[SECURITY] [DSA-129-1] in.uucpd string truncation problem

Package: uucp Vulnerability: remote dos Debian-specific: yes We have received reports that in.uucpd, an authentication agent in the uucp package, does not properly terminate certain long input strings. This has been corrected in uucp package version 1.06.1-11potato3 for Debian 2.2 potato and in...

[SECURITY] [DSA-128-1] sudo buffer overflow

Package : sudo Problem type : buffer overflow Debian-specific: no fc found a buffer overflow in the variable expansion code used by sudo for its prompt. Since sudo is necessarily installed suid root a local user can use this to gain root access. This has been fixed in version 1.6.2-2.2 and we...

[SECURITY] [DSA 125-1] New analog packages fix cross-site scripting vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 125-1 [email protected] http://www.debian.org/security/ Martin Schulze March 28th, 2002 - -------------------------------------------------------------------------- Package : analog...

[SECURITY] [DSA 125-1] New analog packages fix cross-site scripting vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 125-1 [email protected] http://www.debian.org/security/ Martin Schulze March 28th, 2002 - -------------------------------------------------------------------------- Package : analog...

[SECURITY] [DSA 124-1] New mtr packages fix buffer overflow

-------------------------------------------------------------------------- Debian Security Advisory DSA 124-1 [email protected] http://www.debian.org/security/ Martin Schulze March 26th, 2002 - -------------------------------------------------------------------------- Package : mtr...

[SECURITY] [DSA-123-1] listar buffer overflow

Package : listar Problem type : remote exploit Debian-specific: no Janusz Niewiadomski and Wojciech Purczynski reported a buffer overflow in the addressmatch of listar a listserv style mailing-list manager. This has been fixed in version 0.129a-2.potato1. wget url will fetch the file for you dpkg...

[SECURITY] [DSA 122-1] New zlib & other packages fix buffer overflow

Package : zlib, various Vulnerability : malloc error double free Problem-Type : potential remote root Debian-specific: no The compression library zlib has a flaw in which it attempts to free memory more than once under certain conditions. This can possibly be exploited to run arbitrary code in a...

[SECURITY] [DSA 117-1] New CVS packages fix potential security problems

-------------------------------------------------------------------------- Debian Security Advisory DSA 117-1 [email protected] http://www.debian.org/security/ Martin Schulze March 5th, 2002 - -------------------------------------------------------------------------- Package : cvs Vulnerability...

[SECURITY] [DSA 114-1] New GNUJSP packages fix directory and script source disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 114-1 [email protected] http://www.debian.org/security/ Martin Schulze February 21th, 2002 -...

[SECURITY] [DSA 114-1] New GNUJSP packages fix directory and script source disclosure

-------------------------------------------------------------------------- Debian Security Advisory DSA 114-1 [email protected] http://www.debian.org/security/ Martin Schulze February 21th, 2002 - -------------------------------------------------------------------------- Package : gnujsp...

[SECURITY] [DSA 109-1] New Faq-O-Matic packages fix cross-site scripting vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 109-1 [email protected] http://www.debian.org/security/ Martin Schulze February 13th, 2002 - -------------------------------------------------------------------------- Package : faqomatic...

[SECURITY] [DSA 107-1] New jgroff packages fix printf format problem

-------------------------------------------------------------------------- Debian Security Advisory DSA 107-1 [email protected] http://www.debian.org/security/ Martin Schulze January 30th, 2002 - -------------------------------------------------------------------------- Package : jgroff...

[SECURITY] [DSA-089-2] updated i386 icecast-server package

Package : icecast-server Problem type : remote exploit and others Debian-specific: no In Debian Security Advisory DSA-089-1 we reported that icecast-server has several security problems. For details please see that advisory. The i386 package mention in the DSA-089-1 advisory was incorrectly...

[SECURITY] [DSA-105-1] enscript creates temporary files insecurely

Package : enscript Problem type : insecure temporary files Debian-specific: no The version of enscript a tool to convert ASCII text to different formats has been found to create temporary files insecurely. This has been fixed in version 1.6.2-4.1 . wget url will fetch the file for you dpkg -i...

[SECURITY] [DSA-103-1] glibc buffer overflow

Package : glibc Problem type : buffer overflow Debian-specific: no A buffer overflow has been found in the globbing code for glibc. This code which is used to glob patterns for filenames and is commonly used in applications like shells and FTP servers. This has been fixed in versino 2.1.3-20 and ...

[SECURITY] [DSA-091-1] OpenSSH UseLogin vulnerability

Package : ssh Problem type : influencing login Debian-specific: no If the UseLogin feature is enabled in for ssh local users could pass environment variables including variables like LDPRELOAD to the login process. This has been fixed by not copying the environment of UseLogin is enabled. Please...

[SECURITY] [DSA 086-1] New versions of ssh-nonfree & ssh-socks fix buffer overflow

Package: ssh-nonfree, ssh-socks Vulnerability: remote root exploit Debian-specific: no We have received reports that the "SSH CRC-32 compensation attack detector vulnerability" is being actively exploited. This is the same integer type error previously corrected for OpenSSH in DSA-027-1. OpenSSH...

[SECURITY] [DSA 084-1] New gftp packages won't display the password

-------------------------------------------------------------------------- Debian Security Advisory DSA 084-1 [email protected] http://www.debian.org/security/ Martin Schulze October 18th, 2001 - -------------------------------------------------------------------------- Package : gftp...

[SECURITY] [DSA 081-2] No w3m packages for powerpc available

-------------------------------------------------------------------------- Debian Security Advisory DSA 081-2 [email protected] http://www.debian.org/security/ Martin Schulze October 18th, 2001 - -------------------------------------------------------------------------- Packages : w3m, w3m-ssl...

[SECURITY] [DSA 079-1] New UUCP packages fix local exploit

---------------------------------------------------------------------------- Debian Security Advisory DSA 079-1 [email protected] http://www.debian.org/security/ Martin Schulze September 24, 2001 - ---------------------------------------------------------------------------- Package : uucp...