinks in a repository when presenting a file for download. An attacker with repository write access could thereby access any file on disk readable by the user the webserver runs as. OpenVAS Vulnerabili...

Debian Security Advisory DSA 3135-1 (mysql-5.5 - security update)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.41. Please see the MySQL 5.5 Release Notes and Oracle OpenVAS Vulnerability Test $Id: deb3135.nasl 6609 2017-07-07 12:05:59Z cfischer $...

Debian Security Advisory DSA 3129-1 (rpm - security update)

Two vulnerabilities have been discovered in the RPM package manager. CVE-2013-6435 Florian Weimer discovered a race condition in package signature validation. CVE-2014-8118 Florian Weimer discovered an integer overflow in parsing CPIO headers which might result in the execution of arbitrary code...

Debian Security Advisory DSA 3127-1 (iceweasel - security update)

Multiple security issues have been found in Iceweasel, Debian OpenVAS Vulnerability Test $Id: deb3127.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3127-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2015 Greenbone Networks Gm...

Debian Security Advisory DSA 3126-1 (php5 - security update)

It was discovered that libmagic as used by PHP, would trigger an out of bounds memory access when trying to identify a crafted file. Additionally, this updates fixes a potential dependency loop in dpkg trigger handling. OpenVAS Vulnerability Test $Id: deb3126.nasl 8972 2018-02-28 07:02:10Z cfisch...

Debian Security Advisory DSA 3124-1 (otrs2 - security update)

Thorsten Eckel of Znuny GMBH and Remo Staeuble of InfoGuard discovered a privilege escalation vulnerability in otrs2, the Open Ticket Request System. An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is...