# debians

cve_id: DSA-3366-1 rpcbind
date: 2015-09-23 00:00:00+00:00
more_info:
A remotely triggerable use-after-free vulnerability was found in rpcbind, a server that converts RPC program numbers into universal addresses. A remote attacker can take advantage of this flaw to mount a denial of service (rpcbind crash).


cve_id: DSA-3478-1 libgcrypt11
date: 2016-02-15 00:00:00+00:00
more_info:
Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt11 library could be leaked via a side-channel attack.


cve_id: DSA-3435-1 git
date: 2016-01-05 00:00:00+00:00
more_info:
Blake Burkhart discovered that the Git git-remote-ext helper incorrectly handled recursive clones of git repositories. A remote attacker could possibly use this issue to execute arbitary code by injecting commands via crafted URLs.


cve_id: DSA-3437-1 gnutls26
date: 2016-01-09 00:00:00+00:00
more_info:
Karthikeyan Bhargavan and Gaetan Leurent at INRIA discovered a flaw in the TLS 1.2 protocol which could allow the MD5 hash function to be used for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker could exploit this flaw to conduct collision attacks to impersonate a TLS server or an authenticated TLS client.


cve_id: DSA-3457-1 iceweasel
date: 2016-01-27 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and a buffer overflow may lead to the execution of arbitrary code. In addition the bundled NSS crypto library addresses the SLOTH attack on TLS 1.2.


cve_id: DSA-3378-1 gdk-pixbuf
date: 2015-10-24 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in gdk-pixbuf, a toolkit for image loading and pixel buffer manipulation. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3386-1 unzip
date: 2015-10-31 00:00:00+00:00
more_info:
Two vulnerabilities have been found in unzip, a de-archiver for .zip files. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3387-1 openafs
date: 2015-11-01 00:00:00+00:00
more_info:
John Stumpo discovered that OpenAFS, a distributed file system, does not fully initialize certain network packets before transmitting them. This can lead to a disclosure of the plaintext of previously processed packets.


cve_id: DSA-3380-1 php5
date: 2015-10-27 00:00:00+00:00
more_info:
Two vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development.


cve_id: DSA-3505-1 wireshark
date: 2016-03-04 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors/parsers for Pcapng, NBAP, UMTS FP, DCOM, AllJoyn, T.38, SDP, NLM, DNS, BED, SCTP, 802.11, DIAMETER, VeriWave, RVSP, ANSi A, GSM A, Ascend, NBAP, ZigBee ZCL and Sniffer which could result in denial of service.


cve_id: DSA-3390-1 xen
date: 2015-11-02 00:00:00+00:00
more_info:
It was discovered that the code to validate level 2 page table entries is bypassed when certain conditions are satisfied. A malicious PV guest administrator can take advantage of this flaw to gain privileges via a crafted superpage mapping.


cve_id: DSA-3417-1 bouncycastle
date: 2015-12-14 00:00:00+00:00
more_info:
Tibor Jager, JĂśrg Schwenk, and Juraj Somorovsky, from Horst GĂśrtz Institute for IT Security, published a paper in ESORICS 2015 where they describe an invalid curve attack in Bouncy Castle Crypto, a Java library for cryptography. An attacker is able to recover private Elliptic Curve keys from different applications, for example, TLS servers.


cve_id: DSA-3431-1 ganeti
date: 2016-01-01 00:00:00+00:00
more_info:
Pierre Kim discovered two vulnerabilities in the restful API of Ganeti, a virtual server cluster management tool. SSL parameter negotiation could result in denial of service and the DRBD secret could leak.


cve_id: DSA-3399-1 libpng
date: 2015-11-18 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the libpng PNG library. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3420-1 bind9
date: 2015-12-15 00:00:00+00:00
more_info:
It was discovered that the BIND DNS server does not properly handle the parsing of incoming responses, allowing some records with an incorrect class to be accepted by BIND instead of being rejected as malformed. This can trigger a REQUIRE assertion failure when those records are subsequently cached. A remote attacker can exploit this flaw to cause a denial of service against servers performing recursive queries.


cve_id: DSA-3438-1 xscreensaver
date: 2016-01-09 00:00:00+00:00
more_info:
It was discovered that unplugging one of the monitors in a multi-monitor setup can cause xscreensaver to crash.  Someone with physical access to a machine could use this problem to bypass a locked session.


cve_id: DSA-3404-1 python-django
date: 2015-11-25 00:00:00+00:00
more_info:
Ryan Butterfield discovered a vulnerability in the date template filter in python-django, a high-level Python web development framework. A remote attacker can take advantage of this flaw to obtain any secret in the application's settings.


cve_id: DSA-3408-1 gnutls26
date: 2015-12-01 00:00:00+00:00
more_info:
It was discovered that GnuTLS, a library implementing the TLS and SSL protocols, incorrectly validates the first byte of padding in CBC modes. A remote attacker can possibly take advantage of this flaw to perform a padding oracle attack.


cve_id: DSA-3550-1 openssh
date: 2016-04-15 00:00:00+00:00
more_info:
Shayan Sadigh discovered a vulnerability in OpenSSH: If PAM support is enabled and the sshd PAM configuration is configured to read userspecified environment variables and the <q>UseLogin</q> option is enabled, a local user may escalate her privileges to root.


cve_id: DSA-3429-1 foomatic-filters
date: 2015-12-21 00:00:00+00:00
more_info:
Michal Kowalczyk and Adam Chester discovered that missing input sanitising in the foomatic-rip print filter might result in the execution of arbitrary commands.


cve_id: DSA-3423-1 cacti
date: 2015-12-16 00:00:00+00:00
more_info:
Several SQL injection vulnerabilities have been discovered in Cacti, an RRDTool frontend written in PHP. Specially crafted input can be used by an attacker in the rra_id value of the graph.php script to execute arbitrary SQL commands on the database.


cve_id: DSA-3421-1 grub2
date: 2015-12-16 00:00:00+00:00
more_info:
Hector Marco and Ismael Ripoll, from Cybersecurity UPV Research Group, found an integer underflow vulnerability in Grub2, a popular bootloader. A local attacker can bypass the Grub2 authentication by inserting a crafted input as username or password.


cve_id: DSA-3494-1 cacti
date: 2016-02-27 00:00:00+00:00
more_info:
Two SQL injection vulnerabilities were discovered in cacti, a web interface for graphing of monitoring systems. Specially crafted input can be used by an attacker in parameters of the graphs_new.php script to execute arbitrary SQL commands on the database.


cve_id: DSA-3416-1 libphp-phpmailer
date: 2015-12-13 00:00:00+00:00
more_info:
Takeshi Terada discovered a vulnerability in PHPMailer, a PHP library for email transfer, used by many CMSs. The library accepted email addresses and SMTP commands containing line breaks, which can be abused by an attacker to inject messages.


cve_id: DSA-3445-1 pygments
date: 2016-01-13 00:00:00+00:00
more_info:
Javantea discovered that pygments, a generic syntax highlighter, is prone to a shell injection vulnerability allowing a remote attacker to execute arbitrary code via shell metacharacters in a font name.


cve_id: DSA-3442-1 isc-dhcp
date: 2016-01-13 00:00:00+00:00
more_info:
It was discovered that a maliciously crafted packet can crash any of the isc-dhcp applications.  This includes the DHCP client, relay, and server application.  Only IPv4 setups are affected.


cve_id: DSA-3427-1 blueman
date: 2015-12-18 00:00:00+00:00
more_info:
It was discovered that the Mechanism plugin of Blueman, a graphical Bluetooth manager, allows local privilege escalation.


cve_id: DSA-3452-1 claws-mail
date: 2016-01-23 00:00:00+00:00
more_info:
<q>DrWhax</q> of the Tails project reported that Claws Mail is missing range checks in some text conversion functions.  A remote attacker could exploit this to run arbitrary code under the account of a user that receives a message from them using Claws Mail.


cve_id: DSA-3467-1 tiff
date: 2016-02-06 00:00:00+00:00
more_info:
Several vulnerabilities have been found in tiff, a Tag Image File Format library. Multiple out-of-bounds read and write flaws could cause an application using the tiff library to crash.


cve_id: DSA-3527-1 inspircd
date: 2016-03-24 00:00:00+00:00
more_info:
It was discovered that inspircd, an IRC daemon, incorrectly handled PTR lookups of connecting users. This flaw allowed a remote attacker to crash the application by setting up malformed DNS records, thus causing a denial-of-service,


cve_id: DSA-3449-1 bind9
date: 2016-01-19 00:00:00+00:00
more_info:
It was discovered that specific APL RR data could trigger an INSIST failure in apl_42.c and cause the BIND DNS server to exit, leading to a denial-of-service.


cve_id: DSA-3516-1 wireshark
date: 2016-03-13 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors/parsers for DNP, RSL, LLRP, GSM A-bis OML, ASN 1 BER which could result in denial of service.


cve_id: DSA-3541-1 roundcube
date: 2016-04-05 00:00:00+00:00
more_info:
High-Tech Bridge Security Research Lab discovered that Roundcube, a webmail client, contained a path traversal vulnerability. This flaw could be exploited by an attacker to access sensitive files on the server, or even execute arbitrary code.


cve_id: DSA-3538-1 libebml
date: 2016-03-31 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libebml, a library for manipulating Extensible Binary Meta Language files.


cve_id: DSA-3526-1 libmatroska
date: 2016-03-23 00:00:00+00:00
more_info:
It was discovered that libmatroska, an extensible open standard audio/video container format, incorrectly processed EBML lacing. By providing maliciously crafted input, an attacker could use this flaw to force some leakage of information located in the process heap memory.


cve_id: DSA-3553-1 varnish
date: 2016-04-22 00:00:00+00:00
more_info:
RĂŠgis Leroy from Makina Corpus discovered that varnish, a caching HTTP reverse proxy, is vulnerable to HTTP smuggling issues, potentially resulting in cache poisoning or bypassing of access control policies.


cve_id: DSA-3459-1 mysql-5.5
date: 2016-01-28 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.47. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-3493-1 xerces-c
date: 2016-02-25 00:00:00+00:00
more_info:
Gustavo Grieco discovered that xerces-c, a validating XML parser library for C++, mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. These flaws could lead to a denial of service in applications using the xerces-c library, or potentially, to the execution of arbitrary code.


cve_id: DSA-3488-1 libssh
date: 2016-02-23 00:00:00+00:00
more_info:
Aris Adamantiadis discovered that libssh, a tiny C SSH library, incorrectly generated a short ephemeral secret for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. The resulting secret is 128 bits long, instead of the recommended sizes of 1024 and 2048 bits respectively. This flaw could allow an eavesdropper with enough resources to decrypt or intercept SSH sessions.


cve_id: DSA-3499-1 pillow
date: 2016-02-28 00:00:00+00:00
more_info:
Multiple security vulnerabilities have been found in Pillow, a Python imaging library, which may result in denial of service or the execution of arbitrary code if a malformed FLI, PCD or Tiff files is processed.


cve_id: DSA-3473-1 nginx
date: 2016-02-11 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in the resolver in nginx, a small, powerful, scalable web/proxy server, leading to denial of service or, potentially, to arbitrary code execution. These only affect nginx if the <q>resolver</q> directive is used in a configuration file.


cve_id: DSA-3463-1 prosody
date: 2016-01-31 00:00:00+00:00
more_info:
It was discovered that insecure handling of dialback keys may allow a malicious XMPP server to impersonate another server.


cve_id: DSA-3446-1 openssh
date: 2016-01-14 00:00:00+00:00
more_info:
The Qualys Security team discovered two vulnerabilities in the roaming code of the OpenSSH client (an implementation of the SSH protocol suite).


cve_id: DSA-3487-1 libssh2
date: 2016-02-23 00:00:00+00:00
more_info:
Andreas Schneider reported that libssh2, a SSH2 client-side library, passes the number of bytes to a function that expects number of bits during the SSHv2 handshake when libssh2 is to get a suitable value for <q>group order</q> in the Diffie-Hellman negotiation. This weakens significantly the handshake security, potentially allowing an eavesdropper with enough resources to decrypt or intercept SSH sessions.


cve_id: DSA-3482-1 libreoffice
date: 2016-02-17 00:00:00+00:00
more_info:
An anonymous contributor working with VeriSign iDefense Labs discovered that libreoffice, a full-featured office productivity suite, did not correctly handle Lotus WordPro files. This would enable an attacker to crash the program, or execute arbitrary code, by supplying a specially crafted LWP file.


cve_id: DSA-3439-1 prosody
date: 2016-01-10 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in Prosody, a lightweight Jabber/XMPP server. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-3543-1 oar
date: 2016-04-05 00:00:00+00:00
more_info:
Emmanuel Thome discovered that missing sanitising in the oarsh command of OAR, a software used to manage jobs and resources of HPC clusters, could result in privilege escalation.


cve_id: DSA-3676-1 unadf
date: 2016-09-24 00:00:00+00:00
more_info:
Tuomas RĂ¤sĂ¤nen discovered two vulnerabilities in unADF, a tool to extract files from an Amiga Disk File dump (.adf):


cve_id: DSA-3479-1 graphite2
date: 2016-02-15 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in the Graphite font rendering engine which might result in denial of service or the execution of arbitrary code if a malformed font file is processed.


cve_id: DSA-3477-1 iceweasel
date: 2016-02-14 00:00:00+00:00
more_info:
Holger Fuhrmannek discovered that missing input sanitising in the Graphite font rendering engine could result in the execution of arbitrary code.


cve_id: DSA-3517-1 exim4
date: 2016-03-14 00:00:00+00:00
more_info:
A local root privilege escalation vulnerability was found in Exim, Debian's default mail transfer agent, in configurations using the <q>perl_startup</q> option (Only Exim via exim4-daemon-heavy enables Perl support).


cve_id: DSA-3444-1 wordpress
date: 2016-01-13 00:00:00+00:00
more_info:
Crtc4L discovered a cross-site scripting vulnerability in wordpress, a web blogging tool, allowing a remote authenticated administrator to compromise the site.


cve_id: DSA-3508-1 jasper
date: 2016-03-06 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in JasPer, a library for manipulating JPEG-2000 files. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3506-1 libav
date: 2016-03-04 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library.


cve_id: DSA-3510-1 iceweasel
date: 2016-03-09 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, denial of service, address bar spoofing and overwriting local files.


cve_id: DSA-3460-1 privoxy
date: 2016-01-30 00:00:00+00:00
more_info:
It was discovered that privoxy, a web proxy with advanced filtering capabilities, contained invalid reads that could enable a remote attacker to crash the application, thus causing a Denial of Service.


cve_id: DSA-3483-1 cpio
date: 2016-02-19 00:00:00+00:00
more_info:
Gustavo Grieco discovered an out-of-bounds write vulnerability in cpio, a tool for creating and extracting cpio archive files, leading to a denial of service (application crash).


cve_id: DSA-3546-1 optipng
date: 2016-04-07 00:00:00+00:00
more_info:
Hans Jerry Illikainen discovered that missing input sanitising in the BMP processing code of the optipng PNG optimiser may result in denial of service or the execution of arbitrary code if a malformed file is processed.


cve_id: DSA-3472-1 wordpress
date: 2016-02-08 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3521-1 git
date: 2016-03-19 00:00:00+00:00
more_info:
Lael Cellier discovered two buffer overflow vulnerabilities in git, a fast, scalable, distributed revision control system, which could be exploited for remote execution of arbitrary code.


cve_id: DSA-3532-1 quagga
date: 2016-03-27 00:00:00+00:00
more_info:
Kostya Kortchinsky discovered a stack-based buffer overflow vulnerability in the VPNv4 NLRI parser in bgpd in quagga, a BGP/OSPF/RIP routing daemon. A remote attacker can exploit this flaw to cause a denial of service (daemon crash), or potentially, execution of arbitrary code, if bgpd is configured with BGP peers enabled for VPNv4.


cve_id: DSA-3540-1 lhasa
date: 2016-04-03 00:00:00+00:00
more_info:
Marcin Noga discovered an integer underflow in Lhasa, a lzh archive decompressor, which might result in the execution of arbitrary code if a malformed archive is processed.


cve_id: DSA-3501-1 perl
date: 2016-03-01 00:00:00+00:00
more_info:
Stephane Chazelas discovered a bug in the environment handling in Perl. Perl provides a Perl-space hash variable, %ENV, in which environment variables can be looked up.  If a variable appears twice in envp, only the last value would appear in %ENV, but getenv would return the first. Perl's taint security mechanism would be applied to the value in %ENV, but not to the other rest of the environment.  This could result in an ambiguous environment causing environment variables to be propagated to subprocesses, despite the protections supposedly offered by taint checking.


cve_id: DSA-3504-1 bsh
date: 2016-03-04 00:00:00+00:00
more_info:
Alvaro MuĂąoz and Christian Schneider discovered that BeanShell, an embeddable Java source interpreter, could be leveraged to execute arbitrary commands: applications including BeanShell in their classpath are vulnerable to this flaw if they deserialize data from an untrusted source.


cve_id: DSA-3490-1 websvn
date: 2016-02-23 00:00:00+00:00
more_info:
Jakub Palaczynski discovered that websvn, a web viewer for Subversion repositories, does not correctly sanitize user-supplied input, which allows a remote user to run reflected cross-site scripting attacks.


cve_id: DSA-3522-1 squid3
date: 2016-03-20 00:00:00+00:00
more_info:
Alex Rousskov from The Measurement Factory discovered that Squid3, a fully featured web proxy cache, does not properly handle errors for certain malformed HTTP responses. A remote HTTP server can exploit this flaw to cause a denial of service (assertion failure and daemon exit).


cve_id: DSA-3559-1 iceweasel
date: 2016-04-27 00:00:00+00:00
more_info:
Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-3512-1 libotr
date: 2016-03-09 00:00:00+00:00
more_info:
Markus Vervier of X41 D-Sec GmbH discovered an integer overflow vulnerability in libotr, an off-the-record (OTR) messaging library, in the way how the sizes of portions of incoming messages were stored. A remote attacker can exploit this flaw by sending crafted messages to an application that is using libotr to perform denial of service attacks (application crash), or potentially, execute arbitrary code with the privileges of the user running the application.


cve_id: DSA-3542-1 mercurial
date: 2016-04-05 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Mercurial, a distributed version control system. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-3556-1 libgd2
date: 2016-04-24 00:00:00+00:00
more_info:
Hans Jerry Illikainen discovered that libgd2, a library for programmatic graphics creation and manipulation, suffers of a signedness vulnerability which may result in a heap overflow when processing specially crafted compressed gd2 data. A remote attacker can take advantage of this flaw to cause an application using the libgd2 library to crash, or potentially, to execute arbitrary code with the privileges of the user running the application.


cve_id: DSA-3518-1 spip
date: 2016-03-16 00:00:00+00:00
more_info:
Several vulnerabilities were found in SPIP, a website engine for publishing, resulting in code injection.


cve_id: DSA-3498-1 drupal7
date: 2016-02-28 00:00:00+00:00
more_info:
Multiple security vulnerabilities have been found in the Drupal content management framework. For additional information, please refer to the upstream advisory at <url "https://www.drupal.org/SA-CORE-2016-001" />


cve_id: DSA-2173-1 pam-pgsql
date: 2011-02-26 00:00:00+00:00
more_info:
It was discovered that pam-pgsql, a PAM module to authenticate using a PostgreSQL database, was vulnerable to a buffer overflow in supplied IP-addresses.


cve_id: DSA-2215-1 gitolite
date: 2011-04-09 00:00:00+00:00
more_info:
Dylan Simon discovered that gitolite, a SSH-based gatekeeper for Git repositories, is prone to directory traversal attacks when restricting admin defined commands (ADC).  This allows an attacker to execute arbitrary commands with privileges of the gitolite server via crafted command names.


cve_id: DSA-2261-1 redmine
date: 2011-06-15 00:00:00+00:00
more_info:
Joernchen of Phenoelit discovered several vulnerabilities in Redmine, a project management web application:


cve_id: DSA-2263-2 movabletype-opensource
date: 2011-06-16 00:00:00+00:00
more_info:
It was discovered that Movable Type, a weblog publishing system, contains several security vulnerabilities:


cve_id: DSA-2289-1 typo3-src
date: 2011-08-07 00:00:00+00:00
more_info:
Several remote vulnerabilities have been discovered in the TYPO3 web content management framework: cross-site scripting, information disclosure, authentication delay bypass, and arbitrary file deletion. More details can be found in the Typo3 security advisory: <a href="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-001/">\ TYPO3-CORE-SA-2011-001</a>.


cve_id: DSA-2416-1 notmuch
date: 2012-02-22 00:00:00+00:00
more_info:
It was discovered that Notmuch, an email indexer, did not sufficiently escape Emacs MML tags. When using the Emacs interface, a user could be tricked into replying to a maliciously formatted message which could lead to files from the local machine being attached to the outgoing message.


cve_id: DSA-2424-1 libxml-atom-perl
date: 2012-03-04 00:00:00+00:00
more_info:
It was discovered that the XML::Atom Perl module did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used.


cve_id: DSA-2532-1 libapache2-mod-rpaf
date: 2012-08-22 00:00:00+00:00
more_info:
SĂŠbastien Bocahu discovered that the reverse proxy add forward module for the Apache webserver is vulnerable to a denial of service attack through a single crafted request with many headers.


cve_id: DSA-2895-1 prosody
date: 2014-04-06 00:00:00+00:00
more_info:
A denial-of-service vulnerability has been reported in Prosody, a XMPP  server. If compression is enabled, an attacker might send highly-compressed XML  elements (attack known as <q>zip bomb</q>) over XMPP streams and consume all  the resources of the server.


cve_id: DSA-2942-1 typo3-src
date: 2014-06-01 00:00:00+00:00
more_info:
Multiple security issues have been discovered in the Typo3 CMS. More information can be found in the upstream advisory: <a href="http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/">\ http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/</a> 


cve_id: DSA-2947-1 libav
date: 2014-06-04 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and  decoders of the libav multimedia library. A full list of the changes is  available at <a href="http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8.12">http://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v0.8.12</a>


cve_id: DSA-3126-1 php5
date: 2015-01-12 00:00:00+00:00
more_info:
It was discovered that libmagic as used by PHP, would trigger an out of bounds memory access when trying to identify a crafted file.


cve_id: DSA-3154-1 ntp
date: 2015-02-05 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in the ntp package, an implementation of the Network Time Protocol. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3173-1 libgtk2-perl
date: 2015-02-25 00:00:00+00:00
more_info:
It was discovered that libgtk2-perl, a Perl interface to the 2.x series of the Gimp Toolkit library, incorrectly frees memory which GTK+ still holds onto and might access later, leading to denial of service (application crash) or, potentially, to arbitrary code execution.


cve_id: DSA-3310-1 freexl
date: 2015-07-19 00:00:00+00:00
more_info:
It was discovered that an integer overflow in freexl, a library to parse Microsoft Excel spreadsheets may result in denial of service if a malformed Excel file is opened.


cve_id: DSA-3403-1 libcommons-collections3-java
date: 2015-11-24 00:00:00+00:00
more_info:
This update backports changes from the commons-collections 3.2.2 release which disable the deserialisation of the functors classes unless the system property org.apache.commons.collections.enableUnsafeSerialization is set to <q>true</q>. This fixes a vulnerability in unsafe applications deserialising objects from untrusted sources without sanitising the input data. Classes considered unsafe are: CloneTransformer, ForClosure, InstantiateFactory, InstantiateTransformer, InvokerTransformer, PrototypeCloneFactory, PrototypeSerializationFactory and WhileClosure.


cve_id: DSA-3492-2 gajim
date: 2016-02-28 00:00:00+00:00
more_info:
The wheezy part of the previous gajim update, DSA-3492-1, was incorrectly built resulting in an unsatisfiable dependency. This update corrects that problem. For reference, the original advisory text follows.


cve_id: DSA-3523-1 iceweasel
date: 2016-03-20 00:00:00+00:00
more_info:
This update disables the Graphite font shaping library in Iceweasel, Debian's version of the Mozilla Firefox web browser.


cve_id: DSA-3547-1 imagemagick
date: 2016-04-11 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Imagemagick, a program suite for image manipulation. This update fixes a large number of potential security problems such as null-pointer access and buffer-overflows that might lead to memory leaks or denial of service. None of these security problems have a CVE number assigned.


cve_id: DSA-3368-1 cyrus-sasl2
date: 2015-09-25 00:00:00+00:00
more_info:
It was discovered that cyrus-sasl2, a library implementing the Simple Authentication and Security Layer, does not properly handle certain invalid password salts. A remote attacker can take advantage of this flaw to cause a denial of service.


cve_id: DSA-3503-1 linux
date: 2016-03-03 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation or denial-of-service.


cve_id: DSA-3691-1 ghostscript
date: 2016-10-12 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may lead to the execution of arbitrary code or information disclosure if a specially crafted Postscript file is processed.


cve_id: DSA-3587-1 libgd2
date: 2016-05-27 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using the libgd2 library.


cve_id: DSA-3634-1 redis
date: 2016-07-30 00:00:00+00:00
more_info:
It was discovered that redis, a persistent key-value database, did not properly protect redis-cli history files: they were created by default with world-readable permissions.


cve_id: DSA-2853-1 horde3
date: 2014-02-05 00:00:00+00:00
more_info:
Pedro Ribeiro from Agile Information Security found a possible remote  code execution on Horde3, a web application framework. Unsanitized variables are passed to the unserialize() PHP function. A remote attacker could specially-craft one of those variables allowing her to load and execute code.


cve_id: DSA-3110-1 mediawiki
date: 2014-12-23 00:00:00+00:00
more_info:
A flaw was discovered in mediawiki, a wiki engine: thumb.php outputs wikitext messages as raw HTML, potentially leading to cross-site scripting (XSS).


cve_id: DSA-3255-1 zeromq3
date: 2015-05-10 00:00:00+00:00
more_info:
It was discovered that libzmq, a lightweight messaging kernel, is susceptible to a protocol downgrade attack on sockets using the ZMTP v3 protocol. This could allow remote attackers to bypass ZMTP v3 security mechanisms by sending ZMTP v2 or earlier headers.


cve_id: DSA-3635-1 libdbd-mysql-perl
date: 2016-07-29 00:00:00+00:00
more_info:
Two use-after-free vulnerabilities were discovered in DBD::mysql, a Perl DBI driver for the MySQL database server. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using DBD::mysql (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.


cve_id: DSA-3652-1 imagemagick
date: 2016-08-25 00:00:00+00:00
more_info:
This updates fixes many vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed TIFF, WPG, RLE, RAW, PSD, Sun, PICT, VIFF, HDR, Meta, Quantum, PDB, DDS, DCM, EXIF, RGF or BMP files are processed.


cve_id: DSA-3311-1 mariadb-10.0
date: 2015-07-20 00:00:00+00:00
more_info:
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.20. Please see the MariaDB 10.0 Release Notes for further details:


cve_id: DSA-3275-1 fusionforge
date: 2015-05-30 00:00:00+00:00
more_info:
Ansgar Burchardt discovered that the Git plugin for FusionForge, a web-based project-management and collaboration software, does not sufficiently validate user provided input as parameter to the method to create secondary Git repositories. A remote attacker can use this flaw to execute arbitrary code as root via a specially crafted URL.


cve_id: DSA-3562-1 tardiff
date: 2016-05-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in tardiff, a tarball comparison tool. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3425-1 tryton-server
date: 2015-12-17 00:00:00+00:00
more_info:
CĂŠdric Krier discovered a vulnerability in the server-side of Tryton, an application framework written in Python. An authenticated malicious user can write arbitrary values in record fields due missed checks of access permissions when multiple records are written.


cve_id: DSA-3254-1 suricata
date: 2015-05-09 00:00:00+00:00
more_info:
Kostya Kortchinsky of the Google Security Team discovered a flaw in the DER parser used to decode SSL/TLS certificates in suricata. A remote attacker can take advantage of this flaw to cause suricata to crash.


cve_id: DSA-3360-1 icu
date: 2015-09-15 00:00:00+00:00
more_info:
It was discovered that the International Components for Unicode (ICU) library mishandles converter names starting with <code>x-</code>, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file.


cve_id: DSA-3317-1 lxc
date: 2015-07-25 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in LXC, the Linux Containers userspace tools. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3400-1 lxc
date: 2015-11-19 00:00:00+00:00
more_info:
Roman Fiedler discovered a directory traversal flaw in LXC, the Linux Containers userspace tools. A local attacker with access to a LXC container could exploit this flaw to run programs inside the container that are not confined by AppArmor or expose unintended files in the host to the container.


cve_id: DSA-3290-1 linux
date: 2015-06-18 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation or denial of service.


cve_id: DSA-3292-1 cinder
date: 2015-06-19 00:00:00+00:00
more_info:
Bastian Blank from credativ discovered that cinder, a storage-as-a-service system for the OpenStack cloud computing suite, contained a bug that would allow an authenticated user to read any file from the cinder server.


cve_id: DSA-3578-1 libidn
date: 2016-05-14 00:00:00+00:00
more_info:
It was discovered that libidn, the GNU library for Internationalized Domain Names (IDNs), did not correctly handle invalid UTF-8 input, causing an out-of-bounds read. This could allow attackers to disclose sensitive information from an application using the libidn library.


cve_id: DSA-3621-1 mysql-connector-java
date: 2016-07-18 00:00:00+00:00
more_info:
A vulnerability was discovered in mysql-connector-java, a Java database (JDBC) driver for MySQL, which may result in unauthorized update, insert or delete access to some MySQL Connectors accessible data as well as read access to a subset of MySQL Connectors accessible data. The vulnerability was addressed by upgrading mysql-connector-java to the new upstream version 5.1.39, which includes additional changes, such as bug fixes, new features, and possibly incompatible changes. Please see the MySQL Connector/J Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-3700-1 asterisk
date: 2016-10-25 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service or incorrect certificate validation.


cve_id: DSA-3244-1 owncloud
date: 2015-05-02 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in ownCloud, a cloud storage web service for files, music, contacts, calendars and many more.


cve_id: DSA-3239-1 icecast2
date: 2015-04-29 00:00:00+00:00
more_info:
Juliane Holzt discovered that Icecast2, a streaming media server, could dereference a NULL pointer when URL authentication is configured and the stream_auth URL is trigged by a client without setting any credentials. This could allow remote attackers to cause a denial of service (crash).


cve_id: DSA-3240-1 curl
date: 2015-04-29 00:00:00+00:00
more_info:
It was discovered that cURL, an URL transfer library, if configured to use a proxy server with the HTTPS protocol, by default could send to the proxy the same HTTP headers it sends to the destination server, possibly leaking sensitive information.


cve_id: DSA-3617-1 horizon
date: 2016-07-06 00:00:00+00:00
more_info:
Two cross-site scripting vulnerabilities have been found in Horizon, a web application to control an OpenStack cloud.


cve_id: DSA-3464-1 rails
date: 2016-01-31 00:00:00+00:00
more_info:
Multiple security issues have been discovered in the Ruby on Rails web application development framework, which may result in denial of service, cross-site scripting, information disclosure or bypass of input validation.


cve_id: DSA-3354-1 spice
date: 2015-09-08 00:00:00+00:00
more_info:
Frediano Ziglio of Red Hat discovered a race condition flaw in spice's worker_update_monitors_config() function, leading to a heap-based memory corruption. A malicious user in a guest can take advantage of this flaw to cause a denial of service (QEMU process crash) or, potentially execute arbitrary code on the host with the privileges of the hosting QEMU process.


cve_id: DSA-3414-1 xen
date: 2015-12-09 00:00:00+00:00
more_info:
Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure.


cve_id: DSA-3301-1 haproxy
date: 2015-07-05 00:00:00+00:00
more_info:
Charlie Smurthwaite of aTech Media discovered a flaw in HAProxy, a fast and reliable load balancing reverse proxy, when HTTP pipelining is used. A client can take advantage of this flaw to cause data corruption and retrieve uninitialized memory contents that exhibit data from a past request or session.


cve_id: DSA-3241-1 elasticsearch
date: 2015-04-29 00:00:00+00:00
more_info:
John Heasman discovered that the site plugin handling of the Elasticsearch search engine was susceptible to directory traversal.


cve_id: DSA-3288-1 libav
date: 2015-06-13 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at <a href="https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4"> https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</a>


cve_id: DSA-3252-1 sqlite3
date: 2015-05-06 00:00:00+00:00
more_info:
Michal Zalewski discovered multiple vulnerabilities in SQLite, which may result in denial of service or the execution of arbitrary code.


cve_id: DSA-3258-1 quassel
date: 2015-05-12 00:00:00+00:00
more_info:
It was discovered that the fix for  <a href="https://security-tracker.debian.org/tracker/CVE-2013-4422">\ CVE-2013-4422</a> in quassel, a  distributed IRC client, was incomplete. This could allow remote attackers to inject SQL queries after a database reconnection (e.g. when the backend PostgreSQL server is restarted).


cve_id: DSA-3256-1 libtasn1-6
date: 2015-05-10 00:00:00+00:00
more_info:
Hanno Boeck discovered a heap-based buffer overflow flaw in the way Libtasn1, a library to manage ASN.1 structures, decoded certain DER-encoded input. A specially crafted DER-encoded input could cause an application using the Libtasn1 library to crash, or potentially to execute arbitrary code.


cve_id: DSA-3299-1 stunnel4
date: 2015-07-02 00:00:00+00:00
more_info:
Johan Olofsson discovered an authentication bypass vulnerability in Stunnel, a program designed to work as an universal SSL tunnel for network daemons. When Stunnel in server mode is used with the redirect option and certificate-based authentication is enabled with <q>verify = 2</q> or higher, then only the initial connection is redirected to the hosts specified with <q>redirect</q>. This allows a remote attacker to bypass authentication.


cve_id: DSA-3692-1 freeimage
date: 2016-10-13 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the FreeImage multimedia library, which might result in denial of service or the execution of arbitrary code if a malformed XMP or RAW image is processed.


cve_id: DSA-3688-1 nss
date: 2016-10-05 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in NSS, the cryptography library developed by the Mozilla project.


cve_id: DSA-3276-1 symfony
date: 2015-05-31 00:00:00+00:00
more_info:
Jakub Zalas discovered that Symfony, a framework to create websites and web applications, was vulnerable to restriction bypass. It was affecting applications with ESI or SSI support enabled, that use the FragmentListener. A malicious user could call any controller via the /_fragment path by providing an invalid hash in the URL (or removing it), bypassing URL signing and security rules.


cve_id: DSA-3279-1 redis
date: 2015-06-06 00:00:00+00:00
more_info:
It was discovered that redis, a persistent key-value database, could execute insecure Lua bytecode by way of the EVAL command. This could allow remote attackers to break out of the Lua sandbox and execute arbitrary code.


cve_id: DSA-3363-1 owncloud-client
date: 2015-09-20 00:00:00+00:00
more_info:
Johannes Kliemann discovered a vulnerability in ownCloud Desktop Client, the client-side of the ownCloud file sharing services. The vulnerability allows man-in-the-middle attacks in situations where the server is using self-signed certificates and the connection is already established. If the user in the client side manually distrusts the new certificate, the file syncing will continue using the malicious server as valid.


cve_id: DSA-3294-1 wireshark
date: 2015-06-23 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors for WCCP and GSM DTAP, which could result in denial of service.


cve_id: DSA-3373-1 owncloud
date: 2015-10-18 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in ownCloud, a cloud storage web service for files, music, contacts, calendars and many more. These flaws may lead to the execution of arbitrary code, authorization bypass, information disclosure, cross-site scripting or denial of service.


cve_id: DSA-3385-1 mariadb-10.0
date: 2015-10-31 00:00:00+00:00
more_info:
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.22. Please see the MariaDB 10.0 Release Notes for further details:


cve_id: DSA-3609-1 tomcat8
date: 2016-06-29 00:00:00+00:00
more_info:
Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in information disclosure, the bypass of CSRF protections, bypass of the SecurityManager or denial of service.


cve_id: DSA-3347-1 pdns
date: 2015-09-02 00:00:00+00:00
more_info:
Pyry Hakulinen and Ashish Shakla at Automattic discovered that pdns, an authoritative DNS server, was incorrectly processing some DNS packets; this would enable a remote attacker to trigger a DoS by sending specially crafted packets causing the server to crash. 


cve_id: DSA-3424-1 subversion
date: 2015-12-16 00:00:00+00:00
more_info:
Ivan Zhakov discovered an integer overflow in mod_dav_svn, which allows an attacker with write access to the server to execute arbitrary code or cause a denial of service.


cve_id: DSA-3306-1 pdns
date: 2015-07-09 00:00:00+00:00
more_info:
Toshifumi Sakaguchi discovered that the patch applied to pdns, an authoritative DNS server, fixing  <a href="https://security-tracker.debian.org/tracker/CVE-2015-1868">\ CVE-2015-1868</a>, was insufficient in some cases, allowing remote attackers to cause a denial of service (service-affecting CPU spikes and in some cases a crash).


cve_id: DSA-3307-1 pdns-recursor
date: 2015-07-09 00:00:00+00:00
more_info:
Toshifumi Sakaguchi discovered that the patch applied to pdns-recursor, a recursive DNS server, fixing  <a href="https://security-tracker.debian.org/tracker/CVE-2015-1868">\ CVE-2015-1868</a>, was insufficient in some cases, allowing remote attackers to cause a denial of service (service-affecting CPU spikes and in some cases a crash).


