[SECURITY] [DSA 279-1] New metrics packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 279-1 [email protected] http://www.debian.org/security/ Martin Schulze April 7th, 2003 http://www.debian.org/security/faq -...

[SECURITY] [DSA 274-2] New mutt packages fix arbitrary code execution in potato

-------------------------------------------------------------------------- Debian Security Advisory DSA 274-2 [email protected] http://www.debian.org/security/ Martin Schulze April 7th, 2003 http://www.debian.org/security/faq -...

[SECURITY] [DSA 274-2] New mutt packages fix arbitrary code execution in potato

-------------------------------------------------------------------------- Debian Security Advisory DSA 274-2 [email protected] http://www.debian.org/security/ Martin Schulze April 7th, 2003 http://www.debian.org/security/faq -...

[SECURITY] [DSA-130-1] memory allocation error in ethereal

Package: ethereal Vulnerability: remotely triggered memory allocation error Debian-specific: no Ethereal versions prior to 0.9.3 were vulnerable to an allocation error in the ASN.1 parser. This can be triggered when analyzing traffic using the SNMP, LDAP, COPS, or Kerberos protocols in ethereal...

[SECURITY] [DSA-089-2] updated i386 icecast-server package

Package : icecast-server Problem type : remote exploit and others Debian-specific: no In Debian Security Advisory DSA-089-1 we reported that icecast-server has several security problems. For details please see that advisory. The i386 package mention in the DSA-089-1 advisory was incorrectly...

[SECURITY] [DSA-090-1] xtel symlink vulnerabilities

Package : xtel Problem type : symlink attack Debian-specific: no The xtel a X emulator for minitel package as distributed with Debian GNU/Linux 2.2 has two possible symlink attacks: xteld creates a temporary file /tmp/.xtel-user without checking for symlinks. when printing a hardcope xtel would...

[SECURITY] [DSA-040-1] slrn buffer overflow

Package : slrn Problem type : buffer overflow Debian-specific: no Bill Nottingham reported a problem in the wrapping/unwrapping functions of the slrn newsreader. A long header in a message might overflow a buffer and which could result into executing arbitraty code encoded in the message. The...

[SECURITY] [DSA-031-1] New version of sudo released

Package: sudo Vulnerability: buffer overflow Debian-specific: no Todd Miller announced a new version of sudo which corrects a buffer overflow that could potentially be used to gain root privilages on the local system. The fix from sudo 1.6.3p6 is available in sudo 1.6.2p2-1potato1 for Debian 2.2...

[SECURITY] New Debian xmcd packages released

Package: xmcd Vulnerability: untrustworthy privileged binaries Debian-specific: yes Vulnerable: yes The Debian GNU/Linux xmcd package has historically installed two setuid helpers for accessing cddb databases and SCSI cdrom drives. More recently, the package offered the administrator the chance t...

[SECURITY] New Debian ncurses packages released

Package: ncurses Vulnerability: local privilege escalation Debian-specific: no Vulnerable: yes The version of the ncurses display library shipped with Debian GNU/Linux 2.2 is vulnerable to several buffer overflows in the parsing of terminfo database files. This problem was discovered by Jouko...

[SECURITY] New version of ethereal released

Package : ethereal Problem type : remote exploit Debian-specific: no hacksware reported a buffer overflow in the AFS packet parsing code in ethereal. Gerald Combs then found more overflows in the netbios and ntp decoding logic as well. An attacker can exploit those overflows by sending carefully...

[SECURITY] New Debian cron packages released

Package: cron Vulnerability: local priviledge escalation Debian-specific: no Vulnerable: yes The version of Vixie Cron shipped with Debian GNU/Linux 2.2 is vulnerable to a local attack, discovered by Michal Zalewski. Several problems, including insecure permissions on temporary files and race...

[SECURITY] New version of gnupg installed

Package: gnupg Debian-specific: no The version of gnupg that was distributed in Debian GNU/Linux 2.2 had a logic error in the code that checks for valid signatures which could cause false positive results: Jim Small discovered that if the input contained multiple signed sections the exit-code gnu...

[SECURITY] New version of Debian php3 packages released (updated)

Package: php3 Vulnerability: possible remote exploit Debian-specific: no Vulnerable: yes Updated version: corrected URLs In versions of the PHP 3 packages before version 3.0.17, several format string bugs could allow properly crafted requests to execute code as the user running PHP scripts on the...

[SECURITY] New version of Debian php4 packages released (updated)

Package: php4 Vulnerability: possible remote exploit Debian-specific: no Vulnerable: yes Updated version: corrected URLs In versions of the PHP 4 packages before version 4.0.3, several format string bugs could allow properly crafted requests to execute code as the user running PHP scripts on the...

[SECURITY] New version of Debian php4 packages released

Package: php4 Vulnerability: possible remote exploit Debian-specific: no Vulnerable: yes In versions of the PHP 4 packages before version 4.0.3, several format string bugs could allow properly crafted requests to execute code as the user running PHP scripts on the web server. This problem is fixe...

[SECURITY] New versions of Debian traceroute packages

Package: traceroute Vulnerability: local root exploit Debian-specific: no Vulnerable: yes In versions of the traceroute package before 1.4a5-3, it is possible for a local user to gain root access by exploiting an argument parsing error. This problem is fixed in version 1.4a5-3, uploaded to Debian...

[SECURITY] New versions of Boa packages available

Package: boa Vulnerability: exposes contents of local files Debian-specific: no Vulnerable: yes In versions of boa before 0.94.8.3, it is possible to access files outside of the servers document root by the use of properly constructed URL requests. This problem is fixed in version 0.94.8.3-1,...

[SECURITY] Security policy for Debian 2.1 (slink) (updated)

Debian is phasing out support for Debian 2.1 slink. We believe that this will have a minimal impact on our user community as we expect that most slink users have already upgraded to potato. We had originally announced that support would end Sep 30, 2000. In response to feedback to our earlier...

[SECURITY] New versions of sysklogd released

Package: sysklogd Vulnerability: root exploit Debian-specific: no Multiple vulnerabilities have been reported in syslogd and klogd. A local root exploit is possible, and remote exploits may be possible in some cases though we are not currently aware of a remote exploit. Fixed packages are availab...