Jump to content


NEW UPDATES Debian

debian updates sunrat bruno v.t. eric layton

  • Please log in to reply
1351 replies to this topic

#426 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 11 June 2012 - 03:17 AM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2492-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
June 10, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : php5
Vulnerability  : buffer overflow
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2386

The Phar extension for PHP does not properly handle crafted tar files,
leading to a heap-based buffer overflow.  PHP applications processing
tar files could crash or, potentially, execute arbitrary code.

In addition, this update addresses a regression which caused a crash
when accessing a global object that is returned as $this from __get.

For the stable distribution (squeeze), this problem has been fixed in
version 5.3.3-7+squeeze13.

For the testing distribution (wheezy) and the unstable distribution
(sid), this problem has been fixed in version 5.4.4~rc1-1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#427 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 12 June 2012 - 09:54 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2493-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
June 12, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : asterisk
Vulnerability  : denial of service
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2947 CVE-2012-2948
Debian Bug     : 675204 675210

Several vulnerabilities were discovered in Asterisk, a PBX and
telephony toolkit.

CVE-2012-2947
The IAX2 channel driver allows remote attackers to cause a
denial of service (daemon crash) by placing a call on hold
(when a certain mohinterpret setting is enabled).

CVE-2012-2948
The Skinny channel driver allows remote authenticated users to
cause a denial of service (NULL pointer dereference and daemon
crash) by closing a connection in off-hook mode.

In addition, it was discovered that Asterisk does not set the
alwaysauthreject option by default in the SIP channel driver.  This
allows remote attackers to observe a difference in response behavior
and check for the presence of account names.  (CVE-2011-2666)  System
administrators concerned by this user enumerating vulnerability should
enable the alwaysauthreject option in the configuration.  We do not
plan to change the default setting in the stable version
(Asterisk 1.6) in order to preserve backwards compatibility.

For the stable distribution (squeeze), this problem has been fixed in
version 1:1.6.2.9-2+squeeze6.

For the testing distribution (wheezy) and the unstable distribution
(sid), this problem has been fixed in version 1:1.8.13.0~dfsg-1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#428 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 14 June 2012 - 09:19 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2494-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
June 14, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : ffmpeg
Vulnerability  : several
Problem type   : local (remote)
Debian-specific: no
CVE ID         : CVE-2011-3951 CVE-2011-3952 CVE-2012-0851 CVE-2012-0852

It was discovered that ffmpeg, Debian's version of the libav media
codec suite, contains vulnerabilities in the DPCM codecs
(CVE-2011-3951), H.264 (CVE-2012-0851), ADPCM (CVE-2012-0852), and the
KMVC decoder (CVE-2011-3952).

In addition, this update contains bug fixes from the libav 0.5.9
upstream release.

For the stable distribution (squeeze), these problems have been fixed
in version 4:0.5.9-1.

For the unstable distribution (sid), these problems have been fixed in
version 6:0.8.3-1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#429 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 17 June 2012 - 12:04 AM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2495-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
June 16, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : openconnect
Vulnerability  : buffer overflow
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-3291

A buffer overflow was discovered in OpenConnect, a client for the Cisco
AnyConnect VPN, which could result in denial of service.

For the stable distribution (squeeze), this problem has been fixed in
version 2.25-0.1+squeeze1.

For the unstable distribution (sid), this problem has been fixed in
version 3.18-1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#430 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 18 June 2012 - 09:14 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2496-1                   security@debian.org
http://www.debian.org/security/                           Thijs Kinkhorst
June 18, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : mysql-5.1
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-0583 CVE-2012-1688 CVE-2012-1690 CVE-2012-1703
                 CVE-2012-2122
Debian Bug     : 670636 677018

Several issues have been discovered in the MySQL database server. The
vulnerabilities are addressed by upgrading MySQL to a new upstream
version, 5.1.63, which includes additional changes, such as performance
improvements and corrections for data loss defects.  These changes are
described in the MySQL release notes at:
http://dev.mysql.com...news-5-1-x.html

CVE-2012-2122, an authentication bypass vulnerability, occurs only when
MySQL has been built in with certain optimisations enabled. The packages
in Debian stable (squeeze) are not known to be affected by this
vulnerability. It is addressed in this update nonetheless, so future
rebuilds will not become vulnerable to this issue.