cve_id: DSA-4154-1 net-snmp
date: 2018-03-28 00:00:00+00:00
more_info:
A heap corruption vulnerability was discovered in net-snmp, a suite of Simple Network Management Protocol applications, triggered when parsing the PDU prior to the authentication process. A remote, unauthenticated attacker can take advantage of this flaw to crash the snmpd process (causing a denial of service) or, potentially, execute arbitrary code with the privileges of the user running snmpd.


cve_id: DSA-3350-1 bind9
date: 2015-09-02 00:00:00+00:00
more_info:
Hanno Boeck discovered that incorrect validation of DNSSEC-signed records in the Bind DNS server could result in denial of service.


cve_id: DSA-3565-1 botan1.10
date: 2016-05-02 00:00:00+00:00
more_info:
Several security vulnerabilities were found in botan1.10, a C++ library which provides support for many common cryptographic operations, including encryption, authentication, X.509v3 certificates and CRLs.


cve_id: DSA-3342-1 vlc
date: 2015-08-20 00:00:00+00:00
more_info:
Loren Maggiore of Trail of Bits discovered that the 3GP parser of VLC, a multimedia player and streamer, could dereference an arbitrary pointer due to insufficient restrictions on a writable buffer. This could allow remote attackers to execute arbitrary code via crafted 3GP files.


cve_id: DSA-3367-1 wireshark
date: 2015-09-24 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors/parsers for ZigBee, GSM RLC/MAC, WaveAgent, ptvcursor, OpenFlow, WCCP and in internal functions which could result in denial of service.


cve_id: DSA-3334-1 gnutls28
date: 2015-08-12 00:00:00+00:00
more_info:
Kurt Roeckx discovered that decoding a specific certificate with very long DistinguishedName (DN) entries leads to double free. A remote attacker can take advantage of this flaw by creating a specially crafted certificate that, when processed by an application compiled against GnuTLS, could cause the application to crash resulting in a denial of service.


cve_id: DSA-3665-1 openjpeg2
date: 2016-09-11 00:00:00+00:00
more_info:
Multiple vulnerabilities in OpenJPEG, a JPEG 2000 image compression / decompression library, may result in denial of service or the execution of arbitrary code if a malformed JPEG 2000 file is processed.


cve_id: DSA-3829-1 bouncycastle
date: 2017-04-11 00:00:00+00:00
more_info:
Quan Nguyen discovered that a missing boundary check in the Galois/Counter mode implementation of Bouncy Castle (a Java implementation of cryptographic algorithms) may result in information disclosure.


cve_id: DSA-3357-1 vzctl
date: 2015-09-13 00:00:00+00:00
more_info:
It was discovered that vzctl, a set of control tools for the OpenVZ server virtualisation solution, determined the storage layout of containers based on the presence of an XML file inside the container. An attacker with local root privileges in a simfs-based container could gain control over ploop-based containers. Further information on the prerequisites of such an attack can be found at <a href="https://src.openvz.org/projects/OVZL/repos/vzctl/commits/9e98ea630ac0e88b44e3e23c878a5166aeb74e1c">\ src.openvz.org</a>.


cve_id: DSA-3474-1 libgcrypt20
date: 2016-02-12 00:00:00+00:00
more_info:
Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt20 library could be leaked via a side-channel attack.


cve_id: DSA-3589-1 gdk-pixbuf
date: 2016-05-30 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in gdk-pixbuf, a toolkit for image loading and pixel buffer manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using gdk-pixbuf (application crash), or potentially, to execute arbitrary code with the privileges of the user running the application, if a malformed image is opened.


cve_id: DSA-3584-1 librsvg
date: 2016-05-19 00:00:00+00:00
more_info:
Gustavo Grieco discovered several flaws in the way librsvg, a SAX-based renderer library for SVG files, parses SVG files with circular definitions. A remote attacker can take advantage of these flaws to cause an application using the librsvg library to crash.


cve_id: DSA-3343-1 twig
date: 2015-08-26 00:00:00+00:00
more_info:
James Kettle, Alain Tiemblo, Christophe Coevoet and Fabien Potencier discovered that twig, a templating engine for PHP, did not correctly process its input. End users allowed to submit twig templates could use specially crafted code to trigger remote code execution, even in sandboxed templates.


cve_id: DSA-3391-1 php-horde
date: 2015-11-03 00:00:00+00:00
more_info:
It was discovered that the web-based administration interface in the Horde Application Framework did not guard against Cross-Site Request Forgery (CSRF) attacks.  As a result, other, malicious web pages could cause Horde applications to perform actions as the Horde user.


cve_id: DSA-3605-1 libxslt
date: 2016-06-19 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libxslt, an XSLT processing runtime library, which could lead to information disclosure or denial-of-service (application crash) against an application using the libxslt library.


cve_id: DSA-3412-1 redis
date: 2015-12-03 00:00:00+00:00
more_info:
Luca Bruno discovered an integer overflow flaw leading to a stack-based buffer overflow in redis, a persistent key-value database. A remote attacker can use this flaw to cause a denial of service (application crash).


cve_id: DSA-3402-1 symfony
date: 2015-11-24 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in symfony, a framework to create websites and web applications. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3850-1 rtmpdump
date: 2017-05-12 00:00:00+00:00
more_info:
Dave McDaniel discovered multiple vulnerabilities in rtmpdump, a small dumper/library for RTMP media streams, which may result in denial of service or the execution of arbitrary code if a malformed stream is dumped.


cve_id: DSA-3569-1 openafs
date: 2016-05-05 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in openafs, an implementation of the distributed filesystem AFS. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3411-1 cups-filters
date: 2015-12-02 00:00:00+00:00
more_info:
Michal Kowalczyk discovered that missing input sanitising in the foomatic-rip print filter might result in the execution of arbitrary commands.


cve_id: DSA-3529-1 redmine
date: 2016-03-23 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in Redmine, a project management web application, which may result in information disclosure.


cve_id: DSA-4012-1 libav
date: 2017-10-31 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at  <a href="https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.11">\ https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.11</a>


cve_id: DSA-3583-1 swift-plugin-s3
date: 2016-05-18 00:00:00+00:00
more_info:
It was discovered that the swift3 (S3 compatibility) middleware plugin for Swift performed insufficient validation of date headers which might result in replay attacks.


cve_id: DSA-3419-1 cups-filters
date: 2015-12-15 00:00:00+00:00
more_info:
Adam Chester discovered that missing input sanitising in the foomatic-rip print filter might result in the execution of arbitrary commands.


cve_id: DSA-3441-1 perl
date: 2016-01-11 00:00:00+00:00
more_info:
David Golden of MongoDB discovered that File::Spec::canonpath() in Perl returned untainted strings even if passed tainted input. This defect undermines taint propagation, which is sometimes used to ensure that unvalidated user input does not reach sensitive code.


cve_id: DSA-3593-1 libxml2
date: 2016-06-02 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial-of-service against the application, or potentially the execution of arbitrary code with the privileges of the user running the application.


cve_id: DSA-3496-1 php-horde-core
date: 2016-02-28 00:00:00+00:00
more_info:
It was discovered that php-horde-core, a set of classes providing the core functionality of the Horde Application Framework, is prone to a cross-site scripting vulnerability.


cve_id: DSA-3746-1 graphicsmagick
date: 2016-12-24 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in GraphicsMagick, a collection of image processing tool, which can cause denial of service attacks, remote file deletion, and remote command execution.


cve_id: DSA-3528-1 pidgin-otr
date: 2016-03-23 00:00:00+00:00
more_info:
Stefan Sperling discovered that pidgin-otr, a Pidgin plugin implementing Off-The-Record messaging, contained a use-after-free bug. This could be used by a malicious remote user to intentionally crash the application, thus causing a denial-of-service.


cve_id: DSA-3639-1 wordpress
date: 2016-08-03 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in wordpress, a web blogging tool, which could allow remote attackers to compromise a site via cross-site scripting, bypass restrictions, obtain sensitive revision-history information, or mount a denial of service.


cve_id: DSA-3563-1 poppler
date: 2016-05-01 00:00:00+00:00
more_info:
It was discovered that a heap overflow in the Poppler PDF library may result in denial of service and potentially the execution of arbitrary code if a malformed PDF file is opened.


cve_id: DSA-3657-1 libarchive
date: 2016-08-30 00:00:00+00:00
more_info:
Hanno Boeck and Marcin Noga discovered multiple vulnerabilities in libarchive; processing malformed archives may result in denial of service or the execution of arbitrary code.


cve_id: DSA-3658-1 libidn
date: 2016-09-01 00:00:00+00:00
more_info:
Hanno Boeck discovered multiple vulnerabilities in libidn, the GNU library for Internationalized Domain Names (IDNs), allowing a remote attacker to cause a denial of service against an application using the libidn library (application crash).


cve_id: DSA-3712-1 terminology
date: 2016-11-13 00:00:00+00:00
more_info:
Nicolas Braud-Santoni discovered that incorrect sanitising of character escape sequences in the Terminology terminal emulator may result in the execution of arbitrary commands.


cve_id: DSA-3749-1 dcmtk
date: 2016-12-29 00:00:00+00:00
more_info:
Gjoko Krstic of Zero Science Labs discovered that dcmtk, a collection of libraries implementing the DICOM standard, did not properly handle the size of data received from the network. This could lead to denial-of-service (via application crash) or arbitrary code execution.


cve_id: DSA-3453-1 mariadb-10.0
date: 2016-01-25 00:00:00+00:00
more_info:
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.23. Please see the MariaDB 10.0 Release Notes for further details:


cve_id: DSA-3595-1 mariadb-10.0
date: 2016-06-05 00:00:00+00:00
more_info:
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.25. Please see the MariaDB 10.0 Release Notes for further details:


cve_id: DSA-3557-1 mysql-5.5
date: 2016-04-26 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.49. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-3582-1 expat
date: 2016-05-18 00:00:00+00:00
more_info:
Gustavo Grieco discovered that Expat, an XML parsing C library, does not properly handle certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. A remote attacker can take advantage of this flaw to cause an application using the Expat library to crash, or potentially, to execute arbitrary code with the privileges of the user running the application.


cve_id: DSA-3596-1 spice
date: 2016-06-06 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in spice, a SPICE protocol client and server library. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3455-1 curl
date: 2016-01-27 00:00:00+00:00
more_info:
Isaac Boukris discovered that cURL, an URL transfer library, reused NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for the new transfer. This could lead to HTTP requests being sent over the connection authenticated as a different user.


cve_id: DSA-3721-1 tomcat7
date: 2016-11-21 00:00:00+00:00
more_info:
Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in possible timing attacks to determine valid user names, bypass of the SecurityManager, disclosure of system properties, unrestricted access to global resources, arbitrary file overwrites, and potentially escalation of privileges.


cve_id: DSA-3745-1 squid3
date: 2016-12-24 00:00:00+00:00
more_info:
Saulius Lapinskas from Lithuanian State Social Insurance Fund Board discovered that Squid3, a fully featured web proxy cache, does not properly process responses to If-None-Modified HTTP conditional requests, leading to client-specific Cookie data being leaked to other clients. A remote attacker can take advantage of this flaw to discover private and sensitive information about another clients browsing session.


cve_id: DSA-3642-1 lighttpd
date: 2016-08-05 00:00:00+00:00
more_info:
Dominic Scheirlinck and Scott Geary of Vend reported insecure behavior in the lighttpd web server. Lighttpd assigned Proxy header values from client requests to internal HTTP_PROXY environment variables, allowing remote attackers to carry out Man in the Middle (MITM) attacks or initiate connections to arbitrary hosts.


cve_id: DSA-3847-1 xen
date: 2017-05-09 00:00:00+00:00
more_info:
Jan Beulich and Jann Horn discovered multiple vulnerabilities in the Xen hypervisor, which may lead to privilege escalation, guest-to-host breakout, denial of service or information leaks.


cve_id: DSA-3750-1 libphp-phpmailer
date: 2016-12-31 00:00:00+00:00
more_info:
Dawid Golunski discovered that PHPMailer, a popular library to send email from PHP applications, allowed a remote attacker to execute code if they were able to provide a crafted Sender address.


cve_id: DSA-3799-1 imagemagick
date: 2017-03-01 00:00:00+00:00
more_info:
This update fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed TIFF, WPG, IPL, MPC or PSB files are processed.


cve_id: DSA-3769-1 libphp-swiftmailer
date: 2017-01-22 00:00:00+00:00
more_info:
Dawid Golunski from LegalHackers discovered that PHP Swift Mailer, a mailing solution for PHP, did not correctly validate user input. This allowed a remote attacker to execute arbitrary code by passing specially formatted email addresses in specific email headers.


cve_id: DSA-3762-1 tiff
date: 2017-01-13 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the libtiff library and the included tools tiff2rgba, rgb2ycbcr, tiffcp, tiffcrop, tiff2pdf and tiffsplit, which may result in denial of service, memory disclosure or the execution of arbitrary code.


cve_id: DSA-3903-1 tiff
date: 2017-07-05 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.


cve_id: DSA-3752-1 pcsc-lite
date: 2017-01-04 00:00:00+00:00
more_info:
Peter Wu discovered that a use-after-free in the pscd PC/SC daemon of PCSC-Lite might result in denial of service or potentially privilege escalation.


cve_id: DSA-3802-1 zabbix
date: 2017-03-05 00:00:00+00:00
more_info:
An SQL injection vulnerability has been discovered in the <q>Latest data</q> page of the web frontend of the Zabbix network monitoring system


cve_id: DSA-3759-1 python-pysaml2
date: 2017-01-12 00:00:00+00:00
more_info:
Matias P. Brutti discovered that python-pysaml2, a Python implementation of the Security Assertion Markup Language 2.0, did not correctly sanitize the XML messages it handled. This allowed a remote attacker to perform XML External Entity attacks, leading to a wide range of exploits.


cve_id: DSA-3783-1 php5
date: 2017-02-08 00:00:00+00:00
more_info:
Several issues have been discovered in PHP, a widely-used open source general-purpose scripting language.


cve_id: DSA-3772-1 libxpm
date: 2017-01-26 00:00:00+00:00
more_info:
Tobias Stoeckmann discovered that the libXpm library contained two integer overflow flaws, leading to a heap out-of-bounds write, while parsing XPM extensions in a file. An attacker can provide a specially crafted XPM file that, when processed by an application using the libXpm library, would cause a denial-of-service against the application, or potentially, the execution of arbitrary code with the privileges of the user running the application.


cve_id: DSA-3774-1 lcms2
date: 2017-01-29 00:00:00+00:00
more_info:
Ibrahim M. El-Sayed discovered an out-of-bounds heap read vulnerability in the function Type_MLU_Read in lcms2, the Little CMS 2 color management library, which can be triggered by an image with a specially crafted ICC profile and leading to a heap memory leak or denial-of-service for applications using the lcms2 library.


cve_id: DSA-3777-1 libgd2
date: 2017-01-31 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in libgd2, a library for programmatic graphics creation and manipulation, which may result in denial of service or potentially the execution of arbitrary code if a malformed file is processed.


cve_id: DSA-3778-1 ruby-archive-tar-minitar
date: 2017-01-31 00:00:00+00:00
more_info:
Michal Marek discovered that ruby-archive-tar-minitar, a Ruby library that provides the ability to deal with POSIX tar archive files, is prone to a directory traversal vulnerability. An attacker can take advantage of this flaw to overwrite arbitrary files during archive extraction via a .. (dot dot) in an extracted filename.


cve_id: DSA-3853-1 bitlbee
date: 2017-05-15 00:00:00+00:00
more_info:
It was discovered that bitlbee, an IRC to other chat networks gateway, contained issues that allowed a remote attacker to cause a denial of service (via application crash), or potentially execute arbitrary commands.


cve_id: DSA-3789-1 libevent
date: 2017-02-15 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libevent, an asynchronous event notification library. They would lead to Denial Of Service via application crash, or remote code execution.


cve_id: DSA-3820-1 gst-plugins-good1.0
date: 2017-03-27 00:00:00+00:00
more_info:
Hanno Boeck discovered multiple vulnerabilities in the GStreamer media framework and its codecs and demuxers, which may result in denial of service or the execution of arbitrary code if a malformed media file is opened.


cve_id: DSA-3838-1 ghostscript
date: 2017-04-28 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may lead to the execution of arbitrary code or denial of service if a specially crafted Postscript file is processed.


cve_id: DSA-3803-1 texlive-base
date: 2017-03-08 00:00:00+00:00
more_info:
It was discovered that texlive-base, the TeX Live package which provides the essential TeX programs and files, whitelists mpost as an external program to be run from within the TeX source code (called \write18). Since mpost allows to specify other programs to be run, an attacker can take advantage of this flaw for arbitrary code execution when compiling a TeX document.


cve_id: DSA-3839-1 freetype
date: 2017-04-28 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Freetype. Opening malformed fonts may result in denial of service or the execution of arbitrary code.


cve_id: DSA-3827-1 jasper
date: 2017-04-07 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the JasPer library for processing JPEG-2000 images, which may result in denial of service or the execution of arbitrary code if a malformed image is processed.


cve_id: DSA-3808-1 imagemagick
date: 2017-03-13 00:00:00+00:00
more_info:
This update fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed TGA, Sun or PSD files are processed.


cve_id: DSA-3844-1 tiff
date: 2017-05-03 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service, memory disclosure or the execution of arbitrary code.


cve_id: DSA-3879-1 libosip2
date: 2017-06-13 00:00:00+00:00
more_info:
Multiple security vulnerabilities have been found in oSIP, a library implementing the Session Initiation Protocol, which might result in denial of service through malformed SIP messages.


cve_id: DSA-3943-1 gajim
date: 2017-08-14 00:00:00+00:00
more_info:
Gajim, a GTK+-based XMPP/Jabber client, unconditionally implements the "XEP-0146: Remote Controlling Clients" extension, allowing a malicious XMPP server to trigger commands to leak private conversations from encrypted sessions. With this update XEP-0146 support has been disabled by default and made opt-in via the <q>remote_commands</q> option.


cve_id: DSA-3451-1 fuse
date: 2016-01-20 00:00:00+00:00
more_info:
Jann Horn discovered a vulnerability in the fuse (Filesystem in Userspace) package in Debian. The fuse package ships an udev rule adjusting permissions on the related /dev/cuse character device, making it world writable.


cve_id: DSA-3572-1 websvn
date: 2016-05-09 00:00:00+00:00
more_info:
Nitin Venkatesh discovered that websvn, a web viewer for Subversion repositories, is susceptible to cross-site scripting attacks via specially crafted file and directory names in repositories.


cve_id: DSA-3628-1 perl
date: 2016-07-25 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3669-1 tomcat7
date: 2016-09-15 00:00:00+00:00
more_info:
Dawid Golunski of LegalHackers discovered that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation.


cve_id: DSA-3656-1 tryton-server
date: 2016-08-30 00:00:00+00:00
more_info:
Two vulnerabilities have been discovered in the server for the Tryton application platform, which may result in information disclosure of password hashes or file contents.


cve_id: DSA-3695-1 quagga
date: 2016-10-18 00:00:00+00:00
more_info:
It was discovered that the zebra daemon in the Quagga routing suite suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages.


cve_id: DSA-3684-1 libdbd-mysql-perl
date: 2016-10-03 00:00:00+00:00
more_info:
Pali Rohar discovered that libdbd-mysql-perl, the Perl DBI database driver for MySQL and MariaDB, constructed an error message in a fixed-length buffer, leading to a crash (_FORTIFY_SOURCE failure) and, potentially, to denial of service.


cve_id: DSA-3701-1 nginx
date: 2016-10-25 00:00:00+00:00
more_info:
Dawid Golunski reported the nginx web server packages in Debian suffered from a privilege escalation vulnerability (www-data to root) due to the way log files are handled.  This security update changes ownership of the /var/log/nginx directory root.  In addition, /var/log/nginx has to be made accessible to local users, and local users may be able to read the log files themselves local until the next logrotate invocation.


cve_id: DSA-3722-1 vim
date: 2016-11-22 00:00:00+00:00
more_info:
Florian Larysch and Bram Moolenaar discovered that vim, an enhanced vi editor, does not properly validate values for the <q>filetype</q>, <q>syntax</q> and <q>keymap</q> options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.


cve_id: DSA-3733-1 apt
date: 2016-12-13 00:00:00+00:00
more_info:
Jann Horn of Google Project Zero discovered that APT, the high level package manager, does not properly handle errors when validating signatures on InRelease files. An attacker able to man-in-the-middle HTTP requests to an apt repository that uses InRelease files (clearsigned Release files), can take advantage of this flaw to circumvent the signature of the InRelease file, leading to arbitrary code execution.


cve_id: DSA-3741-1 tor
date: 2016-12-20 00:00:00+00:00
more_info:
It was discovered that Tor, a connection-based low-latency anonymous communication system, may read one byte past a buffer when parsing hidden service descriptors. This issue may enable a hostile hidden service to crash Tor clients depending on hardening options and malloc implementation.


cve_id: DSA-3574-1 libarchive
date: 2016-05-10 00:00:00+00:00
more_info:
Rock Stevens, Andrew Ruef and Marcin <q>Icewall</q> Noga discovered a heap-based buffer overflow vulnerability in the zip_read_mac_metadata function in libarchive, a multi-format archive and compression library, which may lead to the execution of arbitrary code if a user or automated system is tricked into processing a specially crafted ZIP file.


cve_id: DSA-3545-1 cgit
date: 2016-04-07 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in cgit, a fast web frontend for git repositories written in C. A remote attacker can take advantage of these flaws to perform cross-site scripting, header injection or denial of service attacks.


cve_id: DSA-3627-1 phpmyadmin
date: 2016-07-24 00:00:00+00:00
more_info:
Several vulnerabilities have been fixed in phpMyAdmin, the web-based MySQL administration interface.


cve_id: DSA-3687-1 nspr
date: 2016-10-05 00:00:00+00:00
more_info:
Two vulnerabilities were reported in NSPR, a library to abstract over operating system interfaces developed by the Mozilla project.


cve_id: DSA-3576-1 icedove
date: 2016-05-13 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple memory safety errors may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-3495-1 xymon
date: 2016-02-29 00:00:00+00:00
more_info:
Markus Krell discovered that xymon, a network- and applications-monitoring system, was vulnerable to the following security issues:


cve_id: DSA-3533-1 openvswitch
date: 2016-03-29 00:00:00+00:00
more_info:
Kashyap Thimmaraju and Bhargava Shastry discovered a remotely triggerable buffer overflow vulnerability in openvswitch, a production quality, multilayer virtual switch implementation. Specially crafted MPLS packets could overflow the buffer reserved for MPLS labels in an OVS internal data structure. A remote attacker can take advantage of this flaw to cause a denial of service, or potentially, execution of arbitrary code.


cve_id: DSA-3509-1 rails
date: 2016-03-09 00:00:00+00:00
more_info:
Two vulnerabilities have been discovered in Rails, a web application framework written in Ruby. Both vulnerabilities affect Action Pack, which handles the web requests for Rails.


cve_id: DSA-3579-1 xerces-c
date: 2016-05-16 00:00:00+00:00
more_info:
Gustavo Grieco discovered an use-after-free vulnerability in xerces-c, a validating XML parser library for C++, due to not properly handling invalid characters in XML input documents in the DTDScanner.


cve_id: DSA-3764-1 pdns
date: 2017-01-13 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3606-1 libpdfbox-java
date: 2016-06-24 00:00:00+00:00
more_info:
It was discovered that pdfbox, a PDF library for Java, was susceptible to XML External Entity attacks.


cve_id: DSA-3497-1 php-horde
date: 2016-02-28 00:00:00+00:00
more_info:
It was discovered that php-horde, a flexible, modular, general-purpose web application framework written in PHP, is prone to a cross-site scripting vulnerability.


cve_id: DSA-3599-1 p7zip
date: 2016-06-09 00:00:00+00:00
more_info:
Marcin <q>Icewall</q> Noga of Cisco Talos discovered an out-of-bound read vulnerability in the CInArchive::ReadFileItem method in p7zip, a 7zr file archiver with high compression ratio. A remote attacker can take advantage of this flaw to cause a denial-of-service or, potentially the execution of arbitrary code with the privileges of the user running p7zip, if a specially crafted UDF file is processed.


cve_id: DSA-3620-1 pidgin
date: 2016-07-15 00:00:00+00:00
more_info:
Yves Younan of Cisco Talos discovered several vulnerabilities in the MXit protocol support in pidgin, a multi-protocol instant messaging client. A remote attacker can take advantage of these flaws to cause a denial of service (application crash), overwrite files, information disclosure, or potentially to execute arbitrary code.


cve_id: DSA-3535-1 kamailio
date: 2016-03-29 00:00:00+00:00
more_info:
Stelios Tsampas discovered a buffer overflow in the Kamailio SIP proxy which might result in the execution of arbitrary code.


cve_id: DSA-3800-1 libquicktime
date: 2017-03-02 00:00:00+00:00
more_info:
Marco Romano discovered that libquicktime, a library for reading and writing QuickTime files, was vulnerable to an integer overflow attack. When opened, a specially crafted MP4 file would cause a denial of service by crashing the application.


cve_id: DSA-3600-1 firefox-esr
date: 2016-06-09 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or spoofing.


cve_id: DSA-3640-1 firefox-esr
date: 2016-08-03 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code, cross-site scripting, information disclosure and bypass of the same-origin policy.


cve_id: DSA-3603-1 libav
date: 2016-06-14 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at <a href="https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.7">\ https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.7</a>


cve_id: DSA-3611-1 libcommons-fileupload-java
date: 2016-06-30 00:00:00+00:00
more_info:
The TERASOLUNA Framework Development Team discovered a denial of service vulnerability in Apache Commons FileUpload, a package to make it easy to add robust, high-performance, file upload capability to servlets and web applications. A remote attacker can take advantage of this flaw by sending file upload requests that cause the HTTP server using the Apache Commons Fileupload library to become unresponsive, preventing the server from servicing other requests.


cve_id: DSA-3570-1 mercurial
date: 2016-05-05 00:00:00+00:00
more_info:
Blake Burkhart discovered an arbitrary code execution flaw in Mercurial, a distributed version control system, when using the convert extension on Git repositories with specially crafted names. This flaw in particular affects automated code conversion services that allow arbitrary repository names.


cve_id: DSA-3632-1 mariadb-10.0
date: 2016-07-27 00:00:00+00:00
more_info:
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.26. Please see the MariaDB 10.0 Release Notes for further details:


cve_id: DSA-3624-1 mysql-5.5
date: 2016-07-21 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.50. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-3711-1 mariadb-10.0
date: 2016-11-11 00:00:00+00:00
more_info:
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.28. Please see the MariaDB 10.0 Release Notes for further details:


cve_id: DSA-3575-1 libxstream-java
date: 2016-05-12 00:00:00+00:00
more_info:
It was discovered that XStream, a Java library to serialize objects to XML and back again, was susceptible to XML External Entity attacks.


cve_id: DSA-3581-1 libndp
date: 2016-05-17 00:00:00+00:00
more_info:
Julien Bernard discovered that libndp, a library for the IPv6 Neighbor Discovery Protocol, does not properly perform input and origin checks during the reception of a NDP message. An attacker in a non-local network could use this flaw to advertise a node as a router, and cause a denial of service attack, or act as a man-in-the-middle.


cve_id: DSA-3580-1 imagemagick
date: 2016-05-16 00:00:00+00:00
more_info:
Nikolay Ermishkin from the Mail.Ru Security Team and Stewie discovered several vulnerabilities in ImageMagick, a program suite for image manipulation. These vulnerabilities, collectively known as ImageTragick, are the consequence of lack of sanitization of untrusted input. An attacker with control on the image input could, with the privileges of the user running the application, execute code (<a href="https://security-tracker.debian.org/tracker/CVE-2016-3714">CVE-2016-3714</a>), make HTTP GET or FTP requests (<a href="https://security-tracker.debian.org/tracker/CVE-2016-3718">CVE-2016-3718</a>), or delete (<a href="https://security-tracker.debian.org/tracker/CVE-2016-3715">CVE-2016-3715</a>), move (<a href="https://security-tracker.debian.org/tracker/CVE-2016-3716">CVE-2016-3716</a>), or read (<a href="https://security-tracker.debian.org/tracker/CVE-2016-3717">CVE-2016-3717</a>) local files.


cve_id: DSA-3825-1 jhead
date: 2017-03-31 00:00:00+00:00
more_info:
It was discovered that jhead, a tool to manipulate the non-image part of EXIF compliant JPEG files, is prone to an out-of-bounds access vulnerability, which may result in denial of service or, potentially, the execution of arbitrary code if an image with specially crafted EXIF data is processed.


cve_id: DSA-3893-1 jython
date: 2017-06-22 00:00:00+00:00
more_info:
Alvaro Munoz and Christian Schneider discovered that jython, an implementation of the Python language seamlessly integrated with Java, is prone to arbitrary code execution triggered when sending a serialized function to the deserializer.


cve_id: DSA-3585-1 wireshark
date: 2016-05-22 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors/parsers for PKTC, IAX2, GSM CBCH and NCP which could result in denial of service.


cve_id: DSA-3568-1 libtasn1-6
date: 2016-05-05 00:00:00+00:00
more_info:
Pascal Cuoq and Miod Vallat discovered that Libtasn1, a library to manage ASN.1 structures, does not correctly handle certain malformed DER certificates. A remote attacker can take advantage of this flaw to cause an application using the Libtasn1 library to hang, resulting in a denial of service.


cve_id: DSA-3681-1 wordpress
date: 2016-09-29 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in wordpress, a web blogging tool, which could allow remote attackers to compromise a site via cross-site scripting, cross-site request forgery, path traversal, or bypass restrictions.


cve_id: DSA-3608-1 libreoffice
date: 2016-06-29 00:00:00+00:00
more_info:
Aleksandar Nikolic discovered that missing input sanitising in the RTF parser in Libreoffice may result in the execution of arbitrary code if a malformed documented is opened.


cve_id: DSA-3727-1 hdf5
date: 2016-11-30 00:00:00+00:00
more_info:
Cisco Talos discovered that hdf5, a file format and library for storing scientific data, contained several vulnerabilities that could lead to arbitrary code execution when handling untrusted data.


cve_id: DSA-3567-1 libpam-sshauth
date: 2016-05-04 00:00:00+00:00
more_info:
It was discovered that libpam-sshauth, a PAM module to authenticate using an SSH server, does not correctly handle system users. In certain configurations an attacker can take advantage of this flaw to gain root privileges.


cve_id: DSA-3577-1 jansson
date: 2016-05-14 00:00:00+00:00
more_info:
Gustavo Grieco discovered that jansson, a C library for encoding, decoding and manipulating JSON data, did not limit the recursion depth when parsing JSON arrays and objects. This could allow remote attackers to cause a denial of service (crash) via stack exhaustion, using crafted JSON data.


cve_id: DSA-3592-1 nginx
date: 2016-06-01 00:00:00+00:00
more_info:
It was discovered that a NULL pointer dereference in the Nginx code  responsible for saving client request bodies to a temporary file might result in denial of service: Malformed requests could crash worker processes.


cve_id: DSA-3610-1 xerces-c
date: 2016-06-29 00:00:00+00:00
more_info:
Brandon Perry discovered that xerces-c, a validating XML parser library for C++, fails to successfully parse a DTD that is deeply nested, causing a stack overflow. A remote unauthenticated attacker can take advantage of this flaw to cause a denial of service against applications using the xerces-c library.


cve_id: DSA-3586-1 atheme-services
date: 2016-05-23 00:00:00+00:00
more_info:
It was discovered that a buffer overflow in the XMLRPC response encoding code of the Atheme IRC services may result in denial of service.


cve_id: DSA-3571-1 ikiwiki
date: 2016-05-08 00:00:00+00:00
more_info:
Simon McVittie discovered a cross-site scripting vulnerability in the error reporting of Ikiwiki, a wiki compiler. This update also hardens ikiwiki's use of imagemagick in the img plugin.


cve_id: DSA-3744-1 libxml2
date: 2016-12-23 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial-of-service against the application, or potentially, the execution of arbitrary code with the privileges of the user running the application.


cve_id: DSA-3709-1 libxslt
date: 2016-11-08 00:00:00+00:00
more_info:
Nick Wellnhofer discovered that the xsltFormatNumberConversion function in libxslt, an XSLT processing runtime library, does not properly check for a zero byte terminating the pattern string. This flaw can be exploited to leak a couple of bytes after the buffer that holds the pattern string.


cve_id: DSA-3612-1 gimp
date: 2016-07-01 00:00:00+00:00
more_info:
Shmuel H discovered that GIMP, the GNU Image Manipulation Program, is prone to a use-after-free vulnerability in the channel and layer properties parsing process when loading a XCF file. An attacker can take advantage of this flaw to potentially execute arbitrary code with the privileges of the user running GIMP if a specially crafted XCF file is processed.


cve_id: DSA-3613-1 libvirt
date: 2016-07-02 00:00:00+00:00
more_info:
Vivian Zhang and Christoph Anton Mitterer discovered that setting an empty VNC password does not work as documented in Libvirt, a virtualisation abstraction library. When the password on a VNC server is set to the empty string, authentication on the VNC server will be disabled, allowing any user to connect, despite the documentation declaring that setting an empty password for the VNC server prevents all client connections. With this update the behaviour is enforced by setting the password expiration to <q>now</q>.


cve_id: DSA-3598-1 vlc
date: 2016-06-07 00:00:00+00:00
more_info:
Patrick Coleman discovered that missing input sanitising in the ADPCM decoder of the VLC media player may result in the execution of arbitrary code if a malformed media file is opened.


cve_id: DSA-3619-1 libgd2
date: 2016-07-15 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using the libgd2 library (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.


cve_id: DSA-3591-1 imagemagick
date: 2016-06-01 00:00:00+00:00
more_info:
Bob Friesenhahn from the GraphicsMagick project discovered a command injection vulnerability in ImageMagick, a program suite for image manipulation. An attacker with control on input image or the input filename can execute arbitrary commands with the privileges of the user running the application. 


cve_id: DSA-3682-1 c-ares
date: 2016-09-30 00:00:00+00:00
more_info:
Gzob Qq discovered that the query-building functions in c-ares, an asynchronous DNS request library would not correctly process crafted query names, resulting in a heap buffer overflow and potentially leading to arbitrary code execution.


cve_id: DSA-3674-1 firefox-esr
date: 2016-09-22 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or information disclosure.


cve_id: DSA-3716-1 firefox-esr
date: 2016-11-16 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or bypass of the same-origin policy. Also, a man-in-the-middle attack in the addon update mechanism has been fixed.


cve_id: DSA-3730-1 icedove
date: 2016-12-11 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple memory safety errors, same-origin policy bypass issues, integer overflows, buffer overflows and use-after-frees may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-3615-1 wireshark
date: 2016-07-02 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors/parsers for PKTC, IAX2, GSM CBCH and NCP, SPOOLS, IEEE 802.11, UMTS FP, USB, Toshiba, CoSine, NetScreen, WBXML which could result in denial of service or potentially the execution of arbitrary code.


cve_id: DSA-3644-1 fontconfig
date: 2016-08-08 00:00:00+00:00
more_info:
Tobias Stoeckmann discovered that cache files are insufficiently validated in fontconfig, a generic font configuration library. An attacker can trigger arbitrary free() calls, which in turn allows double free attacks and therefore arbitrary code execution. In combination with setuid binaries using crafted cache files, this could allow privilege escalation.


cve_id: DSA-3623-1 apache2
date: 2016-07-20 00:00:00+00:00
more_info:
Scott Geary of VendHQ discovered that the Apache HTTPD server used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request.


cve_id: DSA-3677-1 libarchive
date: 2016-09-25 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libarchive, a multi-format archive and compression library, which may lead to denial of service (memory consumption and application crash), bypass of sandboxing restrictions and overwrite arbitrary files with arbitrary data from an archive, or the execution of arbitrary code.


cve_id: DSA-3706-1 mysql-5.5
date: 2016-11-07 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.53, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-3659-1 linux
date: 2016-09-04 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or have other impacts.


cve_id: DSA-3622-1 python-django
date: 2016-07-18 00:00:00+00:00
more_info:
It was discovered that Django, a high-level Python web development framework, is prone to a cross-site scripting vulnerability in the admin's add/change related popup.


cve_id: DSA-3630-1 libgd2
date: 2016-07-26 00:00:00+00:00
more_info:
Secunia Research at Flexera Software discovered an integer overflow vulnerability within the _gdContributionsAlloc() function in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of this flaw to cause a denial-of-service against an application using the libgd2 library.


cve_id: DSA-3626-1 openssh
date: 2016-07-24 00:00:00+00:00
more_info:
Eddie Harari reported that the OpenSSH SSH daemon allows user enumeration through timing differences when trying to authenticate users. When sshd tries to authenticate a non-existing user, it will pick up a fixed fake password structure with a hash based on the Blowfish algorithm. If real users passwords are hashed using SHA256/SHA512, then a remote attacker can take advantage of this flaw by sending large passwords, receiving shorter response times from the server for non-existing users.


cve_id: DSA-3604-1 drupal7
date: 2016-06-16 00:00:00+00:00
more_info:
A privilege escalation vulnerability has been found in the User module of the Drupal content management framework. For additional information, please refer to the upstream advisory at <a href="https://www.drupal.org/SA-CORE-2016-002">\ https://www.drupal.org/SA-CORE-2016-002</a>.


