555 replies to this topic

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2423-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 02, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : movabletype-opensource
Vulnerability  : several
Problem type   : remote
Debian-specific: no
Debian Bug     : 631437 661064

Several vulnerabilities were discovered in Movable Type, a blogging
system:

Under certain circumstances, a user who has "Create Entries" or
"Manage Blog" permissions may be able to read known files on the local
file system.

The file management system contains shell command injection
vulnerabilities, the most serious of which may lead to arbitrary OS
command execution by a user who has a permission to sign-in to the
admin script and also has a permission to upload files.

Session hijack and cross-site request forgery vulnerabilities exist in
the commenting and the community script. A remote attacker could
hijack the user session or could execute arbitrary script code on
victim's browser under the certain circumstances.

Templates which do not escape variable properly and mt-wizard.cgi
contain cross-site scripting vulnerabilities.

For the stable distribution (squeeze), these problems have been fixed
in version 4.3.8+dfsg-0+squeeze2.

For the testing distribution (wheezy) and the unstable distribution
(sid), these problems have been fixed in version 5.1.3+dfsg-1.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2424-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 04, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libxml-atom-perl
Vulnerability  : XML external entity expansion
Problem type   : remote
Debian-specific: no

It was discovered that the XML::Atom Perl module did not disable
external entities when parsing XML from potentially untrusted sources.
This may allow attackers to gain read access to otherwise protected
ressources, depending on how the library is used.

For the stable distribution (squeeze), this problem has been fixed in
version 0.37-1+squeeze1.

For the testing distribution (wheezy) and the unstable distribution
(sid), this problem has been fixed in version 0.39-1.


- -------------------------------------------------------------------------
Debian Security Advisory DSA-2425-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 04, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : plib
Vulnerability  : buffer overflow
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2011-4620
Debian Bug     : 654785

It was discovered that PLIB, a library used by TORCS, contains a
buffer overflow in error message processing, which could allow remote
attackers to execute arbitrary code.

For the stable distribution (squeeze), this problem has been fixed in
version 1.8.5-5+squeeze1.

For the testing distribution (wheezy) and the unstable distribution
(sid), this problem has been fixed in version 1.8.5-5.1.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2426-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 06, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : gimp
Vulnerability  : several
Problem type   : local
Debian-specific: no
CVE ID         : CVE-2010-4540 CVE-2010-4541 CVE-2010-4542 CVE-2010-4543
                 CVE-2011-1782 CVE-2011-2896

Several vulnerabilities have been identified in GIMP, the GNU Image
Manipulation Program.

CVE-2010-4540
Stack-based buffer overflow in the load_preset_response
function in plug-ins/lighting/lighting-ui.c in the "LIGHTING
EFFECTS > LIGHT" plugin allows user-assisted remote attackers
to cause a denial of service (application crash) or possibly
execute arbitrary code via a long Position field in a plugin
configuration file.

CVE-2010-4541
Stack-based buffer overflow in the loadit function in
plug-ins/common/sphere-designer.c in the SPHERE DESIGNER
plugin allows user-assisted remote attackers to cause a denial
of service (application crash) or possibly execute arbitrary
code via a long "Number of lights" field in a plugin
configuration file.

CVE-2010-4542
Stack-based buffer overflow in the gfig_read_parameter_gimp_rgb
function in in the GFIG plugin allows user-assisted remote
attackers to cause a denial of service (application crash) or
possibly execute arbitrary code via a long Foreground field in a
plugin configuration file.

CVE-2010-4543
Heap-based buffer overflow in the read_channel_data function in
file-psp.c in the Paint Shop Pro (PSP) plugin allows remote
attackers to cause a denial of service (application crash) or
possibly execute arbitrary code via a PSP_COMP_RLE (aka RLE
compression) image file that begins a long run count at the end
of the image.

CVE-2011-1782
The correction for CVE-2010-4543 was incomplete.