For the stable distribution (squeeze), these problems have been fixed in
version 5.1.63-0+squeeze1.

For the testing distribution (wheezy), these problems has been fixed
in version 5.1.62-1 of the mysql-5.1 package and version 5.5.24+dfsg-1
of the mysql-5.5 package.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#431 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 20 June 2012 - 08:28 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2497-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
June 20, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : quagga
Vulnerability  : denial of service
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1820
Debian Bug     : 676510

It was discovered that Quagga, a routing daemon, contains a
vulnerability in processing the ORF capability in BGP OPEN messages.
A malformed OPEN message from a previously configured BGP peer could
cause bgpd to crash, causing a denial of service.

For the stable distribution (squeeze), this problem has been fixed in
version 0.99.20.1-0+squeeze3.

For the testing distribution (wheezy) and the unstable distribution
(sid), this problem has been fixed in version 0.99.21-3.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#432 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 24 June 2012 - 08:30 AM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2499-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
June 24, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : icedove
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1937 CVE-2012-1939 CVE-2012-1940

Several vulnerabilities have been discovered in icedove, the Debian
version of the Mozilla Thunderbird mail/news client.  There were
miscellaneous memory safety hazards (CVE-2012-1937, CVE-2012-1939) and
a use-after-free issues (CVE-2012-1940).

For the stable distribution (squeeze), these problems have been fixed
in version 3.0.11-1+squeeze11.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2500-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
June 24, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : mantis
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1118 CVE-2012-1119 CVE-2012-1120 CVE-2012-1122
            CVE-2012-1123 CVE-2012-2692

Several vulnerabilities were discovered in Mantis, am issue tracking
system.

CVE-2012-1118
Mantis installation in which the private_bug_view_threshold
configuration option has been set to an array value do not
properly enforce bug viewing restrictions.

CVE-2012-1119
Copy/clone bug report actions fail to leave an audit trail.

CVE-2012-1120
The delete_bug_threshold/bugnote_allow_user_edit_delete
access check can be bypassed by users who have write
access to the SOAP API.

CVE-2012-1122
Mantis performed access checks incorrectly when moving bugs
between projects.

CVE-2012-1123
A SOAP client sending a null password field can authenticate
as the Mantis administrator.

CVE-2012-2692
Mantis does not check the delete_attachments_threshold
permission when a user attempts to delete an attachment from
an issue.

For the stable distribution (squeeze), these problems have been fixed
in version 1.1.8+dfsg-10squeeze2.


For the testing distribution (wheezy) and the unstable distribution
(sid), these problems have been fixed in version 1.2.11-1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#433 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 24 June 2012 - 09:19 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2501-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
June 24, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : xen
Vulnerability  : several
Problem type   : local
Debian-specific: no
CVE ID         : CVE-2012-0217 CVE-2012-0218 CVE-2012-2934

Several vulnerabilities were discovered in Xen, a hypervisor.

CVE-2012-0217
Xen does not properly handle uncanonical return addresses on
Intel amd64 CPUs, allowing amd64 PV guests to elevate to
hypervisor privileges.  AMD processors, HVM and i386 guests
are not affected.

CVE-2012-0218
Xen does not properly handle SYSCALL and SYSENTER instructions
in PV guests, allowing unprivileged users inside a guest
system to crash the guest system.

CVE-2012-2934
Xen does not detect old AMD CPUs affected by AMD Erratum #121.

For CVE-2012-2934, Xen refuses to start domUs on affected systems
unless the "allow_unsafe" option is passed.

For the stable distribution (squeeze), these problems have been fixed
in version 4.0.1-5.2.

For the testing distribution (wheezy) and the unstable distribution
(sid), these problems have been fixed in version
4.1.3~rc1+hg-20120614.a9c0a89c08f2-1.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2498-1                   security@debian.org
http://www.debian.org/security/                         Yves-Alexis Perez
June 23, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : dhcpcd
Vulnerability  : remote stack overflow
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2152
Debian Bug     : #671265

It was discovered that dhcpcd, a DHCP client, was vulnerable to a stack
overflow. A malformed DHCP message could crash the client, causing a denial of
service, and potentially remote code execution through properly designed
malicous DHCP packets.

