Announcements about Debian security

Moritz Muehlenhoff | 24 May 19:37

Picon

[DSA 2480-1] request-tracker3.8 security update


-------------------------------------------------------------------------
Debian Security Advisory DSA-2480-1                   security <at> debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
May 24, 2012                           http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : request-tracker3.8
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2011-2082 CVE-2011-2083 CVE-2011-2084 CVE-2011-2085 
                 CVE-2011-4458 CVE-2011-4459 CVE-2011-4460

Several vulnerabilities were discovered in Request Tracker, an issue
tracking system:

CVE-2011-2082

   The vulnerable-passwords scripts introduced for CVE-2011-0009
   failed to correct the password hashes of disabled users.

CVE-2011-2083

   Several cross-site scripting issues have been discovered.

CVE-2011-2084

   Password hashes could be disclosed by privileged users.

(Continue reading)

Moritz Muehlenhoff | 23 May 21:39

Picon

[DSA 2479-1] libxml2 security update


-------------------------------------------------------------------------
Debian Security Advisory DSA-2479-1                   security <at> debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
May 23, 2012                           http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : libxml2
Vulnerability  : off-by-one
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2011-3102

Jueri Aedla discovered an off-by-one in libxml2, which could result in
the execution of arbitrary code.

For the stable distribution (squeeze), this problem has been fixed in
version 2.7.8.dfsg-2+squeeze4.

For the unstable distribution (sid), this problem has been fixed in
version 2.7.8.dfsg-9.1.

We recommend that you upgrade your libxml2 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce <at> lists.debian.org

(Continue reading)

Moritz Muehlenhoff | 23 May 21:30

Picon

[DSA 2478-1] sudo security update


-------------------------------------------------------------------------
Debian Security Advisory DSA-2478-1                   security <at> debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
May 23, 2012                           http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : sudo
Vulnerability  : parsing error
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2337

It was discovered that sudo misparsed network masks used in Host and
Host_List stanzas. This allowed the execution of commands on hosts,
where the user would not be allowed to run the specified command.

For the stable distribution (squeeze), this problem has been fixed in
version 1.7.4p4-2.squeeze.3.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your sudo packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce <at> lists.debian.org

(Continue reading)

Florian Weimer | 20 May 20:54

Picon

[DSA 2477-1] sympa security update


-------------------------------------------------------------------------
Debian Security Advisory DSA-2477-1                   security <at> debian.org
http://www.debian.org/security/                            Florian Weimer
May 20, 2012                           http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : sympa
Vulnerability  : authorization bypass
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2352
Debian Bug     : 

Several vulnerabilities have been discovered in Sympa, a mailing list
manager, that allow to skip the scenario-based authorization
mechanisms. This vulnerability allows to display the archives
management page, and download and delete the list archives by
unauthorized users.

For the stable distribution (squeeze), this problem has been fixed in
version 6.0.1+dfsg-4+squeeze1.

For the testing distribution (wheezy), this problem will be fixed
soon.

For the unstable distribution (sid), this problem has been fixed in
version 6.1.11~dfsg-2.

We recommend that you upgrade your sympa packages.

(Continue reading)

Jonathan Wiltshire | 19 May 21:30

Picon

[DSA 2476-1] pidgin-otr security update


-------------------------------------------------------------------------
Debian Security Advisory DSA-2476-1                   security <at> debian.org
http://www.debian.org/security/                        Jonathan Wiltshire
May 19, 2012                           http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : pidgin-otr
Vulnerability  : format string vulnerability
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2369
Debian Bug     : 673154

intrigeri discovered a format string error in pidgin-otr, an off-the-record
messaging plugin for Pidgin.

This could be exploited by a remote attacker to cause arbitrary code to
be executed on the user's machine.

The problem is only in pidgin-otr. Other applications which use libotr are
not affected.

For the stable distribution (squeeze), this problem has been fixed in
version 3.2.0-5+squeeze1.

For the testing distribution (wheezy), this problem has been fixed in
version 3.2.1-1.

For the unstable distribution (sid), this problem has been fixed in

(Continue reading)

Raphael Geissert | 18 May 01:14

Picon

[DSA 2475-1] openssl security update


-------------------------------------------------------------------------
Debian Security Advisory DSA-2475-1                   security <at> debian.org
http://www.debian.org/security/                          Raphael Geissert
May 17, 2012                           http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : openssl
Vulnerability  : integer underflow
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2333

It was discovered that openssl did not correctly handle explicit
Initialization Vectors for CBC encryption modes, as used in TLS 1.1,
1.2, and DTLS. An incorrect calculation would lead to an integer
underflow and incorrect memory access, causing denial of service
(application crash.)

