Debian DSA-1866-1 : kdegraphics - several vulnerabilities

Two security issues have been discovered in kdegraphics, the graphics apps from the official KDE release. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0945 It was discovered that the KSVG animation element implementation suffers from a NULL point...

Debian DSA-1885-1 : xulrunner - several vulnerabilities

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3070 Jesse Ruderman discovered crashes in the layout...

Debian DSA-1988-1 : qt4-x11 - several vulnerabilities

Several vulnerabilities have been discovered in qt4-x11, a cross-platform C++ application framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0945 Array index error in the insertItemBefore method in WebKit, as used in qt4-x11, allows remote...

Debian DSA-1867-1 : kdelibs - several vulnerabilities

Several security issues have been discovered in kdelibs, core libraries from the official KDE release. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-1690 It was discovered that there is a use-after-free flaw in handling certain DOM event handlers...

Debian DSA-1876-1 : dnsmasq - buffer overflow

Several remote vulnerabilities have been discovered in the TFTP component of dnsmasq. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2957 A buffer overflow in TFTP processing may enable arbitrary code execution to attackers which are permitted to u...

Debian DSA-1904-1 : wget - insufficient input validation

Daniel Stenberg discovered that wget, a network utility to retrieve files from the Web using HTTPS and FTP, is vulnerable to the 'Null Prefix Attacks Against SSL/TLS Certificates' published at the Blackhat conference some time ago. This allows an attacker to perform undetected man-in-the-middle...

Debian DSA-1874-1 : nss - several vulnerabilities

Several vulnerabilities have been discovered in the Network Security Service libraries. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2404 Moxie Marlinspike discovered that a buffer overflow in the regular expression parser could lead to the...

Debian DSA-1951-1 : firefox-sage - insufficient input sanitising

It was discovered that firefox-sage, a lightweight RSS and Atom feed reader for Firefox, does not sanitise the RSS feed information correctly, which makes it prone to a cross-site scripting and a cross-domain scripting attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Debian DSA-2002-1 : polipo - denial of service

Several denial of service vulnerabilities have been discovered in polipo, a small, caching web proxy. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3305 A malicous remote server could cause polipo to crash by sending an invalid Cache-Control heade...

Debian DSA-1850-1 : libmodplug - several vulnerabilities

Several vulnerabilities have been discovered in libmodplug, the shared libraries for mod music based on ModPlug. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-1438 It was discovered that libmodplug is prone to an integer overflow when processing a...

Debian DSA-1919-1 : smarty - several vulnerabilities

Several remote vulnerabilities have been discovered in Smarty, a PHP templating engine. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-4810 The expandquotedtext function allows for certain restrictions in templates, like function calling and PHP...

Debian DSA-1832-1 : camlimages - integer overflow

Tielei Wang discovered that CamlImages, an open source image processing library, suffers from several integer overflows which may lead to a potentially exploitable heap overflow and result in arbitrary code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-1889-1 : icu - programming error

It was discovered that the ICU unicode library performed incorrect processing of invalid multibyte sequences, resulting in potential bypass of security mechanisms. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debia...

Debian DSA-1894-1 : newt - buffer overflow

Miroslav Lichvar discovered that newt, a windowing toolkit, is prone to a buffer overflow in the content processing code, which can lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Debian DSA-2000-1 : ffmpeg-debian - several vulnerabilities

Several vulnerabilities have been discovered in ffmpeg, a multimedia player, server and encoder, which also provides a range of multimedia libraries used in applications like MPlayer : Various programming errors in container and codec implementations may lead to denial of service or the execution...

Debian DSA-1931-1 : nspr - several vulnerabilities

Several vulnerabilities have been discovered in the NetScape Portable Runtime Library, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-1563 A programming error in the string handling code may lead t...

Debian DSA-1909-1 : postgresql-ocaml - missing escape function

It was discovered that postgresql-ocaml, OCaml bindings to PostgreSQL's libpq, was missing a function to call PQescapeStringConn. This is needed, because PQescapeStringConn honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are use...

Debian DSA-1924-1 : mahara - several vulnerabilities

Two vulnerabilities have been discovered in mahara, an electronic portfolio, weblog, and resume builder. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3298 Ruslan Kabalin discovered a issue with resetting passwords, which could lead to a privilege...

Debian DSA-1920-1 : nginx - denial of service

A denial of service vulnerability has been found in nginx, a small and efficient web server. Jasson Bell discovered that a remote attacker could cause a denial of service segmentation fault by sending a crafted request. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-1946-1 : belpic - cryptographic weakness

It was discovered that belpic, the belgian eID PKCS11 library, does not properly check the result of an OpenSSL function for verifying cryptographic signatures, which could be used to bypass the certificate validation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...