For the stable distribution (squeeze), this problem has been fixed in
version 1:3.2.3-5+squeeze1.

For the testing distribution (wheezy), this problem has been fixed in
version 1:3.2.3-11.

For the unstable distribution (sid), this problem has been fixed in
version 1:3.2.3-11.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2502-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
June 24, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : python-crypto
Vulnerability  : programming error
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2417

It was discovered that that the ElGamal code in PythonCrypto, a
collection of cryptographic algorithms and protocols for Python used
insecure insufficient prime numbers in key generation, which lead to a
weakened signature or public key space, allowing easier brute force
attacks on such keys.

For the stable distribution (squeeze), this problem has been fixed in
version 2.1.0-2+squeeze1.

For the unstable distribution (sid), this problem has been fixed in
version 2.6-1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#434 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 28 June 2012 - 08:33 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2503-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
June 28, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : bcfg2
Vulnerability  : shell command injection
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-3366
Debian Bug     : 679272

It was discovered that malicious clients can trick the server
component of the Bcfg2 configuration management system to execute
commands with root privileges.

For the stable distribution (squeeze), this problem has been fixed in
version 1.0.1-3+squeeze2.

For the unstable distribution (sid), this problem has been fixed in
version 1.2.2-2.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2504-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
June 28, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libspring-2.5-java
Vulnerability  : information disclosure
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2011-2730
Debian Bug     : 677814

It was discovered that the Spring Framework contains an information
disclosure vulnerability in the processing of certain Expression
Language (EL) patterns, allowing attackers to access sensitive
information using HTTP requests.

NOTE: This update adds a springJspExpressionSupport context parameter
which must be manually set to false when the Spring Framework runs
under a container which provides EL support itself.

For the stable distribution (squeeze), this problem has been fixed in
version 2.5.6.SEC02-2+squeeze1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#435 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 29 June 2012 - 07:43 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2505-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
June 29, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : zendframework
Vulnerability  : information disclosure
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-3363
Debian Bug     : 679215

An XML External Entities inclusion vulnerability was discovered in
Zend Framework, a PHP library.  This vulnerability may allow attackers
to access to local files, depending on how the framework is used.

For the stable distribution (squeeze), this problem has been fixed in
version 1.10.6-1squeeze1.

For the unstable distribution (sid), this problem has been fixed in
version 1.11.12-1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#436 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 02 July 2012 - 09:09 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2506-1                   security@debian.org
http://www.debian.org/security/                         Yves-Alexis Perez
July 02, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libapache-mod-security
Vulnerability  : modsecurity bypass
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2751
Debian Bug     : #678529

Qualys Vulnerability & Malware Research Labs discovered a vulnerability in
ModSecurity, a security module for the Apache webserver. In situations where
both 'Content:Disposition: attachment' and 'Content-Type: multipart' were
present in HTTP headers, the vulernability could allow an attacker to bypass
policy and execute cross-site script (XSS) attacks through properly crafted
HTML documents.

For the stable distribution (squeeze), this problem has been fixed in
version 2.5.12-1+squeeze1.

For the testing distribution (wheezy), this problem has been fixed in
version 2.6.6-1.

For the unstable distribution (sid), this problem has been fixed in
version 2.6.6-1.

In testing and unstable distribution, the source package has been renamed to
modsecurity-apache.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#437 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 04 July 2012 - 08:50 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2507-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
July 04, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : openjdk-6
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1711 CVE-2012-1713 CVE-2012-1716 CVE-2012-1717
                 CVE-2012-1718 CVE-2012-1719 CVE-2012-1723 CVE-2012-1724
                 CVE-2012-1725

Several vulnerabilities have been discovered in OpenJDK, an
implementation of the Oracle Java platform.

CVE-2012-1711 CVE-2012-1719
  
   Multiple errors in the CORBA implementation could lead to
   breakouts of the Java sandbox  

CVE-2012-1713

   Missing input sanitising in the font manager could lead to
   the execution of arbitrary code.

