Debian DSA-2031-1 : krb5 - use-after-free

Sol Jerome discovered that kadmind service in krb5, a system for authenticating users and services on a network, allows remote authenticated users to cause a denial of service daemon crash via a request from a kadmin client that sends an invalid API version number. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-2030-1 : mahara - sql injection

It was discovered that mahara, an electronic portfolio, weblog, and resume builder is not properly escaping input when generating a unique username based on a remote user name from a single sign-on application. An attacker can use this to compromise the mahara database via crafted user names...

Firefox nsTreeSelection实现释放后使用漏洞

CVE ID: CVE-2010-0175 Firefox是一款流行的开源WEB浏览器。 Firefox处理nsTreeSelection元素的特殊事件时存在释放后使用漏洞。在执行select事件时，Firefox未经检查元素之前是否已被释放便进行了访问，这可能导致执行任意代码。 Mozilla Firefox 3.5.x Mozilla Firefox 3.0.x Mozilla Thunderbird 3.0.4 Mozilla SeaMonkey 2.0.4 临时解决方法： 禁用JavaScript。 厂商补丁： Debian ------...

Debian: Security Advisory (DSA-2023-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-2028-1 : xpdf - multiple vulnerabilities

Several vulnerabilities have been identified in xpdf, a suite of tools for viewing and converting Portable Document Format PDF files. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-1188 and CVE-2009-3603 Integer overflow in SplashBitmap::SplashBitm...

Debian DSA-2026-1 : netpbm-free - stack-based buffer overflow

Marc Schoenefeld discovered a stack-based buffer overflow in the XPM reader implementation in netpbm-free, a suite of image manipulation utilities. An attacker could cause a denial of service application crash or possibly execute arbitrary code via an XPM image file that contains a crafted header...

Debian DSA-2024-1 : moin - insufficient input sanitising

Jamie Strandboge discovered that moin, a python clone of WikiWiki, does not sufficiently sanitize the page name in 'Despam' action, allowing remote attackers to perform cross-site scripting XSS attacks. In addition, this update fixes a minor issue in the 'textcha' protection, it could be triviall...

Debian DSA-2025-1 : icedove - several vulnerabilities

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird mail client. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2408 Dan Kaminsky and Moxie Marlinspike discovered that icedove does...

Debian DSA-2023-1 : curl - buffer overflow

Wesley Miaw discovered that libcurl, a multi-protocol file transfer library, is prone to a buffer overflow via the callback function when an application relies on libcurl to automatically uncompress data. Note that this only affects applications that trust libcurl's maximum limit for a fixed buff...

Debian DSA-2022-1 : mediawiki - several vulnerabilities

Several vulnerabilities have been discovered in mediawiki, a web-based wiki engine. The following issues have been identified : - Insufficient input sanitization in the CSS validation code allows editors to display external images in wiki pages. This can be a privacy concern on public wikis as it...

Debian DSA-2021-1 : spamass-milter - missing input sanitization

A missing input sanitization in spamass-milter, a milter used to filter mail through spamassassin, was discovered. This allows a remote attacker to inject and execute arbitrary shell commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-2018-1 : php5 - DoS (crash)

Auke van Slooten discovered that PHP 5, an hypertext preprocessor, crashes because of a NULL pointer dereference when processing invalid XML-RPC requests. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securit...

Debian DSA-2015-1 : drbd8 - privilege escalation

A local vulnerability has been discovered in drbd8. Philipp Reisner fixed an issue in the drbd kernel module that allows local users to send netlink packets to perform actions that should be restricted to users with CAPSYSADMIN privileges. This is a similar issue to those described by...

Debian Security Advisory DSA 2012-1 (linux-2.6)

The remote host is missing an update to linux-2.6 announced via advisory DSA 2012-1. OpenVAS Vulnerability Test $Id: deb20121.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2012-1 linux-2.6 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

Debian Security Advisory DSA 2004-1 (samba)

The remote host is missing an update to samba announced via advisory DSA 2004-1. OpenVAS Vulnerability Test $Id: deb20041.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2004-1 samba Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

Debian DSA-2012-1 : linux-2.6 - privilege escalation/denial of service

Two vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3725 Philipp Reisner reported an issue in the connector subsystem which allows...

Debian DSA-2014-1 : moin - several vulnerabilities

Several vulnerabilities have been discovered in moin, a python clone of WikiWiki. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0668 Multiple security issues in MoinMoin related to configurations that have a non-empty superuser list, the xmlrpc...

Debian DSA-2011-1 : dpkg - path traversal

William Grant discovered that the dpkg-source component of dpkg, the low-level infrastructure for handling the installation and removal of Debian software packages, is vulnerable to path traversal attacks. A specially crafted Debian source package can lead to file modification outside of the...

Debian DSA-2010-1 : kvm - privilege escalation/denial of service

Several local vulnerabilities have been discovered in kvm, a full virtualization system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0298 CVE-2010-0306 Gleb Natapov discovered issues in the KVM subsystem where missing permission checks CPL/IOPL...

Debian DSA-2006-1 : sudo - several vulnerabilities

Several vulnerabilities have been discovered in sudo, a program designed to allow a sysadmin to give limited root privileges to users. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0426 It was discovered that sudo when a pseudo-command is enabled,...