Debian DLA-345-1 : strongswan security update

Tobias Brunner found an authentication bypass vulnerability in strongSwan, an IKE/IPsec suite. Due to insufficient validation of its local state the server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin can be tricked into successfully concluding the authentication without...

Debian DLA-312-1 : libtorrent-rasterbar security update

The lazybdecode function in BitTorrent DHT bootstrap server bootstrap-dht allows remote attackers to execute arbitrary code via a crafted packet, related to 'improper indexing.' Note while this CVE was reported against BitTorrent DHT Bootstrapt server, the same vulnerable code is available in...

Debian DLA-117-1 : qt4-x11 security update

CVE-2011-3193 Check for buffer overflow in LookupMarkMarkPos that may cause crash in this function with certain fonts. CVE-2011-3194 Fix tiff reader to handle TIFFTAGSAMPLESPERPIXEL for grayscale images. The reader uses QImage::FormatIndexed8, but since the samples per pixel value this should be...

Debian Security Advisory DSA 2996-1 (icedove - security update)

Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: Multiple memory safety errors and use-after-frees may lead to the execution of arbitrary code or denial of service. OpenVAS Vulnerability Test $Id: deb2996.nasl 6750 2017-07-18...

[SECURITY] [DSA 2905-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2905-1 [email protected] http://www.debian.org/security/ Michael Gilbert April 15, 2014 http://www.debian.org/security/faq -...

Debian DSA-2876-1 : cups - security update

Florian Weimer of the Red Hat Product Security Team discovered multiple vulnerabilities in the pdftoopvp CUPS filter, which could result in the execution of aribitrary code if a malformed PDF file is processed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

[SECURITY] [DSA 2631-1] squid3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2630-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso February 24, 2013 http://www.debian.org/security/faq -...

Debian DSA-724-1 : phpsysinfo - design flaw

Maksymilian Arciemowicz discovered several cross site scripting issues in phpsysinfo, a PHP based host information application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-724. The tex...

Debian DSA-669-1 : php3 - several vulnerabilities

Two vulnerabilities have been discovered in php4 which also apply to the version of php3 in the stable Debian distribution. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2004-0594 The memorylimit functionality allows remote attackers to execute arbitra...

Debian DSA-670-1 : emacs20 - format string

Max Vozeler discovered several format string vulnerabilities in the movemail utility of Emacs, the well-known editor. Via connecting to a malicious POP server an attacker can execute arbitrary code under the privileges of group mail. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

[SECURITY] [DSA 672-1] New xview packages fix potential arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 672-1 [email protected] http://www.debian.org/security/ Martin Schulze February 9th, 2005 http://www.debian.org/security/faq -...

Debian DSA-649-1 : xtrlock - buffer overflow

A buffer overflow has been discovered in xtrlock, a minimal X display lock program which can be exploited by a malicious local attacker to crash the lock program and take over the desktop session. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-633-1 : bmv - insecure temporary file

Peter Samuelson, upstream maintainer of bmv, a PostScript viewer for SVGAlib, discovered that temporary files are created in an insecure fashion. A malicious local user could cause arbitrary files to be overwritten by a symlink attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-625-1 : pcal - buffer overflows

Danny Lungstrom discovered two buffer overflows in pcal, a program to generate Postscript calendars, that could lead to the execution of arbitrary code when compiling a calendar. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-626-1 : tiff - unsanitised input

Dmitry V. Levin discovered a buffer overflow in libtiff, the Tag Image File Format library for processing TIFF graphics files. Upon reading a TIFF file it is possible to crash the application, and maybe also to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-612-1 : a2ps - unsanitised input

Rudolf Polzer discovered a vulnerability in a2ps, a converter and pretty-printer for many formats to PostScript. The program did not escape shell meta characters properly which could lead to the execution of arbitrary commands as a privileged user if a2ps is installed as a printer filter...

Debian DSA-609-1 : atari800 - buffer overflows

Adam Zabrocki discovered multiple buffer overflows in atari800, an Atari emulator. In order to directly access graphics hardware, one of the affected programs is installed setuid root. A local attacker could exploit this vulnerability to gain root privileges. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-605-1 : viewcvs - settings not honored

Haris Sehic discovered several vulnerabilities in viewcvs, a utility for viewing CVS and Subversion repositories via HTTP. When exporting a repository as a tar archive the hidecvsroot and forbidden settings were not honoured enough. When upgrading the package for woody, please make a copy of your...

Debian DSA-598-1 : yardradius - buffer overflow

Max Vozeler noticed that yardradius, the YARD radius authentication and accounting server, contained a stack overflow similar to the one from radiusd which is referenced as CAN-2001-0534. This could lead to the execution of arbitrary code as root. %NASLMINLEVEL 70300 C Tenable Network Security,...

[SECURITY] [DSA 596-2] New sudo packages removes debug output

-------------------------------------------------------------------------- Debian Security Advisory DSA 596-2 [email protected] http://www.debian.org/security/ Martin Schulze November 24th, 2004 http://www.debian.org/security/faq -...