[BSA-057] Security update for nss

This update to the NSS cryptographic libraries revokes the trust in the "DigiCert Sdn. Bhd" certificate authority. More information can be found in the Mozilla Security Blog: http://blog.mozilla.com/security/2011/11/03/revoking-trust-in-digicert-sdn-bhd-intermediate-certificate-authority/ This...

[BSA-052] Security Update for libvirt

Guido Günther uploaded new packages for libvirt which fixed the following security problems: CVE-2011-2511 Integer overflow in VirDomainGetVcpus CVE-2011-1486 Non thread safe error reporting For the squeeze-backports distribution the problems have been fixed in version 0.9.2-7bpo60+1. For the...

CVE-2011-2874

Google Chrome before 14.0.835.163 does not perform an expected pin operation for a self-signed certificate during a session, which has unspecified impact and remote attack vectors...

[BSA-047] Security Update for nss

Several unauthorised SSL certificates have been found in the wild issued for the DigiNotar Certificate Authority, obtained through a security compromise with said company. Debian, like other software distributors, has as a precaution decided to disable the DigiNotar Root CA by default in the NSS...

[BSA-039] Security Update for qemu-kvm

Michael Tokarev uploaded new packages for qemu-kvm which fixed the following security issues: CVE-2011-0011 Setting the VNC password to an empty string silently disabled all authentication. CVE-2011-1750 The virtio-blk driver performed insufficient validation of read/write I/O from the guest...

[BSA-035] Security Update for exim4

Andreas Metzler uploaded new packages for exim4 which fixed the following security problems: CVE-2011-1764 DKIM related format string vulnerability For the lenny-backports distribution the problems have been fixed in version 4.72-6+squeeze1bpo50+1. For the stable distribution squeeze, this proble...

[BSA-034] Security Update for iceweasel

Mike Hommey uploaded new packages for iceweasel which fixed the following security problems: CVE-2011-0069 CVE-2011-0070 CVE-2011-0072 CVE-2011-0074 CVE-2011-0075 CVE-2011-0077 CVE-2011-0078 CVE-2011-0080 CVE-2011-0081 "Scoobidiver", Ian Beer Bob Clary, Henri Sivonen, Marco Bonardo, Mats Palmgren...

[BSA-033] Security Update for request-tracker3.8

Jan Wagner uploaded new packages for request-tracker3.8 which fixed the following security problems: CVE-2011-1685 If the external custom field feature is enabled, Request Tracker allows authenticated users to execute arbitrary code with the permissions of the web server, possible triggered by a...

[BSA-030] Security update for nss

This update for the Network Security Service libraries marks several fraudulent HTTPS certificates as unstrusted. For the lenny-backports distribution the problems have been fixed in version 3.12,8-1+squeeze1bpo50+1. For the oldstable distribution lenny, this problem has been fixed in version...

[BSA-026] Security Update for subversion

Peter Samuelson uploaded new packages for subversion which fixed the following security problems: CVE-2011-0715 Subversions moddavsvn Apache HTTPD server module will dereference a NULL pointer if a lock token is sent in a HTTP request by a Subversion client which has not authenticated to the...

[BSA-027] Security Update for iceweasel

Mike Hommey uploaded new packages for iceweasel which fixed the following security problems: CVE-2010-1585 Roberto Suggi Liverani discovered that the sanitising performed by ParanoidFragmentSink was incomplete. CVE-2011-0053 Crashes in the layout engine may lead to the execution of arbitrary code...

[BSA-014] New Tor packages fix potential code execution

Willem Pinckaers discovered that Tor, a tool to enable online anonymity, does not correctly handle all data read from the network. By supplying specially crafted packets a remote attacker can cause Tor to overflow its heap, crashing the process in turn. Arbitrary code execution has not been...

BSA-009 Security Update for nss

Alexander Reichle-Schmehl uploaded new packages for nss which fixed the following security problems: CVE-2010-3170 NSS recognizes a wildcard IP address in the subjects Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a...

BSA-009 Security Update for nss

Alexander Reichle-Schmehl uploaded new packages for nss which fixed the following security problems: CVE-2010-3170 NSS recognizes a wildcard IP address in the subjects Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a...

Subject: BSA-008 Security Update for pidgin

Jan Wagner uploaded new packages for pidgin which fixed the following security problems: CVE-2010-3711 Fixes multiple remotely-triggered DoSes https://vulners.com/cve/CVE-2010-3711 For the lenny-backports distribution the problems have been fixed in version 2.7.3-1bpo50+2. For the unstable sid...

Subject: BSA-007 Security Update for mailscanner

Jan Wagner uploaded new packages for mailscanner which fixed the following security problems: CVE-2010-3095 incomplete fix for CVE-2008-5313 https://vulners.com/cve/CVE-2010-3095 The original text of CVE-2008-5313: mailscanner 4.68.8 and other versions before 4.74.16-1 might allow local users to...

BSA-003 Security Update for samba

Christian Perrier uploaded new packages for samba which fixed the following security problems: CVE-2010-3069 A vulnerability has been discovered in samba, a SMB/CIFS file, print, and login server for Unix. The sidparse function does not correctly check its input lengths when reading a binary...

Security update for openoffice.org

Rene Engelhard uploaded new packages for openoffice.org which fixed the following security problems: CVE-2010-2935 CVE-2010-2936: Charlie Miller has discovered two vulnerabilities in OpenOffice.org Impress, which can be exploited by malicious people to compromise a users system and execute...

[Backports-security-announce] Security Update for iceweasel

Alexander Reichle-Schmehl uploaded new packages for iceweasel which fixed the following security problems: CVE-2010-1206: The startDocumentLoad function in browser/base/content/browser.js in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, does not properly...

[Backports-security-announce] Security Update for drupal6

Luigi Gangitano uploaded new packages for drupal6 which fixed the following security problems: SA-CORE-2010-001 Multiple vulnerabilities and weaknesses were discovered in Drupal. Installation cross site scripting A user-supplied value is directly output during installation allowing a malicious us...