[SECURITY] [DLA 80-1] libxml2 security update

Package : libxml2 Version : 2.7.8.dfsg-2+squeeze10 CVE ID : CVE-2014-0191 CVE-2014-3660 Sogeti found a denial of service flaw in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by ...

[SECURITY] [DSA 3059-1] dokuwiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3059-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 29, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 79-1] dokuwiki security update

Package : dokuwiki Version : 0.0.20091225c-10+squeeze3 CVE ID : CVE-2014-8763 CVE-2014-8764 Debian Bug : 766545 This fixes a possibility of bypasswing the wiki authentication when an Active Directory is used for LDAP authentication. These two CVE are almost the same, one apparently being a supers...

[SECURITY] [DSA 3050-2] xulrunner update

------------------------------------------------------------------------- Debian Security Advisory DSA-3050-2 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 28, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 58-3] apt robustness improvements

Package : apt Version : 0.8.10.3+squeeze7 Debian Bug : 710924 The recent security updates to apt make apt bug 710924 1 much easier to trigger. Affected users see "416 Requested Range Not Satisfiable" errors during a apt-get update operation. With the 0.8.10.3+squeeze7 upload the fix for this erro...

[SECURITY] [DLA 78-1] torque security update

Package : torque Version : 2.4.8+dfsg-9squeeze5 CVE ID : CVE-2014-3684 Chad Vizino reported a vulnerability in torque, a PBS-derived batch processing queueing system. A non-root user could exploit the flaw in the tmadopt library call to kill any process, including root-owned ones on any node in a...

[SECURITY] [DSA 3058-1] torque security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3058-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 27, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3058-1] torque security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3058-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 27, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3057-1] libxml2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3057-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst October 26, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 77-1] libtasn1-3 security update

Package : libtasn1-3 Version : 2.7-1+squeeze+2 CVE ID : CVE-2014-3467 CVE-2014-3468 CVE-2014-3469 Several vulnerabilities were discovered in libtasn1-3, a library that manages ASN1 Abstract Syntax Notation One structures. An attacker could use those to cause a denial-of-service via out-of-bounds...

[SECURITY] [DSA 3056-1] libtasn1-3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3056-1 [email protected] http://www.debian.org/security/ Sebastien Delafond October 26, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 76-1] kde4libs security update

Package : kde4libs Version : 4:4.4.5-2+squeeze4 CVE ID : CVE-2014-5033 It was discovered that KAuth, part of kdelibs, uses polkit in a way that is prone to a race condition that may allow authorization bypass...

[SECURITY] [DSA 3055-1] pidgin security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3055-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 23, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 75-1] mysql-5.1 security update

Package : mysql-5.1 Version : 5.1.73-1+deb6u1 CVE ID : CVE-2013-2162 CVE-2014-0001 CVE-2014-4274 This update fixes one important vulnerability CVE-2014-4274 and batches together two other minor fixes CVE-2013-2162, CVE-2014-0001. CVE-2014-4274 Insecure handling of a temporary file that could lead...

[SECURITY] [DLA 74-1] ppp security update

Package : ppp Version : 2.4.5-4+deb6u1 CVE ID : CVE-2014-3158 Debian Bug : http://bugs.debian.org/762789 This updates fixes a potential integer overflow in option parsing. A user in the group "dip" could provide a specially crafted configuration file of more than 2G and generate an integer...

[SECURITY] [DLA 73-1] tzdata update

Package : tzdata Version : 2014h-0squeeze1 Upstream published version 2014h. Changes since 2014e-0squeeze1 currently in squeeze are adjustments to the DST rules of Russia and a timezone change for Turks & Caicos. Aurelien Jarno GPG: 4096R/1DDD8C9B [email protected] http://www.aurel32.net...

[SECURITY] [DSA 3054-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3054-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 20, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3054-1] mysql-5.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3054-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 20, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 72-2] rsyslog regression update

Package : rsyslog Version : 4.6.4-2+deb6u2 The Wheezy patch left an unresolved symbol in the imklog module of the Squeeze version. rsyslog worked fine except that messages from the kernel couldnt be submitted any longer. This update fixes this issue...

[SECURITY] [DLA 72-1] rsylog security update

Package : rsylog Version : 4.6.4-2+deb6u1 CVE ID : CVE-2014-3634 CVE-2014-3683 CVE-2014-3634 Fix remote syslog vulnerability due to improper handling of invalid PRI values. CVE-2014-3683 Followup fix for CVE-2014-3634. The initial patch was incomplete. It did not cover cases where PRI values MAXI...

[SECURITY] [DSA 3050-1] iceweasel security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3050-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 15, 2014 http://www.debian.org/security/faq -...