cve_id: DSA-3643-1 kde4libs
date: 2016-08-06 00:00:00+00:00
more_info:
Andreas Cord-Landwehr discovered that kde4libs, the core libraries for all KDE 4 applications, do not properly handle the extraction of archives with "../" in the file paths. A remote attacker can take advantage of this flaw to overwrite files outside of the extraction folder, if a user is tricked into extracting a specially crafted archive.


cve_id: DSA-3793-1 shadow
date: 2017-02-24 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in the shadow suite. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3636-1 collectd
date: 2016-07-30 00:00:00+00:00
more_info:
Emilien Gaspar discovered that collectd, a statistics collection and monitoring daemon, incorrectly processed incoming network packets. This resulted in a heap overflow, allowing a remote attacker to either cause a DoS via application crash, or potentially execute arbitrary code.


cve_id: DSA-3655-1 mupdf
date: 2016-08-26 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in MuPDF, a lightweight PDF viewer. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3649-1 gnupg
date: 2016-08-17 00:00:00+00:00
more_info:
Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of GnuPG's random number generator. An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output.


cve_id: DSA-3650-1 libgcrypt20
date: 2016-08-17 00:00:00+00:00
more_info:
Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of Libgcrypt's random number generator. An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output.


cve_id: DSA-3651-1 rails
date: 2016-08-25 00:00:00+00:00
more_info:
Andrew Carpenter of Critical Juncture discovered a cross-site scripting vulnerability affecting Action View in rails, a web application framework written in Ruby. Text declared as <q>HTML safe</q> will not have quotes escaped when used as attribute values in tag helpers.


cve_id: DSA-3702-1 tar
date: 2016-11-01 00:00:00+00:00
more_info:
Harry Sintonen discovered that GNU tar does not properly handle member names containing '..', thus allowing an attacker to bypass the path names specified on the command line and replace files and directories in the target directory.


cve_id: DSA-3653-1 flex
date: 2016-08-25 00:00:00+00:00
more_info:
Alexander Sulfrian discovered a buffer overflow in the yy_get_next_buffer() function generated by Flex, which may result in denial of service and potentially the execution of code if operating on data from untrusted sources.


cve_id: DSA-3648-1 wireshark
date: 2016-08-12 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors for NDS, PacketBB, WSP, MMSE, RLC, LDSS, RLC and OpenFlow, which could result in denial of service or the execution of arbitrary code.


cve_id: DSA-3666-1 mysql-5.5
date: 2016-09-14 00:00:00+00:00
more_info:
Dawid Golunski discovered that the mysqld_safe wrapper provided by the MySQL database server insufficiently restricted the load path for custom malloc implementations, which could result in privilege escalation.


cve_id: DSA-3770-1 mariadb-10.0
date: 2017-01-22 00:00:00+00:00
more_info:
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.29. Please see the MariaDB 10.0 Release Notes for further details:


cve_id: DSA-3679-1 jackrabbit
date: 2016-09-27 00:00:00+00:00
more_info:
Lukas Reschke discovered that Apache Jackrabbit, an implementation of the Content Repository for Java Technology API, did not correctly check the Content-Type header on HTTP POST requests, enabling Cross-Site Request Forgery (CSRF) attacks by malicious web sites.


cve_id: DSA-3738-1 tomcat7
date: 2016-12-18 00:00:00+00:00
more_info:
Multiple security vulnerabilities were discovered in the Tomcat servlet and JSP engine, as well as in its Debian-specific maintainer scripts. Those flaws allowed for privilege escalation, information disclosure, and remote code execution.


cve_id: DSA-3668-1 mailman
date: 2016-09-15 00:00:00+00:00
more_info:
It was discovered that there was a CSRF vulnerability in mailman, a web-based mailing list manager, which could allow an attacker to obtain a user's password.


cve_id: DSA-3693-1 libgd2
date: 2016-10-14 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the GD Graphics Library, which may result in denial of service or potentially the execution of arbitrary code if a malformed file is processed.


cve_id: DSA-3672-1 irssi
date: 2016-09-21 00:00:00+00:00
more_info:
Gabriel Campana and Adrien Guinet from Quarkslab discovered two remotely exploitable crash and heap corruption vulnerabilities in the format parsing code in Irssi, a terminal based IRC client.


cve_id: DSA-3763-1 pdns-recursor
date: 2017-01-13 00:00:00+00:00
more_info:
Florian Heinz and Martin Kluge reported that pdns-recursor, a recursive DNS server, parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the pdns server, resulting in a partial denial of service if the system becomes overloaded.


cve_id: DSA-3662-1 inspircd
date: 2016-09-08 00:00:00+00:00
more_info:
It was discovered that incorrect SASL authentication in the Inspircd IRC server may lead to users impersonating other users.


cve_id: DSA-3661-1 charybdis
date: 2016-09-06 00:00:00+00:00
more_info:
It was discovered that incorrect SASL authentication in the Charybdis IRC server may lead to users impersonating other users.


cve_id: DSA-3715-1 moin
date: 2016-11-15 00:00:00+00:00
more_info:
Several cross-site scripting vulnerabilities were discovered in moin, a Python clone of WikiWiki. A remote attacker can conduct cross-site scripting attacks via the GUI editor's attachment dialogue (<a href="https://security-tracker.debian.org/tracker/CVE-2016-7146">CVE-2016-7146</a>), the AttachFile view (<a href="https://security-tracker.debian.org/tracker/CVE-2016-7148">CVE-2016-7148</a>) and the GUI editor's link dialogue (<a href="https://security-tracker.debian.org/tracker/CVE-2016-9119">CVE-2016-9119</a>).


cve_id: DSA-3671-1 wireshark
date: 2016-09-20 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the dissectors for H.225, Catapult DCT2000, UMTS FP and IPMI, which could result in denial of service or the execution of arbitrary code.


cve_id: DSA-3678-1 python-django
date: 2016-09-26 00:00:00+00:00
more_info:
Sergey Bobrov discovered that cookie parsing in Django and Google Analytics interacted such a way that an attacker could set arbitrary cookies.  This allows other malicious web sites to bypass the Cross-Site Request Forgery (CSRF) protections built into Django.


cve_id: DSA-3685-1 libav
date: 2016-10-04 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at <a href="https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.8"> https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.8</a>


cve_id: DSA-3726-1 imagemagick
date: 2016-11-26 00:00:00+00:00
more_info:
Several issues have been discovered in ImageMagick, a popular set of programs and libraries for image manipulation. These issues include several problems in memory handling that can result in a denial of service attack or in execution of arbitrary code by an attacker with control on the image input.


cve_id: DSA-3775-1 tcpdump
date: 2017-01-29 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service or the execution of arbitrary code.


cve_id: DSA-3697-1 kdepimlibs
date: 2016-10-21 00:00:00+00:00
more_info:
Roland Tapken discovered that insufficient input sanitising in KMail's plain text viewer allowed the injection of HTML code.


cve_id: DSA-3797-1 mupdf
date: 2017-02-28 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in the PDF viewer MuPDF, which may result in denial of service or the execution of arbitrary code if a malformed PDF file is opened.


cve_id: DSA-3704-1 memcached
date: 2016-11-03 00:00:00+00:00
more_info:
Aleksandar Nikolic of Cisco Talos discovered several integer overflow vulnerabilities in memcached, a high-performance memory object caching system. A remote attacker can take advantage of these flaws to cause a denial of service (daemon crash), or potentially to execute arbitrary code.


cve_id: DSA-3813-1 r-base
date: 2017-03-19 00:00:00+00:00
more_info:
Cory Duplantis discovered a buffer overflow in the R programming language. A malformed encoding file may lead to the execution of arbitrary code during PDF generation.


cve_id: DSA-3754-1 tomcat7
date: 2017-01-08 00:00:00+00:00
more_info:
It was discovered that incorrect error handling in the NIO HTTP connector of the Tomcat servlet and JSP engine could result in information disclosure.


cve_id: DSA-3694-1 tor
date: 2016-10-18 00:00:00+00:00
more_info:
It has been discovered that Tor treats the contents of some buffer chunks as if they were a NUL-terminated string.  This issue could enable a remote attacker to crash a Tor client, hidden service, relay, or authority.


cve_id: DSA-3703-1 bind9
date: 2016-11-01 00:00:00+00:00
more_info:
Tony Finch and Marco Davids reported an assertion failure in BIND, a DNS server implementation, which causes the server process to terminate.  This denial-of-service vulnerability is related to a defect in the processing of responses with DNAME records from authoritative servers and primarily affects recursive resolvers.


cve_id: DSA-3898-1 expat
date: 2017-06-25 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Expat, an XML parsing C library. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3728-1 firefox-esr
date: 2016-12-01 00:00:00+00:00
more_info:
A use-after-free vulnerability in the SVG Animation was discovered in the Mozilla Firefox web browser, allowing a remote attacker to cause a denial of service (application crash) or execute arbitrary code, if a user is tricked into opening a specially crafted website.


cve_id: DSA-3758-1 bind9
date: 2017-01-11 00:00:00+00:00
more_info:
Several denial-of-service vulnerabilities (assertion failures) were discovered in BIND, a DNS server implementation.


cve_id: DSA-3710-1 pillow
date: 2016-11-10 00:00:00+00:00
more_info:
Cris Neckar discovered multiple vulnerabilities in Pillow, a Python imaging library, which may result in the execution of arbitrary code or information disclosure if a malformed image file is processed.


cve_id: DSA-3719-1 wireshark
date: 2016-11-21 00:00:00+00:00
more_info:
It was discovered that wireshark, a network protocol analyzer, contained several vulnerabilities in the dissectors for DCERPC, AllJoyn, DTN, and OpenFlow, that could lead to various crashes, denial-of-service, or execution of arbitrary code.


cve_id: DSA-3718-1 drupal7
date: 2016-11-17 00:00:00+00:00
more_info:
Multiple vulnerabilities has been found in the Drupal content management framework. For additional information, please refer to the upstream advisory  at <a href="https://www.drupal.org/SA-CORE-2016-005">https://www.drupal.org/SA-CORE-2016-005</a>


cve_id: DSA-3817-1 jbig2dec
date: 2017-03-24 00:00:00+00:00
more_info:
Multiple security issues have been found in the JBIG2 decoder library, which may lead to lead to denial of service or the execution of arbitrary code if a malformed image file (usually embedded in a PDF document) is opened.


cve_id: DSA-3724-1 gst-plugins-good0.10
date: 2016-11-24 00:00:00+00:00
more_info:
Chris Evans discovered that the GStreamer 0.10 plugin used to decode files in the FLIC format allowed execution of arbitrary code. Further details can be found in his advisory at <a href="https://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-advancing-exploitation.html">\ https://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-advancing-exploitation.html</a>


cve_id: DSA-3723-1 gst-plugins-good1.0
date: 2016-11-24 00:00:00+00:00
more_info:
Chris Evans discovered that the GStreamer 1.0 plugin used to decode files in the FLIC format allowed execution of arbitrary code. Further details can be found in his advisory at <a href="https://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-advancing-exploitation.html">\ https://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-advancing-exploitation.html</a>


cve_id: DSA-3833-1 libav
date: 2017-04-24 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at <a href="https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.9"> https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.9</a>


cve_id: DSA-3761-1 rabbitmq-server
date: 2017-01-13 00:00:00+00:00
more_info:
It was discovered that RabbitMQ, an implementation of the AMQP protocol, didn't correctly validate MQTT (MQ Telemetry Transport) connection authentication. This allowed anyone to login to an existing user account without having to provide a password.


cve_id: DSA-3734-1 firefox-esr
date: 2016-12-14 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or information leaks.


cve_id: DSA-3757-1 icedove
date: 2017-01-11 00:00:00+00:00
more_info:
Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail client: Multiple vulnerabilities may lead to the execution of arbitrary code, data leakage or bypass of the content security policy.


cve_id: DSA-3751-1 libgd2
date: 2017-01-01 00:00:00+00:00
more_info:
A stack overflow vulnerability was discovered within the gdImageFillToBorder function in libgd2, a library for programmatic graphics creation and manipulation, triggered when invalid colors are used with truecolor images. A remote attacker can take advantage of this flaw to cause a denial-of-service against an application using the libgd2 library.


cve_id: DSA-3748-1 libcrypto++
date: 2016-12-26 00:00:00+00:00
more_info:
Gergely GĂĄbor Nagy from Tresorit discovered that libcrypto++, a C++ cryptographic library, contained a bug in several ASN.1 parsing routines. This would allow an attacker to remotely cause a denial of service.


cve_id: DSA-3753-1 libvncserver
date: 2017-01-05 00:00:00+00:00
more_info:
It was discovered that libvncserver, a collection of libraries used to implement VNC/RFB clients and servers, incorrectly processed incoming network packets. This resulted in several heap-based buffer overflows, allowing a rogue server to either cause a DoS by crashing the client, or potentially execute arbitrary code on the client side.


cve_id: DSA-3742-1 flightgear
date: 2016-12-20 00:00:00+00:00
more_info:
It was discovered that the Flight Gear flight simulator performs insufficient sanitising of Nasal scripts which allows a malicious script to overwrite arbitrary files with the privileges of the user running Flight Gear.


cve_id: DSA-3747-1 exim4
date: 2016-12-25 00:00:00+00:00
more_info:
Bjoern Jacke discovered that Exim, Debian's default mail transfer agent, may leak the private DKIM signing key to the log files if specific configuration options are met.


cve_id: DSA-3743-1 python-bottle
date: 2016-12-20 00:00:00+00:00
more_info:
It was discovered that bottle, a WSGI-framework for the Python programming language, did not properly filter "\r\n" sequences when handling redirections. This allowed an attacker to perform CRLF attacks such as HTTP header injection.


cve_id: DSA-3780-1 ntfs-3g
date: 2017-02-01 00:00:00+00:00
more_info:
Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.


cve_id: DSA-3826-1 tryton-server
date: 2017-04-04 00:00:00+00:00
more_info:
It was discovered that the original patch to address <a href="https://security-tracker.debian.org/tracker/CVE-2016-1242">CVE-2016-1242</a> did not cover all cases, which may result in information disclosure of file contents.


cve_id: DSA-3877-1 tor
date: 2017-06-10 00:00:00+00:00
more_info:
It has been discovered that Tor, a connection-based low-latency anonymous communication system, contain a flaw in the hidden service code when receiving a BEGIN_DIR cell on a hidden service rendezvous circuit. A remote attacker can take advantage of this flaw to cause a hidden service to crash with an assertion failure (TROVE-2017-005).


cve_id: DSA-3952-1 libxml2
date: 2017-08-23 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause a denial-of-service against the application, information leaks, or potentially, the execution of arbitrary code with the privileges of the user running the application.


cve_id: DSA-3916-1 atril
date: 2017-07-21 00:00:00+00:00
more_info:
It was discovered that Atril, the MATE document viewer, made insecure use of tar when opening tar comic book archives (CBT). Opening a malicious CBT archive could result in the execution of arbitrary code. This update disables the CBT format entirely.


cve_id: DSA-3911-1 evince
date: 2017-07-14 00:00:00+00:00
more_info:
Felix Wilhelm discovered that the Evince document viewer made insecure use of tar when opening tar comic book archives (CBT). Opening a malicious CBT archive could result in the execution of arbitrary code. This update disables the CBT format entirely.


cve_id: DSA-3992-1 curl
date: 2017-10-06 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3981-1 linux
date: 2017-09-20 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to privilege escalation, denial of service or information leaks.


cve_id: DSA-3934-1 git
date: 2017-08-10 00:00:00+00:00
more_info:
Joern Schneeweisz discovered that git, a distributed revision control system, did not correctly handle maliciously constructed ssh:// URLs. This allowed an attacker to run an arbitrary shell command, for instance via git submodules.


cve_id: DSA-4058-1 optipng
date: 2017-12-08 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in optipng, an advanced PNG optimizer, which may result in denial of service or the execution of arbitrary code if a malformed file is processed.


cve_id: DSA-3972-1 bluez
date: 2017-09-13 00:00:00+00:00
more_info:
An information disclosure vulnerability was discovered in the Service Discovery Protocol (SDP) in bluetoothd, allowing a proximate attacker to obtain sensitive information from bluetoothd process memory, including Bluetooth encryption keys.


cve_id: DSA-4007-1 curl
date: 2017-10-27 00:00:00+00:00
more_info:
Brian Carpenter, Geeknik Labs and 0xd34db347 discovered that cURL, an URL transfer library, incorrectly parsed an IMAP FETCH response with size 0, leading to an out-of-bounds read.


cve_id: DSA-3887-1 glibc
date: 2017-06-19 00:00:00+00:00
more_info:
The Qualys Research Labs discovered various problems in the dynamic linker of the GNU C Library which allow local privilege escalation by clashing the stack. For the full details, please refer to their advisory published at: <a href="https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt">https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt</a>


cve_id: DSA-3867-1 sudo
date: 2017-05-30 00:00:00+00:00
more_info:
The Qualys Security team discovered that sudo, a program designed to provide limited super user privileges to specific users, does not properly parse "/proc/[pid]/stat" to read the device number of the tty from field 7 (tty_nr). A sudoers user can take advantage of this flaw on an SELinux-enabled system to obtain full root privileges.


cve_id: DSA-3888-1 exim4
date: 2017-06-19 00:00:00+00:00
more_info:
The Qualys Research Labs discovered a memory leak in the Exim mail transport agent. This is not a security vulnerability in Exim by itself, but can be used to exploit a vulnerability in stack handling. For the full details, please refer to their advisory published at: <a href="https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt">https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt</a>


cve_id: DSA-3889-1 libffi
date: 2017-06-19 00:00:00+00:00
more_info:
libffi, a library used to call code written in one language from code written in a different language, was enforcing an executable stack on the i386 architecture. While this might not be considered a vulnerability by itself, this could be leveraged when exploiting other vulnerabilities, like for example the <q>stack clash</q> class of vulnerabilities discovered by Qualys Research Labs. For the full details, please refer to their advisory published at: <a href="https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt">https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt</a>


cve_id: DSA-4057-1 erlang
date: 2017-12-08 00:00:00+00:00
more_info:
It was discovered that the TLS server in Erlang is vulnerable to an adaptive chosen ciphertext attack against RSA keys.


cve_id: DSA-4084-1 gifsicle
date: 2018-01-12 00:00:00+00:00
more_info:
It was discovered that gifsicle, a tool for manipulating GIF image files, contained a flaw that could lead to arbitrary code execution.


cve_id: DSA-4088-1 gdk-pixbuf
date: 2018-01-15 00:00:00+00:00
more_info:
It was discovered that multiple integer overflows in the GIF image loader in the GDK Pixbuf library may result in denial of service and potentially the execution of arbitrary code if a malformed image file is opened.


cve_id: DSA-4097-1 poppler
date: 2018-01-25 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the poppler PDF rendering library, which could result in denial of service or the execution of arbitrary code if a malformed PDF file is processed.


cve_id: DSA-4083-1 poco
date: 2018-01-11 00:00:00+00:00
more_info:
Stephan Zeisberg discovered that poco, a collection of open source C++ class libraries, did not correctly validate file paths in ZIP archives. An attacker could leverage this flaw to create or overwrite arbitrary files.


cve_id: DSA-4094-1 smarty3
date: 2018-01-22 00:00:00+00:00
more_info:
It was discovered that Smarty, a PHP template engine, was vulnerable to code-injection attacks. An attacker was able to craft a filename in comments that could lead to arbitrary code execution on the host running Smarty.


cve_id: DSA-4146-1 plexus-utils
date: 2018-03-20 00:00:00+00:00
more_info:
Charles Duffy discovered that the Commandline class in the utilities for the Plexus framework performs insufficient quoting of double-encoded strings, which could result in the execution of arbitrary shell commands.


cve_id: DSA-4092-1 awstats
date: 2018-01-19 00:00:00+00:00
more_info:
The cPanel Security Team discovered that awstats, a log file analyzer, was vulnerable to path traversal attacks. A remote unauthenticated attacker could leverage that to perform arbitrary code execution.


cve_id: DSA-4002-1 mysql-5.5
date: 2017-10-19 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.58, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-4042-1 libxml-libxml-perl
date: 2017-11-19 00:00:00+00:00
more_info:
A use-after-free vulnerability was discovered in XML::LibXML, a Perl interface to the libxml2 library, allowing an attacker to execute arbitrary code by controlling the arguments to a replaceChild() call.


cve_id: DSA-4045-1 vlc
date: 2017-11-21 00:00:00+00:00
more_info:
Several vulnerabilities have been found in VLC, the VideoLAN project's media player. Processing malformed media files could lead to denial of service and potentially the execution of arbitrary code.


cve_id: DSA-3914-1 imagemagick
date: 2017-07-18 00:00:00+00:00
more_info:
This updates fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed RLE, SVG, PSD, PDB, DPX, MAT, TGA, VST, CIN, DIB, MPC, EPT, JNG, DJVU, JPEG, ICO, PALM or MNG files are processed.


cve_id: DSA-4016-1 irssi
date: 2017-11-03 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Irssi, a terminal based IRC client. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3905-1 xorg-server
date: 2017-07-09 00:00:00+00:00
more_info:
Two security issues have been discovered in the X.org X server, which may lead to privilege escalation or an information leak.


cve_id: DSA-3930-1 freeradius
date: 2017-08-10 00:00:00+00:00
more_info:
Guido Vranken discovered that FreeRADIUS, an open source implementation of RADIUS, the IETF protocol for AAA (Authorisation, Authentication, and Accounting), did not properly handle memory when processing packets. This would allow a remote attacker to cause a denial-of-service by application crash, or potentially execute arbitrary code.


cve_id: DSA-4204-1 imagemagick
date: 2018-05-18 00:00:00+00:00
more_info:
This update fixes several vulnerabilities in imagemagick, a graphical software suite. Various memory handling problems or issues about incomplete input sanitizing would result in denial of service or memory disclosure.


cve_id: DSA-3912-1 heimdal
date: 2017-07-16 00:00:00+00:00
more_info:
Jeffrey Altman, Viktor Dukhovni, and Nicolas Williams reported that Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos, trusts metadata taken from the unauthenticated plaintext (Ticket), rather than the authenticated and encrypted KDC response. A man-in-the-middle attacker can use this flaw to impersonate services to the client.


cve_id: DSA-3909-1 samba
date: 2017-07-14 00:00:00+00:00
more_info:
Jeffrey Altman, Viktor Duchovni and Nico Williams identified a mutual authentication bypass vulnerability in samba, the SMB/CIFS file, print, and login server. Also known as Orpheus' Lyre, this vulnerability is located in Samba Kerberos Key Distribution Center (KDC-REP) component and could be used by an attacker on the network path to impersonate a server.


cve_id: DSA-3910-1 knot
date: 2017-07-14 00:00:00+00:00
more_info:
ClĂŠment Berthaux from Synaktiv discovered a signature forgery vulnerability in knot, an authoritative-only DNS server. This vulnerability allows an attacker to bypass TSIG authentication by sending crafted DNS packets to a server.


cve_id: DSA-3971-1 tcpdump
date: 2017-09-13 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service or, potentially, execution of arbitrary code.


cve_id: DSA-3917-1 catdoc
date: 2017-07-23 00:00:00+00:00
more_info:
A heap-based buffer underflow flaw was discovered in catdoc, a text extractor for MS-Office files, which may lead to denial of service (application crash) or have unspecified other impact, if a specially crafted file is processed.


cve_id: DSA-4081-1 php5
date: 2018-01-08 00:00:00+00:00
more_info:
Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language:


cve_id: DSA-3962-1 strongswan
date: 2017-09-03 00:00:00+00:00
more_info:
A denial of service vulnerability was identified in strongSwan, an IKE/IPsec suite, using Google's OSS-Fuzz fuzzing project.


cve_id: DSA-4060-1 wireshark
date: 2017-12-09 00:00:00+00:00
more_info:
It was discovered that wireshark, a network protocol analyzer, contained several vulnerabilities in the dissectors for CIP Safety, IWARP_MPA, NetBIOS, Profinet I/O and AMQP, which result in denial of dervice or the execution of arbitrary code.


cve_id: DSA-3946-1 libmspack
date: 2017-08-18 00:00:00+00:00
more_info:
It was discovered that libsmpack, a library used to handle Microsoft compression formats, did not properly validate its input. A remote attacker could craft malicious CAB or CHM files and use this flaw to cause a denial of service via application crash, or potentially execute arbitrary code.


cve_id: DSA-3979-1 pyjwt
date: 2017-09-19 00:00:00+00:00
more_info:
It was discovered that PyJWT, a Python implementation of JSON Web Token performed insufficient validation of some public key types, which could allow a remote attacker to craft JWTs from scratch.


cve_id: DSA-3958-1 fontforge
date: 2017-08-29 00:00:00+00:00
more_info:
It was discovered that FontForge, a font editor, did not correctly validate its input. An attacker could use this flaw by tricking a user into opening a maliciously crafted OpenType font file, thus causing a denial-of-service via application crash, or execution of arbitrary code.


cve_id: DSA-3942-1 supervisor
date: 2017-08-13 00:00:00+00:00
more_info:
Calum Hutton reported that the XML-RPC server in supervisor, a system for controlling process state, does not perform validation on requested XML-RPC methods, allowing an authenticated client to send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server as the same user as supervisord.


cve_id: DSA-3986-1 ghostscript
date: 2017-09-29 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service if a specially crafted Postscript file is processed.


cve_id: DSA-3948-1 ioquake3
date: 2017-08-19 00:00:00+00:00
more_info:
A read buffer overflow was discovered in the idtech3 (Quake III Arena) family of game engines. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted packet.


cve_id: DSA-4177-1 libsdl2-image
date: 2018-04-20 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the image loading library for Simple DirectMedia Layer 2, which could result in denial of service or the execution of arbitrary code if malformed image files are opened.


cve_id: DSA-4184-1 sdl-image1.2
date: 2018-04-28 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the image loading library for Simple DirectMedia Layer 1.2, which could result in denial of service or the execution of arbitrary code if malformed image files are opened.


cve_id: DSA-3983-1 samba
date: 2017-09-22 00:00:00+00:00
more_info:
Multiple security issues have been discoverd in Samba, a SMB/CIFS file, print, and login server for Unix:


cve_id: DSA-4000-1 xorg-server
date: 2017-10-17 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the X.Org X server. An attacker who's able to connect to an X server could cause a denial of service or potentially the execution of arbitrary code.


cve_id: DSA-4025-1 libpam4j
date: 2017-11-08 00:00:00+00:00
more_info:
It was discovered that libpam4j, a Java library wrapper for the integration of PAM did not call pam_acct_mgmt() during authentication. As such a user who has a valid password, but a deactivated or disabled account could still log in.


cve_id: DSA-3924-1 varnish
date: 2017-08-02 00:00:00+00:00
more_info:
A denial of service vulnerability was discovered in Varnish, a state of the art, high-performance web accelerator. Specially crafted HTTP requests can cause the Varnish daemon to assert and restart, clearing the cache in the process.


cve_id: DSA-4022-1 libreoffice
date: 2017-11-07 00:00:00+00:00
more_info:
Marcin Noga discovered two vulnerabilities in LibreOffice, which could result in the execution of arbitrary code if a malformed PPT or DOC document is opened.


cve_id: DSA-4124-1 lucene-solr
date: 2018-02-27 00:00:00+00:00
more_info:
Two vulnerabilities have been found in Solr, a search server based on Lucene, which could result in the execution of arbitrary code or path traversal.


cve_id: DSA-3940-1 cvs
date: 2017-08-13 00:00:00+00:00
more_info:
It was discovered that CVS, a centralised version control system, did not correctly handle maliciously constructed repository URLs, which allowed an attacker to run an arbitrary shell command.


cve_id: DSA-3956-1 connman
date: 2017-08-27 00:00:00+00:00
more_info:
Security consultants in NRI Secure Technologies discovered a stack overflow vulnerability in ConnMan, a network manager for embedded devices. An attacker with control of the DNS responses to the DNS proxy in ConnMan might crash the service and, in same cases, remotely execute arbitrary commands in the host running the service.


cve_id: DSA-4127-1 simplesamlphp
date: 2018-03-02 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in SimpleSAMLphp, a framework for authentication, primarily via the SAML protocol.


cve_id: DSA-3947-1 newsbeuter
date: 2017-08-18 00:00:00+00:00
more_info:
Jeriko One discovered that newsbeuter, a text-mode RSS feed reader, did not properly escape the title and description of a news article when bookmarking it. This allowed a remote attacker to run an arbitrary shell command on the client machine.


cve_id: DSA-4010-1 git-annex
date: 2017-10-30 00:00:00+00:00
more_info:
It was discovered that git-annex, a tool to manage files with git without checking their contents in, did not correctly handle maliciously constructed ssh:// URLs. This allowed an attacker to run an arbitrary shell command.


cve_id: DSA-3999-1 wpa
date: 2017-10-16 00:00:00+00:00
more_info:
Mathy Vanhoef of the imec-DistriNet research group of KU Leuven discovered multiple vulnerabilities in the WPA protocol, used for authentication in wireless networks. Those vulnerabilities apply to both the access point (implemented in hostapd) and the station (implemented in wpa_supplicant).


cve_id: DSA-4008-1 wget
date: 2017-10-28 00:00:00+00:00
more_info:
Antti Levomaeki, Christian Jalio, Joonas Pihlaja and Juhani Eronen discovered two buffer overflows in the HTTP protocol handler of the Wget download tool, which could result in the execution of arbitrary code when connecting to a malicious HTTP server.


cve_id: DSA-4132-1 libvpx
date: 2018-03-04 00:00:00+00:00
more_info:
It was discovered that incorrect validation of frame widths in the libvpx multimedia library may result in denial of service and potentially the execution of arbitrary code.


cve_id: DSA-3995-1 libxfont
date: 2017-10-10 00:00:00+00:00
more_info:
Two vulnerabilities were found in libXfont, the X11 font rasterisation library, which could result in denial of service or memory disclosure.


cve_id: DSA-3988-1 libidn2-0
date: 2017-09-30 00:00:00+00:00
more_info:
An integer overflow vulnerability was discovered in decode_digit() in libidn2-0, the GNU library for Internationalized Domain Names (IDNs), allowing a remote attacker to cause a denial of service against an application using the library (application crash).


cve_id: DSA-3964-1 asterisk
date: 2017-09-04 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in disclosure of RTP connections or the execution of arbitrary shell commands.


cve_id: DSA-4052-1 bzr
date: 2017-11-29 00:00:00+00:00
more_info:
Adam Collard discovered that Bazaar, an easy to use distributed version control system, did not correctly handle maliciously constructed bzr+ssh URLs, allowing a remote attacker to run an arbitrary shell command.


cve_id: DSA-3973-1 wordpress-shibboleth
date: 2017-09-14 00:00:00+00:00
more_info:
A cross-site-scripting vulnerability has been discovered in the login form of the Shibboleth identity provider module for Wordpress.


cve_id: DSA-4130-1 dovecot
date: 2018-03-02 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Dovecot email server. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-3970-1 emacs24
date: 2017-09-12 00:00:00+00:00
more_info:
Charles A. Roelli discovered that Emacs is vulnerable to arbitrary code execution when rendering text/enriched MIME data (e.g. when using Emacs-based mail clients).


cve_id: DSA-3989-1 dnsmasq
date: 2017-10-02 00:00:00+00:00
more_info:
Felix Wilhelm, Fermin J. Serna, Gabriel Campana, Kevin Hamacher, Ron Bowes and Gynvael Coldwind of the Google Security Team discovered several vulnerabilities in dnsmasq, a small caching DNS proxy and DHCP/TFTP server, which may result in denial of service, information leak or the execution of arbitrary code.


cve_id: DSA-3977-1 newsbeuter
date: 2017-09-18 00:00:00+00:00
more_info:
It was discovered that podbeuter, the podcast fetcher in newsbeuter, a text-mode RSS feed reader, did not properly escape the name of the media enclosure (the podcast file), allowing a remote attacker to run an arbitrary shell command on the client machine. This is only exploitable if the file is also played in podbeuter.


cve_id: DSA-3990-1 asterisk
date: 2017-10-03 00:00:00+00:00
more_info:
Klaus-Peter Junghann discovered that insufficient validation of RTCP packets in Asterisk may result in an information leak. Please see the upstream advisory at <a href="http://downloads.asterisk.org/pub/security/AST-2017-008.html">http://downloads.asterisk.org/pub/security/AST-2017-008.html</a> for additional details.


cve_id: DSA-4021-1 otrs2
date: 2017-11-07 00:00:00+00:00
more_info:
It was discovered that missing input validation in the Open Ticket Request System could result in privilege escalation by an agent with write permissions for statistics.


cve_id: DSA-3997-1 wordpress
date: 2017-10-10 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Wordpress, a web blogging tool. They would allow remote attackers to exploit path-traversal issues, perform SQL injections and various cross-site scripting attacks.


cve_id: DSA-3984-1 git
date: 2017-09-26 00:00:00+00:00
more_info:
joernchen discovered that the git-cvsserver subcommand of Git, a distributed version control system, suffers from a shell command injection vulnerability due to unsafe use of the Perl backtick operator.  The git-cvsserver subcommand is reachable from the git-shell subcommand even if CVS support has not been configured (however, the git-cvs package needs to be installed).


cve_id: DSA-4037-1 jackson-databind
date: 2017-11-16 00:00:00+00:00
more_info:
It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, improperly validated user input prior to deserializing: following DSA-4004-1 for  <a href="https://security-tracker.debian.org/tracker/CVE-2017-7525">\ CVE-2017-7525</a>, an additional set of classes was identified as unsafe  for deserialization.


cve_id: DSA-4027-1 postgresql-9.4
date: 2017-11-09 00:00:00+00:00
more_info:
A vulnerabilitiy has been found in the PostgreSQL database system: Denial of service and potential memory disclosure in the json_populate_recordset() and jsonb_populate_recordset() functions.


cve_id: DSA-4086-1 libxml2
date: 2018-01-13 00:00:00+00:00
more_info:
Nick Wellnhofer discovered that certain function calls inside XPath predicates can lead to use-after-free and double-free errors when executed by libxml2's XPath engine via an XSLT transformation.


cve_id: DSA-4150-1 icu
date: 2018-03-23 00:00:00+00:00
more_info:
It was discovered that an integer overflow in the International Components for Unicode (ICU) library could result in denial of service and potentially the execution of arbitrary code.


cve_id: DSA-4118-1 tomcat-native
date: 2018-02-17 00:00:00+00:00
more_info:
Jonas Klempel reported that tomcat-native, a library giving Tomcat access to the Apache Portable Runtime (APR) library's network connection (socket) implementation and random-number generator, does not properly handle fields longer than 127 bytes when parsing the AIA-Extension field of a client certificate. If OCSP checks are used, this could result in client certificates that should have been rejected to be accepted.


cve_id: DSA-4228-1 spip
date: 2018-06-14 00:00:00+00:00
more_info:
Several vulnerabilities were found in SPIP, a website engine for publishing, resulting in cross-site scripting and PHP injection.


cve_id: DSA-4047-1 otrs2
date: 2017-11-23 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in the Open Ticket Request System which could result in disclosure of database credentials or the execution of arbitrary shell commands by logged-in agents.


cve_id: DSA-4033-1 konversation
date: 2017-11-13 00:00:00+00:00
more_info:
Joseph Bisch discovered that Konversation, an user friendly Internet Relay Chat (IRC) client for KDE, could crash when parsing certain IRC color formatting codes.


cve_id: DSA-4026-1 bchunk
date: 2017-11-09 00:00:00+00:00
more_info:
Wen Bin discovered that bchunk, an application that converts a CD image in bin/cue format into a set of iso and cdr/wav tracks files, did not properly check its input. This would allow malicious users to crash the application or potentially execute arbitrary code.


cve_id: DSA-4011-1 quagga
date: 2017-10-30 00:00:00+00:00
more_info:
It was discovered that the bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment AS_PATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity.


cve_id: DSA-4090-1 wordpress
date: 2018-01-17 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform SQL injections and various Cross-Side Scripting (XSS) and Server-Side Request Forgery (SSRF) attacks, as well as bypass some access restrictions.


cve_id: DSA-4068-1 rsync
date: 2017-12-17 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in rsync, a fast, versatile, remote (and local) file-copying tool, allowing a remote attacker to bypass intended access restrictions or cause a denial of service.


cve_id: DSA-4059-1 libxcursor
date: 2017-12-08 00:00:00+00:00
more_info:
It was discovered that libXcursor, a X cursor management library, is prone to several heap overflows when parsing malicious files. An attacker can take advantage of these flaws for arbitrary code execution, if a user is tricked into processing a specially crafted cursor file.


cve_id: DSA-4076-1 asterisk
date: 2017-12-30 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service, information disclosure and potentially the execution of arbitrary code.


cve_id: DSA-4119-1 libav
date: 2018-02-19 00:00:00+00:00
more_info:
Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. A full list of the changes is available at <a href="https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.12"> https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.12</a>


cve_id: DSA-4041-1 procmail
date: 2017-11-19 00:00:00+00:00
more_info:
Jakub Wilk reported a heap-based buffer overflow vulnerability in procmail's formail utility when processing specially-crafted email headers. A remote attacker could use this flaw to cause formail to crash, resulting in a denial of service or data loss.


cve_id: DSA-4038-1 shibboleth-sp2
date: 2017-11-16 00:00:00+00:00
more_info:
Rod Widdowson of Steading System Software LLP discovered a coding error in the <q>Dynamic</q> metadata plugin of the Shibboleth Service Provider, causing the plugin to fail configuring itself with the filters provided and omitting whatever checks they are intended to perform.