CVE-2012-1716

   The SynthLookAndFeel Swing class could be abused to break
   out of the Java sandbox.

CVE-2012-1717

   Several temporary files were created insecurely, resulting in
   local information disclosure.

CVE-2012-1718  

   Certificate revocation lists were incorrectly implemented.

CVE-2012-1723 CVE-2012-1725

   Validation errors in the bytecode verifier of the Hotspot VM
   could lead to breakouts of the Java sandbox.

CVE-2012-1724

   Missing input sanitising in the XML parser could lead to denial
   of service through an infinite loop.

For the stable distribution (squeeze), this problem has been fixed in
version 6b18-1.8.13-0+squeeze2.

For the unstable distribution (sid), this problem has been fixed in
version 6b24-1.11.3-1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#438 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 08 July 2012 - 09:06 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2509-1                   security@debian.org
http://www.debian.org/security/                             Luciano Bello
July 08, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : pidgin
Vulnerability  : remote code execution
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-3374
Debian Bug     : #680661

Ulf Härnhammar found a buffer overflow in Pidgin, a multi protocol instant
messaging client. The vulnerability can be exploited by an incoming
message in the MXit protocol plugin. A remote attacker may cause a crash,
and in some circumstances can lead to remote code execution.

For the stable distribution (squeeze), this problem has been fixed in
version 2.7.3-1+squeeze3.

For the testing distribution (wheezy), this problem has been fixed in
version 2.10.4-1.1.

For the unstable distribution (sid), this problem has been fixed in
version 2.10.6-1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#439 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 12 July 2012 - 10:04 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2511-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
July 12, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : puppet
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-3864 CVE-2012-3865 CVE-2012-3866 CVE-2012-3867

Several security vulnerabilities have been found in Puppet, a
centralized configuration management:

CVE-2012-3864

   Authenticated clients could read arbitrary files on the puppet master.

CVE-2012-3865

   Authenticated clients could delete arbitrary files on the puppet master.

CVE-2012-3866

   The report of the most recent Puppet run was stored with world-
   readable permissions, resulting in information disclosure.

CVE-2012-3867

   Agent hostnames were insufficiently validated.


For the stable distribution (squeeze), this problem has been fixed in
version 2.6.2-5+squeeze6.

For the unstable distribution (sid), this problem has been fixed in
version 2.7.18-1.


- -------------------------------------------------------------------------
Debian Security Advisory DSA-2512-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
July 12, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : mono
Vulnerability  : missing input sanitising
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-3382

Marcus Meissner discovered that the web server included in Mono performed
insufficient sanitising of requests, resulting in cross-site scripting.

For the stable distribution (squeeze), this problem has been fixed in
version 2.6.7-5.1.

For the unstable distribution (sid), this problem has been fixed in
version 2.10.8.1-5.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2510-1                   security@debian.org
http://www.debian.org/security/                             Luciano Bello
July 12, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : extplorer
Vulnerability  : Cross-site request forgery
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-3362
Debian Bug     : 678737

John Leitch has discovered a vulnerability in eXtplorer, a very feature
rich web server file manager, which can be exploited by malicious people
to conduct cross-site request forgery attacks.

The vulnerability allows users to perform certain actions via HTTP requests
without performing any validity checks to verify the request. This can be
exploited for example, to create an administrative user account by tricking
an logged administrator to visiting an attacker-defined web link.

For the stable distribution (squeeze), this problem has been fixed in
version 2.1.0b6+dfsg.2-1+squeeze1.

For the testing distribution (wheezy), this problem has been fixed in
version 2.1.0b6+dfsg.3-3.

For the unstable distribution (sid), this problem has been fixed in
version 2.1.0b6+dfsg.3-3.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#440 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 17 July 2012 - 09:57 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2513-1                   security@debian.org
http://www.debian.org/security/                                Nico Golde
July 17, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : iceape
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1948 CVE-2012-1954 CVE-2012-1967

Several vulnerabilities have been found in the Iceape internet suite,
an unbranded version of Seamonkey:

CVE-2012-1948

  Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill McCloskey
  identified several memory safety problems that may lead to the
  execution of arbitrary code.