CVE-2011-2896
The LZW decompressor in the LZWReadByte function in
plug-ins/common/file-gif-load.c does not properly handle code
words that are absent from the decompression table when
encountered, which allows remote attackers to trigger an
infinite loop or a heap-based buffer overflow, and possibly
execute arbitrary code, via a crafted compressed stream.


For the stable distribution (squeeze), these problems have been fixed in
version 2.6.10-1+squeeze3.

For the testing distribution (wheezy) and the unstable distribution
(sid), these problems have been fixed in version 2.6.11-5.


- -------------------------------------------------------------------------
Debian Security Advisory DSA-2427-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 06, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : imagemagick
Vulnerability  : several
Problem type   : local
CVE ID         : CVE-2012-0247 CVE-2012-0248

Two security vulnerabilities related to EXIF processing were
discovered in ImageMagick, a suite of programs to manipulate images:

CVE-2012-0247
When parsing a maliciously crafted image with incorrect offset
and count in the ResolutionUnit tag in EXIF IFD0, ImageMagick
writes two bytes to an invalid address.

CVE-2012-0248
Parsing a maliciously crafted image with an IFD whose all IOP
tags value offsets point to the beginning of the IFD itself
results in an endless loop and a denial of service.

For the stable distribution (squeeze), these problems have been fixed
in version 8:6.6.0.4-3+squeeze1.

For the testing distribution (wheezy) and the unstable distribution
(sid), these problems have been fixed in version 8:6.6.9.7-6.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2429-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 07, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : mysql-5.1
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2011-2262 CVE-2012-0075 CVE-2012-0087 CVE-2012-0101
              CVE-2012-0102 CVE-2012-0112 CVE-2012-0113 CVE-2012-0114
CVE-2012-0115 CVE-2012-0116 CVE-2012-0118 CVE-2012-0119
CVE-2012-0120 CVE-2012-0484 CVE-2012-0485 CVE-2012-0490
CVE-2012-0492
Debian Bug     : 659687

Several security vulnerabilities were discovered in MySQL, a database
management system.  The vulnerabilities are addressed by upgrading
MySQL to a new upstream version, 5.1.61, which includes additional
changes, such as performance improvements and corrections for data
loss defects.  These changes are described in the MySQL release notes
at: http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html

For the stable distribution (squeeze), these problems have been fixed
in version 5.1.61-0+squeeze1.

For the unstable distribution (sid), these problems have been fixed in
version 5.1.61-2.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2428-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
March 07, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : freetype
Vulnerability  : several
Problem type   : local
Debian-specific: no
CVE ID         : CVE-2012-1133 CVE-2012-1134 CVE-2012-1136 CVE-2012-1142
                 CVE-2012-1144

Mateusz Jurczyk from the Google Security Team discovered several
vulnerabilties in Freetype's parsing of BDF, Type1 and TrueType fonts,
which could result in the execution of arbitrary code if a malformed
font file is processed.

For the stable distribution (squeeze), this problem has been fixed in
version 2.4.2-2.1+squeeze4. The updated packages are already available
since yesterday, but the advisory text couldn't be send earlier.

For the unstable distribution (sid), this problem will be fixed soon.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2430-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
March 10, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : python-pam
Vulnerability  : double free
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1502

Markus Vervier discovered a double free in the Python interface to the
PAM library, which could lead to denial of service.

For the stable distribution (squeeze), this problem has been fixed in
version 0.4.2-12.2+squeeze1.

For the unstable distribution (sid), this problem has been fixed in
version 0.4.2-13.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2431-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
March 11, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libdbd-pg-perl
Vulnerability  : format string vulnerabilities
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1151
Debian Bug     : 661536

Niko Tyni discovered two format string vulnerabilities in DBD:g, a Perl
DBI driver for the PostgreSQL database server, which can be exploited
by a rogue database server.

For the stable distribution (squeeze), this problem has been fixed in
version 2.17.1-2+squeeze1.

