Debian DSA-1438-1 : tar - several vulnerabilities

Several vulnerabilities have been discovered in GNU Tar. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-4131 A directory traversal vulnerability enables attackers using specially crafted archives to extract contents outside the directory tree creat...

Debian DSA-1441-1 : peercast - buffer overflow

Luigi Auriemma discovered that PeerCast, a P2P audio and video streaming server, is vulnerable to a heap overflow in the HTTP server code, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long SOURCE request. %NASLMINLEVEL 70300 C Tenable Networ...

Debian DSA-1439-1 : typo3-src - missing input sanitising

Henning Pingel discovered that TYPO3, a web content management framework, performs insufficient input sanitising, making it vulnerable to SQL injection by logged-in backend users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-1436-1 : linux-2.6 - several vulnerabilities

Several local vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-6058 LMH reported an issue in the minix filesystem that...

Debian DSA-1432-1 : link-grammar - buffer overflow

Alin Rad Pop discovered that link-grammar, Carnegie Mellon University's link grammar parser for English, performed insufficient validation within its tokenizer, which could allow a malicious input file to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Debian DSA-1434-1 : mydns - buffer overflow

It was discovered that in MyDNS, a domain name server with database backend, the daemon could be crashed through malicious remote update requests, which may lead to denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-1433-1 : centericq - buffer overflow

Several remote vulnerabilities have been discovered in centericq, a text-mode multi-protocol instant messenger client, which could allow remote attackers to execute arbitrary code due to insufficient bounds-testing. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-1429-1 : htdig - XSS

Michael Skibbe discovered that htdig, a WWW search system for an intranet or small internet, did not adequately quote values submitted to the search script, allowing remote attackers to inject arbitrary script or HTML into specially crafted links. %NASLMINLEVEL 70300 C Tenable Network Security,...

Debian DSA-1430-1 : libnss-ldap - denial of service

It was reported that a race condition exists in libnss-ldap, an NSS module for using LDAP as a naming service, which could cause denial of service attacks if applications use pthreads. This problem was spotted in the dovecot IMAP/POP server but potentially affects more programs. %NASLMINLEVEL 703...

Debian DSA-1431-1 : ruby-gnome2 - format string

It was discovered that ruby-gnome2, the GNOME-related bindings for the Ruby language, didn't properly sanitize input prior to constructing dialogs. This could allow the execution of arbitrary code if untrusted input is displayed within a dialog. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DSA-1428-2 : linux-2.6 - several vulnerabilities

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : This is an update to DSA 1428-1 which omitted a reference...

Debian DSA-1422-1 : e2fsprogs - integer overflows

Rafal Wojtczuk of McAfee AVERT Research discovered that e2fsprogs, the ext2 file system utilities and libraries, contained multiple integer overflows in memory allocations, based on sizes taken directly from filesystem information. These could result in heap-based overflows potentially allowing t...

Debian DSA-1426-1 : qt-x11-free - several vulnerabilities

Several local/remote vulnerabilities have been discovered in the Qt GUI library. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3388 Tim Brown and Dirk Muller discovered several format string vulnerabilities in the handling of error messages, which...

Debian DSA-1423-1 : sitebar - several vulnerabilities

Several remote vulnerabilities have been discovered in sitebar, a web-based bookmark manager written in PHP. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-5491 A directory traversal vulnerability in the translation module allows remote authenticat...

Debian DSA-1425-1 : xulrunner - several vulnerabilities

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-5947 Jesse Ruderman and Petko D. Petkov discovered that the URI handler for JAR archives...

Debian DSA-1420-1 : zabbix - programming error

Bas van Schaik discovered that the agentd process of Zabbix, a network monitor system, may run user-supplied commands as group id root, not zabbix, which may lead to a privilege escalation. zabbix is not included in the oldstable distribution sarge. %NASLMINLEVEL 70300 C Tenable Network Security,...

Debian DSA-1421-1 : wesnoth - directory traversal

A vulnerability has been discovered in Battle for Wesnoth that allows remote attackers to read arbitrary files the user running the client has access to on the machine running the game client. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-1419-1 : openoffice.org - programming error

A vulnerability has been discovered in HSQLDB, the default database engine shipped with OpenOffice.org. This could result in the execution of arbitrary Java code embedded in a OpenOffice.org database document with the user's privilege. This update requires an update of both openoffice.org and...

Debian DSA-1418-1 : cacti - missing input sanitising

It was discovered that Cacti, a tool to monitor systems and networks, performs insufficient input sanitising, which allows SQL injection. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian DSA-1417-1 : asterisk - missing input sanitising

Tilghman Lesher discovered that the logging engine of Asterisk, a free software PBX and telephony toolkit, performs insufficient sanitising of call-related data, which may lead to SQL injection. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...