Debian DSA-1155-2 : sendmail - programming error

It turned out that the sendmail binary depends on libsasl2 = 2.1.19.dfsg1 which is neither available in the stable nor in the security archive. This version is scheduled for the inclusion in the next update of the stable release, though. You'll have to download the referenced file for your...

Debian DSA-1164-1 : sendmail - programming error

A programming error has been discovered in sendmail, an alternative mail transport agent for Debian, that could allow a remote attacker to crash the sendmail process by sending a specially crafted email message. Please note that in order to install this update you also need libsasl2 library from...

Debian DSA-1040-1 : gdm - programming error

A vulnerability has been identified in gdm, a display manager for X, that could allow a local attacker to gain elevated privileges by exploiting a race condition in the handling of the .ICEauthority file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks...

Debian DSA-978-1 : gnupg - programming error

Tavis Ormandy noticed that gnupg, the GNU privacy guard - a free PGP replacement, verifies external signatures of files successfully even though they don't contain a signature at all. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-879-1 : gallery - programming error

A bug in gallery has been discovered that grants all registrated postnuke users full access to the gallery. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-879. The text itself is copyrigh...

Debian DSA-1027-1 : mailman - programming error

A potential denial of service problem has been discovered in mailman, the web-based GNU mailing list manager. The failing parsing of messages with malformed mime multiparts sometimes caused the whole mailing list to become inoperative. The old stable distribution woody is not vulnerable to this...

Debian DSA-1028-1 : libimager-perl - programming error

Kjetil Kjernsmo discovered a bug in libimager-perl, a Perl extension for generating 24 bit images, which can lead to a segmentation fault if it operates on 4-channel JPEG images. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-1092-1 : mysql-dfsg-4.1 - programming error

Josh Berkus and Tom Lane discovered that MySQL 4.1, a popular SQL database, incorrectly parses a string escaped with mysqlrealescape which could lead to SQL injection. This problem does only exist in versions 4.1 and 5.0. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

Debian DSA-900-3 : fetchmail - programming error

Due to restrictive dependency definition for fetchmail-ssl the updated fetchmailconf package couldn't be installed on the old stable distribution woody together with fetchmail-ssl. Hence, this update loosens it, so that the update can be pulled in. For completeness we're including the original...

Debian DSA-917-1 : courier - programming error

Patrick Cheong Shu Yang discovered that courier-authdaemon, the authentication daemon of the Courier Mail Server, grants access to accounts that are already deactivated. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Debian DSA-1172-1 : bind9 - programming error

Two vulnerabilities have been discovered in BIND9, the Berkeley Internet Name Domain server. The first relates to SIG query processing and the second relates to a condition that can trigger an INSIST failure, both lead to a denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

Debian DSA-1177-1 : usermin - programming error

Hendrik Weimer discovered that it is possible for a normal user to disable the login shell of the root account via usermin, a web-based administration tool. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-1037-1 : zgv - programming error

Andrea Barisani discovered that zgv, an svgalib graphics viewer, attempts to decode JPEG images within the CMYK/YCCK colour space incorrectly, which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-1109-1 : rssh - programming error

Russ Allbery discovered that rssh, a restricted shell, performs insufficient checking of incoming commands, which might lead to a bypass of access restrictions. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian DSA-898-1 : phpgroupware - programming errors

Several vulnerabilities have been discovered in phpsysinfo, a PHP based host information application that is included in phpgroupware. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-0870 Maksymilian Arciemowicz discovered several cross site scripti...

Debian DSA-1038-1 : xzgv - programming error

Andrea Barisani discovered that xzgv, a picture viewer for X with a thumbnail-based selector, attempts to decode JPEG images within the CMYK/YCCK colour space incorrectly, which could lead to the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive tex...

Debian DSA-1156-1 : kdebase - programming error

Ludwig Nussel discovered that kdm, the X display manager for KDE, handles access to the session type configuration file insecurely, which may lead to the disclosure of arbitrary files through a symlink attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Debian DSA-873-1 : net-snmp - programming error

A security vulnerability has been found in Net-SNMP releases that could allow a denial of service attack against Net-SNMP agents that have opened a stream based protocol e.g. TCP but not UDP. By default, Net-SNMP does not open a TCP port. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-1106-1 : ppp - programming error

Marcus Meissner discovered that the winbind plugin in pppd does not check whether a setuid call has been successful when trying to drop privileges, which may fail with some PAM configurations. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-1176-1 : zope2.7 - programming error

It was discovered that the Zope web application server does not disable the csvtable directive in web pages containing ReST markup, allowing the exposure of files readable by the Zope server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...