CVE-2012-1954

  Abhishek Arya discovered a use-after-free problem in nsDocument::AdoptNode
  that may lead to the execution of arbitrary code.

CVE-2012-1967

  moz_bug_r_a4 discovered that in certain cases, http://www.debian.or... Golde
July 17, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : iceweasel
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1948 CVE-2012-1950 CVE-2012-1954 CVE-2012-1966
                 CVE-2012-1967

Several vulnerabilities have been discovered in Iceweasel, a web
browser based on Firefox. The included XULRunner library provides
rendering services for several other applications included in Debian.

CVE-2012-1948

  Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill McCloskey
  identified several memory safety problems that may lead to the
  execution of arbitrary code.

CVE-2012-1950

  Mario Gomes and Code Audit Labs discovered that it is possible
  to force iceweasel to display the URL of the previous entered site
  through drag and drop actions to the address bar. This can be
  abused to perform phishing attacks.

CVE-2012-1954

  Abhishek Arya discovered a use-after-free problem in nsDocument::AdoptNode
  that may lead to the execution of arbitrary code.

CVE-2012-1966

  moz_bug_r_a4 discovered that it is possible to perform cross-site
  scripting attacks through the context menu when using data: URLs.

CVE-2012-1967

  moz_bug_r_a4 discovered that in certain cases, javascript: URLs can
  be executed so that scripts can escape the Javascript sandbox and run
  with elevated privileges.

Note: We'd like to advise users of Iceweasel's 3.5 branch in Debian
stable to consider to upgrade to the Iceweasel 10.0 ESR (Extended
Support Release) which is now available in Debian Backports.
Although Debian will continue to support Iceweasel 3.5 in stable with
security updates, this can only be done on a best effort base as
upstream provides no such support anymore. On top of that, the 10.0
branch adds proactive security features to the browser.


For the stable distribution (squeeze), this problem has been fixed in
version 3.5.16-17.

For the unstable distribution (sid), this problem has been fixed in
version 10.0.6esr-1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#441 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 19 July 2012 - 10:11 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2515-1                   security@debian.org
http://www.debian.or... Golde
July 19, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : nsd3
Vulnerability  : null pointer dereference
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2978

Marek Vavruša and Lubos Slovak discovered that NSD, an authoritative
domain name server, is not properly handling non-standard DNS packets.
his can result in a NULL pointer dereference and crash the handling
process.  A remote attacker can abuse this flaw to perform denial of
service attacks.


For the stable distribution (squeeze), this problem has been fixed in
version 3.2.5-1.squeeze2.

For the testing distribution (wheezy), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in
version 3.2.12-1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#442 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 22 July 2012 - 09:04 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2508-1                   security@debian.org
http://www.debian.org/security/                         Yves-Alexis Perez
July 22, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : kfreebsd-8
Vulnerability  : privilege escalation
Problem type   : local
Debian-specific: no
CVE ID         : CVE-2012-0217
Debian Bug     : 677297

Rafal Wojtczuk from Bromium discovered that FreeBSD wasn't handling correctly
uncanonical return addresses on Intel amd64 CPUs, allowing privilege escalation
to kernel for local users.

For the stable distribution (squeeze), this problem has been fixed in
version 8.1+dfsg-8+squeeze3.

For the testing distribution (wheezy), this problem has been fixed in
version 8.3-4.

For the unstable distribution (sid), this problem has been fixed in
version 8.3-4.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#443 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 26 July 2012 - 09:11 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2516-1                   security@debian.org
http://www.debian.org/security/                                Nico Golde
July 26, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : isc-dhcp
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-3571 CVE-2012-3954

Two security vulnerabilities affecting ISC dhcpd, a server for automatic
IP address assignment, in Debian have been discovered.

CVE-2012-3571

  Markus Hietava of the Codenomicon CROSS project discovered that it is
  possible to force the server to enter an infinite loop via messages with
  malformed client identifiers.

CVE-2012-3954

  Glen Eustace discovered that DHCP servers running in DHCPv6 mode
  and possibly DHCPv4 mode suffer of memory leaks while processing messages.
  An attacker can use this flaw to exhaust resources and perform denial
  of service attacks.


