maradns -- denial of service when resolving a long DNS hostname

MaraDNS developer Sam Trenholme reports: ... a mistake in allocating an array of integers, allocating it in bytes instead of sizeofint units. This resulted in a buffer being too small, allowing it to be overwritten. The impact of this programming error is that MaraDNS can be crashed by sending...

[SECURITY] [DSA 2108-1] New cvsnt package fixes arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - ------------------------------------------------------------------------ Debian Security Advisory DSA-2108-1 [email protected] http://www.debian.org/security/ Sebastien Delafond Sep 14, 2010 http://www.debian.org/security/faq - -...

Debian DSA-2108-1 : cvsnt - programming error

It has been discovered that in cvsnt, a multi-platform version of the original source code versioning system CVS, an error in the authentication code allows a malicious, unprivileged user, through the use of a specially crafted branch name, to gain write access to any module or directory, includi...

Debian Security Advisory DSA 2087-1 (cabextract)

The remote host is missing an update to cabextract announced via advisory DSA 2087-1. OpenVAS Vulnerability Test $Id: deb20871.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2087-1 cabextract Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

Debian: Security Advisory (DSA-2087-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 2078-1] New kvirc packages fix arbitrary IRC command execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-2078-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 31, 2010 http://www.debian.org/security/faq -...

Debian DSA-2087-1 : cabextract - programming error

It was discovered that a programming error in the archive test mode of cabextract, a program to extract Microsoft Cabinet files, could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...

DSA-2087-1 cabextract - arbitrary code execution

Bulletin has no description...

Debian DSA-2078-1 : kvirc - programming error

It was discovered that incorrect parsing of CTCP commands in kvirc, a KDE-based IRC client, could lead to the execution of arbitrary IRC commands against other users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

[SECURITY] [DSA 2078-1] New kvirc packages fix arbitrary IRC command execution

------------------------------------------------------------------------ Debian Security Advisory DSA-2078-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 31, 2010 http://www.debian.org/security/faq -...

FreeBSD Security Advisory (FreeBSD-SA-10:05.opie.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-10:05.opie.asc SPDX-FileCopyrightText: 2010 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Debian DSA-2036-1 : jasper - programming error

It was discovered that the JasPer JPEG-2000 runtime library allowed an attacker to create a crafted input file that could lead to denial of service and heap corruption. Besides addressing this vulnerability, this updates also addresses a regression introduced in the security fix for CVE-2008-3521...

Debian DSA-2027-1 : xulrunner - several vulnerabilities

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0174 Jesse Ruderman and Ehsan Akhgari discovered crashes...

DSA-2027-1 xulrunner - several vulnerabilities

Bulletin has no description...

Debian DSA-1886-1 : iceweasel - several vulnerabilities

Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3079 'mozbugra4' discovered that a programming error in the FeedWriter...

Debian DSA-1837-1 : dbus - programming error

It was discovered that the dbussignaturevalidate function in dbus, a simple interprocess messaging system, is prone to a denial of service attack. This issue was caused by an incorrect fix for DSA-1658-1. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks...

Debian DSA-1831-1 : djbdns - programming error

Matthew Dempsky discovered that Daniel J. Bernstein's djbdns, a Domain Name System server, does not constrain offsets in the required manner, which allows remote attackers with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary record...

Debian DSA-1873-1 : xulrunner - programming error

Juan Pablo Lopez Yacubian discovered that incorrect handling of invalid URLs could be used for spoofing the location bar and the SSL certificate status of a web page. Xulrunner is no longer supported for the old stable distribution etch. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-1938-1 : php-mail - programming error

It was discovered that php-mail, a PHP PEAR module for sending email, has insufficient input sanitising, which might be used to obtain sensitive data from the system that uses php-mail. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin wer...

Debian DSA-1949-1 : php-net-ping - programming error

It was discovered that php-net-ping, a PHP PEAR module to execute ping independently of the Operating System, performs insufficient input sanitising, which might be used to inject arguments no CVE yet or execute arbitrary commands CVE-2009-4024 on a system that uses php-net-ping. %NASLMINLEVEL...