cve_id: DSA-4039-1 opensaml2
date: 2017-11-16 00:00:00+00:00
more_info:
Rod Widdowson of Steading System Software LLP discovered a coding error in the OpenSAML library, causing the DynamicMetadataProvider class to fail configuring itself with the filters provided and omitting whatever checks they are intended to perform.


cve_id: DSA-4066-1 otrs2
date: 2017-12-17 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in the Open Ticket Request System which could result in information disclosure or the execution of arbitrary shell commands by logged-in agents.


cve_id: DSA-4067-1 openafs
date: 2017-12-17 00:00:00+00:00
more_info:
It was discovered that malformed jumbogram packets could result in denial of service against OpenAFS, an implementation of the Andrew distributed file system.


cve_id: DSA-4069-1 otrs2
date: 2017-12-20 00:00:00+00:00
more_info:
Francesco Sirocco discovered a flaw in otrs2, the Open Ticket Request System, which could result in session information disclosure when cookie support is disabled. A remote attacker can take advantage of this flaw to take over an agent's session if the agent is tricked into clicking a link in a specially crafted mail.


cve_id: DSA-4114-1 jackson-databind
date: 2018-02-15 00:00:00+00:00
more_info:
It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, did not properly validate user input before attempting deserialization. This allowed an attacker to perform code execution by providing maliciously crafted input.


cve_id: DSA-4071-1 sensible-utils
date: 2017-12-21 00:00:00+00:00
more_info:
Gabriel Corona reported that sensible-browser from sensible-utils, a collection of small utilities used to sensibly select and spawn an appropriate browser, editor or pager, does not validate strings before launching the program specified by the BROWSER environment variable, potentially allowing a remote attacker to conduct argument-injection attacks if a user is tricked into processing a specially crafted URL.


cve_id: DSA-4077-1 gimp
date: 2017-12-30 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in GIMP, the GNU Image Manipulation Program, which could result in denial of service (application crash) or potentially the execution of arbitrary code if malformed files are opened.


cve_id: DSA-4070-1 enigmail
date: 2017-12-21 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in Enigmail, an OpenPGP extension for Thunderbird, which could result in a loss of confidentiality, faked signatures, plain text leaks and denial of service. Additional information can be found under <a href="https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf">https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf</a>


cve_id: DSA-4104-1 p7zip
date: 2018-02-04 00:00:00+00:00
more_info:
'landave' discovered a heap-based buffer overflow vulnerability in the NCompress::NShrink::CDecoder::CodeReal method in p7zip, a 7zr file archiver with high compression ratio. A remote attacker can take advantage of this flaw to cause a denial-of-service or, potentially the execution of arbitrary code with the privileges of the user running p7zip, if a specially crafted shrinked ZIP archive is processed.


cve_id: DSA-4109-1 ruby-omniauth
date: 2018-02-09 00:00:00+00:00
more_info:
Lalith Rallabhandi discovered that OmniAuth, a Ruby library for implementing multi-provider authentication in web applications, mishandled and leaked sensitive information. An attacker with access to the callback environment, such as in the case of a crafted web application, can request authentication services from this module and access to the CSRF token.


cve_id: DSA-4147-1 polarssl
date: 2018-03-21 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in PolarSSL, a lightweight crypto and SSL/TLS library, that allowed a remote attacker to either cause a denial-of-service by application crash, or execute arbitrary code.


cve_id: DSA-4211-1 xdg-utils
date: 2018-05-25 00:00:00+00:00
more_info:
Gabriel Corona discovered that xdg-utils, a set of tools for desktop environment integration, is vulnerable to argument injection attacks. If the environment variable BROWSER in the victim host has a "%s" and the victim opens a link crafted by an attacker with xdg-open, the malicious party could manipulate the parameters used by the browser when opened. This manipulation could set, for example, a proxy to which the network traffic could be intercepted for that particular execution.


cve_id: DSA-3862-1 puppet
date: 2017-05-25 00:00:00+00:00
more_info:
It was discovered that unrestricted YAML deserialisation of data sent from agents to the server in the Puppet configuration management system could result in the execution of arbitrary code.


cve_id: DSA-3816-1 samba
date: 2017-03-23 00:00:00+00:00
more_info:
Jann Horn of Google discovered a time-of-check, time-of-use race condition in Samba, a SMB/CIFS file, print, and login server for Unix. A malicious client can take advantage of this flaw by exploiting a symlink race to access areas of the server file system not exported under a share definition.


cve_id: DSA-3806-1 pidgin
date: 2017-03-10 00:00:00+00:00
more_info:
It was discovered a vulnerability in Pidgin, a multi-protocol instant messaging client. A server controlled by an attacker can send an invalid XML that can trigger an out-of-bound memory access. This might lead to a crash or, in some extreme cases, to remote code execution in the client-side.


cve_id: DSA-3828-1 dovecot
date: 2017-04-10 00:00:00+00:00
more_info:
It was discovered that the Dovecot email server is vulnerable to a denial of service attack. When the <q>dict</q> passdb and userdb are used for user authentication, the username sent by the IMAP/POP3 client is sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart).


cve_id: DSA-3939-1 botan1.10
date: 2017-08-12 00:00:00+00:00
more_info:
Aleksandar Nikolic discovered that an error in the x509 parser of the Botan crypto library could result in an out-of-bounds memory read, resulting in denial of service or an information leak if processing a malformed certificate.


cve_id: DSA-3937-1 zabbix
date: 2017-08-12 00:00:00+00:00
more_info:
Lilith Wyatt discovered two vulnerabilities in the Zabbix network monitoring system which may result in execution of arbitrary code or database writes by malicious proxies.


cve_id: DSA-3923-1 freerdp
date: 2017-08-01 00:00:00+00:00
more_info:
Tyler Bohan of Talos discovered that FreeRDP, a free implementation of the Remote Desktop Protocol (RDP), contained several vulnerabilities that allowed a malicious remote server or a man-in-the-middle to either cause a DoS by forcibly terminating the client, or execute arbitrary code on the client side.


cve_id: DSA-3978-1 gdk-pixbuf
date: 2017-09-18 00:00:00+00:00
more_info:
Marcin Noga discovered a buffer overflow in the JPEG loader of the GDK Pixbuf library, which may result in the execution of arbitrary code if a malformed file is opened.


cve_id: DSA-3929-1 libsoup2.4
date: 2017-08-10 00:00:00+00:00
more_info:
Aleksandar Nikolic of Cisco Talos discovered a stack-based buffer overflow vulnerability in libsoup2.4, a HTTP library implementation in C. A remote attacker can take advantage of this flaw by sending a specially crafted HTTP request to cause an application using the libsoup2.4 library to crash (denial of service), or potentially execute arbitrary code.


cve_id: DSA-3976-1 freexl
date: 2017-09-17 00:00:00+00:00
more_info:
Marcin <q>Icewall</q> Noga of Cisco Talos discovered two vulnerabilities in freexl, a library to read Microsoft Excel spreadsheets, which might result in denial of service or the execution of arbitrary code if a malformed Excel file is opened.


cve_id: DSA-3795-1 bind9
date: 2017-02-26 00:00:00+00:00
more_info:
It was discovered that a maliciously crafted query can cause ISC's BIND DNS server (named) to crash if both Response Policy Zones (RPZ) and DNS64 (a bridge between IPv4 and IPv6 networks) are enabled.  It is uncommon for both of these options to be used in combination, so very few systems will be affected by this problem in practice.


cve_id: DSA-3854-1 bind9
date: 2017-05-14 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in BIND, a DNS server implementation. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3904-1 bind9
date: 2017-07-08 00:00:00+00:00
more_info:
ClĂŠment Berthaux from Synaktiv discovered two vulnerabilities in BIND, a DNS server implementation. They allow an attacker to bypass TSIG authentication by sending crafted DNS packets to a server.


cve_id: DSA-4133-1 isc-dhcp
date: 2018-03-07 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the ISC DHCP client, relay and server. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-4089-1 bind9
date: 2018-01-16 00:00:00+00:00
more_info:
Jayachandran Palanisamy of Cygate AB reported that BIND, a DNS server implementation, was improperly sequencing cleanup operations, leading in some cases to a use-after-free error, triggering an assertion failure and crash in named.


cve_id: DSA-3792-1 libreoffice
date: 2017-02-23 00:00:00+00:00
more_info:
Ben Hayak discovered that objects embedded in Writer and Calc documents may result in information disclosure. Please see <a href="https://www.libreoffice.org/about-us/security/advisories/cve-2017-3157/"> https://www.libreoffice.org/about-us/security/advisories/cve-2017-3157/</a> for additional information.


cve_id: DSA-3767-1 mysql-5.5
date: 2017-01-19 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.54, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-3809-1 mariadb-10.0
date: 2017-03-14 00:00:00+00:00
more_info:
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.30. Please see the MariaDB 10.0 Release Notes for further details:


cve_id: DSA-3834-1 mysql-5.5
date: 2017-04-25 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.55, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-3944-1 mariadb-10.0
date: 2017-08-17 00:00:00+00:00
more_info:
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.32. Please see the MariaDB 10.0 Release Notes for further details:


cve_id: DSA-3840-1 mysql-connector-java
date: 2017-05-02 00:00:00+00:00
more_info:
Thijs Alkemade discovered that unexpected automatic deserialisation of Java objects in the MySQL Connector/J JDBC driver may result in the execution of arbitary code. For additional details, please refer to the advisory at <a href="https://www.computest.nl/advisories/CT-2017-0425_MySQL-Connector-J.txt">https://www.computest.nl/advisories/CT-2017-0425_MySQL-Connector-J.txt</a>


cve_id: DSA-3922-1 mysql-5.5
date: 2017-07-28 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.57, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-3756-1 icoutils
date: 2017-01-09 00:00:00+00:00
more_info:
Choongwoo Han discovered that a programming error in the wrestool tool of the icoutils suite allows denial of service or the execution of arbitrary code if a malformed binary is parsed.


cve_id: DSA-3765-1 icoutils
date: 2017-01-14 00:00:00+00:00
more_info:
Several programming errors in the wrestool tool of icoutils, a suite of tools to create and extract MS Windows icons and cursors, allow denial of service or the execution of arbitrary code if a malformed binary is parsed.


cve_id: DSA-3883-1 rt-authen-externalauth
date: 2017-06-15 00:00:00+00:00
more_info:
It was discovered that RT::Authen::ExternalAuth, an external authentication module for Request Tracker, is vulnerable to timing side-channel attacks for user passwords. Only ExternalAuth in DBI (database) mode is vulnerable.


cve_id: DSA-3771-1 firefox-esr
date: 2017-01-25 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser: Memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code, information disclosure or privilege escalation.


cve_id: DSA-3832-1 icedove
date: 2017-04-20 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird, which may may lead to the execution of arbitrary code or information leaks.


cve_id: DSA-3805-1 firefox-esr
date: 2017-03-08 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code, ASLR bypass, information disclosure or denial of service.


cve_id: DSA-3831-1 firefox-esr
date: 2017-04-20 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, information disclosure or denial of service.


cve_id: DSA-3872-1 nss
date: 2017-06-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in NSS, a set of cryptographic libraries, which may result in denial of service or information disclosure.


cve_id: DSA-3881-1 firefox-esr
date: 2017-06-14 00:00:00+00:00
more_info:
Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service or domain spoofing.


cve_id: DSA-3918-1 icedove
date: 2017-07-25 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-3779-1 wordpress
date: 2017-02-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in wordpress, a web blogging tool. They would allow remote attackers to hijack victims' credentials, access sensitive information, execute arbitrary commands, bypass read and post restrictions, or mount denial-of-service attacks.


cve_id: DSA-3766-1 mapserver
date: 2017-01-19 00:00:00+00:00
more_info:
It was discovered that mapserver, a CGI-based framework for Internet map services, was vulnerable to a stack-based overflow. This issue allowed a remote user to crash the service, or potentially execute arbitrary code.


cve_id: DSA-3811-1 wireshark
date: 2017-03-18 00:00:00+00:00
more_info:
It was discovered that wireshark, a network protocol analyzer, contained several vulnerabilities in the dissectors for ASTERIX, DHCPv6, NetScaler, LDSS, IAX2, WSP, K12 and STANAG 4607, that could lead to various crashes, denial-of-service or execution of arbitrary code.


cve_id: DSA-3871-1 zookeeper
date: 2017-06-01 00:00:00+00:00
more_info:
It was discovered that Zookeeper, a service for maintaining configuration information, didn't restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption.


cve_id: DSA-3864-1 fop
date: 2017-05-27 00:00:00+00:00
more_info:
It was discovered that an XML external entities vulnerability in the Apache FOP XML formatter may result in information disclosure.


cve_id: DSA-4215-1 batik
date: 2018-06-02 00:00:00+00:00
more_info:
Man Yue Mo, Lars Krapf and Pierre Ernst discovered that Batik, a toolkit for processing SVG images, did not properly validate its input. This would allow an attacker to cause a denial-of-service, mount cross-site scripting attacks, or access restricted files on the server.


cve_id: DSA-3892-1 tomcat7
date: 2017-06-22 00:00:00+00:00
more_info:
Aniket Nandkishor Kulkarni discovered that in tomcat7, a servlet and JSP engine, static error pages used the original request's HTTP method to serve content, instead of systematically using the GET method. This could under certain conditions result in undesirable results, including the replacement or removal of the custom error page.


cve_id: DSA-3891-1 tomcat8
date: 2017-06-22 00:00:00+00:00
more_info:
Aniket Nandkishor Kulkarni discovered that in tomcat8, a servlet and JSP engine, static error pages used the original request's HTTP method to serve content, instead of systematically using the GET method. This could under certain conditions result in undesirable results, including the replacement or removal of the custom error page.


cve_id: DSA-3784-1 viewvc
date: 2017-02-09 00:00:00+00:00
more_info:
Thomas Gerbet discovered that viewvc, a web interface for CVS and Subversion repositories, did not properly sanitize user input. This problem resulted in a potential Cross-Site Scripting vulnerability.


cve_id: DSA-3801-1 ruby-zip
date: 2017-03-04 00:00:00+00:00
more_info:
It was discovered that ruby-zip, a Ruby module for reading and writing zip files, is prone to a directory traversal vulnerability. An attacker can take advantage of this flaw to overwrite arbitrary files during archive extraction via a .. (dot dot) in an extracted filename.


cve_id: DSA-3786-1 vim
date: 2017-02-13 00:00:00+00:00
more_info:
Editor spell files passed to the vim (Vi IMproved) editor may result in an integer overflow in memory allocation and a resulting buffer overflow which potentially  could result in the execution of arbitrary code or denial of service.


cve_id: DSA-3878-1 zziplib
date: 2017-06-12 00:00:00+00:00
more_info:
Agostino Sarubbo discovered multiple vulnerabilities in zziplib, a library to access Zip archives, which could result in denial of service and potentially the execution of arbitrary code if a malformed archive is processed.


cve_id: DSA-3807-1 icoutils
date: 2017-03-12 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the icotool and wrestool tools of Icoutils, a set of programs that deal with MS Windows icons and cursors, which may result in denial of service or the execution of arbitrary code if a malformed .ico or .exe file is processed.


cve_id: DSA-3787-1 tomcat7
date: 2017-02-13 00:00:00+00:00
more_info:
It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop.


cve_id: DSA-3794-1 munin
date: 2017-02-25 00:00:00+00:00
more_info:
Stevie Trujillo discovered a local file write vulnerability in munin, a network-wide graphing framework, when CGI graphs are enabled. GET parameters are not properly handled, allowing to inject options into munin-cgi-graph and overwriting any file accessible by the user running the cgi-process.


cve_id: DSA-3846-1 libytnef
date: 2017-05-09 00:00:00+00:00
more_info:
Several issues were discovered in libytnef, a library used to decode application/ms-tnef e-mail attachments. Multiple heap overflows, out-of-bound writes and reads, NULL pointer dereferences and infinite loops could be exploited by tricking a user into opening a maliciously crafted winmail.dat file.


cve_id: DSA-3798-1 tnef
date: 2017-03-01 00:00:00+00:00
more_info:
Eric Sesterhenn, from X41 D-Sec GmbH, discovered several vulnerabilities in tnef, a tool used to unpack MIME attachments of type <q>application/ms-tnef</q>. Multiple heap overflows, type confusions and out of bound reads and writes could be exploited by tricking a user into opening a malicious attachment. This would result in denial of service via application crash, or potential arbitrary code execution.


cve_id: DSA-3961-1 libgd2
date: 2017-09-03 00:00:00+00:00
more_info:
A double-free vulnerability was discovered in the gdImagePngPtr() function in libgd2, a library for programmatic graphics creation and manipulation, which may result in denial of service or potentially the execution of arbitrary code if a specially crafted file is processed.


cve_id: DSA-3824-1 firebird2.5
date: 2017-03-29 00:00:00+00:00
more_info:
George Noseevich discovered that firebird2.5, a relational database system, did not properly check User-Defined Functions (UDF), thus allowing remote authenticated users to execute arbitrary code on the firebird server.


cve_id: DSA-3849-1 kde4libs
date: 2017-05-12 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-3874-1 ettercap
date: 2017-06-09 00:00:00+00:00
more_info:
Agostino Sarubbo and AromalUllas discovered that ettercap, a network security tool for traffic interception, contains vulnerabilities that allowed an attacker able to provide maliciously crafted filters to cause a denial-of-service via application crash.


cve_id: DSA-3873-1 perl
date: 2017-06-05 00:00:00+00:00
more_info:
The cPanel Security Team reported a time of check to time of use (TOCTTOU) race condition flaw in File::Path, a core module from Perl to create or remove directory trees. An attacker can take advantage of this flaw to set the mode on an attacker-chosen file to a attacker-chosen value.


cve_id: DSA-3815-1 wordpress
date: 2017-03-23 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in wordpress, a web blogging tool. They would allow remote attackers to delete unintended files, mount Cross-Site Scripting attacks, or bypass redirect URL validation mechanisms.


cve_id: DSA-3814-1 audiofile
date: 2017-03-22 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the audiofile library, which may result in denial of service or the execution of arbitrary code if a malformed audio file is processed.


cve_id: DSA-3950-1 libraw
date: 2017-08-21 00:00:00+00:00
more_info:
Hossein Lotfi and Jakub Jirasek from Secunia Research have discovered multiple vulnerabilities in LibRaw, a library for reading RAW images. An attacker could cause a memory corruption leading to a DoS (Denial of Service) with craft KDC or TIFF file.


cve_id: DSA-3861-1 libtasn1-6
date: 2017-05-24 00:00:00+00:00
more_info:
Jakub Jirasek of Secunia Research discovered that libtasn1, a library used to handle Abstract Syntax Notation One structures, did not properly validate its input. This would allow an attacker to cause a crash by denial-of-service, or potentially execute arbitrary code, by tricking a user into processing a maliciously crafted assignments file.


cve_id: DSA-3812-1 ioquake3
date: 2017-03-18 00:00:00+00:00
more_info:
It was discovered that ioquake3, a modified version of the ioQuake3 game engine performs insufficent restrictions on automatically downloaded content (pk3 files or game code), which allows malicious game servers to modify configuration settings including driver settings.


cve_id: DSA-4123-1 drupal7
date: 2018-02-24 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in the Drupal content management framework. For additional information, please refer to the upstream advisory at <a href="https://www.drupal.org/sa-core-2018-001">\ https://www.drupal.org/sa-core-2018-001</a>


cve_id: DSA-3823-1 eject
date: 2017-03-28 00:00:00+00:00
more_info:
Ilja Van Sprundel discovered that the dmcrypt-get-device helper used to check if a given device is an encrypted device handled by devmapper, and used in eject, does not check return values from setuid() and setgid() when dropping privileges.


cve_id: DSA-3856-1 deluge
date: 2017-05-18 00:00:00+00:00
more_info:
Two vulnerabilities have been discovered in the web interface of the Deluge BitTorrent client (directory traversal and cross-site request forgery).


cve_id: DSA-3860-1 samba
date: 2017-05-24 00:00:00+00:00
more_info:
steelo discovered a remote code execution vulnerability in Samba, a SMB/CIFS file, print, and login server for Unix. A malicious client with access to a writable share, can take advantage of this flaw by uploading a shared library and then cause the server to load and execute it.


cve_id: DSA-3907-1 spice
date: 2017-07-11 00:00:00+00:00
more_info:
Frediano Ziglio discovered a buffer overflow in spice, a SPICE protocol client and server library which may result in memory disclosure, denial of service and potentially the execution of arbitrary code.


cve_id: DSA-3884-1 gnutls28
date: 2017-06-16 00:00:00+00:00
more_info:
Hubert Kario discovered that GnuTLS, a library implementing the TLS and SSL protocols, does not properly decode a status response TLS extension, allowing a remote attacker to cause an application using the GnuTLS library to crash (denial of service).


cve_id: DSA-4004-1 jackson-databind
date: 2017-10-20 00:00:00+00:00
more_info:
Liao Xinxi discovered that jackson-databind, a Java library used to parse JSON and other data formats, did not properly validate user input before attemtping deserialization. This allowed an attacker to perform code execution by providing maliciously crafted input.


cve_id: DSA-3960-1 gnupg
date: 2017-09-01 00:00:00+00:00
more_info:
Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal and Yuval Yarom discovered that GnuPG is prone to a local side-channel attack allowing full key recovery for RSA-1024.


cve_id: DSA-3901-1 libgcrypt20
date: 2017-07-02 00:00:00+00:00
more_info:
Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal and Yuval Yarom discovered that Libgcrypt is prone to a local side-channel attack allowing full key recovery for RSA-1024.


cve_id: DSA-3908-1 nginx
date: 2017-07-12 00:00:00+00:00
more_info:
An integer overflow has been found in the HTTP range module of Nginx, a high-performance web and reverse proxy server, which may result in information disclosure.


cve_id: DSA-3949-1 augeas
date: 2017-08-21 00:00:00+00:00
more_info:
Han Han of Red Hat discovered that augeas, a configuration editing tool, improperly handled some escaped strings. A remote attacker could leverage this flaw by sending maliciously crafted strings, thus causing an augeas-enabled application to crash or potentially execute arbitrary code.


cve_id: DSA-3863-1 imagemagick
date: 2017-05-25 00:00:00+00:00
more_info:
This update fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed RLE, ART, JNG, DDS, BMP, ICO, EPT, SUN, MTV, PICT, XWD, PCD, SFW, MAT, EXR, DCM, MNG, PCX or SVG files are processed.


cve_id: DSA-3852-1 squirrelmail
date: 2017-05-13 00:00:00+00:00
more_info:
Dawid Golunski and Filippo Cavallarin discovered that squirrelmail, a webmail application, incorrectly handled a user-supplied value. This would allow a logged-in user to run arbitrary commands on the server.


cve_id: DSA-3928-1 firefox-esr
date: 2017-08-10 00:00:00+00:00
more_info:
Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service, bypass of the same-origin policy or incorrect enforcement of CSP.


cve_id: DSA-3987-1 firefox-esr
date: 2017-09-29 00:00:00+00:00
more_info:
Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service, cross-site scripting or bypass of the phishing and malware protection feature.


cve_id: DSA-3998-1 nss
date: 2017-10-11 00:00:00+00:00
more_info:
Martin Thomson discovered that nss, the Mozilla Network Security Service library, is prone to a use-after-free vulnerability in the TLS 1.2 implementation when handshake hashes are generated. A remote attacker can take advantage of this flaw to cause an application using the nss library to crash, resulting in a denial of service, or potentially to execute arbitrary code.


cve_id: DSA-4035-1 firefox-esr
date: 2017-11-15 00:00:00+00:00
more_info:
Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code, denial of service or bypass of the same origin policy.


cve_id: DSA-4062-1 firefox-esr
date: 2017-12-10 00:00:00+00:00
more_info:
It was discovered that the Private Browsing mode in the Mozilla Firefox web browser allowed to fingerprint a user across multiple sessions via IndexedDB.


cve_id: DSA-3830-1 icu
date: 2017-04-19 00:00:00+00:00
more_info:
It was discovered that icu, the International Components for Unicode library, did not correctly validate its input. An attacker could use this problem to trigger an out-of-bound write through a heap-based buffer overflow, thus causing a denial of service via application crash, or potential execution of arbitrary code.


cve_id: DSA-3837-1 libreoffice
date: 2017-04-27 00:00:00+00:00
more_info:
It was discovered that a buffer overflow in processing Windows Metafiles may result in denial of service or the execution of arbitrary code if a malformed document is opened.


cve_id: DSA-3855-1 jbig2dec
date: 2017-05-18 00:00:00+00:00
more_info:
Multiple security issues have been found in the JBIG2 decoder library, which may lead to denial of service, disclosure of sensitive information from process memory or the execution of arbitrary code if a malformed image file (usually embedded in a PDF document) is opened.


cve_id: DSA-3938-1 libgd2
date: 2017-08-12 00:00:00+00:00
more_info:
Matviy Kotoniy reported that the gdImageCreateFromGifCtx() function used to load images from GIF format files in libgd2, a library for programmatic graphics creation and manipulation, does not zero stack allocated color map buffers before their use, which may result in information disclosure if a specially crafted file is processed.


cve_id: DSA-3841-1 libxstream-java
date: 2017-05-02 00:00:00+00:00
more_info:
It was discovered that XStream, a Java library to serialise objects to XML and back again, was suspectible to denial of service during unmarshalling.


cve_id: DSA-4046-1 libspring-ldap-java
date: 2017-11-22 00:00:00+00:00
more_info:
Tobias Schneider discovered that libspring-ldap-java, a Java library for Spring-based applications using the Lightweight Directory Access Protocol, would under some circumstances allow authentication with a correct username but an arbitrary password.


cve_id: DSA-3836-1 weechat
date: 2017-04-27 00:00:00+00:00
more_info:
It was discovered that weechat, a fast and light chat client, is prone to a buffer overflow vulnerability in the IRC plugin, allowing a remote attacker to cause a denial-of-service by sending a specially crafted filename via DCC.


cve_id: DSA-3870-1 wordpress
date: 2017-06-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in wordpress, a web blogging tool. They would allow remote attackers to force password resets, and perform various cross-site scripting and cross-site request forgery attacks.


cve_id: DSA-3899-1 vlc
date: 2017-06-27 00:00:00+00:00
more_info:
Several vulnerabilities have been found in VLC, the VideoLAN project's media player. Processing malformed subtitles or movie files could lead to denial of service and potentially the execution of arbitrary code.


cve_id: DSA-4192-1 libmad
date: 2018-05-04 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in MAD, an MPEG audio decoder library, which could result in denial of service if a malformed audio file is processed.


cve_id: DSA-3848-1 git
date: 2017-05-10 00:00:00+00:00
more_info:
Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted login shell for Git-only SSH access, allows a user to run an interactive pager by causing it to spawn "git upload-pack --help".


cve_id: DSA-3845-1 libtirpc
date: 2017-05-08 00:00:00+00:00
more_info:
Guido Vranken discovered that incorrect memory management in libtirpc, a transport-independent RPC library used by rpcbind and other programs may result in denial of service via memory exhaustion (depending on memory management settings).


cve_id: DSA-4054-1 tor
date: 2017-12-03 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in Tor, a connection-based low-latency anonymous communication system.


cve_id: DSA-3951-1 smb4k
date: 2017-08-22 00:00:00+00:00
more_info:
Sebastian Krahmer discovered that a programming error in the mount helper binary of the Smb4k Samba network share browser may result in local privilege escalation.


cve_id: DSA-3869-1 tnef
date: 2017-06-01 00:00:00+00:00
more_info:
It was discovered that tnef, a tool used to unpack MIME attachments of type "application/ms-tnef", did not correctly validate its input. An attacker could exploit this by tricking a user into opening a malicious attachment, which would result in a denial-of-service by application crash.


cve_id: DSA-3866-1 strongswan
date: 2017-05-30 00:00:00+00:00
more_info:
Two denial of service vulnerabilities were identified in strongSwan, an IKE/IPsec suite, using Google's OSS-Fuzz fuzzing project.


cve_id: DSA-3868-1 openldap
date: 2017-05-30 00:00:00+00:00
more_info:
Karsten Heymann discovered that the OpenLDAP directory server can be crashed by performing a paged search with a page size of 0, resulting in denial of service. This vulnerability is limited to the MDB storage backend.


cve_id: DSA-3876-1 otrs2
date: 2017-06-09 00:00:00+00:00
more_info:
Joerg-Thomas Vogt discovered that the SecureMode was insufficiently validated in the OTRS ticket system, which could allow agents to escalate their privileges.


cve_id: DSA-3933-1 pjproject
date: 2017-08-10 00:00:00+00:00
more_info:
Two vulnerabilities were found in the PJSIP/PJProject communication library, which may result in denial of service.


cve_id: DSA-3875-1 libmwaw
date: 2017-06-09 00:00:00+00:00
more_info:
It was discovered that a buffer overflow in libmwaw, a library to open old Mac text documents might result in the execution of arbitrary code if a malformed document is opened.


cve_id: DSA-3880-1 libgcrypt20
date: 2017-06-14 00:00:00+00:00
more_info:
It was discovered that a side channel attack in the EdDSA session key handling in Libgcrypt may result in information disclosure.


cve_id: DSA-3913-1 apache2
date: 2017-07-18 00:00:00+00:00
more_info:
Robert Swiecki reported that mod_auth_digest does not properly initialize or reset the value placeholder in [Proxy-]Authorization headers of type <q>Digest</q> between successive key=value assignments, leading to information disclosure or denial of service.


cve_id: DSA-3980-1 apache2
date: 2017-09-20 00:00:00+00:00
more_info:
Hanno Boeck discovered that incorrect parsing of Limit directives of .htaccess files by the Apache HTTP Server could result in memory disclosure.


cve_id: DSA-4218-1 memcached
date: 2018-06-06 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in memcached, a high-performance memory object caching system. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-4085-1 xmltooling
date: 2018-01-12 00:00:00+00:00
more_info:
Philip Huppert discovered the Shibboleth service provider is vulnerable to impersonation attacks and information disclosure due to mishandling of DTDs in the XMLTooling XML parsing library. For additional details please refer to the upstream advisory at <a href="https://shibboleth.net/community/advisories/secadv_20180112.txt">\ https://shibboleth.net/community/advisories/secadv_20180112.txt</a>


cve_id: DSA-4126-1 xmltooling
date: 2018-02-27 00:00:00+00:00
more_info:
Kelby Ludwig and Scott Cantor discovered that the Shibboleth service provider is vulnerable to impersonation attacks and information disclosure due to incorrect XML parsing. For additional details please refer to the upstream advisory at <a href="https://shibboleth.net/community/advisories/secadv_20180227.txt">https://shibboleth.net/community/advisories/secadv_20180227.txt</a>


cve_id: DSA-4163-1 beep
date: 2018-04-02 00:00:00+00:00
more_info:
It was discovered that a race condition in beep (if configured as setuid via debconf) allows local privilege escalation.


cve_id: DSA-4195-1 wget
date: 2018-05-08 00:00:00+00:00
more_info:
Harry Sintonen discovered that wget, a network utility to retrieve files from the web, does not properly handle '\r\n' from continuation lines while parsing the Set-Cookie HTTP header. A malicious web server could use this flaw to inject arbitrary cookies to the cookie jar file, adding new or replacing existing cookie values.


cve_id: DSA-4122-1 squid3
date: 2018-02-23 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Squid3, a fully featured web proxy cache. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-4152-1 mupdf
date: 2018-03-27 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in MuPDF, a PDF, XPS, and e-book viewer, which may result in denial of service or remote code execution. An attacker can craft a PDF document which, when opened in the victim host, might consume vast amounts of memory, crash the program, or, in some cases, execute code in the context in which the application is running.


cve_id: DSA-4175-1 freeplane
date: 2018-04-18 00:00:00+00:00
more_info:
Wojciech Regula discovered an XML External Entity vulnerability in the XML Parser of the mindmap loader in freeplane, a Java program for working with mind maps, resulting in potential information disclosure if a malicious mind map file is opened.


cve_id: DSA-4167-1 sharutils
date: 2018-04-05 00:00:00+00:00
more_info:
A buffer-overflow vulnerability was discovered in Sharutils, a set of utilities handle Shell Archives. An attacker with control on the input of the unshar command, could crash the application or execute arbitrary code in the its context.


cve_id: DSA-4151-1 librelp
date: 2018-03-26 00:00:00+00:00
more_info:
Bas van Schaik and Kevin Backhouse discovered a stack-based buffer overflow vulnerability in librelp, a library providing reliable event logging over the network, triggered while checking x509 certificates from a peer. A remote attacker able to connect to rsyslog can take advantage of this flaw for remote code execution by sending a specially crafted x509 certificate.


cve_id: DSA-4186-1 gunicorn
date: 2018-04-28 00:00:00+00:00
more_info:
It was discovered that gunicorn, an event-based HTTP/WSGI server was susceptible to HTTP Response splitting.


cve_id: DSA-4189-1 quassel
date: 2018-05-02 00:00:00+00:00
more_info:
Two vulnerabilities were found in the Quassel IRC client, which could result in the execution of arbitrary code or denial of service.


cve_id: DSA-4202-1 curl
date: 2018-05-16 00:00:00+00:00
more_info:
OSS-fuzz, assisted by Max Dymond, discovered that cURL, an URL transfer library, could be tricked into reading data beyond the end of a heap based buffer when parsing invalid headers in an RTSP response.


cve_id: DSA-4227-1 plexus-archiver
date: 2018-06-12 00:00:00+00:00
more_info:
Danny Grander discovered a directory traversal flaw in plexus-archiver, an Archiver plugin for the Plexus compiler system, allowing an attacker to overwrite any file writable by the extracting user via a specially crafted Zip archive.


cve_id: DSA-4193-1 wordpress
date: 2018-05-05 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in wordpress, a web blogging tool, which could allow remote attackers to compromise a site via cross-site scripting, bypass restrictions or unsafe redirects. More information can be found in the upstream advisory at <a href="https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/">https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/</a>


cve_id: DSA-4178-1 libreoffice
date: 2018-04-20 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in LibreOffice's code to parse MS Word and Structured Storage files, which could result in denial of service and potentially the execution of arbitrary code if a malformed file is opened.


cve_id: DSA-4216-1 prosody
date: 2018-06-02 00:00:00+00:00
more_info:
It was discovered that Prosody, a lightweight Jabber/XMPP server, does not properly validate client-provided parameters during XMPP stream restarts, allowing authenticated users to override the realm associated with their session, potentially bypassing security policies and allowing impersonation.


cve_id: DSA-4208-1 procps
date: 2018-05-22 00:00:00+00:00
more_info:
The Qualys Research Labs discovered multiple vulnerabilities in procps, a set of command line and full screen utilities for browsing procfs. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-4212-1 git
date: 2018-05-29 00:00:00+00:00
more_info:
Etienne Stalmans discovered that git, a fast, scalable, distributed revision control system, is prone to an arbitrary code execution vulnerability exploitable via specially crafted submodule names in a .gitmodules file.


cve_id: DSA-4217-1 wireshark
date: 2018-06-03 00:00:00+00:00
more_info:
It was discovered that Wireshark, a network protocol analyzer, contained several vulnerabilities in the dissectors for PCP, ADB, NBAP, UMTS MAC, IEEE 802.11, SIGCOMP, LDSS, GSM A DTAP and Q.931, which result in denial of service or the execution of arbitrary code.


cve_id: DSA-4226-1 perl
date: 2018-06-12 00:00:00+00:00
more_info:
Jakub Wilk discovered a directory traversal flaw in the Archive::Tar module, allowing an attacker to overwrite any file writable by the extracting user via a specially crafted tar archive.


cve_id: DSA-4224-1 gnupg
date: 2018-06-08 00:00:00+00:00
more_info:
Marcus Brinkmann discovered that GnuPG performed insufficient sanitisation of file names displayed in status messages, which could be abused to fake the verification status of a signed email.


cve_id: DSA-4194-1 lucene-solr
date: 2018-05-06 00:00:00+00:00
more_info:
An XML external entity expansion vulnerability was discovered in the DataImportHandler of Solr, a search server based on Lucene, which could result in information disclosure.


cve_id: DSA-4091-1 mysql-5.5
date: 2018-01-18 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.59, which includes additional changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-4176-1 mysql-5.5
date: 2018-04-20 00:00:00+00:00
more_info:
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.60, which includes additional changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details:


cve_id: DSA-4096-1 firefox-esr
date: 2018-01-25 00:00:00+00:00
more_info:
Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, integer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service or URL spoofing.


cve_id: DSA-4102-1 thunderbird
date: 2018-01-30 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service or URL spoofing.


cve_id: DSA-4139-1 firefox-esr
date: 2018-03-15 00:00:00+00:00
more_info:
Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors and other implementation errors may lead to the execution of arbitrary code, denial of service or information disclosure.


cve_id: DSA-4155-1 thunderbird
date: 2018-03-28 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service or information disclosure.


cve_id: DSA-4143-1 firefox-esr
date: 2018-03-17 00:00:00+00:00
more_info:
Richard Zhu and Huzaifa Sidhpurwala discovered that an out-of-bounds memory write when playing Vorbis media files could result in the execution of arbitrary code.


cve_id: DSA-4140-1 libvorbis
date: 2018-03-16 00:00:00+00:00
more_info:
Richard Zhu discovered that an out-of-bounds memory write in the codebook parsing code of the Libvorbis multimedia library could result in the execution of arbitrary code if a malformed Vorbis file is opened.