For the unstable distribution (sid), this problem has been fixed in
version 2.19.0-1.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2432-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
March 12, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libyaml-libyaml-perl
Vulnerability  : format string vulnerabilities
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1152
Debian Bug     : 661548

Dominic Hargreaves and Niko Tyni discovered two format string
vulnerabilities in YAML::LibYAML, a Perl interface to the libyaml
library.

For the stable distribution (squeeze), this problem has been fixed in
version 0.33-1+squeeze1.

For the unstable distribution (sid), this problem has been fixed in
version 0.38-2.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2433-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
March 15, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : iceweasel
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-0455 CVE-2012-0456 CVE-2012-0458 CVE-2012-0461

Several vulnerabilities have been discovered in Iceweasel, a web browser
based on Firefox. The included XULRunner library provides rendering
services for several other applications included in Debian.

CVE-2012-0455

   Soroush Dalili discovered that a cross-site scripting countermeasure
   related to Javascript URLs could be bypassed.

CVE-2012-0456

   Atte Kettunen discovered an out of bounds read in the SVG Filters,
   resulting in memory disclosure.

CVE-2012-0458

   Mariusz Mlynski discovered that privileges could be escalated through
   a Javascript URL as the home page.

CVE-2012-0461

   Bob Clary discovered memory corruption bugs, which may lead to the
   execution of arbitrary code.

For the stable distribution (squeeze), this problem has been fixed in
version 3.5.16-13.

For the unstable distribution (sid), this problem has been fixed in
version 10.0.3esr-1.

For the experimental distribution, this problem has been fixed in
version 11.0-1.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2436-1                   security@debian.org
http://www.debian.org/security/                           Thijs Kinkhorst
March 19, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libapache2-mod-fcgid
Vulnerability  : inactive resource limits
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1181
Debian Bug     : 615814

It was discovered that the Apache FCGID module, a FastCGI implementation,
did not properly enforce the FcgidMaxProcessesPerClass resource limit,
rendering this control ineffective and potentially allowing a virtual
host to consume excessive resources.

For the stable distribution (squeeze), this problem has been fixed in
version 1:2.3.6-1+squeeze1.

For the testing distribution (wheezy), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in
version 1:2.3.6-1.1.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2434-1                   security@debian.org
http://www.debian.org/security/                             Luciano Bello
March 19, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : nginx
Vulnerability  : sensitive information leak
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1180
Debian Bug     : 664137

Matthew Daley discovered a memory disclosure vulnerability in nginx. In
previous versions of this web server, an attacker can receive the content of
previously freed memory if an upstream server returned a specially crafted HTTP
response, potentially exposing sensitive information.

For the stable distribution (squeeze), this problem has been fixed in
version 0.7.67-3+squeeze2.

For the unstable distribution (sid), this problem has been fixed in
version 1.1.17-1.

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2435-1                   security@debian.org
http://www.debian.org/security/                          Gabriele Giacone
March 19, 2012                         http://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : gnash
Vulnerability  : several
Problem type   : local / local (remote)
Debian-specific: no
CVE ID         : CVE-2010-4337 CVE-2011-4328 CVE-2012-1175
Debian Bug     : 605419 649384 664023

Several vulnerabilities have been identified in Gnash, the GNU Flash
player.

CVE-2012-1175

  Tielei Wang from Georgia Tech Information Security Center discovered a
  vulnerability in GNU Gnash which is caused due to an integer overflow
  error and can be exploited to cause a heap-based buffer overflow by
  tricking a user into opening a specially crafted SWF file.

CVE-2011-4328

  Alexander Kurtz discovered an unsafe management of HTTP cookies. Cookie
  files are stored under /tmp and have predictable names, vulnerability
  that allows a local attacker to overwrite arbitrary files the users has
  write permissions for, and are also world-readable which may cause
  information leak.

