Debian DSA-778-1 : mantis - missing input sanitising

Two security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-2556 A remote attacker could supply a specially crafted URL to scan arbitrary ports on arbitrary hosts tha...

Debian DSA-779-2 : mozilla-firefox - several vulnerabilities

We experienced that the update for Mozilla Firefox from DSA 779-1 unfortunately was a regression in several cases. Since the usual praxis of backporting apparently does not work, this update is basically version 1.0.6 with the version number rolled back, and hence still named 1.0.4-. For...

Debian DSA-782-1 : bluez-utils - missing input sanitising

Henryk Plotz discovered a vulnerability in bluez-utils, tools and daemons for Bluetooth. Due to missing input sanitising it is possible for an attacker to execute arbitrary commands supplied as device name from the remote device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

Debian DSA-780-1 : kdegraphics - wrong input sanitising

A bug has been discovered in the font handling code in xpdf, which is also present in kpdf, the PDF viewer for KDE. A specially crafted PDF file could cause infinite resource consumption, in terms of both CPU and disk space. The oldstable distribution woody is not affected by this problem...

DSA-779-2 mozilla-firefox - several

Bulletin has no description...

DSA-779-1 mozilla-firefox - several

Bulletin has no description...

Debian DSA-774-1 : fetchmail - buffer overflow

Edward Shornock discovered a bug in the UIDL handling code of fetchmail, a common POP3, APOP and IMAP mail fetching utility. A malicious POP3 server could exploit this problem and inject arbitrary code that will be executed on the victim host. If fetchmail is running as root, this becomes a root...

Debian DSA-776-1 : clamav - integer overflows, infinite loop

Several bugs were discovered in Clam AntiVirus, the antivirus scanner for Unix, designed for integration with mail servers to perform attachment scanning. The following problems were identified : - CAN-2005-2450 Neel Mehta and Alex Wheeler discovered that Clam AntiVirus is vulnerable to integer...

Debian DSA-772-1 : apt-cacher - missing input sanitising

Eduard Bloch discovered a bug in apt-cacher, a caching system for Debian package and source files, that could allow remote attackers to execute arbitrary commands on the caching host as user www-data. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-771-1 : pdns - several vulnerabilities

Several problems have been discovered in pdns, a versatile nameserver that can lead to a denial of service. The Common Vulnerabilities and Exposures project identifies the following problems : - CAN-2005-2301 Norbert Sendetzky and Jan de Groot discovered that the LDAP backend did not properly...

Debian DSA-767-1 : ekg - integer overflows

Marcin Slusarz discovered two integer overflow vulnerabilities in libgadu, a library provided and used by ekg, a console Gadu Gadu client, an instant messaging program, that could lead to the execution of arbitrary code. The library is also used by other packages such as kopete, which should be...

Debian DSA-770-1 : gopher - insecure tmpfile creating

John Goerzen discovered that gopher, a client for the Gopher Distributed Hypertext protocol, creates temporary files in an insecure fashion. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian DSA-765-1 : heimdal - buffer overflow

Gael Delalleau discovered a buffer overflow in the handling of the LINEMODE suboptions in telnet clients. Heimdal, a free implementation of Kerberos 5, also contains such a client. This can lead to the execution of arbitrary code when connected to a malicious server. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-763-1 : zlib - remote DoS

Markus Oberhumer discovered a flaw in the way zlib, a library used for file compression and decompression, handles invalid input. This flaw can cause programs which use zlib to crash when opening an invalid file. This problem does not affect the old stable distribution woody. %NASLMINLEVEL 70300 ...

Debian DSA-760-1 : ekg - several vulnerabilities

Several vulnerabilities have been discovered in ekg, a console Gadu Gadu client, an instant messaging program. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CAN-2005-1850 Marcin Owsiany and Wojtek Kaniewski discovered insecure temporary file creatio...

Debian DSA-762-1 : affix - several vulnerabilities

Kevin Finisterre discovered two problems in the Bluetooth FTP client from affix, user space utilities for the Affix Bluetooth protocol stack. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CAN-2005-2250 A buffer overflow allows remote attackers to...

Debian DSA-761-2 : heartbeat - insecure temporary files

The security update DSA 761-1 for heartbeat contained a bug which caused a regression. This problem is corrected with this advisory. For completeness below please find the original advisory text : Eric Romang discovered several insecure temporary file creations in heartbeat, the subsystem for...

Debian DSA-758-1 : heimdal - buffer overflow

A buffer overflow has been discovered in the telnet server from Heimdal, a free implementation of Kerberos 5, that could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-759-1 : phppgadmin - missing input sanitising

A vulnerability has been discovered in phppgadmin, a set of PHP scripts to administrate PostgreSQL over the WWW, that can lead to disclose sensitive information. Successful exploitation requires that 'magicquotesgpc' is disabled. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

Debian DSA-746-1 : phpgroupware - input validation error

A vulnerability had been identified in the xmlrpc library included with phpgroupware, a web-based application including email, calendar and other groupware functionality. This vulnerability could lead to the execution of arbitrary commands on the server running phpgroupware. The security team is...