cve_id: DSA-4141-1 libvorbisidec
date: 2018-03-16 00:00:00+00:00
more_info:
Huzaifa Sidhpurwala discovered that an out-of-bounds memory write in the codebook parsing code of the Libtremor multimedia library could result in the execution of arbitrary code if a malformed Vorbis file is opened.


cve_id: DSA-4153-1 firefox-esr
date: 2018-03-27 00:00:00+00:00
more_info:
It was discovered that a use-after-free in the compositor of Firefox can result in the execution of arbitrary code.


cve_id: DSA-4199-1 firefox-esr
date: 2018-05-10 00:00:00+00:00
more_info:
Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors and other implementation errors may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-4209-1 thunderbird
date: 2018-05-25 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service or attacks on encrypted emails.


cve_id: DSA-4101-1 wireshark
date: 2018-01-28 00:00:00+00:00
more_info:
It was discovered that wireshark, a network protocol analyzer, contained several vulnerabilities in the dissectors/file parsers for IxVeriWave, WCP, JSON, XML, NTP, XMPP and GDB, which could result in denial of service or the execution of arbitrary code.


cve_id: DSA-4115-1 quagga
date: 2018-02-15 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Quagga, a routing daemon. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-4087-1 transmission
date: 2018-01-14 00:00:00+00:00
more_info:
Tavis Ormandy discovered a vulnerability in the Transmission BitTorrent client; insecure RPC handling between the Transmission daemon and the client interface(s) may result in the execution of arbitrary code if a user visits a malicious website while Transmission is running.


cve_id: DSA-4093-1 openocd
date: 2018-01-21 00:00:00+00:00
more_info:
Josef Gajdusek discovered that OpenOCD, a JTAG debugger for ARM and MIPS, was vulnerable to Cross Protocol Scripting attacks. An attacker could craft a HTML page that, when visited by a victim running OpenOCD, could execute arbitrary commands on the victims host.


cve_id: DSA-4108-1 mailman
date: 2018-02-09 00:00:00+00:00
more_info:
Calum Hutton and the Mailman team discovered a cross site scripting and information leak vulnerability in the user options page. A remote attacker could use a crafted URL to steal cookie information or to fish for whether a user is subscribed to a list with a private roster.


cve_id: DSA-4220-1 firefox-esr
date: 2018-06-08 00:00:00+00:00
more_info:
Ivan Fratric discovered a buffer overflow in the Skia graphics library used by Firefox, which could result in the execution of arbitrary code.


cve_id: DSA-4110-1 exim4
date: 2018-02-10 00:00:00+00:00
more_info:
Meh Chang discovered a buffer overflow flaw in a utility function used in the SMTP listener of Exim, a mail transport agent. A remote attacker can take advantage of this flaw to cause a denial of service, or potentially the execution of arbitrary code via a specially crafted message.


cve_id: DSA-4221-1 libvncserver
date: 2018-06-08 00:00:00+00:00
more_info:
Alexander Peslyak discovered that insufficient input sanitising of RFB packets in LibVNCServer could result in the disclosure of memory contents.


cve_id: DSA-4129-1 freexl
date: 2018-03-02 00:00:00+00:00
more_info:
Multiple heap buffer over reads were discovered in freexl, a library to read Microsoft Excel spreadsheets, which could result in denial of service.


cve_id: DSA-4190-1 jackson-databind
date: 2018-05-03 00:00:00+00:00
more_info:
It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, improperly validated user input prior to deserializing because of an incomplete fix for <a href="https://security-tracker.debian.org/tracker/CVE-2017-7525">\ CVE-2017-7525</a>.


cve_id: DSA-4142-1 uwsgi
date: 2018-03-17 00:00:00+00:00
more_info:
Marios Nicolaides discovered that the PHP plugin in uWSGI, a fast, self-healing application container server, does not properly handle a DOCUMENT_ROOT check during use of the --php-docroot option, allowing a remote attacker to mount a directory traversal attack and gain unauthorized read access to sensitive files located outside of the web root directory.


cve_id: DSA-4161-1 python-django
date: 2018-04-01 00:00:00+00:00
more_info:
James Davis discovered two issues in Django, a high-level Python web development framework, that can lead to a denial-of-service attack. An attacker with control on the input of the django.utils.html.urlize() function or django.utils.text.Truncator's chars() and words() methods could craft a string that might stuck the execution of the application.


cve_id: DSA-4156-1 drupal7
date: 2018-03-29 00:00:00+00:00
more_info:
A remote code execution vulnerability has been found in Drupal, a fully-featured content management framework. For additional information, please refer to the upstream advisory at <a href="https://www.drupal.org/sa-core-2018-002">https://www.drupal.org/sa-core-2018-002</a>


cve_id: DSA-4180-1 drupal7
date: 2018-04-25 00:00:00+00:00
more_info:
A remote code execution vulnerability has been found in Drupal, a fully-featured content management framework. For additional information, please refer to the upstream advisory at <a href="https://www.drupal.org/sa-core-2018-004">https://www.drupal.org/sa-core-2018-004</a>


cve_id: DSA-4214-1 zookeeper
date: 2018-06-01 00:00:00+00:00
more_info:
It was discovered that Zookeeper, a service for maintaining configuration information, enforced no authentication/authorisation when a server attempts to join a Zookeeper quorum.


cve_id: DSA-4168-1 squirrelmail
date: 2018-04-08 00:00:00+00:00
more_info:
Florian Grunow and Birk Kauer of ERNW discovered a path traversal vulnerability in SquirrelMail, a webmail application, allowing an authenticated remote attacker to retrieve or delete arbitrary files via mail attachment.


cve_id: DSA-4165-1 ldap-account-manager
date: 2018-04-03 00:00:00+00:00
more_info:
Michal Kedzior found two vulnerabilities in LDAP Account Manager, a web front-end for LDAP directories.


cve_id: DSA-4148-1 kamailio
date: 2018-03-22 00:00:00+00:00
more_info:
Alfred Farrugia and Sandro Gauci discovered an off-by-one heap overflow in the Kamailio SIP server which could result in denial of service and potentially the execution of arbitrary code.


cve_id: DSA-3293-1 pyjwt
date: 2015-06-20 00:00:00+00:00
more_info:
Tim McLean discovered that pyjwt, a Python implementation of JSON Web Token, would try to verify an HMAC signature using an RSA or ECDSA public key as secret. This could allow remote attackers to trick applications expecting tokens signed with asymmetric keys, into accepting arbitrary tokens. For more information see: <a href="https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/">\ https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/</a>.


cve_id: DSA-3675-1 imagemagick
date: 2016-09-23 00:00:00+00:00
more_info:
This updates fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed SIXEL, PDB, MAP, SGI, TIFF and CALS files are processed.


cve_id: DSA-3708-1 mat
date: 2016-11-07 00:00:00+00:00
more_info:
Hartmut Goebel discovered that MAT, a toolkit to anonymise/remove metadata from files did not remove metadata from images embededed in PDF documents.


cve_id: DSA-3713-1 gst-plugins-bad0.10
date: 2016-11-15 00:00:00+00:00
more_info:
Chris Evans discovered that the GStreamer 0.10 plugin to decode NES Sound Format files allowed the execution of arbitrary code. Further details can be found in his advisory at <a href="http://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-compromising-linux-desktop.html">\ http://scarybeastsecurity.blogspot.de/2016/11/0day-exploit-compromising-linux-desktop.html</a>.


cve_id: DSA-3717-1 gst-plugins-bad1.0, gst-plugins-bad0.10
date: 2016-11-17 00:00:00+00:00
more_info:
Chris Evans discovered that the GStreamer plugin to decode VMware screen capture files allowed the execution of arbitrary code.


cve_id: DSA-3735-1 game-music-emu
date: 2016-12-15 00:00:00+00:00
more_info:
Chris Evans discovered that incorrect emulation of the SPC700 audio co-processor of the Super Nintendo Entertainment System allows the execution of arbitrary code if a malformed SPC music file is opened. Further information can be found at <a href="http://scarybeastsecurity.blogspot.de/2016/12/redux-compromising-linux-using-snes.html"> http://scarybeastsecurity.blogspot.de/2016/12/redux-compromising-linux-using-snes.html</a>


cve_id: DSA-3921-1 enigmail
date: 2017-07-28 00:00:00+00:00
more_info:
In DSA 3918 Thunderbird was upgraded to the latest ESR series. This update upgrades Enigmail, the OpenPGP extention for Thunderbird, to version 1.9.8.1 to restore full compatibility.


cve_id: DSA-4061-1 thunderbird
date: 2017-12-10 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-4117-1 gcc-4.9
date: 2018-02-17 00:00:00+00:00
more_info:
This update doesn't fix a vulnerability in GCC itself, but instead provides support for building retpoline-enabled Linux kernel updates.


cve_id: DSA-4179-1 linux-tools
date: 2018-04-24 00:00:00+00:00
more_info:
This update doesn't fix a vulnerability in linux-tools, but provides support for building Linux kernel modules with the <q>retpoline</q> mitigation for <a href="https://security-tracker.debian.org/tracker/CVE-2017-5715">\ CVE-2017-5715</a> (Spectre variant 2).


cve_id: DSA-4692-1 netqmail
date: 2020-05-24 00:00:00+00:00
more_info:
Georgi Guninski and the Qualys Research Labs discovered multiple vulnerabilities in qmail (shipped in Debian as netqmail with additional patches) which could result in the execution of arbitrary code, bypass of mail address verification and a local information leak whether a file exists or not.


cve_id: DSA-4360-1 libarchive
date: 2018-12-27 00:00:00+00:00
more_info:
Multiple security issues were found in libarchive, a multi-format archive and compression library: Processing malformed RAR archives could result in denial of service or the execution of arbitrary code and malformed WARC, LHarc, ISO, Xar or CAB archives could result in denial of service.


cve_id: DSA-4262-1 symfony
date: 2018-08-03 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to open redirects, cross-site request forgery, information disclosure, session fixation or denial of service.


cve_id: DSA-3959-1 libgcrypt20
date: 2017-08-29 00:00:00+00:00
more_info:
Daniel Genkin, Luke Valenta and Yuval Yarom discovered that Libgcrypt is prone to a local side-channel attack against the ECDH encryption with Curve25519, allowing recovery of the private key.


cve_id: DSA-3993-1 tor
date: 2017-10-06 00:00:00+00:00
more_info:
It was discovered that the Tor onion service could leak sensitive information to log files if the <q>SafeLogging</q> option is set to "0".


cve_id: DSA-4145-1 gitlab
date: 2018-03-18 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Gitlab, a software platform to collaborate on code:


cve_id: DSA-3915-1 ruby-mixlib-archive
date: 2017-07-20 00:00:00+00:00
more_info:
It was discovered that ruby-mixlib-archive, a Chef Software's library used to handle various archive formats, was vulnerable to a directory traversal attack. This allowed attackers to overwrite arbitrary files by using a malicious tar archive containing ".." in its entries.


cve_id: DSA-4307-1 python3.5
date: 2018-09-28 00:00:00+00:00
more_info:
Multiple security issues were discovered in Python: ElementTree failed to initialise Expat's hash salt, two denial of service issues were found in difflib and poplib and a buffer overflow in PyString_DecodeEscape.


cve_id: DSA-3965-1 file
date: 2017-09-05 00:00:00+00:00
more_info:
Thomas Jarosch discovered a stack-based buffer overflow flaw in file, a file type classification tool, which may result in denial of service if an ELF binary with a specially crafted .notes section is processed.


cve_id: DSA-4003-1 libvirt
date: 2017-10-19 00:00:00+00:00
more_info:
Daniel P. Berrange reported that Libvirt, a virtualisation abstraction library, does not properly handle the default_tls_x509_verify (and related) parameters in qemu.conf when setting up TLS clients and servers in QEMU, resulting in TLS clients for character devices and disk devices having verification turned off and ignoring any errors while validating the server certificate.


cve_id: DSA-4341-1 mariadb-10.1
date: 2018-11-19 00:00:00+00:00
more_info:
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.1.37. Please see the MariaDB 10.1 Release Notes for further details:


cve_id: DSA-4106-1 libtasn1-6
date: 2018-02-07 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in Libtasn1, a library to manage ASN.1 structures, allowing a remote attacker to cause a denial of service against an application using the Libtasn1 library.


cve_id: DSA-4321-1 graphicsmagick
date: 2018-10-16 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in GraphicsMagick, a set of command-line applications to manipulate image files, which could result in denial of service or the execution of arbitrary code if malformed image files are processed.


cve_id: DSA-3902-1 jabberd2
date: 2017-07-05 00:00:00+00:00
more_info:
It was discovered that jabberd2, a Jabber instant messenger server, allowed anonymous SASL connections, even if disabled in the configuration.


cve_id: DSA-3931-1 ruby-rack-cors
date: 2017-08-10 00:00:00+00:00
more_info:
Jens Mueller discovered that an incorrect regular expression in rack-cors may lead to insufficient restriction of CORS requests.


cve_id: DSA-3957-1 ffmpeg
date: 2017-08-28 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in FFmpeg, a multimedia player, server and encoder. These issues could lead to Denial-of-Service and, in some situation, the execution of arbitrary code.


cve_id: DSA-4019-1 imagemagick
date: 2017-11-05 00:00:00+00:00
more_info:
This update fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed image files are processed.


cve_id: DSA-4349-1 tiff
date: 2018-11-30 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed.


cve_id: DSA-4248-1 blender
date: 2018-07-17 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in various parsers of Blender, a 3D modeller/ renderer. Malformed .blend model files and malformed multimedia files (AVI, BMP, HDR, CIN, IRIS, PNG, TIFF) may result in the execution of arbitrary code.


cve_id: DSA-4173-1 r-cran-readxl
date: 2018-04-16 00:00:00+00:00
more_info:
Marcin Noga discovered multiple vulnerabilities in readxl, a GNU R package to read Excel files (via the integrated libxls library), which could result in the execution of arbitrary code if a malformed spreadsheet is processed.


cve_id: DSA-3953-1 aodh
date: 2017-08-23 00:00:00+00:00
more_info:
Zane Bitter from Red Hat discovered a vulnerability in Aodh, the alarm engine for OpenStack. Aodh does not verify that the user creating the alarm is the trustor or has the same rights as the trustor, nor that the trust is for the same project as the alarm. The bug allows that an authenticated user without a Keystone token with knowledge of trust IDs to perform unspecified authenticated actions by adding alarm actions.


cve_id: DSA-4072-1 bouncycastle
date: 2017-12-21 00:00:00+00:00
more_info:
Hanno Boeck, Juraj Somorovsky and Craig Young discovered that the TLS implementation in Bouncy Castle is vulnerable to an adaptive chosen ciphertext attack against RSA keys.


cve_id: DSA-3967-1 mbedtls
date: 2017-09-08 00:00:00+00:00
more_info:
An authentication bypass vulnerability was discovered in mbed TLS, a lightweight crypto and SSL/TLS library, when the authentication mode is configured as <q>optional</q>. A remote attacker can take advantage of this flaw to mount a man-in-the-middle attack and impersonate an intended peer via an X.509 certificate chain with many intermediates.


cve_id: DSA-3996-1 ffmpeg
date: 2017-10-10 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed Real, MV, RL2, ASF, Apple HLS, Phantom Cine, MXF, NSV, MOV or RTP H.264 files/streams are processed.


cve_id: DSA-4050-1 xen
date: 2017-11-28 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, information leaks, privilege escalation or the execution of arbitrary code.


cve_id: DSA-4001-1 yadifa
date: 2017-10-19 00:00:00+00:00
more_info:
It was discovered that YADIFA, an authoritative DNS server, did not sufficiently check its input. This allowed a remote attacker to cause a denial-of-service by forcing the daemon to enter an infinite loop.


cve_id: DSA-3994-1 nautilus
date: 2017-10-07 00:00:00+00:00
more_info:
Christian BoxdĂśrfer discovered a vulnerability in the handling of FreeDesktop.org .desktop files in Nautilus, a file manager for the GNOME desktop environment. An attacker can craft a .desktop file intended to run malicious commands but displayed as a innocuous document file in Nautilus. An user would then trust it and open the file, and Nautilus would in turn execute the malicious content. Nautilus protection of only trusting .desktop files with executable permission can be bypassed by shipping the .desktop file inside a tarball.


cve_id: DSA-4113-1 libvorbis
date: 2018-02-14 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in the libraries of the Vorbis audio compression codec, which could result in denial of service or the execution of arbitrary code if a malformed media file is processed.


cve_id: DSA-4276-1 php-horde-image
date: 2018-08-17 00:00:00+00:00
more_info:
Fariskhi Vidyan and Thomas Jarosch discovered several vulnerabilities in php-horde-image, the image processing library for the Horde groupware suite. They would allow an attacker to cause a denial-of-service or execute arbitrary code.


cve_id: DSA-4006-1 mupdf
date: 2017-10-24 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in MuPDF, a PDF file viewer, which may result in denial of service or the execution of arbitrary code.


cve_id: DSA-4063-1 pdns-recursor
date: 2017-12-11 00:00:00+00:00
more_info:
Toshifumi Sakaguchi discovered that PowerDNS Recursor, a high-performance resolving name server was susceptible to denial of service via a crafted CNAME answer.


cve_id: DSA-4049-1 ffmpeg
date: 2017-11-27 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed.


cve_id: DSA-4243-1 cups
date: 2018-07-11 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in CUPS, the Common UNIX Printing System. These issues have been identified with the following CVE ids:


cve_id: DSA-4023-1 slurm-llnl
date: 2017-11-07 00:00:00+00:00
more_info:
Ryan Day discovered that the Simple Linux Utility for Resource Management (SLURM), a cluster resource management and job scheduling system, does not properly handle SPANK environment variables, allowing a user permitted to submit jobs to execute code as root during the Prolog or Epilog. All systems using a Prolog or Epilog script are vulnerable, regardless of whether SPANK plugins are in use.


cve_id: DSA-4191-1 redmine
date: 2018-05-03 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in Redmine, a project management web application. They could lead to remote code execution, information disclosure or cross-site scripting attacks.


cve_id: DSA-4009-1 shadowsocks-libev
date: 2017-10-29 00:00:00+00:00
more_info:
Niklas Abel discovered that insufficient input sanitising in the ss-manager component of shadowsocks-libev, a lightweight socks5 proxy, could result in arbitrary shell command execution.


cve_id: DSA-4056-1 nova
date: 2017-12-07 00:00:00+00:00
more_info:
George Shuklin from servers.com discovered that Nova, a cloud computing fabric controller, did not correctly enforce its image- or hosts-filters. This allowed an authenticated user to bypass those filters by simply rebuilding an instance.


cve_id: DSA-4415-1 passenger
date: 2019-03-24 00:00:00+00:00
more_info:
An arbitrary file read vulnerability was discovered in passenger, a web application server. A local user allowed to deploy an application to passenger, can take advantage of this flaw by creating a symlink from the REVISION file to an arbitrary file on the system and have its content displayed through passenger-status.


cve_id: DSA-4327-1 thunderbird
date: 2018-10-25 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird: Multiple memory safety errors and use-after-frees may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-4044-1 swauth
date: 2017-11-21 00:00:00+00:00
more_info:
A vulnerability has been discovered in swauth, an authentication system for Swift, a distributed virtual object store used in Openstack.


cve_id: DSA-4030-1 roundcube
date: 2017-11-09 00:00:00+00:00
more_info:
A file disclosure vulnerability was discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers. An authenticated attacker can take advantage of this flaw to read roundcube's configuration files.


cve_id: DSA-4170-1 pjproject
date: 2018-04-09 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the PJSIP/PJProject multimedia communication which may result in denial of service during the processing of SIP and SDP messages and ioqueue keys.


cve_id: DSA-4053-1 exim4
date: 2017-11-30 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Exim, a mail transport agent. The Common Vulnerabilities and Exposures project identifies the following issues:


cve_id: DSA-4259-1 ruby2.3
date: 2018-07-31 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in incorrect processing of HTTP/FTP, directory traversal, command injection, unintended socket creation or information disclosure.


cve_id: DSA-4055-1 heimdal
date: 2017-12-07 00:00:00+00:00
more_info:
Michael Eder and Thomas Kittel discovered that Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos, did not correctly handle ASN.1 data. This would allow an unauthenticated remote attacker to cause a denial of service (crash of the KDC daemon) by sending maliciously crafted packets.


cve_id: DSA-4405-1 openjpeg2
date: 2019-03-10 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in openjpeg2, the open-source JPEG 2000 codec, that could be leveraged to cause a denial of service or possibly remote code execution.


cve_id: DSA-4203-1 vlc
date: 2018-05-17 00:00:00+00:00
more_info:
Hans Jerry Illikainen discovered a type conversion vulnerability in the MP4 demuxer of the VLC media player, which could result in the execution of arbitrary code if a malformed media file is played.


cve_id: DSA-4334-1 mupdf
date: 2018-11-04 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in MuPDF, a PDF, XPS, and e-book viewer which could result in denial of service or the execution of arbitrary code if malformed documents are opened.


cve_id: DSA-4138-1 mbedtls
date: 2018-03-15 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in mbed TLS, a lightweight crypto and SSL/TLS library, that allowed a remote attacker to either cause a denial-of-service by application crash, or execute arbitrary code.


cve_id: DSA-4198-1 prosody
date: 2018-05-09 00:00:00+00:00
more_info:
Albert Dengg discovered that incorrect parsing of &lt;stream:error&gt; messages in the Prosody Jabber/XMPP server may result in denial of service.


cve_id: DSA-3906-1 undertow
date: 2017-07-11 00:00:00+00:00
more_info:
Two vulnerabilities have been discovered in Undertow, a web server written in Java, which may lead to denial of service or HTTP request smuggling.


cve_id: DSA-3955-1 mariadb-10.1
date: 2017-08-26 00:00:00+00:00
more_info:
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.1.26. Please see the MariaDB 10.1 Release Notes for further details:


cve_id: DSA-4128-1 trafficserver
date: 2018-03-02 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server. They could lead to the use of an incorrect upstream proxy, or allow a remote attacker to cause a denial-of-service by application crash.


cve_id: DSA-4318-1 moin
date: 2018-10-15 00:00:00+00:00
more_info:
Nitin Venkatesh discovered a cross-site scripting vulnerability in moin, a Python clone of WikiWiki. A remote attacker can conduct cross-site scripting attacks via the GUI editor's link dialogue. This only affects installations which have set up fckeditor (not enabled by default).


cve_id: DSA-4339-1 ceph
date: 2018-11-13 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in Ceph, a distributed storage and file system: The cephx authentication protocol was suspectible to replay attacks and calculated signatures incorrectly, <q>ceph mon</q> did not validate capabilities for pool operations (resulting in potential corruption or deletion of snapshot images) and a format string vulnerability in libradosstriper could result in denial of service.


cve_id: DSA-4325-1 mosquitto
date: 2018-10-25 00:00:00+00:00
more_info:
It was discovered that mosquitto, an MQTT broker, was vulnerable to remote denial-of-service attacks that could be mounted using various vectors.


cve_id: DSA-4278-1 jetty9
date: 2018-08-19 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in Jetty, a Java servlet engine and webserver which could result in HTTP request smuggling.


cve_id: DSA-4034-1 varnish
date: 2017-11-15 00:00:00+00:00
more_info:
'shamger' and Carlo Cannas discovered that a programming error in Varnish, a state of the art, high-performance web accelerator, may result in disclosure of memory contents or denial of service.


cve_id: DSA-4036-1 mediawiki
date: 2017-11-15 00:00:00+00:00
more_info:
Multiple security vulnerabilities have been discovered in MediaWiki, a website engine for collaborative work:


cve_id: DSA-3890-1 spip
date: 2017-06-21 00:00:00+00:00
more_info:
Emeric Boit of ANSSI reported that SPIP, a website engine for publishing, insufficiently sanitises the value from the X-Forwarded-Host HTTP header field. An unauthenticated attacker can take advantage of this flaw to cause remote code execution.


cve_id: DSA-3895-1 flatpak
date: 2017-06-22 00:00:00+00:00
more_info:
It was discovered that Flatpak, an application deployment framework for desktop apps insufficiently restricted file permissinons in third-party repositories, which could result in privilege escalation.


cve_id: DSA-4183-1 tor
date: 2018-04-28 00:00:00+00:00
more_info:
It has been discovered that Tor, a connection-based low-latency anonymous communication system, contains a protocol-list handling bug that could be used to remotely crash directory authorities with a null-pointer exception (TROVE-2018-001).


cve_id: DSA-4159-1 remctl
date: 2018-04-01 00:00:00+00:00
more_info:
Santosh Ananthakrishnan discovered a use-after-free in remctl, a server for Kerberos-authenticated command execution. If the command is configured with the sudo option, this could potentially result in the execution of arbitrary code.


cve_id: DSA-4231-1 libgcrypt20
date: 2018-06-17 00:00:00+00:00
more_info:
It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys.


cve_id: DSA-4296-1 mbedtls
date: 2018-09-16 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in mbedtls, a lightweight crypto and SSL/TLS library which could result in plain text recovery via side-channel attacks.


cve_id: DSA-4301-1 mediawiki
date: 2018-09-22 00:00:00+00:00
more_info:
Multiple security vulnerabilities have been discovered in MediaWiki, a website engine for collaborative work, which result in incorrectly configured rate limits, information disclosure in Special:Redirect/logid and bypass of an account lock.


cve_id: DSA-4246-1 mailman
date: 2018-07-15 00:00:00+00:00
more_info:
Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. discovered that mailman, a web-based mailing list manager, is prone to a cross-site scripting flaw allowing a malicious listowner to inject scripts into the listinfo page, due to not validated input in the host_name field.


cve_id: DSA-4348-1 openssl
date: 2018-11-30 00:00:00+00:00
more_info:
Several local side channel attacks and a denial of service via large Diffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets Layer toolkit.


cve_id: DSA-4158-1 openssl1.0
date: 2018-03-29 00:00:00+00:00
more_info:
It was discovered that constructed ASN.1 types with a recursive definition could exceed the stack, potentially leading to a denial of service.


cve_id: DSA-4219-1 jruby
date: 2018-06-08 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in jruby, a Java implementation of the Ruby programming language. They would allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code.


cve_id: DSA-4247-1 ruby-rack-protection
date: 2018-07-16 00:00:00+00:00
more_info:
A timing attack was discovered in the function for CSRF token validation of the <q>Ruby rack protection</q> framework.


cve_id: DSA-4233-1 bouncycastle
date: 2018-06-22 00:00:00+00:00
more_info:
It was discovered that the low-level interface to the RSA key pair generator of Bouncy Castle (a Java implementation of cryptographic algorithms) could perform less Miller-Rabin primality tests than expected.


cve_id: DSA-4283-1 ruby-json-jwt
date: 2018-08-31 00:00:00+00:00
more_info:
It was discovered that ruby-json-jwt, a Ruby implementation of JSON web tokens performed insufficient validation of GCM auth tags.


cve_id: DSA-4285-1 sympa
date: 2018-09-05 00:00:00+00:00
more_info:
Michael Kaczmarczik discovered a vulnerability in the web interface template editing function of Sympa, a mailing list manager. Owner and listmasters could use this flaw to create or modify arbitrary files in the server with privileges of sympa user or owner view list config files even if edit_list.conf prohibits it.


cve_id: DSA-4303-1 okular
date: 2018-09-23 00:00:00+00:00
more_info:
Joran Herve discovered that the Okular document viewer was susceptible to directory traversal via malformed .okular files (annotated document archives), which could result in the creation of arbitrary files.


cve_id: DSA-4306-1 python2.7
date: 2018-09-27 00:00:00+00:00
more_info:
Multiple security issues were discovered in Python: ElementTree failed to initialise Expat's hash salt, two denial of service issues were found in difflib and poplib and the shutil module was affected by a command injection vulnerability.


cve_id: DSA-4378-1 php-pear
date: 2019-01-30 00:00:00+00:00
more_info:
Fariskhi Vidyan discovered that the PEAR Archive_Tar package for handling tar files in PHP is prone to a PHP object injection vulnerability, potentially allowing a remote attacker to execute arbitrary code.


cve_id: DSA-4200-1 kwallet-pam
date: 2018-05-14 00:00:00+00:00
more_info:
Fabian Vogt discovered that incorrect permission handling in the PAM module of the KDE Wallet could allow an unprivileged local user to gain ownership of arbitrary files.


cve_id: DSA-4197-1 wavpack
date: 2018-05-09 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the wavpack audio codec which could result in denial of service or the execution of arbitrary code if malformed media files are processed.


cve_id: DSA-4338-1 qemu
date: 2018-11-11 00:00:00+00:00
more_info:
Integer overflows in the processing of packets in network cards emulated by QEMU, a fast processor emulator, could result in denial of service.


cve_id: DSA-4174-1 corosync
date: 2018-04-17 00:00:00+00:00
more_info:
The Citrix Security Response Team discovered that corosync, a cluster engine implementation, allowed an unauthenticated user to cause a denial-of-service by application crash.


cve_id: DSA-4396-1 ansible
date: 2019-02-19 00:00:00+00:00
more_info:
Several vulnerabilities have been found in Ansible, a configuration management, deployment, and task execution system:


cve_id: DSA-4169-1 pcs
date: 2018-04-11 00:00:00+00:00
more_info:
CĂŠdric Buissart from Red Hat discovered an information disclosure bug in pcs, a pacemaker command line interface and GUI. The REST interface normally doesn't allow passing --debug parameter to prevent information leak, but the check wasn't sufficient.


cve_id: DSA-4300-1 libarchive-zip-perl
date: 2018-09-22 00:00:00+00:00
more_info:
It was discovered that Archive::Zip, a perl module for manipulation of ZIP archives, is prone to a directory traversal vulnerability. An attacker able to provide a specially crafted archive for processing can take advantage of this flaw to overwrite arbitrary files during archive extraction.


cve_id: DSA-4319-1 spice
date: 2018-10-15 00:00:00+00:00
more_info:
Frediano Ziglio reported a missing check in the script to generate demarshalling code in the SPICE protocol client and server library. The generated demarshalling code is prone to multiple buffer overflows. An authenticated attacker can take advantage of this flaw to cause a denial of service (spice server crash), or possibly, execute arbitrary code.


cve_id: DSA-4255-1 ant
date: 2018-07-24 00:00:00+00:00
more_info:
Danny Grander reported that the unzip and untar tasks in ant, a Java based build tool like make, allow the extraction of files outside a target directory. An attacker can take advantage of this flaw by submitting a specially crafted Zip or Tar archive to an ant build to overwrite any file writable by the user running ant.


cve_id: DSA-4253-1 network-manager-vpnc
date: 2018-07-23 00:00:00+00:00
more_info:
Denis Andzakovic discovered that network-manager-vpnc, a plugin to provide VPNC support for NetworkManager, is prone to a privilege escalation vulnerability. A newline character can be used to inject a Password helper parameter into the configuration data passed to vpnc, allowing a local user with privileges to modify a system connection to execute arbitrary commands as root.


cve_id: DSA-4257-1 fuse
date: 2018-07-28 00:00:00+00:00
more_info:
Jann Horn discovered that FUSE, a Filesystem in USErspace, allows the bypass of the <q>user_allow_other</q> restriction when SELinux is active (including in permissive mode). A local user can take advantage of this flaw in the fusermount utility to bypass the system configuration and mount a FUSE filesystem with the <q>allow_other</q> mount option.


cve_id: DSA-4322-1 libssh
date: 2018-10-17 00:00:00+00:00
more_info:
Peter Winter-Smith of NCC Group discovered that libssh, a tiny C SSH library, contains an authentication bypass vulnerability in the server code. An attacker can take advantage of this flaw to successfully authenticate without any credentials by presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication.


cve_id: DSA-4238-1 exiv2
date: 2018-07-03 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Exiv2, a C++ library and a command line utility to manage image metadata which could result in denial of service or the execution of arbitrary code if a malformed file is parsed.


cve_id: DSA-4254-1 slurm-llnl
date: 2018-07-24 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in the Simple Linux Utility for Resource Management (SLURM), a cluster resource management and job scheduling system. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-4207-1 packagekit
date: 2018-05-22 00:00:00+00:00
more_info:
Matthias Gerstner discovered that PackageKit, a DBus abstraction layer for simple software management tasks, contains an authentication bypass flaw allowing users without privileges to install local packages.


cve_id: DSA-4230-1 redis
date: 2018-06-17 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the Lua subsystem of Redis, a persistent key-value database, which could result in denial of service.


cve_id: DSA-4245-1 imagemagick
date: 2018-07-14 00:00:00+00:00
more_info:
This update fixes several vulnerabilities in Imagemagick, a graphical software suite. Various memory handling problems or incomplete input sanitising could result in denial of service or the execution of arbitrary code.


cve_id: DSA-4452-1 jackson-databind
date: 2019-05-24 00:00:00+00:00
more_info:
Multiple security issues were found in jackson-databind, a Java library to parse JSON and other data formats which could result in information disclosure or the execution of arbitrary code.


cve_id: DSA-4261-1 vim-syntastic
date: 2018-08-03 00:00:00+00:00
more_info:
Enrico Zini discovered a vulnerability in Syntastic, an addon module for the Vim editor that runs a file through external checkers and displays any resulting errors. Config files were looked up in the current working directory which could result in arbitrary shell code execution if a malformed source code file is opened.


cve_id: DSA-4293-1 discount
date: 2018-09-14 00:00:00+00:00
more_info:
Several heap buffer overflows were found in discount, an implementation of the Markdown markup language, that could be triggered with specially crafted Markdown data and would cause discount to read past the end of internal buffers.


cve_id: DSA-4251-1 vlc
date: 2018-07-18 00:00:00+00:00
more_info:
A use-after-free was discovered in the MP4 demuxer of the VLC media player, which could result in the execution of arbitrary code if a malformed media file is played.


cve_id: DSA-4356-1 netatalk
date: 2018-12-20 00:00:00+00:00
more_info:
Jacob Baines discovered a flaw in the handling of the DSI Opensession command in Netatalk, an implementation of the AppleTalk Protocol Suite, allowing an unauthenticated user to execute arbitrary code with root privileges.


cve_id: DSA-4336-1 ghostscript
date: 2018-11-10 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service, disclosure of existence and size of arbitrary files, or the execution of arbitrary code if a malformed Postscript file is processed (despite the dSAFER sandbox being enabled).


cve_id: DSA-4357-1 libapache-mod-jk
date: 2018-12-20 00:00:00+00:00
more_info:
Raphael Arrouas and Jean Lejeune discovered an access control bypass vulnerability in mod_jk, the Apache connector for the Tomcat Java servlet engine. The vulnerability is addressed by upgrading mod_jk to the new upstream version 1.2.46, which includes additional changes.


cve_id: DSA-4596-1 tomcat8
date: 2019-12-27 00:00:00+00:00
more_info:
Several issues were discovered in the Tomcat servlet and JSP engine, which could result in session fixation attacks, information disclosure, cross-site scripting, denial of service via resource exhaustion and insecure redirects.


cve_id: DSA-4454-1 qemu
date: 2019-05-30 00:00:00+00:00
more_info:
Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service, the execution of arbitrary code or information disclosure.


cve_id: DSA-4359-1 wireshark
date: 2018-12-27 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Wireshark, a network protocol analyzer, which could result in denial of service or the execution of arbitrary code.


cve_id: DSA-4447-1 intel-microcode
date: 2019-05-15 00:00:00+00:00
more_info:
This update ships updated CPU microcode for most types of Intel CPUs. It provides mitigations for the MSBDS, MFBDS, MLPDS and MDSUM hardware vulnerabilities.


cve_id: DSA-4444-1 linux
date: 2019-05-14 00:00:00+00:00
more_info:
Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into temporary microarchitectural structures (buffers). This flaw could allow an attacker controlling an unprivileged process to read sensitive information, including from the kernel and all other processes running on the system or cross guest/host boundaries to read host memory.


cve_id: DSA-4602-1 xen
date: 2020-01-13 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks.


cve_id: DSA-4564-1 linux
date: 2019-11-12 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, or information leak.


cve_id: DSA-4320-1 asterisk
date: 2018-10-16 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service or information disclosure.


cve_id: DSA-4235-1 firefox-esr
date: 2018-06-27 00:00:00+00:00
more_info:
Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors and other implementation errors may lead to the execution of arbitrary code, denial of service, cross-site request forgery or information disclosure.


cve_id: DSA-4287-1 firefox-esr
date: 2018-09-07 00:00:00+00:00
more_info:
Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors and use-after-frees may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-4304-1 firefox-esr
date: 2018-09-23 00:00:00+00:00
more_info:
Two security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code and local information disclosure.


cve_id: DSA-4310-1 firefox-esr
date: 2018-10-03 00:00:00+00:00
more_info:
Two security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code inside the sandboxed content process.


cve_id: DSA-4324-1 firefox-esr
date: 2018-10-24 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could result in the execution of arbitrary code, privilege escalation or information disclosure.


cve_id: DSA-4337-1 thunderbird
date: 2018-11-10 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird: Multiple memory safety errors may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-4354-1 firefox-esr
date: 2018-12-12 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or bypass of the same-origin policy.


cve_id: DSA-4388-1 mosquitto
date: 2019-02-10 00:00:00+00:00
more_info:
Three vulnerabilities were discovered in the Mosquitto MQTT broker, which could result in authentication bypass. Please refer to <a href="https://mosquitto.org/blog/2019/02/version-1-5-6-released/">https://mosquitto.org/blog/2019/02/version-1-5-6-released/</a> for additional information.


