[SECURITY] [DLA 72-1] rsylog security update

Package : rsylog Version : 4.6.4-2+deb6u1 CVE ID : CVE-2014-3634 CVE-2014-3683 CVE-2014-3634 Fix remote syslog vulnerability due to improper handling of invalid PRI values. CVE-2014-3683 Followup fix for CVE-2014-3634. The initial patch was incomplete. It did not cover cases where PRI values MAXI...

[SECURITY] [DSA 3050-1] iceweasel security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3050-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 15, 2014 http://www.debian.org/security/faq -...

[BSA-098] Security update for drupal7

Gunnar Wolf uploaded new packages for Drupal7 which fixed the following security problems: CVE 2014-3704 / SA-CORE-2014-005: Highly critical: Pre Auth SQL injection The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared...

[SECURITY] [DSA 3053-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3053-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst October 16, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 71-1] apache2 security update

Package : apache2 Version : 2.2.16-6+squeeze14 CVE ID : CVE-2013-5704 CVE-2014-3581 This update fixes two security issues with apache2. CVE-2013-5704 Disable the possibility to replace HTTP headers with HTTP trailers as this could be used to circumvent earlier header operations made by other...

[SECURITY] [DSA 3052-1] wpa security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3052-1 [email protected] http://www.debian.org/security/ Michael Gilbert October 15, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3052-1] wpa security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3052-1 [email protected] http://www.debian.org/security/ Michael Gilbert October 15, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3051-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3051-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 15, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3049-1] wireshark security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3049-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 14, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 58-2] apt regression fix

Package : apt Version : 0.8.10.3+squeeze6 CVE ID : CVE-2014-6273 This update fixes a regression introduced in 0.8.10.3+squeeze5 where apt would send invalid HTTP requests when sending If-Range queries. Thanks to Steven McDonald who reported1 the regression and to Michael Vogt for having uploaded ...

[SECURITY] [DSA 3048-1] apt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3048-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst October 08, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3047-1] rsyslog security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3047-1 [email protected] http://www.debian.org/security/ Luciano Bello October 08, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 70-1] tryton-server security update

Package : tryton-server Version : 1.6.1-2+squeeze2 CVE ID : CVE-2014-6633 duesenfranz discovered, that safeeval in trytond could be used to execute arbitrary commands, mainly via the webdav interface. The patches applied do not allow double underscores in safeeval and avoid double evaluation from...

[SECURITY] [DSA 3046-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3046-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 05, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3046-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3046-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 05, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3045-1] qemu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3045-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 04, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3044-1] qemu-kvm security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3044-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 04, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3042-1] exuberant-ctags security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3042-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 04, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 69-1] exuberant-ctags security update

Package : exuberant-ctags Version : 1:5.8-3squeeze2 CVE ID : CVE-2014-7204 Debian Bug : 742605 Stefano Zacchiroli discovered that certain JavaScript input files cause ctags to enter an infinite loop until it runs out of disk space. This update fixes the JavaScript parser...

[SECURITY] [DSA 3041-1] xen security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3041-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 01, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3040-1] rsyslog security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3040-1 [email protected] http://www.debian.org/security/ September 30, 2014 http://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DLA 68-1] fex security update

Package : fex Version : 20100208+debian1-1+squeeze4 CVE ID : CVE-2014-3875 CVE-2014-3876 CVE-2014-3877 CVE-2014-3875 When inserting encoded newline characters into a request to rup, additional HTTP headers can be injected into the reply, as well as new HTML code on the top of the website...

[SECURITY] [DLA 67-1] php5 security update

Package : php5 Version : 5.3.3-7+squeeze22 CVE ID : CVE-2014-3538 CVE-2014-3587 CVE-2014-3597 CVE-2014-3538 It was discovered that the original fix for CVE-2013-7345 did not sufficiently address the problem. A remote attacker could still cause a denial of service CPU consumption via a...

[SECURITY] [DLA 66-1] apache2 security update

Package : apache2 Version : 2.2.16-6+squeeze13 CVE ID : CVE-2013-6438 CVE-2014-0118 CVE-2014-0226 CVE-2014-0231 CVE-2014-0231: prevent denial of service in modcgid. CVE-2014-0226: prevent denial of service via race in modstatus. CVE-2014-0118: fix resource consumption via moddeflate body...

