Debian DSA-2168-1 : openafs - several vulnerabilities

Two vulnerabilities were discovered the distributed filesystem AFS : - CVE-2011-0430 Andrew Deason discovered that a double free in the Rx server process could lead to denial of service or the execution of arbitrary code. - CVE-2011-0431 It was discovered that insufficient error handling in the...

Debian DSA-2169-1 : telepathy-gabble - insufficient input validation

It was discovered that telepathy-gabble, the Jabber/XMPP connection manager for the Telepathy framework, is processing google:jingleinfo updates without validating their origin. This may allow an attacker to trick telepathy-gabble into relaying streamed media data through a server of his choice a...

Debian DSA-2164-1 : shadow - insufficient input sanitization

Kees Cook discovered that the chfn and chsh utilities do not properly sanitize user input that includes newlines. An attacker could use this to corrupt passwd entries and may create users or groups in NIS environments. Packages in the oldstable distribution lenny are not affected by this problem...

Debian DSA-2165-1 : ffmpeg-debian - buffer overflow

Several vulnerabilities have been discovered in FFmpeg coders, which are used by MPlayer and other applications. - CVE-2010-3429 Cesar Bernardini and Felipe Andres Manzano reported an arbitrary offset dereference vulnerability in the libavcodec, in particular in the FLIC file format parser. A...

Debian DSA-2163-1 : python-django - multiple vulnerabilities

Several vulnerabilities were discovered in the Django web development framework : - CVE-2011-0696 For several reasons the internal CSRF protection was not used to validate AJAX requests in the past. However, it was discovered that this exception can be exploited with a combination of browser...

Debian DSA-2162-1 : openssl - invalid memory access

Neel Mehta discovered that an incorrectly formatted ClientHello handshake message could cause OpenSSL to parse past the end of the message. This allows an attacker to crash an application using OpenSSL by triggering an invalid memory access. Additionally, some applications may be vulnerable to...

Debian DSA-2161-1 : openjdk-6 - denial of service

It was discovered that the floating point parser in OpenJDK, an implementation of the Java platform, can enter an infinite loop when processing certain input strings. Such input strings represent valid numbers and can be contained in data supplied by an attacker over the network, leading to a...

Debian DSA-2160-1 : tomcat6 - several vulnerabilities

Several vulnerabilities were discovered in the Tomcat Servlet and JSP engine : - CVE-2010-3718 It was discovered that the SecurityManager insufficiently restricted the working directory. - CVE-2011-0013 It was discovered that the HTML manager interface is affected by cross-site scripting. -...

Debian DSA-2159-1 : vlc - missing input sanitising

Dan Rosenberg discovered that insufficient input validation in VLC's processing of Matroska/WebM containers could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securit...

Debian DSA-2158-1 : cgiirc - XSS

Michael Brooks Sitewatch discovered a reflective XSS flaw in CGI:IRC, a web-based IRC client, which could lead to the execution of arbitrary JavaScript. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

Debian DSA-2157-1 : postgresql-8.3, postgresql-8.4, postgresql-9.0 - buffer overflow

It was discovered that PostgreSQL's intarray contrib module does not properly handle integers with a large number of digits, leading to a server crash and potentially arbitrary code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-2155-1 : freetype - several vulnerabilities

Two buffer overflows were found in the Freetype font library, which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-2155. The text itself is...

Debian DSA-2154-1 : exim4 - privilege escalation

A design flaw CVE-2010-4345 in exim4 allowed the local Debian-exim user to obtain root privileges by specifying an alternate configuration file using the -C option or by using the macro override facility -D option. Unfortunately, fixing this vulnerability is not possible without some changes in...

Debian DSA-2153-1 : linux-2.6 - privilege escalation/denial of service/information leak

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0435 Gleb Napatov reported an issue in the KVM subsystem...

Debian DSA-2152-1 : hplip - buffer overflow

Sebastian Krahmer discovered a buffer overflow in the SNMP discovery code of the HP Linux Printing and Imaging System, which could result in the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Debian DSA-2151-1 : openoffice.org - several vulnerabilities

Several security related problems have been discovered in the OpenOffice.org package that allows malformed documents to trick the system into crashes or even the execution of arbitrary code. - CVE-2010-3450 During an internal security audit within Red Hat, a directory traversal vulnerability has...

Debian DSA-2150-1 : request-tracker3.6 - unsalted password hashing

It was discovered that Request Tracker, an issue tracking system, stored passwords in its database by using an insufficiently strong hashing method. If an attacker would have access to the password database, he could decode the passwords stored in it. %NASLMINLEVEL 70300 C Tenable Network Securit...

Debian Security Advisory DSA 2126-1 (linux-2.6)

The remote host is missing an update to linux-2.6 announced via advisory DSA 2126-1. OpenVAS Vulnerability Test $Id: deb21261.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2126-1 linux-2.6 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

Debian Security Advisory DSA 2132-1 (xulrunner)

The remote host is missing an update to xulrunner announced via advisory DSA 2132-1. OpenVAS Vulnerability Test $Id: deb21321.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2132-1 xulrunner Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

Debian: Security Advisory (DSA-2038)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...