For the stable distribution (squeeze), this problem has been fixed in
version 0.9.8o-4squeeze13.

For the testing distribution (wheezy), and the unstable distribution
(sid), this problem has been fixed in version 1.0.1c-1.

We recommend that you upgrade your openssl packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

(Continue reading)

Raphael Geissert | 17 May 07:17

Picon

[DSA 2474-1] ikiwiki security update


-------------------------------------------------------------------------
Debian Security Advisory DSA-2474-1                   security <at> debian.org
http://www.debian.org/security/                          Raphael Geissert
May 16, 2012                           http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : ikiwiki
Vulnerability  : cross-site scripting
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-0220

Raúl Benencia discovered that ikiwiki, a wiki compiler, does not
properly escape the author (and its URL) of certain metadata, such as
comments. This might be used to conduct cross-site scripting attacks.

For the stable distribution (squeeze), this problem has been fixed in
version 3.20100815.9.

For the testing distribution (wheezy), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in
version 3.20120516.

We recommend that you upgrade your ikiwiki packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

(Continue reading)

Florian Weimer | 17 May 00:04

Picon

[DSA 2473-1] openoffice.org security update


-------------------------------------------------------------------------
Debian Security Advisory DSA-2473-1                   security <at> debian.org
http://www.debian.org/security/                            Florian Weimer
May 16, 2012                           http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : openoffice.org
Vulnerability  : buffer overflow
Problem type   : local (remote)
Debian-specific: no
CVE ID         : CVE-2012-1149

Tielei Wang discovered that OpenOffice.org does not allocate a large
enough memory region when processing a specially crafted JPEG object,
leading to a heap-based buffer overflow and potentially arbitrary code
execution.

For the stable distribution (squeeze), this problem has been fixed in
version 1:3.2.1-11+squeeze5.

For the testing distribution (wheezy) and the unstable distribution
(sid), this problem has been fixed in version 1:3.4.5-1 of the
libreoffice package.

We recommend that you upgrade your openoffice.org packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

(Continue reading)

Florian Weimer | 16 May 07:54

Picon

[DSA 2472-1] gridengine security update


-------------------------------------------------------------------------
Debian Security Advisory DSA-2472-1                   security <at> debian.org
http://www.debian.org/security/                            Florian Weimer
May 15, 2012                           http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : gridengine
Vulnerability  : privilege escalation
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-0208

Dave Love discovered that users who are allowed to submit jobs to a
Grid Engine installation can escalate their privileges to root because
the environment is not properly sanitized before creating processes.

For the stable distribution (squeeze), this problem has been fixed in
version 6.2u5-1squeeze1.

For the unstable distribution (sid), this problem has been fixed in
version 6.2u5-6.

We recommend that you upgrade your gridengine packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce <at> lists.debian.org

(Continue reading)

Moritz Muehlenhoff | 13 May 23:09

Picon

[DSA 2457-2] New icedove/iceweasel packages fix regression


-------------------------------------------------------------------------
Debian Security Advisory DSA-2457-2                   security <at> debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
May 13, 2012                           http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : iceweasel / icedove
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-0467 CVE-2012-0470 CVE-2012-0471 CVE-2012-0477 
                 CVE-2012-0479

The updates DSA-2457 and DSA-2458 for Iceweasel and Icedove introduced
a regression, which could lead to crashes when interpreting some
Javascript statements.

For the stable distribution (squeeze), this problem has been fixed in
version 3.5.16-15 for Iceweasel and 2.0.11-12 for Icedove.

The unstable distribution (sid) is not affected.

We recommend that you upgrade your iceweasel and icedove packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce <at> lists.debian.org

(Continue reading)

Moritz Muehlenhoff | 13 May 22:37

Picon

[DSA-2471-1] ffmpeg security update


-------------------------------------------------------------------------
Debian Security Advisory DSA-2471-1                   security <at> debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
May 13, 2012                           http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : ffmpeg
Vulnerability  : several
Problem type   : local(remote)
Debian-specific: no
CVE ID         : CVE-2011-3892 CVE-2011-3893 CVE-2011-3895 CVE-2011-3929 
                 CVE-2011-3936 CVE-2011-3940 CVE-2011-3947 CVE-2012-0853 
                 CVE-2012-0947

Several vulnerabilities have been discovered in FFmpeg, a multimedia 
player, server and encoder. Multiple input validations in the decoders/
demuxers for Westwood Studios VQA, Apple MJPEG-B, Theora, Matroska, 
Vorbis, Sony ATRAC3, DV, NSV, files could lead to the execution of
arbitrary code.