For the stable distribution (squeeze), this problem has been fixed in
version 4.1.1-P1-15+squeeze4.

For the testing (wheezy) and unstable (sid) distributions, this problem
will be fixed soon.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#444 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 30 July 2012 - 08:46 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2517-1                   security@debian.org
http://www.debian.org/security/                                Nico Golde
July 30, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : bind9
Vulnerability  : denial of service
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-3817

Einar Lonn discovered that under certain conditions bind9, a DNS server,
may use cached data before initialization.  As a result, an attacker can
trigger and assertion failure on servers under high query load that do
DNSSEC validation.

For the stable distribution (squeeze), this problem has been fixed in
version 1:9.7.3.dfsg-1~squeeze6.

For the testing distribution (wheezy), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in
version 1:9.8.1.dfsg.P1-4.2.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#445 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 01 August 2012 - 05:04 AM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2518-1                   security@debian.org
http://www.debian.org/security/                         Yves-Alexis Perez
July 31, 2012                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : krb5
Vulnerability  : denial of service and remote code execution
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1014 CVE-2012-1015
Debian Bug     : 683429

Emmanuel Bouillon from NCI Agency discovered multiple vulnerabilities in MIT
Kerberos, a daemon implementing the network authentication protocol.

CVE-2012-1014

By sending specially crafted AS-REQ (Authentication Service Request) to a KDC
(Key Distribution Center), an attacker could make it free an uninitialized
pointer, corrupting the heap.  This can lead to process crash or even arbitrary
code execution.
.
This CVE only affects testing (wheezy) and unstable (sid) distributions.

CVE-2012-1015

By sending specially crafted AS-REQ to a KDC, an attacker could make it
dereference an uninitialized pointer, leading to process crash or even
arbitrary code execution

In both cases, arbitrary code execution is believed to be difficult to achieve,
but might not be impossible.

For the stable distribution (squeeze), this problem has been fixed in
version 1.8.3+dfsg-4squeeze6.

For the testing distribution (wheezy), this problem has been fixed in
version 1.10.1+dfsg-2.

For the unstable distribution (sid), this problem has been fixed in
version 1.10.1+dfsg-2.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#446 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 01 August 2012 - 10:42 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2519-1                   security@debian.org
http://www.debian.org/security/                                Nico Golde
August 1, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : isc-dhcp
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2011-4539 CVE-2012-3571 CVE-2012-3954

Several security vulnerabilities affecting ISC dhcpd, a server for
automatic IP address assignment, have been discovered.  Additionally, the
latest security update for isc-dhcp, DSA-2516-1, did not properly apply
the patches for CVE-2012-3571 and CVE-2012-3954.  This has been addressed
in this additional update.

CVE-2011-4539

  BlueCat Networks discovered that it is possible to crash DHCP servers
  configured to evaluate requests with regular expressions via crafted
  DHCP request packets.

CVE-2012-3571

  Markus Hietava of the Codenomicon CROSS project discovered that it is
  possible to force the server to enter an infinite loop via messages with
  malformed client identifiers.

CVE-2012-3954

  Glen Eustace discovered that DHCP servers running in DHCPv6 mode
  and possibly DHCPv4 mode suffer of memory leaks while processing messages.
  An attacker can use this flaw to exhaust resources and perform denial
  of service attacks.


For the stable distribution (squeeze), this problem has been fixed in
version 4.1.1-P1-15+squeeze5.

For the testing (wheezy) and unstable (sid) distributions, this problem
will be fixed soon.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#447 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 02 August 2012 - 10:05 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2520-1                   security@debian.org
http://www.debian.org/security/                         Yves-Alexis Perez
August 01, 2012                        http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : openoffice.org
Vulnerability  : Multiple heap-based buffer overflows
Problem type   : local
Debian-specific: no
CVE ID         : CVE-2012-2665
Debian Bug     :

Timo Warns from PRE-CERT discovered multiple heap-based buffer overflows in
OpenOffice.org, an office productivity suite. The issues lies in the XML
manifest encryption tag parsing code. Using specially crafted files, an
attacker can cause application crash and could cause arbitrary code execution.