CVE-2010-4337

  Jakub Wilk discovered an unsafe management of temporary files during the
  build process. Files are stored under /tmp and have predictable names,
  vulnerability that allows a local attacker to overwrite arbitrary files
  the users has write permissions for.

For the stable distribution (squeeze), this problem has been fixed in
version 0.8.8-5+squeeze1.

For the unstable distribution (sid), this problem has been fixed in
version 0.8.10-5.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2437-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
March 21, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : icedove
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-0455 CVE-2012-0456 CVE-2012-0458 CVE-2012-0461

Several vulnerabilities have been discovered in Icedove, an unbranded
version of the Thunderbird mail/news client.

CVE-2012-0455

   Soroush Dalili discovered that a cross-site scripting countermeasure
   related to Javascript URLs could be bypassed.

CVE-2012-0456

   Atte Kettunen discovered an out of bounds read in the SVG Filters,
   resulting in memory disclosure.

CVE-2012-0458

   Mariusz Mlynski discovered that privileges could be escalated through
   a Javascript URL as the home page.

CVE-2012-0461

   Bob Clary discovered memory corruption bugs, which may lead to the
   execution of arbitrary code.

For the stable distribution (squeeze), this problem has been fixed in
version icedove 3.0.11-1+squeeze8.

For the unstable distribution (sid), this problem will be fixed soon.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2438-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
March 22, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : raptor
Vulnerability  : programming error
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-0037

It was discovered that Raptor, a RDF parser and serializer library,
allows file inclusion through XML entities, resulting in information
disclosure.

For the stable distribution (squeeze), this problem has been fixed in
version 1.4.21-2+squeeze1.

For the unstable distribution (sid), this problem will be fixed soon.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2439-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
March 22, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libpng
Vulnerability  : buffer overflow
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2011-3045

Glenn-Randers Pehrson discovered an buffer overflow in the libpng PNG
library, which could lead to the execution of arbitrary code if a
malformed image is processed.

For the stable distribution (squeeze), this problem has been fixed in
version 1.2.44-1+squeeze3. Packages for i386 are not yet available,
but will be provided shortly.

For the unstable distribution (sid), this problem will be fixed soon.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2440-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 24, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libtasn1-3
Vulnerability  : missing bounds check
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1569

Matthew Hall discovered that many callers of the asn1_get_length_der
function did not check the result against the overall buffer length
before processing it further.  This could result in out-of-bounds
memory accesses and application crashes.  Applications using GNUTLS
are exposed to this issue.

For the stable distribution (squeeze), this problem has been fixed in
version 2.7-1+squeeze+1.

For the unstable distribution (sid), this problem has been fixed in
version 2.12-1.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2441-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 25, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : gnutls26
Vulnerability  : missing bounds check
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1573

Matthew Hall discovered that GNUTLS does not properly handle truncated
GenericBlockCipher structures nested inside TLS records, leading to
crashes in applications using the GNUTLS library.

For the stable distribution (squeeze), this problem has been fixed in
version 2.8.6-1+squeeze2.

For the unstable distribution (sid), this problem has been fixed in
version 2.12.18-1 of the gnutls26 package and version 3.0.17-2 of the
gnutls28 package.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2442-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 26, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : openarena
Vulnerability  : UDP traffic amplification
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2010-5077
Debian Bug     : 665656

It has been discovered that spoofed "getstatus" UDP requests are being
sent by attackers to servers for use with games derived from the
Quake 3 engine (such as openarena).  These servers respond with a
packet flood to the victim whose IP address was impersonated by the
attackers, causing a denial of service.

For the stable distribution (squeeze), this problem has been fixed in
version 0.8.5-5+squeeze2.

For the testing distribution (wheezy) and the unstable distribution
(sid), this problem has been fixed in version 0.8.5-6.

