Debian: Security Advisory (DSA-2329-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-2388-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-2407-1 : cvs - heap overflow

It was discovered that a malicious CVS server could cause a heap overflow in the CVS client, potentially allowing the server to execute arbitrary code on the client. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Debian DSA-2406-1 : icedove - several vulnerabilities

Several vulnerabilities have been discovered in Icedove, Debian's variant of the Mozilla Thunderbird code base. - CVE-2011-3670 Icedove does not not properly enforce the IPv6 literal address syntax, which allows remote attackers to obtain sensitive information by making XMLHttpRequest calls throu...

CVE-2012-0804

Heap-based buffer overflow in the proxyconnect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service crash and possibly execute arbitrary code via a crafted HTTP response...

[SECURITY] [DSA 2384-2] cacti regression

------------------------------------------------------------------------- Debian Security Advisory DSA-2384-2 [email protected] http://www.debian.org/security/ February 04, 2012 http://www.debian.org/security/faq - -------------------------------------------------------------------------...

Debian DSA-2403-2 : php5 - code injection

Stefan Esser discovered that the implementation of the maxinputvars configuration variable in a recent PHP security update was flawed such that it allows remote attackers to crash PHP or potentially execute code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packag...

Debian DSA-2399-2 : php5 - several vulnerabilities

Several vulnerabilities have been discovered in PHP, the web scripting language. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2011-1938 The UNIX socket handling allowed attackers to trigger a buffer overflow via a long path name. - CVE-2011-2483 The...

Debian DSA-2398-2 : curl - several vulnerabilities (BEAST)

Several vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-3389 This update enables OpenSSL workarounds against the 'BEAST' attack. Additional information can be found in the cURL...

Debian DSA-2397-1 : icu - buffer underflow

It was discovered that a buffer overflow in the Unicode library ICU could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-2397. The text itself is...

Debian DSA-2396-1 : qemu-kvm - buffer underflow

Nicolae Mogoreanu discovered a heap overflow in the emulated e1000e network interface card of KVM, a solution for full virtualization on x86 hardware, which could result in denial of service or privilege escalation. This update also fixes a guest-triggerable memory corruption in VNC handling...

Debian DSA-2395-1 : wireshark - buffer underflow

Laurent Butti discovered a buffer underflow in the LANalyzer dissector of the Wireshark network traffic analyzer, which could lead to the execution of arbitrary code CVE-2012-0068 . This update also addresses several bugs, which can lead to crashes of Wireshark. These are not treated as security...

Debian DSA-2393-1 : bip - buffer overflow

Julien Tinnes reported a buffer overflow in the Bip multiuser IRC proxy which may allow arbitrary code execution by remote users. The oldstable distribution lenny is not affected by this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-2392-1 : openssl - out-of-bounds read

Antonio Martin discovered a denial-of-service vulnerability in OpenSSL, an implementation of TLS and related protocols. A malicious client can cause the DTLS server implementation to crash. Regular, TCP-based TLS is not affected by this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DSA-2391-1 : phpmyadmin - several vulnerabilities

Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-4107 The XML import plugin allowed a remote attacker to read arbitrary files via XML data containing...

Debian DSA-2388-1 : t1lib - several vulnerabilities

Several vulnerabilities were discovered in t1lib, a Postscript Type 1 font rasterizer library, some of which might lead to code execution through the opening of files embedding bad fonts. - CVE-2010-2642 A heap-based buffer overflow in the AFM font metrics parser potentially leads to the executio...

Debian DSA-2363-1 : tor - buffer overflow

It was discovered that Tor, an online privacy tool, incorrectly computes buffer sizes in certain cases involving SOCKS connections. Malicious parties could use this to cause a heap-based buffer overflow, potentially allowing execution of arbitrary code. In Tor's default configuration this issue c...

Debian DSA-2375-1 : krb5, krb5-appl - buffer overflow

It was discovered that the encryption support for BSD telnetd contains a pre-authentication buffer overflow, which may enable remote attackers who can connect to the Telnet port to execute arbitrary code with root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive te...

Debian DSA-2387-1 : simplesamlphp - insufficient input sanitation

'timtai1' discovered that simpleSAMLphp, an authentication and federation platform, is vulnerable to a cross site scripting attack, allowing a remote attacker to access sensitive client data. The oldstable distribution lenny does not contain a simplesamlphp package. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-2374-1 : openswan - implementation error

The information security group at ETH Zurich discovered a denial of service vulnerability in the crypto helper handler of the IKE daemon pluto. More information can be found in the upstream advisory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...