For the stable distribution (squeeze), this problem has been fixed in
version 3.2.1-11+squeeze7.

openoffice.org package has been replaced by libreoffice in testing (wheezy) and
unstable (sid) distributions.

For the testing distribution (wheezy), this problem has been fixed in
version 1:3.5.4-7.

For the unstable distribution (sid), this problem has been fixed in
version 1:3.5.4-7.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#448 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 04 August 2012 - 09:35 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2519-2                   security@debian.org
http://www.debian.org/security/                                Nico Golde
August 4, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : isc-dhcp
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2011-4539 CVE-2012-3571 CVE-2012-3954

It was discovered that the recent update for isc-dhcp, did not contain
the patched code included in the source package.  Due to quirk in the
build system those patches were deapplied during the build process.

For the stable distribution (squeeze), this problem has been fixed in
version 4.1.1-P1-15+squeeze6.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2521-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
August 04, 2012                        http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libxml2
Vulnerability  : integer overflows
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2807

Jueri Aedla discovered several integer overflows in libxml, which could
lead to the execution of arbitrary code or denial of service.

For the stable distribution (squeeze), this problem has been fixed in
version 2.7.8.dfsg-2+squeeze5.

For the testing distribution (wheezy) and the unstable distribution (sid),
this problem has been fixed in version 2.8.0+dfsg1-5.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#449 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 06 August 2012 - 08:24 AM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2522-1                   security@debian.org
http://www.debian.org/security/                         Yves-Alexis Perez
August 05, 2012                        http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : fckeditor
Vulnerability  : cross site scripting
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-4000
Debian Bug     : 683418

Emilio Pinna discovered a cross site scripting vulnerability in the
spellchecker.php page of FCKeditor, a popular html/text editor for the web.

For the stable distribution (squeeze), this problem has been fixed in
version 1:2.6.6-1squeeze1.

For the testing distribution (wheezy), this problem has been fixed in
version 1:2.6.6-3.

For the unstable distribution (sid), this problem has been fixed in
version 1:2.6.6-3.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.

#450 OFFLINE   sunrat

sunrat

    Thread Kahuna

  • Forum Moderators
  • 5,346 posts

Posted 06 August 2012 - 07:54 PM

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2523-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
August 06, 2012                        http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : globus-gridftp-server
Vulnerability  : programming error
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-3292

It was discovered that the GridFTP component from the Globus Toolkit, a
toolkit used for building Grid systems and applications performed
insufficient validation of a name lookup, which could lead to privilege
escalation.

For the stable distribution (squeeze), this problem has been fixed in
version 3.23-1+squeeze1 of the globus-gridftp-server source package
and in version 0.43-1+squeeze1 of the globus-gridftp-server-control
source package

For the testing distribution (wheezy) and the unstable distribution (sid),
this problem has been fixed in version 6.5-1.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2524-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
August 06, 2012                        http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : openttd
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-0049 CVE-2012-3436

Two denial of service vulnerabilities have been discovered in the server
component of OpenTTD, a free reimplementation of Transport Tycoon Deluxe.

For the stable distribution (squeeze), this problem has been fixed in
version 1.0.4-6.

For the unstable distribution (sid), this problem will be fixed soon.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2525-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
August 06, 2012                        http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : expat
Vulnerability  : several
Problem type   : local
Debian-specific: no
CVE ID         : CVE-2012-0876 CVE-2012-1148

It was discovered that Expat, a C library to parse XML, is vulnerable
to denial of service through hash collisions and a memory leak in
pool handling.

For the stable distribution (squeeze), this problem has been fixed in
version 2.0.1-7+squeeze1.

For the testing distribution (wheezy), this problem has been fixed in
version 2.1.0~beta3-1.

For the unstable distribution (sid), this problem has been fixed in
version 2.1.0~beta3-1.
registered Linux user number 324659  || The importance of Reading The *Fine* Manual! :D
Posted ImagePosted ImagePosted ImagePosted ImageKXStudio
For the things we have to learn before we can do them, we learn by doing them.





Also tagged with one or more of these keywords: debian, updates, sunrat, bruno, v.t. eric layton

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users