[sunrat]

- ----------------------------------------------------------------------
Debian Security Advisory DSA-2443-1                security@debian.org
http://www.debian.org/security/                           Dann Frazier
March 26, 2012                      http://www.debian.org/security/faq
- ----------------------------------------------------------------------

Package        : linux-2.6
Vulnerability  : privilege escalation/denial of service
Problem type   : local
Debian-specific: no
CVE Id(s)      : CVE-2009-4307 CVE-2011-1833 CVE-2011-4347 CVE-2012-0045
                 CVE-2012-1090 CVE-2012-1097

Several vulnerabilities have been discovered in the Linux kernel that may lead
to a denial of service or privilege escalation. The Common Vulnerabilities and
Exposures project identifies the following problems:

CVE-2009-4307

    Nageswara R Sastry reported an issue in the ext4 filesystem. Local users
    with the privileges to mount a filesystem can cause a denial of service
    (BUG) by providing a s_log_groups_per_flex value greater than 31.

CVE-2011-1833

    Vasiliy Kulikov of Openwall and Dan Rosenberg discovered an information
    leak in the eCryptfs filesystem. Local users were able to mount arbitrary
    directories.

CVE-2011-4347

    Sasha Levin reported an issue in the device assignment functionality in
    KVM. Local users with permission to access /dev/kvm could assign unused pci
    devices to a guest and cause a denial of service (crash).

CVE-2012-0045

    Stephan Barwolf reported an issue in KVM. Local users in a 32-bit guest
    running on a 64-bit system can crash the guest with a syscall instruction.

CVE-2012-1090

    CAI Qian reported an issue in the CIFS filesystem. A reference count leak
    can occur during the lookup of special files, resulting in a denial of
    service (oops) on umount.

CVE-2012-1097

    H. Peter Anvin reported an issue in the regset infrastructure. Local users
    can cause a denial of service (NULL pointer dereference) by triggering the
    write methods of readonly regsets.

For the stable distribution (squeeze), this problem has been fixed in version
2.6.32-41squeeze2.

The following matrix lists additional source packages that were rebuilt for
compatibility with or to take advantage of this update:

                                             Debian 6.0 (squeeze)
     user-mode-linux                         2.6.32-1um-4+41squeeze2

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2444-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 29, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : tryton-server
Vulnerability  : privilege escalation
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-0215

It was discovered that the Tryton application framework for Python
allows authenticated users to escalate their privileges by editing the
Many2Many field.

For the stable distribution (squeeze), this problem has been fixed in
version 1.6.1-2+squeeze1.

For the unstable distribution (sid), this problem has been fixed in
version 2.2.2-1.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2445-1                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 31, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : typo3-src
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1606 CVE-2012-1607 CVE-2012-1608

Several remote vulnerabilities have been discovered in the TYPO3 web
content management framework:

CVE-2012-1606
Failing to properly HTML-encode user input in several places,
the TYPO3 backend is susceptible to Cross-Site Scripting. A
valid backend user is required to exploit these
vulnerabilities.

CVE-2012-1607
Accessing a CLI Script directly with a browser may disclose
the database name used for the TYPO3 installation.

CVE-2012-1608
By not removing non printable characters, the API method
t3lib_div::RemoveXSS() fails to filter specially crafted HTML
injections, thus is susceptible to Cross-Site Scripting.

For the stable distribution (squeeze), these problems have been fixed in
version 4.3.9+dfsg1-1+squeeze3.

For the testing distribution (wheezy) and the unstable distribution
(sid), these problems have been fixed in version 4.5.14+dfsg1-1.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2442-2                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 31, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : openarena
Vulnerability  : UDP traffic amplification
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2010-5077

The openarena update DSA-2442-1 introduced a regression in which
servers would cease to respond to status requests after an uptime of
several weeks.

