Debian DSA-1276-1 : krb5 - several vulnerabilities

Several remote vulnerabilities have been discovered in the MIT reference implementation of the Kerberos network authentication protocol suite, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-0956 It...

Debian DSA-1273-1 : nas - several vulnerabilities

Several vulnerabilities have been discovered in nas, the Network Audio System. - CVE-2007-1543 A stack-based buffer overflow in the acceptattlocal function in server/os/connection.c in nas allows remote attackers to execute arbitrary code via a long path slave name in a USL socket connection. -...

Debian DSA-1272-1 : tcpdump - buffer overflow

Moritz Jodeit discovered an off-by-one buffer overflow in tcpdump, a powerful tool for network monitoring and data acquisition, which allows denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-1270-2 : openoffice.org - several vulnerabilities

Several security related problems have been discovered in OpenOffice.org, the free office suite. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-0002 iDefense reported several integer overflow bugs in libwpd, a library for handling WordPerfect...

Debian DSA-1268-1 : libwpd - integer overflow

iDefense reported several integer overflow bugs in libwpd, a library for handling WordPerfect documents. Attackers were able to exploit these with carefully crafted Word Perfect files that could cause an application linked with libwpd to crash or possibly execute arbitrary code. %NASLMINLEVEL 703...

Debian DSA-1266-1 : gnupg - several vulnerabilities

Gerardo Richarte discovered that GnuPG, a free PGP replacement, provides insufficient user feedback if an OpenPGP message contains both unsigned and signed portions. Inserting text segments into an otherwise signed message could be exploited to forge the content of signed messages. This update...

Debian DSA-1265-1 : mozilla - several vulnerabilities

Several security related problems have been discovered in Mozilla and derived products. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2006-6497 Several vulnerabilities in the layout engine allow remote attackers to cause a denial of service and...

Debian DSA-1262-1 : gnomemeeting - format string

'Mu Security' discovered that a format string vulnerability in the VoIP solution GnomeMeeting allows the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-1262...

Debian DSA-1261-1 : postgresql - several vulnerabilities

It was discovered that the PostgreSQL database performs insufficient type checking for SQL function arguments, which might lead to denial of service or information disclosure. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...

Debian DSA-1259-1 : fetchmail - programming error

Isaac Wilcox discovered that fetchmail, a popular mail retrieval and forwarding utility, insufficiently enforces encryption of connections, which might lead to information disclosure. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-1260-1 : imagemagick - buffer overflow

Vladimir Nadvornik discovered that the fix for a vulnerability in the PALM decoder of Imagemagick, a collection of image manipulation programs, was ineffective. To avoid confusion a new CVE ID has been assigned; the original issue was tracked as CVE-2006-5456. %NASLMINLEVEL 70300 C Tenable Networ...

Debian DSA-1255-1 : libgtop2 - buffer overflow

Liu Qishuai discovered that the GNOME gtop library performs insufficient sanitising when parsing the system's /proc table, which may lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Debian DSA-1256-1 : gtk+2.0 - programming error

It was discovered that the image loading code in the GTK+ graphical user interface library performs insufficient error handling when loading malformed images, which may lead to denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-1254-1 : bind9 - insufficient input sanitising

It was discovered that the Bind name server daemon is vulnerable to denial of service by triggering an assertion through a crafted DNS query. This only affects installations which use the DNSSEC extentions. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

Debian DSA-1252-1 : vlc - format string

Kevin Finisterre discovered several format string problems in vlc, a multimedia player and streamer, that could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

Debian DSA-1258-1 : mozilla-thunderbird - several vulnerabilities

Several security related problems have been discovered in Mozilla and derived products such as Mozilla Firefox. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2006-6497 Several vulnerabilities in the layout engine allow remote attackers to cause ...

Samba服务器VFS插件afsacl.so远程格式串处理漏洞

Samba是一套实现SMB（Server Messages Block）协议、跨平台进行文件共享和打印共享服务的程序。 Samba的VFS插件afsacl.so库在处理文件名时存在格式串漏洞，攻击者可能利用此漏洞诱使用户处理恶意的VFS分区控制服务器。 Samba在调用snprintf时将磁盘上所储存的文件名用作了格式串，如果用户能够写入的共享使用Samba的afsacl.so库对AFS文件系统上的文件设置Windows NT访问控制列表的话，就可能通过文件名中的格式串标识符导致执行任意代码。 这个漏洞仅影响与CIFS共享了AFS文件系统并在smb.conf中明确要求加载afsacl.s...

Debian DSA-1250-1 : cacti - missing input sanitising

It was discovered that cacti, a frontend to rrdtool, performs insufficient validation of data passed to the 'cmd' script, which allows SQL injection and the execution of arbitrary shell commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-1251-1 : netrick - insufficient escaping

It has been discovered that netrik, a text mode WWW browser with vi like keybindings, doesn't properly sanitize temporary filenames when editing textareas which could allow attackers to execute arbitrary commands via shell metacharacters. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-1249-1 : xfree86 - several vulnerabilities

Several vulnerabilities have been discovered in the X Window System, which may lead to privilege escalation or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-6101 Sean Larsson discovered an integer overflow in the Render extensio...