GnuTLS堆溢出及拒绝服务漏洞

BUGTRAQ ID: 29292 CVECAN ID: CVE-2008-1948,CVE-2008-1949,CVE-2008-1950 GnuTLS是用于实现TLS加密协议的函数库。 GnuTLS在处理各种畸形TLS报文时存在多个安全漏洞，可能导致拒绝服务或完全入侵运行该库应用程序所在的操作系统。 如果用户所发送的Client Hello消息包含有Server Name扩展的话，就可能在lib/extservername.c文件的gnutlsservernamerecvparams函数中触发堆溢出，导致执行任意代码。...

Debian DSA-1585-1 : speex - integer overflow

It was discovered that speex, the Speex codec command line tools, did not correctly deal with negative offsets in a particular header field. This could allow a malicious file to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-1580-1 : phpgedview - programming error

It was discovered that phpGedView, an application to provide online access to genealogical data, allowed remote attackers to gain administrator privileges due to a programming error. Note: this problem was a fundamental design flaw in the interface API to connect phpGedView with external programs...

Debian DSA-1584-1 : libfishsound - buffer overflow

It was discovered that libfishsound, a simple programming interface that wraps Xiph.Org audio codecs, didn't correctly handle negative values in a particular header field. This could allow malicious files to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-1582-1 : peercast - buffer overflow

Nico Golde discovered that PeerCast, a P2P audio and video streaming server, is vulnerable to a buffer overflow in the HTTP Basic Authentication code, allowing a remote attacker to crash PeerCast or execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Debian DSA-1581-1 : gnutls13 - several vulnerabilities

Several remote vulnerabilities have been discovered in GNUTLS, an implementation of the SSL/TLS protocol suite. NOTE: The libgnutls13 package, which provides the GNUTLS library, does not contain logic to automatically restart potentially affected services. You must restart affected services...

Debian DSA-1583-1 : gnome-peercast - buffer overflow

Several remote vulnerabilities have been discovered in GNOME PeerCast, the GNOME interface to PeerCast, a P2P audio and video streaming server. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-6454 Luigi Auriemma discovered that PeerCast is vulnerabl...

Debian DSA-1577-1 : gforge - insecure temporary files

Stephen Gran and Mark Hymers discovered that some scripts run by GForge, a collaborative development tool, open files in write mode in a potentially insecure manner. This may be exploited to overwrite arbitrary files on the local system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-1579-1 : netpbm-free - insufficient input sanitizing

A vulnerability was discovered in the GIF reader implementation in netpbm-free, a suite of image manipulation utilities. Insufficient input data validation could allow a maliciously-crafted GIF file to overrun a stack buffer, potentially permitting the execution of arbitrary code. %NASLMINLEVEL...

Debian and Ubuntu OpenSSL packages contain a predictable random number generator

Overview A vulnerability in the OpenSSL package included with the Debian GNU/Linux operating system and its derivatives may cause weak cryptographic keys to be generated. Description A weakness exists in the random number generator used by the OpenSSL package included with the Debian GNU/Linux...

Debian DSA-1573-1 : rdesktop - several vulnerabilities

Several remote vulnerabilities have been discovered in rdesktop, a Remote Desktop Protocol client. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-1801 Remote exploitation of an integer underflow vulnerability allows attackers to execute arbitrary...

Debian DSA-1575-1 : linux-2.6 - denial of service

A vulnerability has been discovered in the Linux kernel that may lead to a denial of service. The Common Vulnerabilities and Exposures project identifies the following problem : - CVE-2008-1669 Alexander Viro discovered a race condition in the fcntl code that may permit local users on...

Debian Security Advisory DSA 1565-1 (linux-2.6)

The remote host is missing an update to linux-2.6 announced via advisory DSA 1565-1. OpenVAS Vulnerability Test $Id: deb15651.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1565-1 linux-2.6 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian Security Advisory DSA 1566-1 (cpio)

The remote host is missing an update to cpio announced via advisory DSA 1566-1. OpenVAS Vulnerability Test $Id: deb15661.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1566-1 cpio Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian Security Advisory DSA 1563-1 (asterisk)

The remote host is missing an update to asterisk announced via advisory DSA 1563-1. OpenVAS Vulnerability Test $Id: deb15631.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1563-1 asterisk Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian Security Advisory DSA 1564-1 (wordpress)

The remote host is missing an update to wordpress announced via advisory DSA 1564-1. OpenVAS Vulnerability Test $Id: deb15641.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1564-1 wordpress Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian: Security Advisory (DSA-1554-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-1570-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-1569-2 : cacti - insufficient input sanitising

It was discovered that Cacti, a systems and services monitoring frontend, performed insufficient input sanitising, leading to cross site scripting and SQL injection being possible. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-1566-1 : cpio - programming error

Dmitry Levin discovered a vulnerability in path handling code used by the cpio archive utility. The weakness could enable a denial of service crash or potentially the execution of arbitrary code if a vulnerable version of cpio is used to extract or to list the contents of a maliciously crafted...