Debian DSA-1002-1 : webcalendar - several vulnerabilities

Several security related problems have been discovered in webcalendar, a PHP based multi-user calendar. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2005-3949 Multiple SQL injection vulnerabilities allow remote attackers to execute arbitrary SQ...

Debian DSA-1120-1 : mozilla-firefox - several vulnerabilities

Several security related problems have been discovered in Mozilla. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2006-1942 Eric Foley discovered that a user can be tricked to expose a local file to a remote attacker by displaying a local file as...

Debian DSA-1183-1 : kernel-source-2.4.27 - several vulnerabilities

Several security related problems have been discovered in the Linux kernel which may lead to a denial of service or even the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-4798 A buffer overflow in NFS readlink handling...

Debian DSA-951-2 : trac - missing input sanitising

This update corrects the search feature in trac, an enhanced wiki and issue tracking system for software development projects, which broke with the last security update. For completeness please find below the original advisory text : Several vulnerabilities have been discovered in trac, an enhanc...

Debian DSA-1108-1 : mutt - buffer overflow

It was discovered that the mutt mail reader performs insufficient validation of values returned from an IMAP server, which might overflow a buffer and potentially lead to the injection of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...

Debian DSA-1181-1 : gzip - several vulnerabilities

Tavis Ormandy from the Google Security Team discovered several vulnerabilities in gzip, the GNU compression utility. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-4334 A NULL pointer dereference may lead to denial of service if gzip is used in an...

Debian DSA-1167-1 : apache - missing input sanitising

Several remote vulnerabilities have been discovered in the Apache, the worlds most popular webserver, which may lead to the execution of arbitrary web script. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-3352 A cross-site scripting XSS flaw exist...

Debian DSA-1009-1 : crossfire - buffer overflow

A buffer overflow has been discovered in the crossfire game which allows remote attackers to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-1009. The text itself i...

Debian DSA-931-1 : xpdf - buffer overflows

'infamous41md' and Chris Evans discovered several heap based buffer overflows in xpdf, the Portable Document Format PDF suite, that can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-1140-1 : gnupg - integer overflow

Evgeny Legerov discovered that overly large comments can crash gnupg, the GNU privacy guard - a free PGP replacement. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-1140. The text itself ...

Debian DSA-917-1 : courier - programming error

Patrick Cheong Shu Yang discovered that courier-authdaemon, the authentication daemon of the Courier Mail Server, grants access to accounts that are already deactivated. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Debian DSA-1049-1 : ethereal - several vulnerabilities

Gerald Combs reported several vulnerabilities in ethereal, a popular network traffic analyser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-1932 The OID printing routine is susceptible to an off-by-one error. - CVE-2006-1933 The UMA and BER...

Debian DSA-1177-1 : usermin - programming error

Hendrik Weimer discovered that it is possible for a normal user to disable the login shell of the root account via usermin, a web-based administration tool. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-887-1 : clamav - several vulnerabilities

Several vulnerabilities have been discovered in Clam AntiVirus, the antivirus scanner for Unix, designed for integration with mail servers to perform attachment scanning. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-3239 The OLE2 unpacker allows...

Debian DSA-911-1 : gtk+2.0 - several vulnerabilities

Several vulnerabilities have been found in gtk+2.0, the Gtk+ GdkPixBuf XPM image rendering library. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-2975 Ludwig Nussel discovered an infinite loop when processing XPM images that allows an attacker to...

Debian DSA-999-1 : lurker - several vulnerabilities

Several security related problems have been discovered in lurker, an archive tool for mailing lists with integrated search engine. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-1062 Lurker's mechanism for specifying configuration files was...

Debian DSA-900-3 : fetchmail - programming error

Due to restrictive dependency definition for fetchmail-ssl the updated fetchmailconf package couldn't be installed on the old stable distribution woody together with fetchmail-ssl. Hence, this update loosens it, so that the update can be pulled in. For completeness we're including the original...

Debian DSA-1153-1 : clamav - buffer overflow

Damian Put discovered a heap overflow vulnerability in the UPX unpacker of the ClamAV anti-virus toolkit which could allow remote attackers to execute arbitrary code or cause denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-909-1 : horde3 - missing input sanitising

Daniel Schreckling discovered that the MIME viewer in horde3, a web application suite, does not always sanitise its input leaving a possibility to force the return of malicious code that could be executed on the victims machine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Debian DSA-1060-1 : kernel-patch-vserver - programming error

Jan Rekorajski discovered that the kernel patch for virtual private servers does not limit context capabilities to the root user within the virtual server, which might lead to privilege escalation for some virtual server specific operations. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...