cve_id: DSA-4234-1 lava-server
date: 2018-06-22 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in LAVA, a continuous integration system for deploying operating systems for running tests, which could result in information disclosure of files readable by the lavaserver system user or the execution of arbitrary code via a XMLRPC call.


cve_id: DSA-4250-1 wordpress
date: 2018-07-18 00:00:00+00:00
more_info:
A vulnerability was discovered in Wordpress, a web blogging tool. It allowed remote attackers with specific roles to execute arbitrary code.


cve_id: DSA-4670-1 tiff
date: 2020-04-29 00:00:00+00:00
more_info:
Several vulnerabilities have been found in the TIFF library, which may result in denial of service or the execution of arbitrary code if malformed image files are processed.


cve_id: DSA-4241-1 libsoup2.4
date: 2018-07-05 00:00:00+00:00
more_info:
It was discovered that the Soup HTTP library performed insufficient validation of cookie requests which could result in an out-of-bounds memory read.


cve_id: DSA-4281-1 tomcat8
date: 2018-08-29 00:00:00+00:00
more_info:
Several issues were discovered in the Tomcat servlet and JSP engine. They could lead to unauthorized access to protected resources, denial-of-service, or information leak.


cve_id: DSA-4282-1 trafficserver
date: 2018-08-31 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server, which could result in denial of service, cache poisoning or information disclosure.


cve_id: DSA-4252-1 znc
date: 2018-07-18 00:00:00+00:00
more_info:
Jeriko One discovered two vulnerabilities in the ZNC IRC bouncer which could result in privilege escalation or denial of service.


cve_id: DSA-4290-1 libextractor
date: 2018-09-10 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libextractor, a library to extract arbitrary meta-data from files, which may lead to denial of service or the execution of arbitrary code if a specially crafted file is opened.


cve_id: DSA-4277-1 mutt
date: 2018-08-17 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Mutt, a text-based mailreader supporting MIME, GPG, PGP and threading, potentially leading to code execution, denial of service or information disclosure when connecting to a malicious mail/NNTP server.


cve_id: DSA-4270-1 gdm3
date: 2018-08-13 00:00:00+00:00
more_info:
Chris Coulson discovered a use-after-free flaw in the GNOME Display Manager, triggerable by an unprivileged user via a specially crafted sequence of D-Bus method calls, leading to denial of service or potentially the execution of arbitrary code.


cve_id: DSA-4275-1 keystone
date: 2018-08-16 00:00:00+00:00
more_info:
Kristi Nikolla discovered an information leak in Keystone, the OpenStack identity service, if running in a federated setup.


cve_id: DSA-4264-1 python-django
date: 2018-08-05 00:00:00+00:00
more_info:
Andreas Hug discovered an open redirect in Django, a Python web development framework, which is exploitable if <code>django.middleware.common.CommonMiddleware</code> is used and the APPEND_SLASH setting is enabled.


cve_id: DSA-4317-1 otrs2
date: 2018-10-14 00:00:00+00:00
more_info:
Three vulnerabilities were discovered in the Open Ticket Request System which could result in privilege escalation or denial of service.


cve_id: DSA-4286-1 curl
date: 2018-09-05 00:00:00+00:00
more_info:
Zhaoyang Wu discovered that cURL, an URL transfer library, contains a buffer overflow in the NTLM authentication code triggered by passwords that exceed 2GB in length on 32bit systems.


cve_id: DSA-4328-1 xorg-server
date: 2018-10-25 00:00:00+00:00
more_info:
Narendra Shinde discovered that incorrect command-line parameter validation in the Xorg X server may result in arbitary file overwrite, which can result in privilege escalation.


cve_id: DSA-4260-1 libmspack
date: 2018-08-02 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libsmpack, a library used to handle Microsoft compression formats. A remote attacker could craft malicious CAB, CHM or KWAJ files and use these flaws to cause a denial of service via application crash, or potentially execute arbitrary code.


cve_id: DSA-4267-1 kamailio
date: 2018-08-08 00:00:00+00:00
more_info:
Henning Westerholt discovered a flaw related to the To header processing in kamailio, a very fast, dynamic and configurable SIP server. Missing input validation in the build_res_buf_from_sip_req function could result in denial of service and potentially the execution of arbitrary code.


cve_id: DSA-4441-1 symfony
date: 2019-05-10 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the Symfony PHP framework which could lead to cache bypass, authentication bypass, information disclosure, open redirect, cross-site request forgery, deletion of arbitrary files, or arbitrary code execution.


cve_id: DSA-4353-1 php7.0
date: 2018-12-10 00:00:00+00:00
more_info:
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: The EXIF module was susceptible to denial of service/information disclosure when parsing malformed images, the Apache module allowed cross-site-scripting via the body of a "Transfer-Encoding: chunked" request and the IMAP extension performed insufficient input validation which can result in the execution of arbitrary shell commands in the imap_open() function and denial of service in the imap_mail() function.


cve_id: DSA-4263-1 cgit
date: 2018-08-04 00:00:00+00:00
more_info:
Jann Horn discovered a directory traversal vulnerability in cgit, a fast web frontend for git repositories written in C. A remote attacker can take advantage of this flaw to retrieve arbitrary files via a specially crafted request, when 'enable-http-clone=1' (default) is not turned off.


cve_id: DSA-4383-1 libvncserver
date: 2019-02-03 00:00:00+00:00
more_info:
Pavel Cheremushkin discovered several vulnerabilities in libvncserver, a library to implement VNC server/client functionalities, which might result in the execution of arbitrary code, denial of service or information disclosure.


cve_id: DSA-4280-1 openssh
date: 2018-08-22 00:00:00+00:00
more_info:
Dariusz Tytko, Michal Sajdak and Qualys Security discovered that OpenSSH, an implementation of the SSH protocol suite, was prone to a user enumeration vulnerability. This would allow a remote attacker to check whether a specific user account existed on the target server.


cve_id: DSA-4374-1 qtbase-opensource-src
date: 2019-01-28 00:00:00+00:00
more_info:
Several issues were discovered in qtbase-opensource-src, a cross-platform C++ application framework, which could lead to denial-of-service via application crash. Additionally, this update fixes a problem affecting vlc, where it would start without a GUI.


cve_id: DSA-4457-1 evolution
date: 2019-06-07 00:00:00+00:00
more_info:
Hanno BĂśck discovered that Evolution was vulnerable to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted HTML email. This issue was mitigated by moving the security bar with encryption and signature information above the message headers.


cve_id: DSA-4288-1 ghostscript
date: 2018-09-07 00:00:00+00:00
more_info:
Tavis Ormandy discovered multiple vulnerabilites in Ghostscript, an interpreter for the PostScript language, which could result in denial of service, the creation of files or the execution of arbitrary code if a malformed Postscript file is processed (despite the dSAFER sandbox being enabled).


cve_id: DSA-4315-1 wireshark
date: 2018-10-12 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Wireshark, a network protocol analyzer which could result in denial of service or the execution of arbitrary code.


cve_id: DSA-4305-1 strongswan
date: 2018-09-24 00:00:00+00:00
more_info:
Sze Yiu Chau and his team from Purdue University and The University of Iowa found several issues in the gmp plugin for strongSwan, an IKE/IPsec suite.


cve_id: DSA-4316-1 imagemagick
date: 2018-10-12 00:00:00+00:00
more_info:
This update fixes several vulnerabilities in Imagemagick, a graphical software suite. Various memory handling problems or incomplete input sanitising have been found in the coders for BMP, DIB, PICT, DCM, CUT and PSD.


cve_id: DSA-4284-1 lcms2
date: 2018-09-04 00:00:00+00:00
more_info:
Quang Nguyen discovered an integer overflow in the Little CMS 2 colour management library, which could result in denial of service and potentially the execution of arbitrary code if a malformed IT8 calibration file is processed.


cve_id: DSA-4364-1 ruby-loofah
date: 2019-01-08 00:00:00+00:00
more_info:
It was discovered that ruby-loofah, a general library for manipulating and transforming HTML/XML documents and fragments, performed insufficient sanitising of SVG elements.


cve_id: DSA-4294-1 ghostscript
date: 2018-09-16 00:00:00+00:00
more_info:
Tavis Ormandy discovered multiple vulnerabilites in Ghostscript, an interpreter for the PostScript language, which could result in the execution of arbitrary code if a malformed Postscript file is processed (despite the dSAFER sandbox being enabled).


cve_id: DSA-4292-1 kamailio
date: 2018-09-11 00:00:00+00:00
more_info:
Henning Westerholt discovered a flaw related to the Via header processing in kamailio, a very fast, dynamic and configurable SIP server. An unauthenticated attacker can take advantage of this flaw to mount a denial of service attack via a specially crafted SIP message with an invalid Via header.


cve_id: DSA-4312-1 tinc
date: 2018-10-08 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in tinc, a Virtual Private Network (VPN) daemon. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-4291-1 mgetty
date: 2018-09-11 00:00:00+00:00
more_info:
Two input sanitization failures have been found in the faxrunq and faxq binaries in mgetty, a smart modem getty replacement. An attacker could leverage them  to insert commands via shell metacharacters in jobs id and have them executed with the privilege of the faxrunq/faxq user.


cve_id: DSA-4335-1 nginx
date: 2018-11-08 00:00:00+00:00
more_info:
Three vulnerabilities were discovered in Nginx, a high-performance web and reverse proxy server, which could result in denial of service in processing HTTP/2 (via excessive memory/CPU usage) or server memory disclosure in the ngx_http_mp4_module module (used for server-side MP4 streaming).


cve_id: DSA-4381-1 libreoffice
date: 2019-02-02 00:00:00+00:00
more_info:
Alex Infuehr discovered a directory traversal vulnerability which could result in the execution of Python script code when opening a malformed document.


cve_id: DSA-4455-1 heimdal
date: 2019-06-03 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos.


cve_id: DSA-4443-1 samba
date: 2019-05-14 00:00:00+00:00
more_info:
Isaac Boukris and Andrew Bartlett discovered that the S4U2Self Kerberos extension used in Samba's Active Directory support was susceptible to man-in-the-middle attacks caused by incomplete checksum validation.


cve_id: DSA-4302-1 openafs
date: 2018-09-23 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in openafs, an implementation of the distributed filesystem AFS. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: DSA-4298-1 hylafax
date: 2018-09-20 00:00:00+00:00
more_info:
Luis Merino, Markus Vervier and Eric Sesterhenn discovered that missing input sanitising in the Hylafax fax software could potentially result in the execution of arbitrary code via a malformed fax message.


cve_id: DSA-4299-1 texlive-bin
date: 2018-09-21 00:00:00+00:00
more_info:
Nick Roessler from the University of Pennsylvania has found a buffer overflow in texlive-bin, the executables for TexLive, the popular distribution of TeX document production system.


cve_id: DSA-4311-1 git
date: 2018-10-05 00:00:00+00:00
more_info:
joernchen of Phenoelit discovered that git, a fast, scalable, distributed revision control system, is prone to an arbitrary code execution vulnerability via a specially crafted .gitmodules file in a project cloned with --recurse-submodules.


cve_id: DSA-4340-1 chromium-browser
date: 2018-11-18 00:00:00+00:00
more_info:
An out-of-bounds bounds memory access issue was discovered in chromium's v8 javascript library by cloudfuzzer.


cve_id: DSA-4309-1 strongswan
date: 2018-10-01 00:00:00+00:00
more_info:
Google's OSS-Fuzz revealed an exploitable bug in the gmp plugin caused by the patch that fixes <a href="https://security-tracker.debian.org/tracker/CVE-2018-16151">\ CVE-2018-16151</a> and <a href="https://security-tracker.debian.org/tracker/CVE-2018-16152">\ CVE-2018-16152</a> (DSA-4305-1).


cve_id: DSA-4314-1 net-snmp
date: 2018-10-11 00:00:00+00:00
more_info:
Magnus Klaaborg Stubman discovered a NULL pointer dereference bug in net-snmp, a suite of Simple Network Management Protocol applications, allowing a remote, authenticated attacker to crash the snmpd process (causing a denial of service).


cve_id: DSA-4391-1 firefox-esr
date: 2019-02-14 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code.


cve_id: DSA-4392-1 thunderbird
date: 2019-02-16 00:00:00+00:00
more_info:
Multiple security issues have been found in the Thunderbird mail client, which could lead to the execution of arbitrary code, denial of service or spoofing of S/MIME signatures.


cve_id: DSA-4376-1 firefox-esr
date: 2019-01-30 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or privilege escalation.


cve_id: DSA-4420-1 thunderbird
date: 2019-03-30 00:00:00+00:00
more_info:
Multiple security issues have been found in the Thunderbird mail client, which could lead to the execution of arbitrary code or denial of service.


cve_id: DSA-4451-1 thunderbird
date: 2019-05-24 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird: Multiple vulnerabilities may lead to the execution of arbitrary code or denial of service.


cve_id: DSA-4329-1 teeworlds
date: 2018-10-28 00:00:00+00:00
more_info:
It was discovered that incorrect connection setup in the server for Teeworlds, an online multi-player platform 2D shooter, could result in denial of service via forged connection packets (rendering all game server slots occupied).


cve_id: DSA-4333-1 icecast2
date: 2018-11-04 00:00:00+00:00
more_info:
Nick Rolfe discovered multiple buffer overflows in the Icecast multimedia streaming server which could result in the execution of arbitrary code.


cve_id: DSA-4346-1 ghostscript
date: 2018-11-27 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service or the execution of arbitrary code if a malformed Postscript file is processed (despite the -dSAFER sandbox being enabled).


cve_id: DSA-4344-1 roundcube
date: 2018-11-24 00:00:00+00:00
more_info:
Aidan Marlin discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, is prone to a cross-site scripting vulnerability in handling invalid style tag content.


cve_id: DSA-4351-1 libphp-phpmailer
date: 2018-12-07 00:00:00+00:00
more_info:
It was discovered that PHPMailer, a library to send email from PHP applications, is prone to a PHP object injection vulnerability, potentially allowing a remote attacker to execute arbitrary code.


cve_id: DSA-4522-1 faad2
date: 2019-09-15 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in faad2, the Freeware Advanced Audio Coder. These vulnerabilities might allow remote attackers to cause denial-of-service, or potentially execute arbitrary code if crafted MPEG AAC files are processed.


cve_id: DSA-4350-1 policykit-1
date: 2018-12-06 00:00:00+00:00
more_info:
It was discovered that incorrect processing of very high UIDs in Policykit, a framework for managing administrative policies and privileges, could result in authentication bypass.


cve_id: DSA-4401-1 wordpress
date: 2019-03-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and PHP injections attacks, delete files, leak potentially sensitive data, create posts of unauthorized types, or cause denial-of-service by application crash.


cve_id: DSA-4394-1 rdesktop
date: 2019-02-18 00:00:00+00:00
more_info:
Multiple security issues were found in the rdesktop RDP client, which could result in denial of service, information disclosure and the execution of arbitrary code.


cve_id: DSA-4640-1 graphicsmagick
date: 2020-03-15 00:00:00+00:00
more_info:
This update fixes several vulnerabilities in Graphicsmagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed media files are processed.


cve_id: DSA-4389-1 libu2f-host
date: 2019-02-11 00:00:00+00:00
more_info:
Christian Reitter discovered that libu2f-host, a library implementing the host-side of the U2F protocol, failed to properly check for a buffer overflow. This would allow an attacker with a custom made malicious USB device masquerading as a security key, and physical access to a computer where PAM U2F or an application with libu2f-host integrated, to potentially execute arbitrary code on that computer.


cve_id: DSA-4361-1 libextractor
date: 2018-12-28 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in libextractor, a library to extract arbitrary meta-data from files, which may lead to denial of service or memory disclosure if a malformed OLE file is processed.


cve_id: DSA-4387-1 openssh
date: 2019-02-09 00:00:00+00:00
more_info:
Harry Sintonen from F-Secure Corporation discovered multiple vulnerabilities in OpenSSH, an implementation of the SSH protocol suite. All the vulnerabilities are in found in the scp client implementing the SCP protocol.


cve_id: DSA-4402-1 mumble
date: 2019-03-05 00:00:00+00:00
more_info:
It was discovered that insufficient restrictions in the connection handling of Mumble, a low latency encrypted VoIP client, could result in denial of service. 


cve_id: DSA-4506-1 qemu
date: 2019-08-24 00:00:00+00:00
more_info:
Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service, the execution of arbitrary code or bypass of ACLs.


cve_id: DSA-4472-1 expat
date: 2019-06-28 00:00:00+00:00
more_info:
It was discovered that Expat, an XML parsing C library, did not properly handled XML input including XML names that contain a large number of colons, potentially resulting in denial of service.


cve_id: DSA-4279-1 linux
date: 2018-08-20 00:00:00+00:00
more_info:
Multiple researchers have discovered a vulnerability in the way the Intel processor designs have implemented speculative execution of instructions in combination with handling of page-faults. This flaw could allow an attacker controlling an unprivileged process to read memory from arbitrary (non-user controlled) addresses, including from the kernel and all other processes running on the system or cross guest/host boundaries to read host memory.


cve_id: DSA-4274-1 xen
date: 2018-08-16 00:00:00+00:00
more_info:
This update provides mitigations for the <q>L1 Terminal Fault</q> vulnerability affecting a range of Intel CPUs.


cve_id: DSA-4273-1 intel-microcode
date: 2018-08-16 00:00:00+00:00
more_info:
This update ships updated CPU microcode for some types of Intel CPUs and provides SSBD support (needed to address <q>Spectre v4</q>) and fixes for <q>Spectre v3a</q>.


cve_id: DSA-4210-1 xen
date: 2018-05-25 00:00:00+00:00
more_info:
This update provides mitigations for the Spectre v4 variant in x86-based micro processors. On Intel CPUs this requires updated microcode which is currently not released publicly (but your hardware vendor may have issued an update). For servers with AMD CPUs no microcode update is needed, please refer to <a href="https://xenbits.xen.org/xsa/advisory-263.html">\ https://xenbits.xen.org/xsa/advisory-263.html</a> for further information.


cve_id: DSA-4232-1 xen
date: 2018-06-20 00:00:00+00:00
more_info:
This update provides mitigations for the <q>lazy FPU</q> vulnerability affecting a range of Intel CPUs, which could result in leaking CPU register states belonging to another vCPU previously scheduled on the same CPU. For additional information please refer to <a href="https://xenbits.xen.org/xsa/advisory-267.html">\ https://xenbits.xen.org/xsa/advisory-267.html</a>


cve_id: DSA-4358-1 ruby-sanitize
date: 2018-12-27 00:00:00+00:00
more_info:
The Shopify Application Security Team discovered that ruby-sanitize, a whitelist-based HTML sanitizer, is prone to a HTML injection vulnerability. A specially crafted HTML fragment can cause to allow nonwhitelisted attributes to be used on a whitelisted HTML element.


cve_id: DSA-4242-1 ruby-sprockets
date: 2018-07-09 00:00:00+00:00
more_info:
Orange Tsai discovered a path traversal flaw in ruby-sprockets, a Rack-based asset packaging system. A remote attacker can take advantage of this flaw to read arbitrary files outside an application's root directory via specially crafted requests, when the Sprockets server is used in production.


cve_id: DSA-4343-1 liblivemedia
date: 2018-11-23 00:00:00+00:00
more_info:
It was discovered that a buffer overflow in liveMedia, a set of C++ libraries for multimedia streaming could result in the execution of arbitrary code when parsing a malformed RTSP stream.


cve_id: DSA-4162-1 irssi
date: 2018-04-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Irssi, a terminal-based IRC client which can result in denial of service.


cve_id: DSA-4095-1 gcab
date: 2018-01-24 00:00:00+00:00
more_info:
It was discovered that gcab, a Microsoft Cabinet file manipulation tool, is prone to a stack-based buffer overflow vulnerability when extracting .cab files. An attacker can take advantage of this flaw to cause a denial-of-service or, potentially the execution of arbitrary code with the privileges of the user running gcab, if a specially crafted .cab file is processed.


cve_id: DSA-4105-1 mpv
date: 2018-02-06 00:00:00+00:00
more_info:
It was discovered that mpv, a media player, was vulnerable to remote code execution attacks. An attacker could craft a malicious web page that, when used as an argument in mpv, could execute arbitrary code in the host of the mpv user.


cve_id: DSA-4380-1 golang-1.8
date: 2019-02-01 00:00:00+00:00
more_info:
A vulnerability was discovered in the implementation of the P-521 and P-384 elliptic curves, which could result in denial of service and in some cases key recovery.


cve_id: DSA-4107-1 django-anymail
date: 2018-02-07 00:00:00+00:00
more_info:
It was discovered that the webhook validation of Anymail, a Django email backends for multiple ESPs, is prone to a timing attack. A remote attacker can take advantage of this flaw to obtain a WEBHOOK_AUTHORIZATION secret and post arbitrary email tracking events.


cve_id: DSA-4125-1 wavpack
date: 2018-02-27 00:00:00+00:00
more_info:
Joonun Jang discovered several problems in wavpack, an audio compression format suite. Incorrect processing of input resulted in several heap- and stack-based buffer overflows, leading to application crash or potential code execution.


cve_id: DSA-4116-1 plasma-workspace
date: 2018-02-16 00:00:00+00:00
more_info:
Krzysztof Sieluzycki discovered that the notifier for removable devices in the KDE Plasma workspace performed insufficient sanitisation of FAT/VFAT volume labels, which could result in the execution of arbitrary shell commands if a removable device with a malformed disk label is mounted.


cve_id: DSA-4111-1 libreoffice
date: 2018-02-11 00:00:00+00:00
more_info:
Mikhail Klementev, Ronnie Goodrich and Andrew Krasichkov discovered that missing restrictions in the implementation of the WEBSERVICE function in LibreOffice could result in the disclosure of arbitrary files readable by the user who opens a malformed document.


cve_id: DSA-4134-1 util-linux
date: 2018-03-10 00:00:00+00:00
more_info:
Bjorn Bosselmann discovered that the umount bash completion from util-linux does not properly handle embedded shell commands in a mountpoint name. An attacker with rights to mount filesystems can take advantage of this flaw for privilege escalation if a user (in particular root) is tricked into using the umount completion while a specially crafted mount is present.


cve_id: DSA-4171-1 ruby-loofah
date: 2018-04-13 00:00:00+00:00
more_info:
The Shopify Application Security Team reported that ruby-loofah, a general library for manipulating and transforming HTML/XML documents and fragments, allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments. This might allow to mount a code injection attack into a browser consuming sanitized output.


cve_id: DSA-4181-1 roundcube
date: 2018-04-28 00:00:00+00:00
more_info:
Andrea Basile discovered that the <q>archive</q> plugin in roundcube, a skinnable AJAX based webmail solution for IMAP servers, does not properly sanitize a user-controlled parameter, allowing a remote attacker to inject arbitrary IMAP commands and perform malicious actions.


cve_id: DSA-4461-1 zookeeper
date: 2019-06-12 00:00:00+00:00
more_info:
Harrison Neil discovered that the getACL() command in Zookeeper, a service for maintaining configuration information, did not validate permissions, which could result in information disclosure.


cve_id: DSA-4406-1 waagent
date: 2019-03-12 00:00:00+00:00
more_info:
Francis McBratney discovered that the Windows Azure Linux Agent created swap files with world-readable permissions, resulting in information disclosure.


cve_id: DSA-4377-1 rssh
date: 2019-01-30 00:00:00+00:00
more_info:
The ESnet security team discovered a vulnerability in rssh, a restricted shell that allows users to perform only scp, sftp, cvs, svnserve (Subversion), rdist and/or rsync operations. Missing validation in the scp support could result in the bypass of this restriction, allowing the execution of arbitrary shell commands.


cve_id: DSA-4439-1 postgresql-9.6
date: 2019-05-09 00:00:00+00:00
more_info:
Dean Rasheed discovered that row security policies in the PostgreSQL database system could be bypassed.


cve_id: DSA-4456-1 exim4
date: 2019-06-05 00:00:00+00:00
more_info:
The Qualys Research Labs reported a flaw in Exim, a mail transport agent. Improper validation of the recipient address in the deliver_message() function may result in the execution of arbitrary commands.


cve_id: DSA-4469-1 libvirt
date: 2019-06-22 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in Libvirt, a virtualisation abstraction library, allowing an API client with read-only permissions to execute arbitrary commands via the virConnectGetDomainCapabilities API, or read or execute arbitrary files via the virDomainSaveImageGetXMLDesc API.


cve_id: DSA-4470-1 pdns
date: 2019-06-23 00:00:00+00:00
more_info:
Two vulnerabilities have been discovered in pdns, an authoritative DNS server which may result in denial of service via malformed zone records and excessive NOTIFY packets in a master/slave setup.


cve_id: DSA-4480-1 redis
date: 2019-07-11 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the HyperLogLog implementation of Redis, a persistent key-value database, which could result in denial of service or potentially the execution of arbitrary code.


cve_id: DSA-4492-1 postgresql-9.6
date: 2019-08-08 00:00:00+00:00
more_info:
A issue has been discovered in the PostgreSQL database system, which could result in privilege escalation.


cve_id: DSA-4499-1 ghostscript
date: 2019-08-12 00:00:00+00:00
more_info:
Netanel reported that the .buildfont1 procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox.


cve_id: DSA-4712-1 imagemagick
date: 2020-06-30 00:00:00+00:00
more_info:
This update fixes multiple vulnerabilities in Imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or potentially the execution of arbitrary code if malformed image files are processed.


cve_id: DSA-4436-1 imagemagick
date: 2019-04-28 00:00:00+00:00
more_info:
This update fixes two vulnerabilities in Imagemagick: Memory handling problems and missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed TIFF or Postscript files are processed.


cve_id: DSA-4426-1 tryton-server
date: 2019-04-07 00:00:00+00:00
more_info:
Cedric Krier discovered that missing access validation in Tryton could result in information disclosure .


cve_id: DSA-4529-1 php7.0
date: 2019-09-20 00:00:00+00:00
more_info:
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: Missing sanitising in the EXIF extension and the iconv_mime_decode_headers() function could result in information disclosure or denial of service.


cve_id: DSA-4576-1 php-imagick
date: 2019-11-25 00:00:00+00:00
more_info:
An out-of-bounds write vulnerability was discovered in php-imagick, a PHP extension to create and modify images using the ImageMagick API, which could result in denial of service, or potentially the execution of arbitrary code.


cve_id: DSA-4552-1 php7.0
date: 2019-10-28 00:00:00+00:00
more_info:
Emil Lerner and Andrew Danau discovered that insufficient validation in the path handling code of PHP FPM could result in the execution of arbitrary code in some setups.


cve_id: DSA-4628-1 php7.0
date: 2020-02-18 00:00:00+00:00
more_info:
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in information disclosure, denial of service or incorrect validation of path names.


cve_id: DSA-4717-1 php7.0
date: 2020-07-05 00:00:00+00:00
more_info:
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in information disclosure, denial of service or potentially the execution of arbitrary code.


cve_id: DSA-4429-1 spip
date: 2019-04-10 00:00:00+00:00
more_info:
It was discovered that SPIP, a website engine for publishing, did not properly sanitize its user input. This would allow an authenticated user to perform arbitrary command execution.


cve_id: DSA-4565-1 intel-microcode
date: 2019-11-13 00:00:00+00:00
more_info:
This update ships updated CPU microcode for some types of Intel CPUs. In particular it provides mitigations for the TAA (TSX Asynchronous Abort) vulnerability. For affected CPUs, to fully mitigate the vulnerability it is also necessary to update the Linux kernel packages as released in DSA 4564-1.


cve_id: DSA-4458-1 cyrus-imapd
date: 2019-06-08 00:00:00+00:00
more_info:
A flaw was discovered in the CalDAV feature in httpd of the Cyrus IMAP server, leading to denial of service or potentially the execution of arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.


cve_id: DSA-4434-1 drupal7
date: 2019-04-20 00:00:00+00:00
more_info:
A cross-site scripting vulnerability has been found in Drupal, a fully-featured content management framework. For additional information, please refer to the upstream advisory at <a href="https://www.drupal.org/sa-core-2019-006">https://www.drupal.org/sa-core-2019-006</a> .


cve_id: DSA-4460-1 mediawiki
date: 2019-06-12 00:00:00+00:00
more_info:
Multiple security vulnerabilities have been discovered in MediaWiki, a website engine for collaborative work, which may result in authentication bypass, denial of service, cross-site scripting, information disclosure and bypass of anti-spam measures.


cve_id: DSA-4438-1 atftp
date: 2019-05-07 00:00:00+00:00
more_info:
Denis Andzakovic discovered two vulnerabilities in atftp, the advanced TFTP server which could result in denial of service by sending malformed packets.


cve_id: DSA-4510-1 dovecot
date: 2019-08-28 00:00:00+00:00
more_info:
Nick Roessler and Rafi Rubin discovered that the IMAP and ManageSieve protocol parsers in the Dovecot email server do not properly validate input (both pre- and post-login). A remote attacker can take advantage of this flaw to trigger out of bounds heap memory writes, leading to information leaks or potentially the execution of arbitrary code.


cve_id: DSA-4450-1 wpa
date: 2019-05-24 00:00:00+00:00
more_info:
A vulnerability was found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point).


cve_id: DSA-4464-1 thunderbird
date: 2019-06-15 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which may lead to the execution of arbitrary code if malformed email messages are read.


cve_id: DSA-4466-1 firefox-esr
date: 2019-06-18 00:00:00+00:00
more_info:
Samuel Gross discovered a type confusion bug in the JavaScript engine of the Mozilla Firefox web browser, which could result in the execution of arbitrary code when browsing a malicious website.


cve_id: DSA-4474-1 firefox-esr
date: 2019-07-01 00:00:00+00:00
more_info:
A sandbox escape was found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code if combined with additional vulnerabilities.


cve_id: DSA-4479-1 firefox-esr
date: 2019-07-11 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting, spoofing, information disclosure, denial of service or cross-site request forgery.


cve_id: DSA-4482-1 thunderbird
date: 2019-07-14 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code, cross-site scripting, spoofing, information disclosure, denial of service or cross-site request forgery.


cve_id: DSA-4523-1 thunderbird
date: 2019-09-15 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code, cross-site scripting, information disclosure and a covert content attack on S/MIME encryption using a crafted multipart/alternative message.


cve_id: DSA-4516-1 firefox-esr
date: 2019-09-05 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting, bypass of the same-origin policy, sandbox escape, information disclosure or denial of service.


cve_id: DSA-4571-1 thunderbird
date: 2019-11-17 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or denial of service.


cve_id: DSA-4445-1 drupal7
date: 2019-05-14 00:00:00+00:00
more_info:
It was discovered that incomplete validation in a Phar processing library embedded in Drupal, a fully-featured content management framework, could result in information disclosure.


cve_id: DSA-4446-1 lemonldap-ng
date: 2019-05-14 00:00:00+00:00
more_info:
It was discovered that the Lemonldap::NG web SSO system performed insufficient validation of session tokens if the <q>tokenUseGlobalStorage</q> option is enabled, which could grant users with access to the main session database access to an anonymous session.


cve_id: DSA-4593-1 freeimage
date: 2019-12-27 00:00:00+00:00
more_info:
It was found that freeimage, a graphics library, was affected by the following two security issues:


cve_id: DSA-4476-1 python-django
date: 2019-07-05 00:00:00+00:00
more_info:
Three security issues were found in Django, a Python web development framework, which could result in denial of service, incomplete sanitisation of clickable links or missing redirects of HTTP requests to HTTPS.


cve_id: DSA-4542-1 jackson-databind
date: 2019-10-06 00:00:00+00:00
more_info:
It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, did not properly validate user input before attempting deserialization. This allowed an attacker providing maliciously crafted input to perform code execution, or read arbitrary files on the server.


cve_id: DSA-4541-1 libapreq2
date: 2019-10-04 00:00:00+00:00
more_info:
Max Kellermann reported a NULL pointer dereference flaw in libapreq2, a generic Apache request library, allowing a remote attacker to cause a denial of service against an application using the library (application crash) if an invalid nested <q>multipart</q> body is processed.


cve_id: DSA-4478-1 dosbox
date: 2019-07-10 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in the DOSBox emulator, which could result in the execution of arbitrary code on the host running DOSBox when running a malicious executable in the emulator.


cve_id: DSA-4487-1 neovim
date: 2019-07-23 00:00:00+00:00
more_info:
User <q>Arminius</q> discovered a vulnerability in Vim, an enhanced version of the standard UNIX editor Vi (Vi IMproved), which also affected the Neovim fork, an extensible editor focused on modern code and features:
Editors typically provide a way to embed editor configuration commands (aka modelines) which are executed once a file is opened, while harmful commands are filtered by a sandbox mechanism. It was discovered that the <q>source</q> command (used to include and execute another file) was not filtered, allowing shell command execution with a carefully crafted file opened in Neovim.


cve_id: DSA-4467-1 vim
date: 2019-06-18 00:00:00+00:00
more_info:
User <q>Arminius</q> discovered a vulnerability in Vim, an enhanced version of the standard UNIX editor Vi (Vi IMproved). The <q>Common vulnerabilities and exposures project</q> identifies the following problem:


cve_id: DSA-4462-1 dbus
date: 2019-06-13 00:00:00+00:00
more_info:
Joe Vennix discovered an authentication bypass vulnerability in dbus, an asynchronous inter-process communication system. The implementation of the DBUS_COOKIE_SHA1 authentication mechanism was susceptible to a symbolic link attack. A local attacker could take advantage of this flaw to bypass authentication and connect to a DBusServer with elevated privileges.


cve_id: DSA-4491-1 proftpd-dfsg
date: 2019-08-04 00:00:00+00:00
more_info:
Tobias Maedel discovered that the mod_copy module of ProFTPD, a FTP/SFTP/FTPS server, performed incomplete permission validation for the CPFR/CPTO commands.


cve_id: DSA-4463-1 znc
date: 2019-06-14 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in the ZNC IRC bouncer which could result in remote code execution (<a href="https://security-tracker.debian.org/tracker/CVE-2019-12816">CVE-2019-12816</a>) or denial of service via invalid encoding (<a href="https://security-tracker.debian.org/tracker/CVE-2019-9917">CVE-2019-9917</a>).


cve_id: DSA-4675-1 graphicsmagick
date: 2020-05-05 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in GraphicsMagick, a set of command-line applications to manipulate image files, which could result in information disclosure, denial of service or the execution of arbitrary code if malformed image files are processed.


cve_id: DSA-4477-1 zeromq3
date: 2019-07-08 00:00:00+00:00
more_info:
Fang-Pen Lin discovered a stack-based buffer-overflow flaw in ZeroMQ, a lightweight messaging kernel library. A remote, unauthenticated client connecting to an application using the libzmq library, running with a socket listening with CURVE encryption/authentication enabled, can take advantage of this flaw to cause a denial of service or the execution of arbitrary code.


cve_id: DSA-4484-1 linux
date: 2019-07-20 00:00:00+00:00
more_info:
Jann Horn discovered that the ptrace subsystem in the Linux kernel mishandles the management of the credentials of a process that wants to create a ptrace relationship, allowing a local user to obtain root privileges under certain scenarios.


cve_id: DSA-4581-1 git
date: 2019-12-10 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in git, a fast, scalable, distributed revision control system.


cve_id: DSA-4481-1 ruby-mini-magick
date: 2019-07-13 00:00:00+00:00
more_info:
Harsh Jaiswal discovered a remote shell execution vulnerability in ruby-mini-magick, a Ruby library providing a wrapper around ImageMagick or GraphicsMagick, exploitable when using MiniMagick::Image.open with specially crafted URLs coming from unsanitized user input.


cve_id: DSA-4504-1 vlc
date: 2019-08-20 00:00:00+00:00
more_info:
Multiple security issues were discovered in the VLC media player, which could result in the execution of arbitrary code or denial of service if a malformed file/stream is processed.


cve_id: DSA-4489-1 patch
date: 2019-07-27 00:00:00+00:00
more_info:
Imre Rad discovered several vulnerabilities in GNU patch, leading to shell command injection or escape from the working directory and access and overwrite files, if specially crafted patch files are processed.


cve_id: DSA-4650-1 qbittorrent
date: 2020-04-02 00:00:00+00:00
more_info:
Miguel Onoro reported that qbittorrent, a bittorrent client with a Qt5 GUI user interface, allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, which could result in remote command execution via a crafted name within an RSS feed if qbittorrent is configured to run an external program on torrent completion.


cve_id: DSA-4488-1 exim4
date: 2019-07-25 00:00:00+00:00
more_info:
Jeremy Harris discovered that Exim, a mail transport agent, does not properly handle the ${sort } expansion. This flaw can be exploited by a remote attacker to execute programs with root privileges in non-default (and unusual) configurations where ${sort } expansion is used for items that can be controlled by an attacker.


cve_id: DSA-4498-1 python-django
date: 2019-08-12 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in python-django, a web development framework. They could lead to remote denial-of-service or SQL injection,


cve_id: DSA-4543-1 sudo
date: 2019-10-14 00:00:00+00:00
more_info:
Joe Vennix discovered that sudo, a program designed to provide limited super user privileges to specific users, when configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, allows to run commands as root by specifying the user ID -1 or 4294967295. This could allow a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access.