[SECURITY] [DLA 65-1] python-django security update

Package : python-django Version : 1.2.3-3+squeeze11 CVE ID : CVE-2014-0480 CVE-2014-0481 CVE-2014-0482 CVE-2014-0483 This update address an issue with reverse generating external URLs; a denial of service involving file uploads; a potential session hijacking issue in the remote-user middleware; a...

[SECURITY] [DSA 3039-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3039-1 [email protected] http://www.debian.org/security/ Michael Gilbert September 28, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3039-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3039-1 [email protected] http://www.debian.org/security/ Michael Gilbert September 28, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3038-1] libvirt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3038-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 27, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3038-1] libvirt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3038-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 27, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 64-1] curl security update

Package : curl Version : 7.21.0-2.1+squeeze9 CVE ID : CVE-2014-3613 CVE-2014-3613 By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary site...

[SECURITY] [DSA 3037-1] icedove security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3037-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez September 26, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3036-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3036-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst September 26, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 63-1] bash security update

Package : bash Version : 4.1-3+deb6u2 CVE ID : CVE-2014-7169 Debian Bug : 762760 762761 Tavis Ormandy discovered that the patch applied to fix CVE-2014-6271 released in DSA-3032-1 for bash, the GNU Bourne-Again Shell, was incomplete and could still allow some characters to be injected into anothe...

[SECURITY] [DSA 3035-1] bash security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3035-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 25, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3035-1] bash security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3035-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 25, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 62-1] nss security update

Package : nss Version : 3.12.8-1+squeeze9 CVE ID : CVE-2014-1568 Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS the Mozilla Network Security Service library was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. An attacker could craf...

[SECURITY] [DSA 3034-1] iceweasel security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3034-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez September 25, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3033-1] nss security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3033-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez September 25, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 61-1] libplack-perl security update

Package : libplack-perl Version : 0.9941-1+deb6u1 CVE ID : CVE-2014-5269 Apply fix for CVE-2014-5269: Plack::App::File would previously strip trailing slashes off provided paths. This could under specific circumstances lead to the unintended delivery of files. For details see...

[SECURITY] [DLA 60-1] icinga security update

Package : icinga Version : 1.0.2-2+squeeze2 CVE ID : CVE-2013-7108 CVE-2014-1878 Two fixes for the Classic UI: - fix off-by-one memory access in processcgivars CVE-2013-7108 - prevent possible buffer overflows in cmd.cgi CVE-2014-1878...

[SECURITY] [email protected]

Package : bash Version : 4.1-3+deb6u1 CVE ID : CVE-2014-6271 Stephane Chazelas discovered a vulnerability in bash, the GNU Bourne-Again Shell, related to how environment variables are processed. In many common configurations, this vulnerability is exploitable over the network, especially if bash...

[SECURITY] [email protected]

Package : bash Version : 4.1-3+deb6u1 CVE ID : CVE-2014-6271 Stephane Chazelas discovered a vulnerability in bash, the GNU Bourne-Again Shell, related to how environment variables are processed. In many common configurations, this vulnerability is exploitable over the network, especially if bash...

[SECURITY] [DSA 3032-1] bash security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3032-1 [email protected] http://www.debian.org/security/ Florian Weimer September 24, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 58-1] apt security update

Package : apt Version : 0.8.10.3+squeeze5 CVE ID : CVE-2014-6273 The Google Security Team discovered a buffer overflow vulnerability in the HTTP transport code in apt-get. An attacker able to man-in-the-middle a HTTP request to an apt repository can trigger the buffer overflow, leading to a crash...

[SECURITY] [DSA 3031-1] apt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3031-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 23, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3031-1] apt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3031-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 23, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3030-1] mantis security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3030-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff September 20, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3029-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3029-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 20, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3029-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3029-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 20, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3025-2] apt regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3025-2 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 18, 2014 http://www.debian.org/security/faq -...