These issues were discovered by Aki Helin, Mateusz Jurczyk, Gynvael 
Coldwind, and Michael Niedermayer.

For the stable distribution (squeeze), this problem has been fixed in
version 4:0.5.8-1.

For the unstable distribution (sid), this problem has been fixed in
version 6:0.8.2-1 of libav.

(Continue reading)

Group

gmane.linux.debian.user.security.announce.

Search Archive

Page

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11

May 2012

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

[DSA 2480-1] request-tracker3.8 security update (24 May 19:37)
[DSA 2479-1] libxml2 security update (23 May 21:39)
[DSA 2478-1] sudo security update (23 May 21:30)
[DSA 2477-1] sympa security update (20 May 20:54)
[DSA 2476-1] pidgin-otr security update (19 May 21:30)
[DSA 2475-1] openssl security update (18 May 01:14)
[DSA 2474-1] ikiwiki security update (17 May 07:17)
[DSA 2473-1] openoffice.org security update (17 May 00:04)
[DSA 2472-1] gridengine security update (16 May 07:54)
[DSA 2457-2] New icedove/iceweasel packages fix regression (13 May 23:09)
[DSA-2471-1] ffmpeg security update (13 May 22:37)
[DSA 2670-1] wordpress security update (11 May 22:41)
[DSA 2469-1] linux-2.6 security update (10 May 17:48)
[DSA 2468-1] libjakarta-poi-java security update (9 May 21:46)
[DSA 2422-2] file regression fix (9 May 20:23)
[DSA 2467-1] mahara security update (9 May 19:47)
[DSA 2466-1] rails security update (9 May 19:30)
[DSA 2465-1] php5 security update (9 May 19:23)
[DSA 2464-2] icedove regression update (8 May 21:28)
[DSA 2459-2] quagga security update (4 May 23:50)
[DSA 2462-2] imagemagick regression update (3 May 23:53)

Archives

23	May 2012
19	April 2012
25	March 2012
26	February 2012
25	January 2012
24	December 2011
23	November 2011
20	October 2011
16	September 2011
12	August 2011
24	July 2011
17	June 2011
24	May 2011
19	April 2011
37	March 2011
19	February 2011
22	January 2011
12	December 2010
6	November 2010
8	October 2010
17	September 2010
23	August 2010
15	July 2010
13	June 2010
16	May 2010
15	April 2010
21	March 2010
20	February 2010
25	January 2010
24	December 2009
19	November 2009
28	October 2009
24	September 2009
31	August 2009
27	July 2009
17	June 2009
23	May 2009
25	April 2009
32	March 2009
13	February 2009
26	January 2009
20	December 2008
14	November 2008
20	October 2008
12	September 2008
12	August 2008
29	July 2008
11	June 2008
32	May 2008
32	April 2008
31	March 2008
33	February 2008
42	January 2008
28	December 2007
23	November 2007
26	October 2007
24	September 2007
17	August 2007
19	July 2007
29	June 2007
18	May 2007
10	April 2007
13	March 2007
5	February 2007
12	January 2007
26	December 2006
22	November 2006
17	October 2006
27	September 2006
36	August 2006
28	July 2006
20	June 2006
38	May 2006
30	April 2006
43	March 2006
22	February 2006
38	January 2006
18	December 2005
39	November 2005
49	October 2005
45	September 2005
23	August 2005
40	July 2005
3	June 2005
12	May 2005
21	April 2005
12	March 2005
30	February 2005
40	January 2005
19	December 2004
25	November 2004
27	October 2004
11	September 2004
10	August 2004
11	July 2004
15	June 2004
13	May 2004
32	April 2004
18	March 2004
23	February 2004
26	January 2004
3	December 2003
7	November 2003
4	October 2003
21	September 2003
25	August 2003
21	July 2003
36	June 2003
11	May 2003
29	April 2003
19	March 2003
9	February 2003
30	January 2003
21	December 2002
17	November 2002
17	October 2002
18	September 2002
26	August 2002
3	July 2002
10	June 2002
1	April 2002

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template