cve_id: DSA-4494-1 kconfig
date: 2019-08-09 00:00:00+00:00
more_info:
Dominik Penner discovered that KConfig, the KDE configuration settings framework, supported a feature to define shell command execution in .desktop files. If a user is provided with a malformed .desktop file (e.g. if it's embedded into a downloaded archive and it gets opened in a file browser) arbitrary commands could get executed. This update removes this feature.


cve_id: DSA-4518-1 ghostscript
date: 2019-09-07 00:00:00+00:00
more_info:
It was discovered that various procedures in Ghostscript, the GPL PostScript/PDF interpreter, do not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox.


cve_id: DSA-4567-1 dpdk
date: 2019-11-12 00:00:00+00:00
more_info:
It was discovered that the vhost PMD in DPDK, a set of libraries for fast packet processing, was affected by memory and file descriptor leaks which could result in denial of service.


cve_id: DSA-4525-1 ibus
date: 2019-09-18 00:00:00+00:00
more_info:
Simon McVittie reported a flaw in ibus, the Intelligent Input Bus. Due to a misconfiguration during the setup of the DBus, any unprivileged user could monitor and send method calls to the ibus bus of another user, if able to discover the UNIX socket used by another user connected on a graphical environment. The attacker can take advantage of this flaw to intercept keystrokes of the victim user or modify input related configurations through DBus method calls.


cve_id: DSA-4588-1 python-ecdsa
date: 2019-12-17 00:00:00+00:00
more_info:
It was discovered that python-ecdsa, a cryptographic signature library for Python, incorrectly handled certain signatures. A remote attacker could use this issue to cause python-ecdsa to either not warn about incorrect signatures, or generate exceptions resulting in a denial-of-service.


cve_id: DSA-4569-1 ghostscript
date: 2019-11-14 00:00:00+00:00
more_info:
Manfred Paul and Lukas Schauer reported that the .charkeys procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox.


cve_id: DSA-4475-1 openssl
date: 2019-07-01 00:00:00+00:00
more_info:
Joran Dirk Greef discovered that overly long nonces used with ChaCha20-Poly1305 were incorrectly processed and could result in nonce reuse. This doesn't affect OpenSSL-internal uses of ChaCha20-Poly1305 such as TLS.


cve_id: DSA-4539-1 openssl
date: 2019-10-01 00:00:00+00:00
more_info:
Three security issues were discovered in OpenSSL: A timing attack against ECDSA, a padding oracle in PKCS7_dataDecode() and CMS_decrypt_set1_pkey() and it was discovered that a feature of the random number generator (RNG) intended to protect against shared RNG state between parent and child processes in the event of a fork() syscall was not used by default.


cve_id: DSA-4540-1 openssl1.0
date: 2019-10-01 00:00:00+00:00
more_info:
Two security issues were discovered in OpenSSL: A timing attack against ECDSA and a padding oracle in PKCS7_dataDecode() and CMS_decrypt_set1_pkey().


cve_id: DSA-4594-1 openssl1.0
date: 2019-12-27 00:00:00+00:00
more_info:
Guido Vranken discovered an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli.


cve_id: DSA-4554-1 ruby-loofah
date: 2019-10-28 00:00:00+00:00
more_info:
It was discovered that ruby-loofah, a general library for manipulating and transforming HTML/XML documents and fragments, was susceptible to cross-site scripting.


cve_id: DSA-4609-1 python-apt
date: 2020-01-23 00:00:00+00:00
more_info:
Two security issues were found in the Python interface to the apt package manager; package downloads from unsigned repositories were incorrectly rejected and the hash validation relied on MD5.


cve_id: DSA-4587-1 ruby2.3
date: 2019-12-17 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the interpreter for the Ruby language, which could result in unauthorized access by bypassing intended path matchings, denial of service, or the execution of arbitrary code.


cve_id: DSA-4517-1 exim4
date: 2019-09-06 00:00:00+00:00
more_info:
"Zerons" and Qualys discovered that a buffer overflow triggerable in the TLS negotiation code of the Exim mail transport agent could result in the execution of arbitrary code with root privileges.


cve_id: DSA-4616-1 qemu
date: 2020-02-02 00:00:00+00:00
more_info:
Two security issues have been found in the SLiRP networking implementation of QEMU, a fast processor emulator, which could result in the execution of arbitrary code or denial of service.


cve_id: DSA-4530-1 expat
date: 2019-09-22 00:00:00+00:00
more_info:
It was discovered that Expat, an XML parsing C library, did not properly handled internal entities closing the doctype, potentially resulting in denial of service or information disclosure if a malformed XML file is processed.


cve_id: DSA-4599-1 wordpress
date: 2020-01-08 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation.


cve_id: DSA-4607-1 openconnect
date: 2020-01-20 00:00:00+00:00
more_info:
Lukas Kupczyk reported a vulnerability in the handling of chunked HTTP in openconnect, an open client for Cisco AnyConnect, Pulse and GlobalProtect VPN. A malicious HTTP server (after having accepted its identity certificate), can provide bogus chunk lengths for chunked HTTP encoding and cause a heap-based buffer overflow.


cve_id: DSA-4526-1 opendmarc
date: 2019-09-19 00:00:00+00:00
more_info:
It was discovered that OpenDMARC, a milter implementation of DMARC, is prone to a signature-bypass vulnerability with multiple From: addresses.


cve_id: DSA-4532-1 spip
date: 2019-09-25 00:00:00+00:00
more_info:
It was discovered that SPIP, a website engine for publishing, would allow unauthenticated users to modify published content and write to the database, perform cross-site request forgeries, and enumerate registered users.


cve_id: DSA-4537-1 file-roller
date: 2019-09-28 00:00:00+00:00
more_info:
It was discovered that file-roller, an archive manager for GNOME, does not properly handle the extraction of archives with a single ./../ in a file path. An attacker able to provide a specially crafted archive for processing can take advantage of this flaw to overwrite files if a user is dragging a specific file or map to a location to extract to.


cve_id: DSA-4604-1 cacti
date: 2020-01-19 00:00:00+00:00
more_info:
Multiple issues have been found in cacti, a server monitoring system, potentially resulting in SQL code execution or information disclosure by authenticated users.


cve_id: DSA-4555-1 pam-python
date: 2019-10-29 00:00:00+00:00
more_info:
Malte Kraus discovered that libpam-python, a PAM module allowing PAM modules to be written in Python, didn't sanitise environment variables which could result in local privilege escalation if used with a setuid binary.


cve_id: DSA-4545-1 mediawiki
date: 2019-10-18 00:00:00+00:00
more_info:
It was discovered that the Special:Redirect functionality of MediaWiki, a website engine for collaborative work, could expose suppressed user names, resulting in an information leak.


cve_id: DSA-4631-1 pillow
date: 2020-02-21 00:00:00+00:00
more_info:
Multiple security issues were discovered in Pillow, a Python imaging library, which could result in denial of service and potentially the execution of arbitrary code if malformed PCX, FLI, SGI or TIFF images are processed.


cve_id: DSA-4597-1 netty
date: 2020-01-03 00:00:00+00:00
more_info:
It was reported that Netty, a Java NIO client/server framework, is prone to a HTTP request smuggling vulnerability due to mishandling whitespace before the colon in HTTP headers.


cve_id: DSA-4585-1 thunderbird
date: 2019-12-15 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code.


cve_id: DSA-4600-1 firefox-esr
date: 2020-01-09 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, data exfiltration or cross-site scripting.


cve_id: DSA-4603-1 thunderbird
date: 2020-01-17 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or information disclosure.


cve_id: DSA-4676-1 salt
date: 2020-05-06 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in salt, a powerful remote execution manager, which could result in retrieve of user tokens from the salt master, execution of arbitrary commands on salt minions, arbitrary directory access to authenticated users or arbitrary code execution on salt-api hosts.


cve_id: DSA-4574-1 redmine
date: 2019-11-19 00:00:00+00:00
more_info:
Holger Just discovered an SQL injection in Redmine, a project management web application. In addition a cross-site scripting issue was found in Textile formatting.


cve_id: DSA-4673-1 tomcat8
date: 2020-05-03 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in the Tomcat servlet and JSP engine, which could result in HTTP request smuggling and code execution in the AJP connector (disabled by default in Debian).


cve_id: DSA-4619-1 libxmlrpc3-java
date: 2020-02-06 00:00:00+00:00
more_info:
Guillaume Teissier reported that the XMLRPC client in libxmlrpc3-java, an XML-RPC implementation in Java, does perform deserialization of the server-side exception serialized in the faultCause attribute of XMLRPC error response messages. A malicious XMLRPC server can take advantage of this flaw to execute arbitrary code with the privileges of an application using the Apache XMLRPC client library.


cve_id: DSA-4686-1 apache-log4j1.2
date: 2020-05-16 00:00:00+00:00
more_info:
It was discovered that the SocketServer class included in apache-log4j1.2, a logging library for java, is vulnerable to deserialization of untrusted data. An attacker can take advantage of this flaw to execute arbitrary code in the context of the logger application by sending a specially crafted log event.


cve_id: DSA-4663-1 python-reportlab
date: 2020-04-25 00:00:00+00:00
more_info:
It was discovered that python-reportlab, a Python library to create PDF documents, is prone to a code injection vulnerability while parsing a color attribute. An attacker can take advantage of this flaw to execute arbitrary code if a specially crafted document is processed.


cve_id: DSA-4559-1 proftpd-dfsg
date: 2019-11-05 00:00:00+00:00
more_info:
Stephan Zeisberg discovered that missing input validation in ProFTPD, a FTP/SFTP/FTPS server, could result in denial of service via an infinite loop.


cve_id: DSA-4550-1 file
date: 2019-10-25 00:00:00+00:00
more_info:
A buffer overflow was found in file, a file type classification tool, which may result in denial of service or potentially the execution of arbitrary code if a malformed CDF (Composite Document File) file is processed.


cve_id: DSA-4582-1 davical
date: 2019-12-13 00:00:00+00:00
more_info:
Multiple cross-site scripting and cross-site request forgery issues were discovered in the DAViCal CalDAV Server.


cve_id: DSA-4557-1 libarchive
date: 2019-10-31 00:00:00+00:00
more_info:
A use-after-free was found in libarchive, a multi-format archive and compression library, which could result in denial of service and potentially the execution of arbitrary code is a malformed archive is processed.


cve_id: DSA-4614-1 sudo
date: 2020-02-01 00:00:00+00:00
more_info:
Joe Vennix discovered a stack-based buffer overflow vulnerability in sudo, a program designed to provide limited super user privileges to specific users, triggerable when configured with the <q>pwfeedback</q> option enabled. An unprivileged user can take advantage of this flaw to obtain full root privileges.


cve_id: DSA-4573-1 symfony
date: 2019-11-18 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to a timing attack/information leak, argument injection and code execution via unserialization.


cve_id: DSA-4592-1 mediawiki
date: 2019-12-26 00:00:00+00:00
more_info:
It was discovered that the Title blacklist functionality in MediaWiki, a website engine for collaborative work, could by bypassed.


cve_id: DSA-4590-1 cyrus-imapd
date: 2019-12-19 00:00:00+00:00
more_info:
It was discovered that the lmtpd component of the Cyrus IMAP server created mailboxes with administrator privileges if the <q>fileinto</q> was used, bypassing ACL checks.


cve_id: DSA-4598-1 python-django
date: 2020-01-07 00:00:00+00:00
more_info:
Simon Charette reported that the password reset functionality in Django, a high-level Python web development framework, uses a Unicode case-insensitive query to retrieve accounts matching the email address requesting the password reset. An attacker can take advantage of this flaw to potentially retrieve password reset tokens and hijack accounts.


cve_id: DSA-4591-1 cyrus-sasl2
date: 2019-12-20 00:00:00+00:00
more_info:
Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library.


cve_id: DSA-4601-1 ldm
date: 2020-01-09 00:00:00+00:00
more_info:
It was discovered that a hook script of ldm, the display manager for the Linux Terminal Server Project, incorrectly parsed responses from an SSH server, which could result in local root privilege escalation.


cve_id: DSA-4365-1 tmpreaper
date: 2019-01-10 00:00:00+00:00
more_info:
Stephen Roettger discovered a race condition in tmpreaper, a program that cleans up files in directories based on their age, which could result in local privilege escalation.


cve_id: DSA-4371-1 apt
date: 2019-01-22 00:00:00+00:00
more_info:
Max Justicz discovered a vulnerability in APT, the high level package manager. The code handling HTTP redirects in the HTTP transport method doesn't properly sanitize fields transmitted over the wire. This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicous content in the HTTP connection. This content could then be recognized as a valid package by APT and used later for code execution with root privileges on the target machine.


cve_id: DSA-4382-1 rssh
date: 2019-02-02 00:00:00+00:00
more_info:
Nick Cleaton discovered two vulnerabilities in rssh, a restricted shell that allows users to perform only scp, sftp, cvs, svnserve (Subversion), rdist and/or rsync operations. Missing validation in the rsync support could result in the bypass of this restriction, allowing the execution of arbitrary shell commands.


cve_id: DSA-4560-1 simplesamlphp
date: 2019-11-06 00:00:00+00:00
more_info:
It was discovered that in SimpleSAMLphp, an implementation of the SAML 2.0 protocol, it was possible to circumvent XML signature verification on SAML messages.


cve_id: DSA-4589-1 debian-edu-config
date: 2019-12-18 00:00:00+00:00
more_info:
It was discovered that debian-edu-config, a set of configuration files used for the Debian Edu blend, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other user principals.


cve_id: DSA-4595-1 debian-lan-config
date: 2019-12-27 00:00:00+00:00
more_info:
It was discovered that debian-lan-config, a FAI config space for the Debian-LAN system, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other user principals.


cve_id: DSA-4363-1 python-django
date: 2019-01-08 00:00:00+00:00
more_info:
It was discovered that malformed URLs could spoof the content of the default 404 page of Django, a Python web development framework.


cve_id: DSA-4375-1 spice
date: 2019-01-29 00:00:00+00:00
more_info:
Christophe Fergeau discovered an out-of-bounds read vulnerability in spice, a SPICE protocol client and server library, which might result in denial of service (spice server crash), or possibly, execution of arbitrary code.


cve_id: DSA-4385-1 dovecot
date: 2019-02-05 00:00:00+00:00
more_info:
halfdog discovered an authentication bypass vulnerability in the Dovecot email server. Under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. If there is no additional password verification, this allows the attacker to login as anyone else in the system. Only installations using:


cve_id: DSA-4397-1 ldb
date: 2019-02-28 00:00:00+00:00
more_info:
Garming Sam reported an out-of-bounds read in the ldb_wildcard_compare() function of ldb, a LDAP-like embedded database, resulting in denial of service.


cve_id: DSA-4432-1 ghostscript
date: 2019-04-16 00:00:00+00:00
more_info:
Cedric Buissart discovered two vulnerabilities in Ghostscript, the GPL PostScript/PDF interpreter, which could result in bypass of file system restrictions of the dSAFER sandbox.


cve_id: DSA-4442-1 ghostscript
date: 2019-05-12 00:00:00+00:00
more_info:
A vulnerability was discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service or the execution of arbitrary code if a malformed Postscript file is processed (despite the -dSAFER sandbox being enabled).


cve_id: DSA-4431-1 libssh2
date: 2019-04-13 00:00:00+00:00
more_info:
Chris Coulson discovered several vulnerabilities in libssh2, a SSH2 client-side library, which could result in denial of service, information leaks or the execution of arbitrary code.


cve_id: DSA-4424-1 pdns
date: 2019-04-04 00:00:00+00:00
more_info:
Adam Dobrawy, Frederico Silva and Gregory Brzeski from HyperOne.com discovered that pdns, an authoritative DNS server, did not properly validate user-supplied data when building a HTTP request from a DNS query in the HTTP Connector of the Remote backend. This would allow a remote user to cause either a denial-of-service, or information disclosure.


cve_id: DSA-4414-1 libapache2-mod-auth-mellon
date: 2019-03-23 00:00:00+00:00
more_info:
Several issues have been discovered in Apache module auth_mellon, which provides SAML 2.0 authentication.


cve_id: DSA-4427-1 samba
date: 2019-04-08 00:00:00+00:00
more_info:
Michael Hanselmann discovered that Samba, a SMB/CIFS file, print, and login server for Unix, was vulnerable to a symlink traversal attack. It would allow remote authenticated users with write permission to either write or detect files outside of Samba shares.


cve_id: DSA-4535-1 e2fsprogs
date: 2019-09-27 00:00:00+00:00
more_info:
Lilith of Cisco Talos discovered a buffer overflow flaw in the quota code used by e2fsck from the ext2/ext3/ext4 file system utilities. Running e2fsck on a malformed file system can result in the execution of arbitrary code.


cve_id: DSA-4416-1 wireshark
date: 2019-03-24 00:00:00+00:00
more_info:
It was discovered that Wireshark, a network traffic analyzer, contained several vulnerabilities in the dissectors for 6LoWPAN, P_MUL, RTSE, ISAKMP, TCAP, ASN.1 BER and RPCAP, which could result in denial of service.


cve_id: DSA-4404-1 chromium
date: 2019-03-09 00:00:00+00:00
more_info:
Clement Lecigne discovered a use-after-free issue in chromium's file reader implementation.  A maliciously crafted file could be used to remotely execute arbitrary code because of this problem.


cve_id: DSA-4425-1 wget
date: 2019-04-05 00:00:00+00:00
more_info:
Kusano Kazuhiko discovered a buffer overflow vulnerability in the handling of Internationalized Resource Identifiers (IRI) in wget, a network utility to retrieve files from the web, which could result in the execution of arbitrary code or denial of service when recursively downloading from an untrusted server.


cve_id: DSA-4372-1 ghostscript
date: 2019-01-26 00:00:00+00:00
more_info:
Tavis Ormandy discovered a vulnerability in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service or the execution of arbitrary code if a malformed Postscript file is processed (despite the -dSAFER sandbox being enabled).


cve_id: DSA-4368-1 zeromq3
date: 2019-01-14 00:00:00+00:00
more_info:
Guido Vranken discovered that an incorrect bounds check in ZeroMQ, a lightweight messaging kernel, could result in the execution of arbitrary code.


cve_id: DSA-4408-1 liblivemedia
date: 2019-03-17 00:00:00+00:00
more_info:
Multiple security issues were discovered in liveMedia, a set of C++ libraries for multimedia streaming which could result in the execution of arbitrary code or denial of service when parsing a malformed RTSP stream.


cve_id: DSA-4370-1 drupal7
date: 2019-01-17 00:00:00+00:00
more_info:
Two vulnerabilities were found in Drupal, a fully-featured content management framework, which could result in arbitrary code execution.


cve_id: DSA-4412-1 drupal7
date: 2019-03-20 00:00:00+00:00
more_info:
It was discovered that missing input sanitising in the file module of Drupal, a fully-featured content management framework, could result in cross-site scripting.


cve_id: DSA-4435-1 libpng1.6
date: 2019-04-27 00:00:00+00:00
more_info:
A use-after-free vulnerability was discovered in the png_image_free() function in the libpng PNG library, which could lead to denial of service or potentially the execution of arbitrary code if a malformed image is processed.


cve_id: DSA-4418-1 dovecot
date: 2019-03-28 00:00:00+00:00
more_info:
A vulnerability was discovered in the Dovecot email server. When reading FTS or POP3-UIDL headers from the Dovecot index, the input buffer size is not bounds-checked. An attacker with the ability to modify dovecot indexes, can take advantage of this flaw for privilege escalation or the execution of arbitrary code with the permissions of the dovecot user. Only installations using the FTS or pop3 migration plugins are affected.


cve_id: DSA-4433-1 ruby2.3
date: 2019-04-16 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Rubygems included in the interpreter for the Ruby language, which may result in denial of service or the execution of arbitrary code.


cve_id: DSA-4398-1 php7.0
date: 2019-02-28 00:00:00+00:00
more_info:
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: Multiple out-of-bounds memory accesses were found in the xmlrpc, mbstring and phar extensions and the dns_get_record() function.


cve_id: DSA-4399-1 ikiwiki
date: 2019-02-28 00:00:00+00:00
more_info:
Joey Hess discovered that the aggregate plugin of the Ikiwiki wiki compiler was susceptible to server-side request forgery, resulting in information disclosure or denial of service.


cve_id: DSA-4578-1 libvpx
date: 2019-11-28 00:00:00+00:00
more_info:
Multiple security issues were found in libvpx multimedia library which could result in denial of service and potentially the execution of arbitrary code if malformed WebM files are processed.


cve_id: DSA-4618-1 libexif
date: 2020-02-06 00:00:00+00:00
more_info:
An out-of-bounds write vulnerability due to an integer overflow was reported in libexif, a library to parse EXIF files, which could result in denial of service, or potentially the execution of arbitrary code if specially crafted image files are processed.


cve_id: DSA-4430-1 wpa
date: 2019-04-10 00:00:00+00:00
more_info:
Mathy Vanhoef (NYUAD) and Eyal Ronen (Tel Aviv University &amp; KU Leuven) found multiple vulnerabilities in the WPA implementation found in wpa_supplication (station) and hostapd (access point). These vulnerability are also collectively known as <q>Dragonblood</q>.


cve_id: DSA-4511-1 nghttp2
date: 2019-09-01 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in the HTTP/2 code of the nghttp2 HTTP server, which could result in denial of service.


cve_id: DSA-4505-1 nginx
date: 2019-08-22 00:00:00+00:00
more_info:
Three vulnerabilities were discovered in the HTTP/2 code of Nginx, a high-performance web and reverse proxy server, which could result in denial of service.


cve_id: DSA-4407-1 xmltooling
date: 2019-03-12 00:00:00+00:00
more_info:
Ross Geerlings discovered that the XMLTooling library didn't correctly handle exceptions on malformed XML declarations, which could result in denial of service against the application using XMLTooling.


cve_id: DSA-4403-1 php7.0
date: 2019-03-08 00:00:00+00:00
more_info:
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: The EXIF extension had multiple cases of invalid memory access and rename() was implemented insecurely.


cve_id: DSA-4409-1 neutron
date: 2019-03-18 00:00:00+00:00
more_info:
Erik Olof Gunnar Andersson discovered that incorrect validation of port settings in the iptables security group driver of Neutron, the OpenStack virtual network service, could result in denial of service in a multi tenant setup.


cve_id: DSA-4413-1 ntfs-3g
date: 2019-03-21 00:00:00+00:00
more_info:
A heap-based buffer overflow was discovered in NTFS-3G, a read-write NTFS driver for FUSE. A local user can take advantage of this flaw for local root privilege escalation.


cve_id: DSA-4501-1 libreoffice
date: 2019-08-15 00:00:00+00:00
more_info:
It was discovered that the code fixes to address  <a href="https://security-tracker.debian.org/tracker/CVE-2018-16858">\ CVE-2018-16858</a> and <a href="https://security-tracker.debian.org/tracker/CVE-2019-9848">\ CVE-2019-9848</a> were not complete.


cve_id: DSA-4519-1 libreoffice
date: 2019-09-08 00:00:00+00:00
more_info:
It was discovered that the code fixes for LibreOffice to address <a href="https://security-tracker.debian.org/tracker/CVE-2019-9852">\ CVE-2019-9852</a> were not complete. Additional information can be found at <url "https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9854/">.


cve_id: DSA-4468-1 php-horde-form
date: 2019-06-21 00:00:00+00:00
more_info:
A path traversal vulnerability due to an unsanitized POST parameter was discovered in php-horde-form, a package providing form rendering, validation, and other functionality for the Horde Application Framework. An attacker can take advantage of this flaw for remote code execution.


cve_id: DSA-4423-1 putty
date: 2019-04-03 00:00:00+00:00
more_info:
Multiple vulnerabilities were found in the PuTTY SSH client, which could result in denial of service and potentially the execution of arbitrary code. In addition, in some situations random numbers could potentially be re-used.


cve_id: DSA-4437-1 gst-plugins-base1.0
date: 2019-04-29 00:00:00+00:00
more_info:
It was discovered that a buffer overflow in the RTSP parser of the GStreamer media framework may result in the execution of arbitrary code if a malformed RTSP stream is opened.


cve_id: DSA-4419-1 twig
date: 2019-03-29 00:00:00+00:00
more_info:
Fabien Potencier discovered that twig, a template engine for PHP, did not correctly enforce sandboxing. This could result in potential information disclosure.


cve_id: DSA-4701-1 intel-microcode
date: 2020-06-11 00:00:00+00:00
more_info:
This update ships updated CPU microcode for some types of Intel CPUs and provides mitigations for the Special Register Buffer Data Sampling (<a href="https://security-tracker.debian.org/tracker/CVE-2020-0543">CVE-2020-0543</a>), Vector Register Sampling (<a href="https://security-tracker.debian.org/tracker/CVE-2020-0548">CVE-2020-0548</a>) and L1D Eviction Sampling (<a href="https://security-tracker.debian.org/tracker/CVE-2020-0549">CVE-2020-0549</a>) hardware vulnerabilities.


cve_id: DSA-4647-1 bluez
date: 2020-03-26 00:00:00+00:00
more_info:
It was reported that the BlueZ's HID and HOGP profile implementations don't specifically require bonding between the device and the host. Malicious devices can take advantage of this flaw to connect to a target host and impersonate an existing HID device without security or to cause an SDP or GATT service discovery to take place which would allow HID reports to be injected to the input subsystem from a non-bonded source.


cve_id: DSA-4617-1 qtbase-opensource-src
date: 2020-02-03 00:00:00+00:00
more_info:
Two security issues were found in the Qt library, which could result in plugins and libraries being loaded from the current working directory, resulting in potential code execution.


cve_id: DSA-4646-1 icu
date: 2020-03-25 00:00:00+00:00
more_info:
Andre Bargull discovered an integer overflow in the International Components for Unicode (ICU) library which could result in denial of service and potentially the execution of arbitrary code.


cve_id: DSA-4648-1 libpam-krb5
date: 2020-03-31 00:00:00+00:00
more_info:
Russ Allbery discovered a buffer overflow in the PAM module for MIT Kerberos, which could result in denial of service or potentially the execution of arbitrary code.


cve_id: DSA-4688-1 dpdk
date: 2020-05-18 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the vhost code of DPDK, a set of libraries for fast packet processing, which could result in denial of service or the execution of arbitrary code by malicious guests/containers.


cve_id: DSA-4659-1 git
date: 2020-04-20 00:00:00+00:00
more_info:
Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted.


cve_id: DSA-4693-1 drupal7
date: 2020-05-26 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Drupal, a fully-featured content management framework, which could result in an open redirect or cross-site scripting.


cve_id: DSA-4660-1 awl
date: 2020-04-21 00:00:00+00:00
more_info:
Andrew Bartlett discovered that awl, DAViCal Andrew's Web Libraries, did not properly handle session management: this would allow a malicious user to impersonate other sessions or users.


cve_id: DSA-4664-1 mailman
date: 2020-04-26 00:00:00+00:00
more_info:
Hanno Boeck discovered that it was possible to create a cross site scripting attack on the webarchives of the Mailman mailing list manager, by sending a special type of attachement.


cve_id: DSA-4666-1 openldap
date: 2020-04-28 00:00:00+00:00
more_info:
A vulnerability was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. LDAP search filters with nested boolean expressions can result in denial of service (slapd daemon crash).


cve_id: DSA-4678-1 firefox-esr
date: 2020-05-06 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or information disclosure.


cve_id: DSA-4683-1 thunderbird
date: 2020-05-08 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could result in spoofing the displayed sender email address, denial of service or potentially the execution of arbitrary code.


cve_id: DSA-4702-1 thunderbird
date: 2020-06-11 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could result in the setup of a non-encrypted IMAP connection, denial of service or potentially the execution of arbitrary code.


cve_id: DSA-4695-1 firefox-esr
date: 2020-06-03 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or a timing attack on cryptographic keys.


cve_id: DSA-4718-1 thunderbird
date: 2020-07-05 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could result in denial of service or potentially the execution of arbitrary code.


cve_id: DSA-4674-1 roundcube
date: 2020-05-05 00:00:00+00:00
more_info:
It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not correctly process and sanitize requests. This would allow a remote attacker to perform either a Cross-Site Request Forgery (CSRF) forcing an authenticated user to be logged out, or a Cross-Side Scripting (XSS) leading to execution of arbitrary code.


cve_id: DSA-4687-1 exim4
date: 2020-05-16 00:00:00+00:00
more_info:
It was discovered that exim4, a mail transport agent, suffers from a authentication bypass vulnerability in the spa authentication driver. The spa authentication driver is not enabled by default.


cve_id: DSA-4705-1 python-django
date: 2020-06-18 00:00:00+00:00
more_info:
It was discovered that Django, a high-level Python web development framework, did not properly sanitize input. This would allow a remote attacker to perform SQL injection attacks, Cross-Site Scripting (XSS) attacks, or leak sensitive information.


cve_id: DSA-4704-1 vlc
date: 2020-06-16 00:00:00+00:00
more_info:
A vulnerability was discovered in the VLC media player, which could result in the execution of arbitrary code or denial of service if a malformed video file is opened.


cve_id: DSA-4706-1 drupal7
date: 2020-06-18 00:00:00+00:00
more_info:
It was discovered that Drupal, a fully-featured content management framework, was suspectible to cross site request forgery.


cve_id: DSA-4700-1 roundcube
date: 2020-06-11 00:00:00+00:00
more_info:
Matei Badanoiu and LoRexxar@knownsec discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not correctly process and sanitize requests. This would allow a remote attacker to perform a Cross-Side Scripting (XSS) attack leading to the execution of arbitrary code.


cve_id: DSA-4707-1 mutt
date: 2020-06-19 00:00:00+00:00
more_info:
Damian Poddebniak and Fabian Ising discovered two security issues in the STARTTLS handling of the Mutt mail client, which could enable MITM attacks.


cve_id: DSA-4622-1 postgresql-9.6
date: 2020-02-13 00:00:00+00:00
more_info:
Tom Lane discovered that <q>ALTER ... DEPENDS ON EXTENSION</q> sub commands in the PostgreSQL database did not perform authorisation checks.


cve_id: DSA-4615-1 spamassassin
date: 2020-02-01 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in spamassassin, a Perl-based spam filter using text analysis. Malicious rule or configuration files, possibly downloaded from an updates server, could execute arbitrary commands under multiple scenarios.


cve_id: DSA-4685-1 apt
date: 2020-05-14 00:00:00+00:00
more_info:
Shuaibing Lu discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could result in denial of service when processing specially crafted deb files.


cve_id: DSA-4657-1 git
date: 2020-04-14 00:00:00+00:00
more_info:
Felix Wilhelm of Google Project Zero discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline, the credential helper machinery can be fooled to return credential information for a wrong host.


cve_id: DSA-4630-1 python-pysaml2
date: 2020-02-21 00:00:00+00:00
more_info:
It was discovered that pysaml2, a Python implementation of SAML to be used in a WSGI environment, was susceptible to XML signature wrapping attacks, which could result in a bypass of signature verification.


cve_id: DSA-4671-1 vlc
date: 2020-04-30 00:00:00+00:00
more_info:
Multiple security issues were discovered in the microdns plugin of the VLC media player, which could result in denial of service or potentially the execution of arbitrary code via malicious mDNS packets.


cve_id: DSA-4653-1 firefox-esr
date: 2020-04-04 00:00:00+00:00
more_info:
Two security issues have been found in the Mozilla Firefox web browser, which could result in the execution of arbitrary code.


cve_id: DSA-4611-1 opensmtpd
date: 2020-01-29 00:00:00+00:00
more_info:
Qualys discovered that the OpenSMTPD SMTP server performed insufficient validation of email addresses which could result in the execution of arbitrary commands as root. In addition this update fixes a denial of service by triggering an opportunistic TLS downgrade.


cve_id: DSA-4629-1 python-django
date: 2020-02-19 00:00:00+00:00
more_info:
Simon Charette discovered that Django, a high-level Python web development framework, did not properly handle input in its PostgreSQL module. A remote attacker could leverage this to perform SQL injection attacks.


cve_id: DSA-4612-1 prosody-modules
date: 2020-01-31 00:00:00+00:00
more_info:
It was discovered that the LDAP authentication modules for the Prosody Jabber/XMPP server incorrectly validated the XMPP address when checking whether a user has admin access.


cve_id: DSA-4632-1 ppp
date: 2020-02-22 00:00:00+00:00
more_info:
Ilja Van Sprundel reported a logic flaw in the Extensible Authentication Protocol (EAP) packet parser in the Point-to-Point Protocol Daemon (pppd). An unauthenticated attacker can take advantage of this flaw to trigger a stack-based buffer overflow, leading to denial of service (pppd daemon crash).


cve_id: DSA-4634-1 opensmtpd
date: 2020-02-26 00:00:00+00:00
more_info:
Qualys discovered that the OpenSMTPD SMTP server performed insufficient validation of SMTP commands, which could result in local privilege escalation or the execution of arbitrary code.


cve_id: DSA-4635-1 proftpd-dfsg
date: 2020-02-26 00:00:00+00:00
more_info:
Antonio Morales discovered an use-after-free flaw in the memory pool allocator in ProFTPD, a powerful modular FTP/SFTP/FTPS server. Interrupting current data transfers can corrupt the ProFTPD memory pool, leading to denial of service, or potentially the execution of arbitrary code.


cve_id: DSA-4637-1 network-manager-ssh
date: 2020-03-09 00:00:00+00:00
more_info:
Kobus van Schoor discovered that network-manager-ssh, a plugin to provide VPN integration for SSH in NetworkManager, is prone to a privilege escalation vulnerability. A local user with privileges to modify a connection can take advantage of this flaw to execute arbitrary commands as root.


cve_id: DSA-4032-1 imagemagick
date: 2017-11-12 00:00:00+00:00
more_info:
This update fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed GIF, TTF, SVG, TIFF, PCX, JPG or SFW files are processed.


cve_id: DSA-4078-1 linux
date: 2018-01-04 00:00:00+00:00
more_info:
Multiple researchers have discovered a vulnerability in Intel processors, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system.


cve_id: DSA-4265-1 xml-security-c
date: 2018-08-05 00:00:00+00:00
more_info:
It was discovered that the Apache XML Security for C++ library performed insufficient validation of KeyInfo hints, which could result in denial of service via NULL pointer dereferences when processing malformed XML data.


cve_id: DSA-4297-1 chromium-browser
date: 2018-09-19 00:00:00+00:00
more_info:
Two vulnerabilities have been discovered in the chromium web browser. Kevin Cheung discovered an error in the WebAssembly implementation and evil1m0 discovered a URL spoofing issue.


cve_id: DSA-4323-1 drupal7
date: 2018-10-18 00:00:00+00:00
more_info:
Two vulnerabilities were found in Drupal, a fully-featured content management framework, which could result in arbitrary code execution or an open redirect. For additional information, please refer to the upstream advisory at <a href="https://www.drupal.org/sa-core-2018-006">\ https://www.drupal.org/sa-core-2018-006</a>


cve_id: DSA-4390-1 flatpak
date: 2019-02-12 00:00:00+00:00
more_info:
It was discovered that Flatpak, an application deployment framework for desktop apps, insufficiently restricted the execution of <q>apply_extra</q> scripts which could potentially result in privilege escalation.


cve_id: DSA-4473-1 rdesktop
date: 2019-06-28 00:00:00+00:00
more_info:
Multiple security issues were found in the rdesktop RDP client, which could result in denial of service and the execution of arbitrary code.


cve_id: CVE-2005-1513 netqmail
date: 0001-01-01 00:00:00+00:00
more_info:
Georgi Guninski and the Qualys Research Labs discovered multiple vulnerabilities in qmail (shipped in Debian as netqmail with additional patches) which could result in the execution of arbitrary code, bypass of mail address verification and a local information leak whether a file exists or not.


cve_id: CVE-2015-8011 openvswitch
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in the LLPD implementation of Open vSwitch, a software-based Ethernet virtual switch, which could result in denial of service.


cve_id: CVE-2015-8553 linux
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.


cve_id: CVE-2016-10095 tiff
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.


cve_id: CVE-2016-9063 expat
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in Expat, an XML parsing C library. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: CVE-2017-1000376 libffi
date: 0001-01-01 00:00:00+00:00
more_info:
libffi, a library used to call code written in one language from code written in a different language, was enforcing an executable stack on the i386 architecture. While this might not be considered a vulnerability by itself, this could be leveraged when exploiting other vulnerabilities, like for example the <q>stack clash</q> class of vulnerabilities discovered by Qualys Research Labs. For the full details, please refer to their advisory published at: <a href="https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt">https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt</a>


cve_id: CVE-2017-10971 xorg-server
date: 0001-01-01 00:00:00+00:00
more_info:
Two security issues have been discovered in the X.org X server, which may lead to privilege escalation or an information leak.


cve_id: CVE-2017-11103 samba
date: 0001-01-01 00:00:00+00:00
more_info:
Jeffrey Altman, Viktor Duchovni and Nico Williams identified a mutual authentication bypass vulnerability in samba, the SMB/CIFS file, print, and login server. Also known as Orpheus' Lyre, this vulnerability is located in Samba Kerberos Key Distribution Center (KDC-REP) component and could be used by an attacker on the network path to impersonate a server.


cve_id: CVE-2017-11108 tcpdump
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service or, potentially, execution of arbitrary code.


cve_id: CVE-2017-11110 catdoc
date: 0001-01-01 00:00:00+00:00
more_info:
A heap-based buffer underflow flaw was discovered in catdoc, a text extractor for MS-Office files, which may lead to denial of service (application crash) or have unspecified other impact, if a specially crafted file is processed.