[BSA-098] Security update for drupal7

Gunnar Wolf uploaded new packages for Drupal7 which fixed the following security problems: CVE 2014-3704 / SA-CORE-2014-005: Highly critical: Pre Auth SQL injection The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared...

[SECURITY] [DSA 3053-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3053-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst October 16, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 71-1] apache2 security update

Package : apache2 Version : 2.2.16-6+squeeze14 CVE ID : CVE-2013-5704 CVE-2014-3581 This update fixes two security issues with apache2. CVE-2013-5704 Disable the possibility to replace HTTP headers with HTTP trailers as this could be used to circumvent earlier header operations made by other...

[SECURITY] [DSA 3052-1] wpa security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3052-1 [email protected] http://www.debian.org/security/ Michael Gilbert October 15, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3052-1] wpa security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3052-1 [email protected] http://www.debian.org/security/ Michael Gilbert October 15, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3051-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3051-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 15, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3049-1] wireshark security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3049-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 14, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 58-2] apt regression fix

Package : apt Version : 0.8.10.3+squeeze6 CVE ID : CVE-2014-6273 This update fixes a regression introduced in 0.8.10.3+squeeze5 where apt would send invalid HTTP requests when sending If-Range queries. Thanks to Steven McDonald who reported1 the regression and to Michael Vogt for having uploaded ...

[SECURITY] [DSA 3048-1] apt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3048-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst October 08, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3047-1] rsyslog security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3047-1 [email protected] http://www.debian.org/security/ Luciano Bello October 08, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 70-1] tryton-server security update

Package : tryton-server Version : 1.6.1-2+squeeze2 CVE ID : CVE-2014-6633 duesenfranz discovered, that safeeval in trytond could be used to execute arbitrary commands, mainly via the webdav interface. The patches applied do not allow double underscores in safeeval and avoid double evaluation from...

[SECURITY] [DSA 3046-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3046-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 05, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3046-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3046-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso October 05, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3045-1] qemu security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3045-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 04, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3044-1] qemu-kvm security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3044-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 04, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3042-1] exuberant-ctags security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3042-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 04, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 69-1] exuberant-ctags security update

Package : exuberant-ctags Version : 1:5.8-3squeeze2 CVE ID : CVE-2014-7204 Debian Bug : 742605 Stefano Zacchiroli discovered that certain JavaScript input files cause ctags to enter an infinite loop until it runs out of disk space. This update fixes the JavaScript parser...

[SECURITY] [DSA 3041-1] xen security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3041-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 01, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3040-1] rsyslog security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3040-1 [email protected] http://www.debian.org/security/ September 30, 2014 http://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DLA 68-1] fex security update

Package : fex Version : 20100208+debian1-1+squeeze4 CVE ID : CVE-2014-3875 CVE-2014-3876 CVE-2014-3877 CVE-2014-3875 When inserting encoded newline characters into a request to rup, additional HTTP headers can be injected into the reply, as well as new HTML code on the top of the website...

[SECURITY] [DLA 67-1] php5 security update

Package : php5 Version : 5.3.3-7+squeeze22 CVE ID : CVE-2014-3538 CVE-2014-3587 CVE-2014-3597 CVE-2014-3538 It was discovered that the original fix for CVE-2013-7345 did not sufficiently address the problem. A remote attacker could still cause a denial of service CPU consumption via a...

[SECURITY] [DLA 66-1] apache2 security update

Package : apache2 Version : 2.2.16-6+squeeze13 CVE ID : CVE-2013-6438 CVE-2014-0118 CVE-2014-0226 CVE-2014-0231 CVE-2014-0231: prevent denial of service in modcgid. CVE-2014-0226: prevent denial of service via race in modstatus. CVE-2014-0118: fix resource consumption via moddeflate body...

[SECURITY] [DLA 65-1] python-django security update

Package : python-django Version : 1.2.3-3+squeeze11 CVE ID : CVE-2014-0480 CVE-2014-0481 CVE-2014-0482 CVE-2014-0483 This update address an issue with reverse generating external URLs; a denial of service involving file uploads; a potential session hijacking issue in the remote-user middleware; a...

[SECURITY] [DSA 3039-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3039-1 [email protected] http://www.debian.org/security/ Michael Gilbert September 28, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3039-1] chromium-browser security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3039-1 [email protected] http://www.debian.org/security/ Michael Gilbert September 28, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3038-1] libvirt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3038-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 27, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3038-1] libvirt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3038-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso September 27, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DLA 64-1] curl security update

Package : curl Version : 7.21.0-2.1+squeeze9 CVE ID : CVE-2014-3613 CVE-2014-3613 By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary site...

[SECURITY] [DSA 3037-1] icedove security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3037-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez September 26, 2014 http://www.debian.org/security/faq -...