Debian Security Advisory DSA 2826-1 (denyhosts - Remote denial of ssh service)

Helmut Grohne discovered that denyhosts, a tool preventing SSH brute-force attacks, could be used to perform remote denial of service against the SSH daemon. Incorrectly specified regular expressions used to detect brute force attacks in authentication logs could be exploited by a malicious user ...

Debian Security Advisory DSA 2825-1 (wireshark - several vulnerabilities)

Laurent Butti and Garming Sam discovered multiple vulnerabilities in the dissectors for NTLMSSPv2 and BSSGP, which could lead to denial of service or the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2825.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA...

Debian Security Advisory DSA 2824-1 (curl - unchecked tls/ssl certificate host name)

Marc Deslauriers discovered that curl, a file retrieval tool, would mistakenly skip verifying the CN and SAN name fields when digital signature verification was disabled in the libcurl GnuTLS backend. The default configuration for the curl package is not affected by this issue since the digital...

Debian Security Advisory DSA 2822-1 (xorg-server - integer underflow)

Bryan Quigley discovered an integer underflow in the Xorg X server which could lead to denial of service or the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2822.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2822-1 using nvtgen 1.0 Script version: 1...

Debian Security Advisory DSA 2823-1 (pixman - integer underflow)

Bryan Quigley discovered an integer underflow in Pixman which could lead to denial of service or the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2823.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2823-1 using nvtgen 1.0 Script version: 1.0 Author:...

Debian Security Advisory DSA 2821-1 (gnupg - side channel attack)

Genkin, Shamir and Tromer discovered that RSA key material could be extracted by using the sound generated by the computer during the decryption of some chosen ciphertexts. OpenVAS Vulnerability Test $Id: deb2821.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2821-1...

Debian Security Advisory DSA 2820-1 (nspr - integer overflow)

It was discovered that NSPR, Netscape Portable Runtime library, could crash an application using the library when parsing a certificate that causes an integer overflow. This flaw only affects 64-bit systems. OpenVAS Vulnerability Test $Id: deb2820.nasl 6611 2017-07-07 12:07:20Z cfischer $...

Debian Security Advisory DSA 2817-1 (libtar - Integer overflow)

Timo Warns reported multiple integer overflow vulnerabilities in libtar, a library for manipulating tar archives, which can result in the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2817.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2817-1 using...

Debian DSA-2813-1 : gimp - several vulnerabilities

Murray McAllister discovered multiple integer and buffer overflows in the XWD plugin in Gimp, which can result in the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Adviso...

Debian Security Advisory DSA 2812-1 (samba - several vulnerabilities)

Two security issues were found in Samba, a SMB/CIFS file, print, and login server: CVE-2013-4408 It was discovered that multiple buffer overflows in the processing of DCE-RPC packets may lead to the execution of arbitrary code. CVE-2013-4475 Hemanth Thummala discovered that ACLs were not checked...

Debian Security Advisory DSA 2813-1 (gimp - several vulnerabilities)

Murray McAllister discovered multiple integer and buffer overflows in the XWD plugin in Gimp, which can result in the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2813.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2813-1 using nvtgen 1.0 Script...

Debian Security Advisory DSA 2814-1 (varnish - denial of service)

A denial of service vulnerability was reported in varnish, a state of the art, high-performance web accelerator. With some configurations of varnish a remote attacker could mount a denial of service child-process crash and temporary caching outage via a GET request with trailing whitespace...

Debian Security Advisory DSA 2810-1 (ruby1.9.1 - heap overflow)

Charlie Somerville discovered that Ruby incorrectly handled floating point number conversion. If an application using Ruby accepted untrusted input strings and converted them to floating point numbers, an attacker able to provide such input could cause the application to crash or, possibly, execu...

Debian Security Advisory DSA 2808-1 (openjpeg - several vulnerabilities)

Several vulnerabilities have been discovered in OpenJPEG, a JPEG 2000 image library, that may lead to denial of service CVE-2013-1447 via application crash or high memory consumption, possible code execution through heap buffer overflows CVE-2013-6045, information disclosure CVE-2013-6052, or yet...

Debian Security Advisory DSA 2807-1 (links2 - integer overflow)

Mikulas Patocka discovered an integer overflow in the parsing of HTML tables in the Links web browser. This can only be exploited when running Links in graphical mode. OpenVAS Vulnerability Test $Id: deb2807.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2807-1 using...

Debian DSA-2805-1 : sup-mail - command injection

joernchen of Phenoelit discovered two command injection flaws in Sup, a console-based email client. An attacker might execute arbitrary command if the user opens a maliciously crafted email. - CVE-2013-4478 Sup wrongly handled the filename of attachments. - CVE-2013-4479 Sup did not sanitize the...

Debian Security Advisory DSA 2806-1 (nbd - privilege escalation)

It was discovered that nbd-server, the server for the Network Block Device protocol, did incorrect parsing of the access control lists, allowing access to any hosts with an IP address sharing a prefix with an allowed address. OpenVAS Vulnerability Test $Id: deb2806.nasl 6611 2017-07-07 12:07:20Z...

Debian Security Advisory DSA 2805-1 (sup-mail - command injection)

joernchen of Phenoelit discovered two command injection flaws in Sup, a console-based email client. An attacker might execute arbitrary command if the user opens a maliciously crafted email. CVE-2013-4478 Sup wrongly handled the filename of attachments. CVE-2013-4479 Sup did not sanitize the...

Debian Security Advisory DSA 2803-1 (quagga - several vulnerabilities)

Multiple vulnerabilities were discovered in Quagga, a BGP/OSPF/RIP routing daemon: CVE-2013-2236 A buffer overflow was found in the OSPF API-server exporting the LSDB and allowing announcement of Opaque-LSAs. CVE-2013-6051 bgpd could be crashed through BGP updates. This only affects Wheezy/stable...

Debian Security Advisory DSA 2800-1 (nss - buffer overflow)

Andrew Tinits reported a potentially exploitable buffer overflow in the Mozilla Network Security Service library nss. With a specially crafted request a remote attacker could cause a denial of service or possibly execute arbitrary code. OpenVAS Vulnerability Test $Id: deb2800.nasl 6611 2017-07-07...