For the stable distribution (squeeze), this problem has been fixed in
version 0.8.5-5+squeeze3.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2398-2                   security@debian.org
http://www.debian.org/security/                            Florian Weimer
March 31, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : curl
Vulnerability  : regression
Debian-specific: no
Debian Bug     : 658276

cURL is a command-line tool and library for transferring data with URL
syntax.  It was discovered that the countermeasures against the
Dai/Rogaway chosen-plaintext attack on SSL/TLS (CVE-2011-3389,
"BEAST") cause interoperability issues with some server
implementations.  This update ads the the CURLOPT_SSL_OPTIONS and
CURLSSLOPT_ALLOW_BEAST options to the library, and the
- --ssl-allow-beast option to the "curl" program.

For the stable distribution (squeeze), this problem has been fixed in
version 7.21.0-2.1+squeeze2.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2446-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
April 04, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libpng
Vulnerability  : incorrect memory handling
Problem type   : local(remote)
Debian-specific: no
CVE ID         : CVE-2011-3048

It was discovered that incorrect memory handling in the png_set_text2()
function of the PNG library could lead to the execution of arbitrary
code.

For the stable distribution (squeeze), this problem has been fixed in
version libpng_1.2.44-1+squeeze4.

For the unstable distribution (sid), this problem will be fixed soon.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2447-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
April 04, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : tiff
Vulnerability  : integer overflow
Problem type   : local(remote)
Debian-specific: no
CVE ID         : CVE-2012-1173

Alexander Gavrun discovered an integer overflow in the TIFF library
in the parsing of the TileSize entry, which could result in the execution
of arbitrary code if a malformed image is opened.

For the stable distribution (squeeze), this problem has been fixed in
version 3.9.4-5+squeeze4.

For the unstable distribution (sid), this problem will be fixed soon.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2448-1                   security@debian.org
http://www.debian.org/security/                        Jonathan Wiltshire
April 10, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : inspircd
Vulnerability  : buffer overflow
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1836
Debian Bug     : 667914

It was discovered that a heap-based buffer overflow in InspIRCd could allow
remote attackers to execute arbitrary code via a crafted DNS query.

For the stable distribution (squeeze), this problem has been fixed in
version 1.1.22+dfsg-4+squeeze1.

For the testing distribution (wheezy), this problem has been fixed in
version 1.1.22+dfsg-4+wheezy1.

For the unstable distribution (sid), this problem has been fixed in
version 2.0.5-0.1.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2449-1                   security@debian.org
http://www.debian.org/security/                                Nico Golde
April 12, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : sqlalchemy
Vulnerability  : missing input sanitization
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-0805

It was discovered that sqlalchemy, an SQL toolkit and object relational
mapper for python, is not sanitizing input passed to the limit/offset
keywords to select() as well as the value passed to select.limit()/offset().
This allows an attacker to perform SQL injection attacks against
applications using sqlalchemy that do not implement their own filtering.

For the stable distribution (squeeze), this problem has been fixed in
version 0.6.3-3+squeeze1.

For the testing distribution (wheezy), this problem has been fixed in
version 0.6.7-1.

For the unstable distribution (sid), this problem has been fixed in
version 0.6.7-1.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2450-1                   security@debian.org
http://www.debian.org/security/                           Thijs Kinkhorst
April 12, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : samba
Vulnerability  : privilege escalation
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-1182
Debian Bug     : 668309

It was discovered that Samba, the SMB/CIFS file, print, and login server,
contained a flaw in the remote procedure call (RPC) code which allowed
remote code execution as the super user from an unauthenticated
connection.

For the stable distribution (squeeze), this problem has been fixed in
version 2:3.5.6~dfsg-3squeeze7.

For the testing distribution (wheezy), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in
version 2:3.6.4-1.

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2451-1                   security@debian.org
http://www.debian.org/security/                                Nico Golde
April 13, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : puppet
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE IDs        : CVE-2012-1906 CVE-2012-1986 CVE-2012-1987 CVE-2012-1988

Several vulnerabilities have been discovered in puppet, a centralized
configuration management system.  The Common Vulnerabilities and
Exposures project identifies the following problems:

CVE-2012-1906

    Puppet is using predictable temporary file names when downloading
    Mac OS X package files.  This allows a local attacker to either
    overwrite arbitrary files on the system or to install an arbitrary
    package.

