Debian Security Advisory DSA 2760-1 (chrony - several vulnerabilities)

Florian Weimer discovered two security problems in the Chrony time synchronisation software buffer overflows and use of uninitialised data in command replies. OpenVAS Vulnerability Test $Id: deb2760.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2760-1 using nvtgen 1.0...

Debian Security Advisory DSA 2596-1 (mediawiki-extensions - cross-site scripting)

Thorsten Glaser discovered that the RSSReader extension for MediaWiki, a website engine for collaborative work, does not properly escape tags in feeds. This could allow a malicious feed to inject JavaScript into the MediaWiki pages. OpenVAS Vulnerability Test $Id: deb25961.nasl 8972 2018-02-28...

Debian Security Advisory DSA 2585-1 (bogofilter - buffer overflow)

A heap-based buffer overflow was discovered in bogofilter, a software package for classifying mail messages as spam or non-spam. Crafted mail messages with invalid base64 data could lead to heap corruption and, potentially, arbitrary code execution. OpenVAS Vulnerability Test $Id: deb25851.nasl...

Debian Security Advisory DSA 2553-1 (iceweasel - several vulnerabilities)

Several vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox. The included XULRunner library provides rendering services for several other applications included in Debian. The reported vulnerabilities could lead to the execution of arbitrary code or the bypass of...

Debian Security Advisory DSA 2758-1 (python-django - denial of service)

It was discovered that python-django, a high-level Python web develompent framework, is prone to a denial of service vulnerability via large passwords. A non-authenticated remote attacker could mount a denial of service by submitting arbitrarily large passwords, tying up server resources in the...

Debian DSA-2753-1 : mediawiki - information leak

It was discovered that in MediaWiki, a wiki engine, several API modules allowed anti-CSRF tokens to be accessed via JSONP. These tokens protect against cross site request forgeries and are confidential. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks i...

Debian Security Advisory DSA 2753-1 (mediawiki - information leak)

It was discovered that in Mediawiki, a wiki engine, several API modules allowed anti-CSRF tokens to be accessed via JSONP. These tokens protect against cross site request forgeries and are confidential. OpenVAS Vulnerability Test $Id: deb2753.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generat...

Debian Security Advisory DSA 2756-1 (wireshark - several vulnerabilities)

Multiple vulnerabilities were discovered in the dissectors for LDAP, RTPS and NBAP and in the Netmon file parser, which could result in denial of service or the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2756.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from...

Debian Security Advisory DSA 2754-1 (exactimage - denial of service)

It was discovered that exactimage, a fast image processing library, does not correctly handle error conditions of the embedded copy of dcraw. This could result in a crash or other behaviour in an application using the library due to an uninitialized variable being passed to longjmp. This is a...

Debian Security Advisory DSA 2752-1 (phpbb3 - permissions too wide)

Andreas Beckmann discovered that phpBB, a web forum, as installed in Debian, sets incorrect permissions for cached files, allowing a malicious local user to overwrite them. OpenVAS Vulnerability Test $Id: deb2752.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2752-1...

Debian Security Advisory DSA 2751-1 (libmodplug - several vulnerabilities)

Several vulnerabilities have been discovered in libmodplug, a library for mod music based on ModPlug, that might allow arbitrary code execution when processing specially-crafted ABC files through applications using the library, such as media players. OpenVAS Vulnerability Test $Id: deb2751.nasl...

Debian Security Advisory DSA 2750-1 (imagemagick - buffer overflow)

Anton Kortunov reported a heap corruption in ImageMagick, a program collection and library for converting and manipulating image files. Crafted GIF files could cause ImageMagick to crash, potentially leading to arbitrary code execution. The oldstable distribution squeeze is not affected by this...

Debian Security Advisory DSA 2749-1 (asterisk - several vulnerabilities)

Colin Cuthbertson and Walter Doekes discovered two vulnerabilities in the SIP processing code of Asterisk - an open source PBX and telephony toolkit -, which could result in denial of service. OpenVAS Vulnerability Test $Id: deb2749.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from...

Debian DSA-2747-1 : cacti - several vulnerabilities

Two vulnerabilities were discovered in Cacti, a web interface for graphing of monitoring systems : - CVE-2013-5588 install/index.php and cacti/host.php suffered from Cross-Site Scripting vulnerabilities. - CVE-2013-5589 cacti/host.php contained a SQL injection vulnerability, allowing an attacker ...

Debian Security Advisory DSA 2748-1 (exactimage - denial of service)

Several denial-of-service vulnerabilities were discovered in the dcraw code base, a program for procesing raw format images from digital cameras. This update corrects them in the copy that is embedded in the exactimage package. OpenVAS Vulnerability Test $Id: deb2748.nasl 6611 2017-07-07 12:07:20...

Debian Security Advisory DSA 2747-1 (cacti - several vulnerabilities)

Two vulnerabilities were discovered in Cacti, a web interface for graphing of monitoring systems: CVE-2013-5588 install/index.php and cacti/host.php suffered from Cross-Site Scripting vulnerabilities. CVE-2013-5589 cacti/host.php contained an SQL injection vulnerability, allowing an attacker to...

Debian Security Advisory DSA 2744-1 (tiff - several vulnerabilities)

Pedro Ribeiro and Huzaifa S. Sidhpurwala discovered multiple vulnerabilities in various tools shipped by the tiff library. Processing a malformed file may lead to denial of service or the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2744.nasl 6611 2017-07-07 12:07:20Z cfischer ...

Debian Security Advisory DSA 2742-1 (php5 - interpretation conflict)

It was discovered that PHP, a general-purpose scripting language commonly used for web application development, did not properly process embedded NUL characters in the subjectAltName extension of X.509 certificates. Depending on the application and with insufficient CA-level checks, this could be...

Debian DSA-2739-1 : cacti - several vulnerabilities

Two security issues SQL injection and command line injection via SNMP settings were found in Cacti, a web interface for graphing of monitoring systems. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

Debian Security Advisory DSA 2739-1 (cacti - several vulnerabilities)

Two security issues SQL injection and command line injection via SNMP settings were found in Cacti, a web interface for graphing of monitoring systems. OpenVAS Vulnerability Test $Id: deb2739.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2739-1 using nvtgen 1.0 Script...