Debian DSA-2284-1 : opensaml2 - implementation error

Juraj Somorovsky, Andreas Mayer, Meiko Jensen, Florian Kohlar, Marco Kampmann and Joerg Schwenk discovered that Shibboleth, a federated web single sign-on system is vulnerable to XML signature wrapping attacks. More details can be found in the Shibboleth advisory. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-2280-1 : libvirt - several vulnerabilities

It was discovered that libvirt, a library for interfacing with different virtualization systems, is prone to an integer overflow CVE-2011-2511 . Additionally, the stable version is prone to a denial of service, because its error reporting is not thread-safe CVE-2011-1486 . %NASLMINLEVEL 70300 C...

Debian DSA-2278-1 : horde3 - several vulnerabilities

It was discovered that horde3, the horde web application framework, is prone to a cross-site scripting attack and a cross-site request forgery. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian DSA-2276-1 : asterisk - multiple denial of service

Paul Belanger reported a vulnerability in Asterisk identified as AST-2011-008CVE-2011-2529 through which an unauthenticated attacker may crash an Asterisk server remotely. A package containing a NULL char causes the SIP header parser to alter unrelated memory structures. Jared Mauch reported a...

Debian DSA-2277-1 : xml-security-c - stack-based buffer overflow

It has been discovered that xml-security-c, an implementation of the XML Digital Signature and Encryption specifications, is not properly handling RSA keys of sizes on the order of 8192 or more bits. This allows an attacker to crash applications using this functionality or potentially execute...

Debian DSA-2275-1 : openoffice.org - stack-based buffer overflow

Will Dormann and Jared Allar discovered that the Lotus Word Pro import filter of OpenOffice.org, a full-featured office productivity suite that provides a near drop-in replacement for Microsoft Office, is not properly handling object ids in the '.lwp' file format. An attacker can exploit this wit...

Debian DSA-2273-1 : icedove - several vulnerabilities

Several vulnerabilities have been discovered in Icedove, an unbranded version of the Thunderbird mail/news client. - CVE-2011-0083 / CVE-2011-2363 'regenrecht' discovered two use-after-frees in SVG processing, which could lead to the execution of arbitrary code. - CVE-2011-0085 'regenrecht'...

Debian DSA-2266-1 : php5 - several vulnerabilities

Several vulnerabilities were discovered in PHP, which could lead to denial of service or potentially the execution of arbitrary code. - CVE-2010-2531 An information leak was found in the varexport function. - CVE-2011-0421 The Zip module could crash. - CVE-2011-0708 An integer overflow was...

Debian DSA-2267-1 : perl - restriction bypass

It was discovered that Perl's Safe module - a module to compile and execute code in restricted compartments - could be bypassed. Please note that this update is known to break Petal, an XML-based templating engine shipped with Debian 6.0/Squeeze in the package libpetal-perl, see bug 582805 for...

Debian DSA-2268-1 : iceweasel - several vulnerabilities

Several vulnerabilities have been found in Iceweasel, a web browser based on Firefox : - CVE-2011-0083 / CVE-2011-2363 'regenrecht' discovered two use-after-frees in SVG processing, which could lead to the execution of arbitrary code. - CVE-2011-0085 'regenrecht' discovered a use-after-free in XU...

Debian DSA-2271-1 : curl - improper delegation of client credentials

Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism. This is...

Debian DSA-2270-1 : qemu-kvm - programming error

It was discovered that incorrect sanitising of virtio queue commands in KVM, a solution for full virtualization on x86 hardware, could lead to denial of service or the execution of arbitrary code. The oldstable distribution lenny is not affected by this problem. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-2265-1 : perl - lack of tainted flag propagation

Mark Martinec discovered that Perl incorrectly clears the tainted flag on values returned by case conversion functions such as 'lc'. This may expose preexisting vulnerabilities in applications which use these functions while processing untrusted input. No such applications are known at this stage...

Debian DSA-2263-2 : movabletype-opensource - several vulnerabilities

It was discovered that Movable Type, a weblog publishing system, contains several security vulnerabilities : A remote attacker could execute arbitrary code in a logged-in users' web browser. A remote attacker could read or modify the contents in the system under certain circumstances. %NASLMINLEV...

Debian DSA-2262-1 : moodle - several vulnerabilities

Several cross-site scripting and information disclosure issues have been fixed in Moodle, a course management system for online learning : - MSA-11-0002 Cross-site request forgery vulnerability in RSS block - MSA-11-0003 Cross-site scripting vulnerability in tag autocomplete - MSA-11-0008 IMS...

Debian DSA-2261-1 : redmine - several vulnerabilities

Joernchen of Phenoelit discovered several vulnerabilities in Redmine, a project management web application : - Logged in users may be able to access private data. - The Textile formatter allowed for cross site scripting, exposing sensitive data to an attacker. - The Bazaar repository adapter coul...

Debian DSA-2260-1 : rails - several vulnerabilities

Two vulnerabilities were discovered in Ruby on Rails, a web application framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3086 The cookie store may be vulnerable to a timing attack, potentially allowing remote attackers to forge message...

Debian DSA-2258-1 : kolab-cyrus-imapd - implementation error

It was discovered that the STARTTLS implementation of the Kolab Cyrus IMAP server does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted IMAP, LMTP, NNTP and POP3 sessions by sending a cleartext command that is processed after TLS is i...

Debian DSA-2259-1 : fex - authentication bypass

It was discovered that FEX, a web service for transferring very large files, is not properly validating authentication IDs. While the service properly validates existing authentication IDs, an attacker who is not specifying any authentication ID at all can bypass the authentication procedure. The...

Debian DSA-2244-1 : bind9 - incorrect boundary condition

It was discovered that BIND, an implementation of the DNS protocol, does not correctly process certain large RRSIG record sets in DNSSEC responses. The resulting assertion failure causes the name server process to crash, making name resolution unavailable. CVE-2011-1910 In addition, this update...