5706 matches found
Debian DSA-879-1 : gallery - programming error
A bug in gallery has been discovered that grants all registrated postnuke users full access to the gallery. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-879. The text itself is copyrigh...
Debian DSA-1032-1 : zope-cmfplone - programming error
It was discovered that the Plone content management system lacks security declarations for three internal classes. This allows manipulation of user portraits by unprivileged users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
Debian DSA-1038-1 : xzgv - programming error
Andrea Barisani discovered that xzgv, a picture viewer for X with a thumbnail-based selector, attempts to decode JPEG images within the CMYK/YCCK colour space incorrectly, which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive tex...
Debian DSA-1106-1 : ppp - programming error
Marcus Meissner discovered that the winbind plugin in pppd does not check whether a setuid call has been successful when trying to drop privileges, which may fail with some PAM configurations. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...
Debian DSA-1143-1 : dhcp - programming error
Justin Winschief and Andrew Steets discovered a bug in dhcp, the DHCP server for automatic IP address assignment, which causes the server to unexpectedly exit. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...
Debian DSA-1156-1 : kdebase - programming error
Ludwig Nussel discovered that kdm, the X display manager for KDE, handles access to the session type configuration file insecurely, which may lead to the disclosure of arbitrary files through a symlink attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...
Debian DSA-1028-1 : libimager-perl - programming error
Kjetil Kjernsmo discovered a bug in libimager-perl, a Perl extension for generating 24 bit images, which can lead to a segmentation fault if it operates on 4-channel JPEG images. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
Debian DSA-1037-1 : zgv - programming error
Andrea Barisani discovered that zgv, an svgalib graphics viewer, attempts to decode JPEG images within the CMYK/YCCK colour space incorrectly, which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...
Debian DSA-900-3 : fetchmail - programming error
Due to restrictive dependency definition for fetchmail-ssl the updated fetchmailconf package couldn't be installed on the old stable distribution woody together with fetchmail-ssl. Hence, this update loosens it, so that the update can be pulled in. For completeness we're including the original...
Debian DSA-1092-1 : mysql-dfsg-4.1 - programming error
Josh Berkus and Tom Lane discovered that MySQL 4.1, a popular SQL database, incorrectly parses a string escaped with mysqlrealescape which could lead to SQL injection. This problem does only exist in versions 4.1 and 5.0. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...
Debian DSA-1077-1 : lynx-ssl - programming error
Michal Zalewski discovered that lynx, the popular text-mode WWW Browser, is not able to grok invalid HTML including a TEXTAREA tag with a large COLS value and a large tag name in an element that is not terminated, and loops forever trying to render the broken HTML. The same code is present in...
Debian DSA-1060-1 : kernel-patch-vserver - programming error
Jan Rekorajski discovered that the kernel patch for virtual private servers does not limit context capabilities to the root user within the virtual server, which might lead to privilege escalation for some virtual server specific operations. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...
Debian DSA-1015-1 : sendmail - programming error
Mark Dowd discovered a flaw in the handling of asynchronous signals in sendmail, a powerful, efficient, and scalable mail transport agent. This allows a remote attacker to exploit a race condition to execute arbitrary code as root. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
Debian DSA-1146-1 : krb5 - programming error
In certain application programs packaged in the MIT Kerberos 5 source distribution, calls to setuid and seteuid are not always checked for success and may fail with some PAM configurations. A local user could exploit one of these vulnerabilities to result in privilege escalation. No exploit code ...
Debian DSA-1040-1 : gdm - programming error
A vulnerability has been identified in gdm, a display manager for X, that could allow a local attacker to gain elevated privileges by exploiting a race condition in the handling of the .ICEauthority file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks...
Debian DSA-978-1 : gnupg - programming error
Tavis Ormandy noticed that gnupg, the GNU privacy guard - a free PGP replacement, verifies external signatures of files successfully even though they don't contain a signature at all. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
[SECURITY] [DSA 1180-1] New bomberclone packages fix several vulnerabilities
-------------------------------------------------------------------------- Debian Security Advisory DSA 1180-1 [email protected] http://www.debian.org/security/ Martin Schulze September 19th, 2006 http://www.debian.org/security/faq -...
[SECURITY] [DSA 1179-1] New alsaplayer packages fix denial of service
-------------------------------------------------------------------------- Debian Security Advisory DSA 1179-1 [email protected] http://www.debian.org/security/ Martin Schulze September 19th, 2006 http://www.debian.org/security/faq -...
[SECURITY] [DSA 1177-1] New usermin packages fix denial of service
-------------------------------------------------------------------------- Debian Security Advisory DSA 1177-1 [email protected] http://www.debian.org/security/ Martin Schulze September 15th, 2006 http://www.debian.org/security/faq -...
[SECURITY] [DSA 1176-1] New zope2.7 packages fix information disclosure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1176-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff September 13th, 2006 http://www.debian.org/security/faq -...