Debian DSA-1299-1 : ipsec-tools - missing input sanitising

It was discovered that a specially crafted packet sent to the racoon ipsec key exchange server could cause a tunnel to crash, resulting in a denial of service. The oldstable distribution sarge isn't affected by this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive tex...

[SECURITY] [DSA 1299-1] New ipsec-tools packages fix denial of service

--------------------------------------------------------------------------- Debian Security Advisory DSA 1299-1 [email protected] http://www.debian.org/security/ dann frazier June 7th, 2007 http://www.debian.org/security/faq -...

Debian DSA-1298-1 : otrs2 - missing input sanitising

It was discovered that the Open Ticket Request System performs insufficient input sanitising for the Subaction parameter, which allows the injection of arbitrary web script code. The oldstable distribution sarge doesn't include otrs2. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-1296-1 : php4 - missing input sanitising

It was discovered that the ftp extension of PHP, a server-side, HTML-embedded scripting language performs insufficient input sanitising, which permits an attacker to execute arbitrary FTP commands. This requires the attacker to already have access to the FTP server. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-1267-1 : webcalendar - missing input sanitising

It was discovered that WebCalendar, a PHP-based calendar application, insufficiently protects an internal variable, which allows remote file inclusion. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

[SECURITY] [DSA 1248-1] New libsoup packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1248-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 12nd, 2007 http://www.debian.org/security/faq -...

Debian DSA-1010-1 : ilohamail - missing input sanitising

Ulf Harnhammar from the Debian Security Audit Project discovered that ilohamail, a lightweight multilingual web-based IMAP/POP3 client, does not always sanitise input provided by users which allows remote attackers to inject arbitrary web script or HTML. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-953-1 : flyspray - missing input sanitising

Several cross-site scripting vulnerabilities have been discovered in flyspray, a lightweight bug tracking system, which allows attackers to insert arbitrary script code into the index page. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Debian DSA-1066-1 : phpbb2 - missing input sanitising

It was discovered that phpbb2, a web-based bulletin board, does insufficiently sanitise values passed to the 'Font Colour 3' setting, which might lead to the execution of injected code by admin users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-1144-1 : chmlib - missing input sanitising

It was discovered that one of the utilities shipped with chmlib, a library for dealing with Microsoft CHM files, performs insufficient sanitising of filenames, which might lead to directory traversal. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-1130-1 : sitebar - missing input validation

A cross-site scripting vulnerability has been discovered in sitebar, a web-based bookmark manager written in PHP, which allows remote attackers to inject arbitrary web script or HTML. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

[SECURITY] [DSA 1133-1] New mantis packages fix execution of arbitrary web script code

-------------------------------------------------------------------------- Debian Security Advisory DSA 1133-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff August 1st, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1061-1] New popfile packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 1061-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 19th, 2006 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1058-1] New awstats packages fix arbitrary command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1058-1 [email protected] http://www.debian.org/security/ Martin Schulze May 18th, 2006 http://www.debian.org/security/faq -...

Debian DSA-869-1 : eric - missing input sanitising

The developers of eric, a full featured Python IDE, have fixed a bug in the processing of project files that could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securi...

Debian DSA-847-1 : dia - missing input sanitising

Joxean Koret discovered that the Python SVG import plugin in dia, a vector-oriented diagram editor, does not properly sanitise data read from an SVG file and is hence vulnerable to execute arbitrary Python code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-820-1 : courier - missing input sanitising

Jakob Balle discovered that with 'Conditional Comments' in Internet Explorer it is possible to hide JavaScript code in comments that will be executed when the browser views a malicious email via sqwebmail. Successful exploitation requires that the user is using Internet Explorer. %NASLMINLEVEL...

[SECURITY] [DSA 820-1] New courier packages fix cross-site scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 820-1 [email protected] http://www.debian.org/security/ Martin Schulze September 24th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 782-1] New bluez-utils packages fix arbitrary command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 782-1 [email protected] http://www.debian.org/security/ Martin Schulze August 23rd, 2005 http://www.debian.org/security/faq -...

Debian DSA-782-1 : bluez-utils - missing input sanitising

Henryk Plotz discovered a vulnerability in bluez-utils, tools and daemons for Bluetooth. Due to missing input sanitising it is possible for an attacker to execute arbitrary commands supplied as device name from the remote device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...