CVE-2012-1986

    When handling requests for a file from a remote filebucket, puppet
    can be tricked into overwriting its defined location for filebucket
    storage.  This allows an authorized attacker with access to the puppet
    master to read arbitrary files.

CVE-2012-1987

    Puppet is incorrectly handling filebucket store requests.  This allows
    an attacker to perform denial of service attacks against puppet by
    resource exhaustion.

CVE-2012-1988

    Puppet is incorrectly handling filebucket requests.  This allows an
    attacker with access to the certificate on the agent and an unprivileged
    account on puppet master to execute arbitrary code via crafted file
    path names and making a filebucket request.


For the stable distribution (squeeze), this problem has been fixed in
version 2.6.2-5+squeeze5.

For the testing distribution (wheezy), this problem has been fixed in
version 2.7.13-1.

For the unstable distribution (sid), this problem has been fixed in
version 2.7.13-1.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2452-1                   security@debian.org
http://www.debian.org/security/                            Stefan Fritsch
April 15, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : apache2
Vulnerability  : insecure default configuration
Problem type   : local/remote
Debian-specific: yes
CVE ID         : CVE-2012-0216

Niels Heinen noticed a security issue with the default Apache
configuration on Debian if certain scripting modules like mod_php or
mod_rivet are installed. The problem arises because the directory
/usr/share/doc, which is mapped to the URL /doc, may contain example
scripts that can be executed by requests to this URL. Although access
to the URL /doc is restricted to connections from localhost, this still
creates security issues in two specific configurations:

- - If some front-end server on the same host forwards connections to an
  apache2 backend server on the localhost address, or

- - if the machine running apache2 is also used for web browsing.

Systems not meeting one of these two conditions are not known to be
vulnerable. The actual security impact depends on which packages (and
accordingly which example scripts) are installed on the system.
Possible issues include cross site scripting, code execution, or
leakage of sensitive data.

This updates removes the problematic configuration sections from the
files /etc/apache2/sites-available/default and .../default-ssl. When
upgrading, you should not blindly allow dpkg to replace those files,
though. Rather you should merge the changes, namely the removal of the
'Alias /doc "/usr/share/doc"' line and the related '<Directory
"/usr/share/doc/">' block, into your versions of these config files.
You may also want to check if you have copied these sections to any
additional virtual host configurations.

For the stable distribution (squeeze), this problem has been fixed in
version 2.2.16-6+squeeze7.

For the testing distribution (wheezy), this problem will be fixed in
version 2.2.22-4.

For the unstable distribution (sid), this problem will be fixed in
version 2.2.22-4.

For the experimental distribution, this problem has been fixed in
version 2.4.1-3.

[sunrat]

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2453-1                   security@debian.org
http://www.debian.org/security/                                Nico Golde
April 16, 2012                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : gajim
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE IDs        : CVE-2012-2093 CVE-2012-2086 CVE-2012-2085
Debian bug     : 668038

Several vulnerabilities have been discovered in gajim, a feature-rich
jabber client.  The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2012-1987

    gajim is not properly sanitizing input before passing it to shell
    commands.  An attacker can use this flaw to execute arbitrary code
    on behalf of the victim if the user e.g. clicks on a specially crafted
    URL in an instant message.

CVE-2012-2093

    gajim is using predictable temporary files in an insecure manner when
    converting instant messages containing LaTeX to images.  A local
    attacker can use this flaw to conduct symlink attacks and overwrite
    files the victim has write access to.

CVE-2012-2086

    gajim is not properly sanitizing input when logging conversations
    which results in the possibility to conduct SQL injection attacks.


For the stable distribution (squeeze), this problem has been fixed in
version 0.13.4-3+squeeze2.

For the testing distribution (wheezy), this problem has been fixed in
version 0.15-1.

For the unstable distribution (sid), this problem has been fixed in
version 0.15-1.