Debian Security Advisory DSA 2587-1 (libcgi-pm-perl - HTTP header injection)

It was discovered that the CGI module for Perl does not filter LF characters in the Set-Cookie and P3P headers, potentially allowing attackers to inject HTTP headers. OpenVAS Vulnerability Test $Id: deb25871.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2587-1 using...

Debian Security Advisory DSA 2581-1 (mysql-5.1 - several vulnerabilities)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to a new upstream version, 5.1.66, which includes additional changes, such as performance improvements and corrections for data loss defects. These changes are described in the...

Debian Security Advisory DSA 2586-1 (perl - several vulnerabilities)

Two vulnerabilities were discovered in the implementation of the Perl programming language: CVE-2012-5195The x operator could cause the Perl interpreter to crash if very long strings were created. CVE-2012-5526The CGI module does not properly escape LF characters in the Set-Cookie and P3P headers...

Debian Security Advisory DSA 2759-1 (iceweasel - several vulnerabilities)

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows may lead to the execution of arbitrary code. The Iceweasel version in the oldstable distribution squeeze is no longer supported with security...

Debian Security Advisory DSA 2595-1 (ghostscript - integer overflow)

Marc Schoenefeld discovered that an integer overflow in the ICC parsing code of Ghostscript can lead to the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb25951.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2595-1 using nvtgen 1.0 Script version: 1.0...

Debian Security Advisory DSA 2393-1 (bip - buffer overflow)

Julien Tinnes reported a buffer overflow in the Bip multiuser IRC proxy which may allow arbitrary code execution by remote users. The oldstable distribution lenny is not affected by this problem. OpenVAS Vulnerability Test $Id: deb23931.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated fro...

Debian Security Advisory DSA 2589-1 (tiff - buffer overflow)

The tiff library for handling TIFF image files contained a stack-based buffer overflow, potentially allowing attackers who can submit such files to a vulnerable system to execute arbitrary code. OpenVAS Vulnerability Test $Id: deb25891.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from...

Debian Security Advisory DSA 2532-1 (libapache2-mod-rpaf - denial of service)

Sebastien Bocahu discovered that the reverse proxy add forward module for the Apache webserver is vulnerable to a denial of service attack through a single crafted request with many headers. OpenVAS Vulnerability Test $Id: deb25321.nasl 8972 2018-02-28 07:02:10Z cfischer $ Auto-generated from...

Debian Security Advisory DSA 2594-1 (virtualbox-ose - programming error)

halfdog discovered that incorrect interrupt handling in VirtualBox, a x86 virtualization solution, can lead to denial of service. OpenVAS Vulnerability Test $Id: deb25941.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2594-1 using nvtgen 1.0 Script version: 1.0 Author:...

Debian Security Advisory DSA 2553-1 (iceweasel - several vulnerabilities)

Several vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox. The included XULRunner library provides rendering services for several other applications included in Debian. The reported vulnerabilities could lead to the execution of arbitrary code or the bypass of...

Debian Security Advisory DSA 2592-1 (elinks - programming error)

Marko Myllynen discovered that ELinks, a powerful text-mode browser, incorrectly delegates user credentials during GSS-Negotiate. OpenVAS Vulnerability Test $Id: deb25921.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2592-1 using nvtgen 1.0 Script version: 1.0 Author:...

Debian Security Advisory DSA 2462-2 (imagemagick - several vulnerabilities)

Several integer overflows and missing input validations were discovered in the ImageMagick image manipulation suite, resulting in the execution of arbitrary code or denial of service. OpenVAS Vulnerability Test $Id: deb24622.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory D...

Debian Security Advisory DSA 2591-1 (mahara - several vulnerabilities)

Multiple security issues have been found in Mahara, an electronic portfolio, weblog, and resume builder, which can result in cross-site scripting, clickjacking or arbitrary file execution. OpenVAS Vulnerability Test $Id: deb25911.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from...

Debian Security Advisory DSA 2471-1 (ffmpeg - several vulnerabilities)

Several vulnerabilities have been discovered in FFmpeg, a multimedia player, server and encoder. Multiple input validations in the decoders/ demuxers for Westwood Studios VQA, Apple MJPEG-B, Theora, Matroska, Vorbis, Sony ATRAC3, DV, NSV, files could lead to the execution of arbitrary code. These...

Debian Security Advisory DSA 2758-1 (python-django - denial of service)

It was discovered that python-django, a high-level Python web develompent framework, is prone to a denial of service vulnerability via large passwords. A non-authenticated remote attacker could mount a denial of service by submitting arbitrarily large passwords, tying up server resources in the...

Debian DSA-2753-1 : mediawiki - information leak

It was discovered that in MediaWiki, a wiki engine, several API modules allowed anti-CSRF tokens to be accessed via JSONP. These tokens protect against cross site request forgeries and are confidential. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks i...

Debian Security Advisory DSA 2756-1 (wireshark - several vulnerabilities)

Multiple vulnerabilities were discovered in the dissectors for LDAP, RTPS and NBAP and in the Netmon file parser, which could result in denial of service or the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2756.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from...

Debian Security Advisory DSA 2753-1 (mediawiki - information leak)

It was discovered that in Mediawiki, a wiki engine, several API modules allowed anti-CSRF tokens to be accessed via JSONP. These tokens protect against cross site request forgeries and are confidential. OpenVAS Vulnerability Test $Id: deb2753.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generat...

Debian Security Advisory DSA 2754-1 (exactimage - denial of service)

It was discovered that exactimage, a fast image processing library, does not correctly handle error conditions of the embedded copy of dcraw. This could result in a crash or other behaviour in an application using the library due to an uninitialized variable being passed to longjmp. This is a...

Debian Security Advisory DSA 2752-1 (phpbb3 - permissions too wide)

Andreas Beckmann discovered that phpBB, a web forum, as installed in Debian, sets incorrect permissions for cached files, allowing a malicious local user to overwrite them. OpenVAS Vulnerability Test $Id: deb2752.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2752-1...