cve_id: CVE-2017-11185 strongswan
date: 0001-01-01 00:00:00+00:00
more_info:
A denial of service vulnerability was identified in strongSwan, an IKE/IPsec suite, using Google's OSS-Fuzz fuzzing project.


cve_id: CVE-2017-12837 perl
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: CVE-2017-12865 connman
date: 0001-01-01 00:00:00+00:00
more_info:
Security consultants in NRI Secure Technologies discovered a stack overflow vulnerability in ConnMan, a network manager for embedded devices. An attacker with control of the DNS responses to the DNS proxy in ConnMan might crash the service and, in same cases, remotely execute arbitrary commands in the host running the service.


cve_id: CVE-2017-13077 wpa
date: 0001-01-01 00:00:00+00:00
more_info:
Mathy Vanhoef of the imec-DistriNet research group of KU Leuven discovered multiple vulnerabilities in the WPA protocol, used for authentication in wireless networks. Those vulnerabilities apply to both the access point (implemented in hostapd) and the station (implemented in wpa_supplicant).


cve_id: CVE-2017-14032 mbedtls
date: 0001-01-01 00:00:00+00:00
more_info:
An authentication bypass vulnerability was discovered in mbed TLS, a lightweight crypto and SSL/TLS library, when the authentication mode is configured as <q>optional</q>. A remote attacker can take advantage of this flaw to mount a man-in-the-middle attack and impersonate an intended peer via an X.509 certificate chain with many intermediates.


cve_id: CVE-2017-14604 nautilus
date: 0001-01-01 00:00:00+00:00
more_info:
Christian BoxdĂśrfer discovered a vulnerability in the handling of FreeDesktop.org .desktop files in Nautilus, a file manager for the GNOME desktop environment. An attacker can craft a .desktop file intended to run malicious commands but displayed as a innocuous document file in Nautilus. An user would then trust it and open the file, and Nautilus would in turn execute the malicious content. Nautilus protection of only trusting .desktop files with executable permission can be bypassed by shipping the .desktop file inside a tarball.


cve_id: CVE-2017-14718 wordpress
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Wordpress, a web blogging tool. They would allow remote attackers to exploit path-traversal issues, perform SQL injections and various cross-site scripting attacks.


cve_id: CVE-2017-18926 raptor2
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that raptor2, an RDF parser library, is prone to heap-based buffer overflow flaws, which could result in denial of service, or potentially the execution of arbitrary code, if a specially crafted file is processed.


cve_id: CVE-2017-7526 libgcrypt20
date: 0001-01-01 00:00:00+00:00
more_info:
Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal and Yuval Yarom discovered that Libgcrypt is prone to a local side-channel attack allowing full key recovery for RSA-1024.


cve_id: CVE-2017-7805 nss
date: 0001-01-01 00:00:00+00:00
more_info:
Martin Thomson discovered that nss, the Mozilla Network Security Service library, is prone to a use-after-free vulnerability in the TLS 1.2 implementation when handshake hashes are generated. A remote attacker can take advantage of this flaw to cause an application using the nss library to crash, resulting in a denial of service, or potentially to execute arbitrary code.


cve_id: CVE-2017-9111 openexr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were found in the OpenEXR image library, which could result in denial of service and potentially the execution of arbitrary code when processing malformed EXR image files.


cve_id: CVE-2017-9736 spip
date: 0001-01-01 00:00:00+00:00
more_info:
Emeric Boit of ANSSI reported that SPIP, a website engine for publishing, insufficiently sanitises the value from the X-Forwarded-Host HTTP header field. An unauthenticated attacker can take advantage of this flaw to cause remote code execution.


cve_id: CVE-2018-11782 subversion
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Subversion, a version control system. The Common Vulnerabilities and Exposures project identifies the following problems:


cve_id: CVE-2018-12126 xen
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks.


cve_id: CVE-2018-12207 linux
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, or information leak.


cve_id: CVE-2018-1311 xerces-c
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that xerces-c, a validating XML parser library for C++, did not correctly scan DTDs. The use-after-free vulnerability resulting from this issue would allow a remote attacker to leverage a specially crafted XML file in order to crash the application or potentially execute arbitrary code. Please note that the patch fixing this issue comes at the expense of a newly introduced memory leak.


cve_id: CVE-2018-20184 graphicsmagick
date: 0001-01-01 00:00:00+00:00
more_info:
This update fixes several vulnerabilities in Graphicsmagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or the execution of arbitrary code if malformed media files are processed.


cve_id: CVE-2018-20196 faad2
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the freeware Advanced Audio Decoder, which may result in denial of service or potentially the execution of arbitrary code if malformed media files are processed.


cve_id: CVE-2018-25009 libwebp
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in libwebp, the implementation of the WebP image format, which could result in denial of service, memory disclosure or potentially the execution of arbitrary code if malformed images are processed.


cve_id: CVE-2018-25032 zlib
date: 0001-01-01 00:00:00+00:00
more_info:
Danilo Ramos discovered that incorrect memory handling in zlib's deflate handling could result in denial of service or potentially the execution of arbitrary code if specially crafted input is processed.


cve_id: CVE-2018-5786 lrzip
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the lrzip compression program which could result in denial of service or potentially the execution of arbitrary code.


cve_id: CVE-2019-10072 tomcat9
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in the Tomcat servlet and JSP engine, which could result in HTTP request smuggling, code execution in the AJP connector (disabled by default in Debian) or a man-in-the-middle attack against the JMX interface.


cve_id: CVE-2019-1010238 pango1.0
date: 0001-01-01 00:00:00+00:00
more_info:
Benno Fuenfstueck discovered that Pango, a library for layout and rendering of text with an emphasis on internationalization, is prone to a heap-based buffer overflow flaw in the pango_log2vis_get_embedding_levels function. An attacker can take advantage of this flaw for denial of service or potentially the execution of arbitrary code.


cve_id: CVE-2019-10156 ansible
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been found in Ansible, a configuration management, deployment and task execution system, which could result in information disclosure or argument injection. In addition a race condition in become_user was fixed.


cve_id: CVE-2019-10192 redis
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the HyperLogLog implementation of Redis, a persistent key-value database, which could result in denial of service or potentially the execution of arbitrary code.


cve_id: CVE-2019-10197 samba
date: 0001-01-01 00:00:00+00:00
more_info:
Stefan Metzmacher discovered a flaw in Samba, a SMB/CIFS file, print, and login server for Unix. Specific combinations of parameters and permissions can allow user to escape from the share path definition and see the complete '/' filesystem. Unix permission checks in the kernel are still enforced.


cve_id: CVE-2019-10208 postgresql-11
date: 0001-01-01 00:00:00+00:00
more_info:
Two security issues have been discovered in the PostgreSQL database system, which could result in privilege escalation, denial of service or memory disclosure.


cve_id: CVE-2019-10216 ghostscript
date: 0001-01-01 00:00:00+00:00
more_info:
Netanel reported that the .buildfont1 procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox.


cve_id: CVE-2019-10241 jetty9
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in Jetty, a Java servlet engine and webserver which could result in cross-site scripting, information disclosure, privilege escalation or denial of service.


cve_id: CVE-2019-10649 imagemagick
date: 0001-01-01 00:00:00+00:00
more_info:
This update fixes multiple vulnerabilities in Imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service, memory disclosure or potentially the execution of arbitrary code if malformed image files are processed.


cve_id: CVE-2019-11036 php7.3
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: Missing sanitising in the EXIF extension and the iconv_mime_decode_headers() function could result in information disclosure or denial of service.


cve_id: CVE-2019-11043 php7.3
date: 0001-01-01 00:00:00+00:00
more_info:
Emil Lerner and Andrew Danau discovered that insufficient validation in the path handling code of PHP FPM could result in the execution of arbitrary code in some setups.


cve_id: CVE-2019-11045 php7.3
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in information disclosure, denial of service or incorrect validation of path names.


cve_id: CVE-2019-11048 php7.3
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in information disclosure, denial of service or potentially the execution of arbitrary code.


cve_id: CVE-2019-11135 intel-microcode
date: 0001-01-01 00:00:00+00:00
more_info:
This update ships updated CPU microcode for some types of Intel CPUs. In particular it provides mitigations for the TAA (TSX Asynchronous Abort) vulnerability. For affected CPUs, to fully mitigate the vulnerability it is also necessary to update the Linux kernel packages as released in DSA 4564-1.


cve_id: CVE-2019-11500 dovecot
date: 0001-01-01 00:00:00+00:00
more_info:
Nick Roessler and Rafi Rubin discovered that the IMAP and ManageSieve protocol parsers in the Dovecot email server do not properly validate input (both pre- and post-login). A remote attacker can take advantage of this flaw to trigger out of bounds heap memory writes, leading to information leaks or potentially the execution of arbitrary code.


cve_id: CVE-2019-11709 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting, spoofing, information disclosure, denial of service or cross-site request forgery.


cve_id: CVE-2019-11709 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code, cross-site scripting, spoofing, information disclosure, denial of service or cross-site request forgery.


cve_id: CVE-2019-11739 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code, cross-site scripting, information disclosure and a covert content attack on S/MIME encryption using a crafted multipart/alternative message.


cve_id: CVE-2019-11740 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting, bypass of the same-origin policy, sandbox escape, information disclosure or denial of service.


cve_id: CVE-2019-11745 nss
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in NSS, a set of cryptographic libraries, which may result in denial of service and potentially the execution of arbitrary code.


cve_id: CVE-2019-11755 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or denial of service.


cve_id: CVE-2019-11757 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure, cross-site scripting or denial of service.


cve_id: CVE-2019-11779 mosquitto
date: 0001-01-01 00:00:00+00:00
more_info:
A vulnerability was discovered in mosquitto, a MQTT version 3.1/3.1.1 compatible message broker, allowing a malicious MQTT client to cause a denial of service (stack overflow and daemon crash), by sending a specially crafted SUBSCRIBE packet containing a topic with a extremely deep hierarchy.


cve_id: CVE-2019-12068 qemu
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service or the execution of arbitrary code.


cve_id: CVE-2019-12384 jackson-databind
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, did not properly validate user input before attempting deserialization. This allowed an attacker providing maliciously crafted input to perform code execution, or read arbitrary files on the server.


cve_id: CVE-2019-12412 libapreq2
date: 0001-01-01 00:00:00+00:00
more_info:
Max Kellermann reported a NULL pointer dereference flaw in libapreq2, a generic Apache request library, allowing a remote attacker to cause a denial of service against an application using the library (application crash) if an invalid nested <q>multipart</q> body is processed.


cve_id: CVE-2019-12519 squid
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in the Squid proxy caching server, which could result in the bypass of security filters, information disclosure, the execution of arbitrary code or denial of service.


cve_id: CVE-2019-12525 squid
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Squid, a fully featured web proxy cache. The flaws in the HTTP Digest Authentication processing, the HTTP Basic Authentication processing and in the cachemgr.cgi allowed remote attackers to perform denial of service and cross-site scripting attacks, and potentially the execution of arbitrary code.


cve_id: CVE-2019-12594 dosbox
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in the DOSBox emulator, which could result in the execution of arbitrary code on the host running DOSBox when running a malicious executable in the emulator.


cve_id: CVE-2019-12730 ffmpeg
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed.


cve_id: CVE-2019-12815 proftpd-dfsg
date: 0001-01-01 00:00:00+00:00
more_info:
Tobias Maedel discovered that the mod_copy module of ProFTPD, a FTP/SFTP/FTPS server, performed incomplete permission validation for the CPFR/CPTO commands.


cve_id: CVE-2019-12838 slurm-llnl
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that the Simple Linux Utility for Resource Management (SLURM), a cluster resource management and job scheduling system, did not escape strings when importing an archive file into the accounting_storage/mysql backend, resulting in SQL injection.


cve_id: CVE-2019-12921 graphicsmagick
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in GraphicsMagick, a set of command-line applications to manipulate image files, which could result in information disclosure, denial of service or the execution of arbitrary code if malformed image files are processed.


cve_id: CVE-2019-13132 zeromq3
date: 0001-01-01 00:00:00+00:00
more_info:
Fang-Pen Lin discovered a stack-based buffer-overflow flaw in ZeroMQ, a lightweight messaging kernel library. A remote, unauthenticated client connecting to an application using the libzmq library, running with a socket listening with CURVE encryption/authentication enabled, can take advantage of this flaw to cause a denial of service or the execution of arbitrary code.


cve_id: CVE-2019-13139 docker.io
date: 0001-01-01 00:00:00+00:00
more_info:
Three security vulnerabilities have been discovered in the Docker container runtime: Insecure loading of NSS libraries in <q>docker cp</q> could result in execution of code with root privileges, sensitive data could be logged in debug mode and there was a command injection vulnerability in the <q>docker build</q> command.


cve_id: CVE-2019-13164 qemu
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service, the execution of arbitrary code or bypass of ACLs.


cve_id: CVE-2019-13272 linux
date: 0001-01-01 00:00:00+00:00
more_info:
Jann Horn discovered that the ptrace subsystem in the Linux kernel mishandles the management of the credentials of a process that wants to create a ptrace relationship, allowing a local user to obtain root privileges under certain scenarios.


cve_id: CVE-2019-13290 mupdf
date: 0001-01-01 00:00:00+00:00
more_info:
A heap-based buffer overflow flaw was discovered in MuPDF, a lightweight PDF viewer, which may result in denial of service or the execution of arbitrary code if a malformed PDF file is opened.


cve_id: CVE-2019-13377 wpa
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities were found in the WPA protocol implementation found in wpa_supplication (station) and hostapd (access point).


cve_id: CVE-2019-1348 git
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in git, a fast, scalable, distributed revision control system.


cve_id: CVE-2019-13574 ruby-mini-magick
date: 0001-01-01 00:00:00+00:00
more_info:
Harsh Jaiswal discovered a remote shell execution vulnerability in ruby-mini-magick, a Ruby library providing a wrapper around ImageMagick or GraphicsMagick, exploitable when using MiniMagick::Image.open with specially crafted URLs coming from unsanitized user input.


cve_id: CVE-2019-13602 vlc
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in the VLC media player, which could result in the execution of arbitrary code or denial of service if a malformed file/stream is processed.


cve_id: CVE-2019-13636 patch
date: 0001-01-01 00:00:00+00:00
more_info:
Imre Rad discovered several vulnerabilities in GNU patch, leading to shell command injection or escape from the working directory and access and overwrite files, if specially crafted patch files are processed.


cve_id: CVE-2019-13640 qbittorrent
date: 0001-01-01 00:00:00+00:00
more_info:
Miguel Onoro reported that qbittorrent, a bittorrent client with a Qt5 GUI user interface, allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, which could result in remote command execution via a crafted name within an RSS feed if qbittorrent is configured to run an external program on torrent completion.


cve_id: CVE-2019-13917 exim4
date: 0001-01-01 00:00:00+00:00
more_info:
Jeremy Harris discovered that Exim, a mail transport agent, does not properly handle the ${sort } expansion. This flaw can be exploited by a remote attacker to execute programs with root privileges in non-default (and unusual) configurations where ${sort } expansion is used for items that can be controlled by an attacker.


cve_id: CVE-2019-14232 python-django
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in python-django, a web development framework. They could lead to remote denial-of-service or SQL injection,


cve_id: CVE-2019-14287 sudo
date: 0001-01-01 00:00:00+00:00
more_info:
Joe Vennix discovered that sudo, a program designed to provide limited super user privileges to specific users, when configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, allows to run commands as root by specifying the user ID -1 or 4294967295. This could allow a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access.


cve_id: CVE-2019-14380 libopenmpt
date: 0001-01-01 00:00:00+00:00
more_info:
Two security issues were found in libopenmpt, a cross-platform C++ and C library to decode tracked music files, which could result in denial of service and potentially the execution of arbitrary code if malformed music files are processed.


cve_id: CVE-2019-14744 kconfig
date: 0001-01-01 00:00:00+00:00
more_info:
Dominik Penner discovered that KConfig, the KDE configuration settings framework, supported a feature to define shell command execution in .desktop files. If a user is provided with a malformed .desktop file (e.g. if it's embedded into a downloaded archive and it gets opened in a file browser) arbitrary commands could get executed. This update removes this feature.


cve_id: CVE-2019-14809 golang-1.11
date: 0001-01-01 00:00:00+00:00
more_info:
Three vulnerabilities have been discovered in the Go programming language; "net/url" accepted some invalid hosts in URLs which could result in authorisation bypass in some applications and the HTTP/2 implementation was susceptible to denial of service.


cve_id: CVE-2019-14811 ghostscript
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that various procedures in Ghostscript, the GPL PostScript/PDF interpreter, do not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox.


cve_id: CVE-2019-14818 dpdk
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that the vhost PMD in DPDK, a set of libraries for fast packet processing, was affected by memory and file descriptor leaks which could result in denial of service.


cve_id: CVE-2019-14822 ibus
date: 0001-01-01 00:00:00+00:00
more_info:
Simon McVittie reported a flaw in ibus, the Intelligent Input Bus. Due to a misconfiguration during the setup of the DBus, any unprivileged user could monitor and send method calls to the ibus bus of another user, if able to discover the UNIX socket used by another user connected on a graphical environment. The attacker can take advantage of this flaw to intercept keystrokes of the victim user or modify input related configurations through DBus method calls.


cve_id: CVE-2019-14853 python-ecdsa
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that python-ecdsa, a cryptographic signature library for Python, incorrectly handled certain signatures. A remote attacker could use this issue to cause python-ecdsa to either not warn about incorrect signatures, or generate exceptions resulting in a denial-of-service.


cve_id: CVE-2019-14869 ghostscript
date: 0001-01-01 00:00:00+00:00
more_info:
Manfred Paul and Lukas Schauer reported that the .charkeys procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox.


cve_id: CVE-2019-15142 djvulibre
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in djvulibre, a library and set of tools to handle documents in the DjVu format. An attacker could crash document viewers and possibly execute arbitrary code through crafted DjVu files.


cve_id: CVE-2019-1547 openssl
date: 0001-01-01 00:00:00+00:00
more_info:
Three security issues were discovered in OpenSSL: A timing attack against ECDSA, a padding oracle in PKCS7_dataDecode() and CMS_decrypt_set1_pkey() and it was discovered that a feature of the random number generator (RNG) intended to protect against shared RNG state between parent and child processes in the event of a fork() syscall was not used by default.


cve_id: CVE-2019-1551 openssl
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. An overflow bug in the x64_64 Montgomery squaring procedure, an integer overflow in CipherUpdate and a NULL pointer dereference flaw X509_issuer_and_serial_hash() were found, which could result in denial of service.


cve_id: CVE-2019-15587 ruby-loofah
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that ruby-loofah, a general library for manipulating and transforming HTML/XML documents and fragments, was susceptible to cross-site scripting.


cve_id: CVE-2019-15604 nodejs
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in Node.js, which could result in denial of service or HTTP request smuggling.


cve_id: CVE-2019-15795 python-apt
date: 0001-01-01 00:00:00+00:00
more_info:
Two security issues were found in the Python interface to the apt package manager; package downloads from unsigned repositories were incorrectly rejected and the hash validation relied on MD5.


cve_id: CVE-2019-15845 ruby2.5
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the interpreter for the Ruby language, which could result in unauthorized access by bypassing intended path matchings, denial of service, or the execution of arbitrary code.


cve_id: CVE-2019-15846 exim4
date: 0001-01-01 00:00:00+00:00
more_info:
"Zerons" and Qualys discovered that a buffer overflow triggerable in the TLS negotiation code of the Exim mail transport agent could result in the execution of arbitrary code with root privileges.


cve_id: CVE-2019-15890 qemu
date: 0001-01-01 00:00:00+00:00
more_info:
Two security issues have been found in the SLiRP networking implementation of QEMU, a fast processor emulator, which could result in the execution of arbitrary code or denial of service.


cve_id: CVE-2019-15892 varnish
date: 0001-01-01 00:00:00+00:00
more_info:
Alf-Andre Walla discovered a remotely triggerable assert in the Varnish web accelerator; sending a malformed HTTP request could result in denial of service.


cve_id: CVE-2019-15903 expat
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that Expat, an XML parsing C library, did not properly handled internal entities closing the doctype, potentially resulting in denial of service or information disclosure if a malformed XML file is processed.


cve_id: CVE-2019-15941 lemonldap-ng
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that the Lemonldap::NG web SSO system did not restrict OIDC authorization codes to the relying party.


cve_id: CVE-2019-16159 bird
date: 0001-01-01 00:00:00+00:00
more_info:
Daniel McCarney discovered that the BIRD internet routing daemon incorrectly validated RFC 8203 messages in it's BGP daemon, resulting in a stack buffer overflow.


cve_id: CVE-2019-16235 dino-im
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the Dino XMPP client, which could allow spoofing message, manipulation of a user's roster (contact list) and unauthorised sending of message carbons.


cve_id: CVE-2019-16239 openconnect
date: 0001-01-01 00:00:00+00:00
more_info:
Lukas Kupczyk reported a vulnerability in the handling of chunked HTTP in openconnect, an open client for Cisco AnyConnect, Pulse and GlobalProtect VPN. A malicious HTTP server (after having accepted its identity certificate), can provide bogus chunk lengths for chunked HTTP encoding and cause a heap-based buffer overflow.


cve_id: CVE-2019-16276 golang-1.11
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that the Go programming language did accept and normalize invalid HTTP/1.1 headers with a space before the colon, which could lead to filter bypasses or request smuggling in some setups.


cve_id: CVE-2019-16378 opendmarc
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that OpenDMARC, a milter implementation of DMARC, is prone to a signature-bypass vulnerability with multiple From: addresses.


cve_id: CVE-2019-16391 spip
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that SPIP, a website engine for publishing, would allow unauthenticated users to modify published content and write to the database, perform cross-site request forgeries, and enumerate registered users.


cve_id: CVE-2019-16723 cacti
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple issues have been found in cacti, a server monitoring system, potentially resulting in SQL code execution or information disclosure by authenticated users.


cve_id: CVE-2019-16729 pam-python
date: 0001-01-01 00:00:00+00:00
more_info:
Malte Kraus discovered that libpam-python, a PAM module allowing PAM modules to be written in Python, didn't sanitise environment variables which could result in local privilege escalation if used with a setuid binary.


cve_id: CVE-2019-16738 mediawiki
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that the Special:Redirect functionality of MediaWiki, a website engine for collaborative work, could expose suppressed user names, resulting in an information leak.


cve_id: CVE-2019-16865 pillow
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in Pillow, a Python imaging library, which could result in denial of service and potentially the execution of arbitrary code if malformed PCX, FLI, SGI or TIFF images are processed.


cve_id: CVE-2019-16866 unbound
date: 0001-01-01 00:00:00+00:00
more_info:
X41 D-Sec discovered that unbound, a validating, recursive, and caching DNS resolver, did not correctly process some NOTIFY queries. This could lead to remote denial-of-service by application crash.


cve_id: CVE-2019-16869 netty
date: 0001-01-01 00:00:00+00:00
more_info:
It was reported that Netty, a Java NIO client/server framework, is prone to a HTTP request smuggling vulnerability due to mishandling whitespace before the colon in HTTP headers.


cve_id: CVE-2019-16928 exim4
date: 0001-01-01 00:00:00+00:00
more_info:
A buffer overflow flaw was discovered in Exim, a mail transport agent. A remote attacker can take advantage of this flaw to cause a denial of service, or potentially the execution of arbitrary code.


cve_id: CVE-2019-17005 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code.


cve_id: CVE-2019-17005 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code.


cve_id: CVE-2019-17006 nss
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in NSS, a set of cryptographic libraries, which may result in side channel/timing attacks or denial of service.


cve_id: CVE-2019-17016 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, data exfiltration or cross-site scripting.


cve_id: CVE-2019-17016 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or information disclosure.


cve_id: CVE-2019-17361 salt
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in salt, a powerful remote execution manager, which could result in retrieve of user tokens from the salt master, execution of arbitrary commands on salt minions, arbitrary directory access to authenticated users or arbitrary code execution on salt-api hosts.


cve_id: CVE-2019-17544 aspell
date: 0001-01-01 00:00:00+00:00
more_info:
A buffer overflow was discovered in the Aspell spell checker, which could result in the execution of arbitrary code.


cve_id: CVE-2019-17559 trafficserver
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server, which could result in denial of service or request smuggling attacks.


cve_id: CVE-2019-17570 libxmlrpc3-java
date: 0001-01-01 00:00:00+00:00
more_info:
Guillaume Teissier reported that the XMLRPC client in libxmlrpc3-java, an XML-RPC implementation in Java, does perform deserialization of the server-side exception serialized in the faultCause attribute of XMLRPC error response messages. A malicious XMLRPC server can take advantage of this flaw to execute arbitrary code with the privileges of an application using the Apache XMLRPC client library.


cve_id: CVE-2019-17571 apache-log4j1.2
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that the SocketServer class included in apache-log4j1.2, a logging library for java, is vulnerable to deserialization of untrusted data. An attacker can take advantage of this flaw to execute arbitrary code in the context of the logger application by sending a specially crafted log event.


cve_id: CVE-2019-17596 golang-1.11
date: 0001-01-01 00:00:00+00:00
more_info:
Daniel Mandragona discovered that invalid DSA public keys can cause a panic in dsa.Verify(), resulting in denial of service.


cve_id: CVE-2019-17626 python-reportlab
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that python-reportlab, a Python library to create PDF documents, is prone to a code injection vulnerability while parsing a color attribute. An attacker can take advantage of this flaw to execute arbitrary code if a specially crafted document is processed.


cve_id: CVE-2019-18217 proftpd-dfsg
date: 0001-01-01 00:00:00+00:00
more_info:
Stephan Zeisberg discovered that missing input validation in ProFTPD, a FTP/SFTP/FTPS server, could result in denial of service via an infinite loop.


cve_id: CVE-2019-18218 file
date: 0001-01-01 00:00:00+00:00
more_info:
A buffer overflow was found in file, a file type classification tool, which may result in denial of service or potentially the execution of arbitrary code if a malformed CDF (Composite Document File) file is processed.


cve_id: CVE-2019-18224 libidn2
date: 0001-01-01 00:00:00+00:00
more_info:
A heap-based buffer overflow vulnerability was discovered in the idn2_to_ascii_4i() function in libidn2, the GNU library for Internationalized Domain Names (IDNs), which could result in denial of service, or the execution of arbitrary code when processing a long domain string.


cve_id: CVE-2019-18281 qtbase-opensource-src
date: 0001-01-01 00:00:00+00:00
more_info:
An out-of-bounds memory access was discovered in the Qt library, which could result in denial of service through a text file containing many directional characters.


cve_id: CVE-2019-18345 davical
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple cross-site scripting and cross-site request forgery issues were discovered in the DAViCal CalDAV Server.


cve_id: CVE-2019-18397 fribidi
date: 0001-01-01 00:00:00+00:00
more_info:
Alex Murray discovered a stack-based buffer overflow vulnerability in fribidi, an implementation of the Unicode Bidirectional Algorithm algorithm, which could result in denial of service or potentially the execution of arbitrary code, when processing a large number of unicode isolate directional characters.


cve_id: CVE-2019-18408 libarchive
date: 0001-01-01 00:00:00+00:00
more_info:
A use-after-free was found in libarchive, a multi-format archive and compression library, which could result in denial of service and potentially the execution of arbitrary code is a malformed archive is processed.


cve_id: CVE-2019-18823 condor
date: 0001-01-01 00:00:00+00:00
more_info:
Several flaws have been discovered in HTCondor, a distributed workload management system, which allow users with only READ access to any daemon to use a different authentication method than the administrator has specified. If the administrator has configured the READ or WRITE methods to include CLAIMTOBE, then it is possible to impersonate another user and submit or remove jobs.


cve_id: CVE-2019-18860 squid
date: 0001-01-01 00:00:00+00:00
more_info:
Two security issues were discovered in the Squid proxy caching server, which could result in cache poisoning, request smuggling and incomplete validation of hostnames in cachemgr.cgi.


cve_id: CVE-2019-18887 symfony
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to a timing attack/information leak, argument injection and code execution via unserialization.


cve_id: CVE-2019-18978 ruby-rack-cors
date: 0001-01-01 00:00:00+00:00
more_info:
Improper pathname handling in ruby-rack-cors, a middleware that makes Rack-based apps CORS compatible, may result in access to private resources.


cve_id: CVE-2019-19330 haproxy
date: 0001-01-01 00:00:00+00:00
more_info:
Tim DĂźsterhus discovered that haproxy, a TCP/HTTP reverse proxy, did not properly sanitize HTTP headers when converting from HTTP/2 to HTTP/1. This would allow a remote user to perform CRLF injections.


cve_id: CVE-2019-19709 mediawiki
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that the Title blacklist functionality in MediaWiki, a website engine for collaborative work, could by bypassed.


cve_id: CVE-2019-19728 slurm-llnl
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in the Simple Linux Utility for Resource Management (SLURM), a cluster resource management and job scheduling system, which could result in denial of service, information disclosure or privilege escalation.


cve_id: CVE-2019-19783 cyrus-imapd
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that the lmtpd component of the Cyrus IMAP server created mailboxes with administrator privileges if the <q>fileinto</q> was used, bypassing ACL checks.


cve_id: CVE-2019-19830 spip
date: 0001-01-01 00:00:00+00:00
more_info:
A vulnerability was discovered in the SPIP publishing system, which could result in unauthorised writes to the database by authors.


cve_id: CVE-2019-19844 python-django
date: 0001-01-01 00:00:00+00:00
more_info:
Simon Charette reported that the password reset functionality in Django, a high-level Python web development framework, uses a Unicode case-insensitive query to retrieve accounts matching the email address requesting the password reset. An attacker can take advantage of this flaw to potentially retrieve password reset tokens and hijack accounts.


cve_id: CVE-2019-19906 cyrus-sasl2
date: 0001-01-01 00:00:00+00:00
more_info:
Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for applications using the library.


cve_id: CVE-2019-20373 ldm
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that a hook script of ldm, the display manager for the Linux Terminal Server Project, incorrectly parsed responses from an SSH server, which could result in local root privilege escalation.


cve_id: CVE-2019-20421 exiv2
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in Exiv2, a C++ library and a command line utility to manage image metadata which could result in denial of service or the execution of arbitrary code if a malformed file is parsed.


cve_id: CVE-2019-20444 netty
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in Netty, a Java NIO client/server framework, which could result in HTTP request smuggling, denial of service or information disclosure.


cve_id: CVE-2019-20917 inspircd
date: 0001-01-01 00:00:00+00:00
more_info:
Two security issues were discovered in the pgsql and mysql modules of the InspIRCd IRC daemon, which could result in denial of service.


cve_id: CVE-2019-20933 influxdb
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that incorrect validation of JWT tokens in InfluxDB, a time series, metrics, and analytics database, could result in authentication bypass.


cve_id: CVE-2019-2745 openjdk-11
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the OpenJDK Java runtime, resulting in information disclosure, denial of service or bypass of sandbox restrictions. In addition the implementation of elliptic curve cryptography was modernised.


cve_id: CVE-2019-3465 simplesamlphp
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that in SimpleSAMLphp, an implementation of the SAML 2.0 protocol, it was possible to circumvent XML signature verification on SAML messages.


cve_id: CVE-2019-3467 debian-edu-config
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that debian-edu-config, a set of configuration files used for the Debian Edu blend, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other user principals.


cve_id: CVE-2019-3467 debian-lan-config
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that debian-lan-config, a FAI config space for the Debian-LAN system, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other user principals.


cve_id: CVE-2019-5094 e2fsprogs
date: 0001-01-01 00:00:00+00:00
more_info:
Lilith of Cisco Talos discovered a buffer overflow flaw in the quota code used by e2fsck from the ext2/ext3/ext4 file system utilities. Running e2fsck on a malformed file system can result in the execution of arbitrary code.


cve_id: CVE-2019-9232 libvpx
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were found in libvpx multimedia library which could result in denial of service and potentially the execution of arbitrary code if malformed WebM files are processed.


cve_id: CVE-2019-9278 libexif
date: 0001-01-01 00:00:00+00:00
more_info:
An out-of-bounds write vulnerability due to an integer overflow was reported in libexif, a library to parse EXIF files, which could result in denial of service, or potentially the execution of arbitrary code if specially crafted image files are processed.


cve_id: CVE-2019-9511 nghttp2
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in the HTTP/2 code of the nghttp2 HTTP server, which could result in denial of service.


cve_id: CVE-2019-9511 nginx
date: 0001-01-01 00:00:00+00:00
more_info:
Three vulnerabilities were discovered in the HTTP/2 code of Nginx, a high-performance web and reverse proxy server, which could result in denial of service.


cve_id: CVE-2019-9512 h2o
date: 0001-01-01 00:00:00+00:00
more_info:
Three vulnerabilities were discovered in the HTTP/2 code of the H2O HTTP server, which could result in denial of service.


cve_id: CVE-2019-9512 trafficserver
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in the HTTP/2 code of Apache Traffic Server, a reverse and forward proxy server, which could result in denial of service.


cve_id: CVE-2019-9787 wordpress
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation.


cve_id: CVE-2019-9850 libreoffice
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that the code fixes to address  <a href="https://security-tracker.debian.org/tracker/CVE-2018-16858">\ CVE-2018-16858</a> and <a href="https://security-tracker.debian.org/tracker/CVE-2019-9848">\ CVE-2019-9848</a> were not complete.


cve_id: CVE-2019-9854 libreoffice
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that the code fixes for LibreOffice to address <a href="https://security-tracker.debian.org/tracker/CVE-2019-9852">\ CVE-2019-9852</a> were not complete. Additional information can be found at <url "https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9854/">.


cve_id: CVE-2020-0452 libexif
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that a boundary check in libexif, a library to parse EXIF files, could be optimised away by the compiler, resulting in a potential buffer overflow.


cve_id: CVE-2020-0543 intel-microcode
date: 0001-01-01 00:00:00+00:00
more_info:
This update ships updated CPU microcode for some types of Intel CPUs and provides mitigations for the Special Register Buffer Data Sampling (<a href="https://security-tracker.debian.org/tracker/CVE-2020-0543">CVE-2020-0543</a>), Vector Register Sampling (<a href="https://security-tracker.debian.org/tracker/CVE-2020-0548">CVE-2020-0548</a>) and L1D Eviction Sampling (<a href="https://security-tracker.debian.org/tracker/CVE-2020-0549">CVE-2020-0549</a>) hardware vulnerabilities.


cve_id: CVE-2020-0556 bluez
date: 0001-01-01 00:00:00+00:00
more_info:
It was reported that the BlueZ's HID and HOGP profile implementations don't specifically require bonding between the device and the host. Malicious devices can take advantage of this flaw to connect to a target host and impersonate an existing HID device without security or to cause an SDP or GATT service discovery to take place which would allow HID reports to be injected to the input subsystem from a non-bonded source.


cve_id: CVE-2020-0569 qtbase-opensource-src
date: 0001-01-01 00:00:00+00:00
more_info:
Two security issues were found in the Qt library, which could result in plugins and libraries being loaded from the current working directory, resulting in potential code execution.


cve_id: CVE-2020-10531 icu
date: 0001-01-01 00:00:00+00:00
more_info:
Andre Bargull discovered an integer overflow in the International Components for Unicode (ICU) library which could result in denial of service and potentially the execution of arbitrary code.


cve_id: CVE-2020-10592 tor
date: 0001-01-01 00:00:00+00:00
more_info:
A denial of service vulnerability (by triggering high CPU consumption) was found in Tor, a connection-based low-latency anonymous communication system.


cve_id: CVE-2020-10595 libpam-krb5
date: 0001-01-01 00:00:00+00:00
more_info:
Russ Allbery discovered a buffer overflow in the PAM module for MIT Kerberos, which could result in denial of service or potentially the execution of arbitrary code.


cve_id: CVE-2020-10722 dpdk
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the vhost code of DPDK, a set of libraries for fast packet processing, which could result in denial of service or the execution of arbitrary code by malicious guests/containers.


cve_id: CVE-2020-10730 ldb
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in ldb, a LDAP-like embedded database built on top of TDB.


cve_id: CVE-2020-10756 qemu
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service.


cve_id: CVE-2020-10936 sympa
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Sympa, a mailing list manager, which could result in local privilege escalation, denial of service or unauthorized access via the SOAP API.


cve_id: CVE-2020-10957 dovecot
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in the Dovecot email server, which could cause crashes in the submission, submission-login or lmtp services, resulting in denial of service.


cve_id: CVE-2020-10960 mediawiki
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that some user-generated CSS selectors in MediaWiki, a website engine for collaborative work, were not escaped.


cve_id: CVE-2020-10995 pdns-recursor
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities have been discovered in PDNS Recursor, a resolving name server; a traffic amplification attack against third party authoritative name servers (NXNSAttack) and insufficient validation of NXDOMAIN responses lacking an SOA.


cve_id: CVE-2020-11008 git
date: 0001-01-01 00:00:00+00:00
more_info:
Carlo Arenas discovered a flaw in git, a fast, scalable, distributed revision control system. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted.


cve_id: CVE-2020-11080 nodejs
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in Node.js, which could result in denial of service and potentially the execution of arbitrary code.


cve_id: CVE-2020-11082 ruby-kaminari
date: 0001-01-01 00:00:00+00:00
more_info:
A security vulnerability has been found in Kaminari, a pagination engine plugin for Rails 3+ and other modern frameworks, that would allow an attacker to inject arbitrary code into pages with pagination links.


cve_id: CVE-2020-11100 haproxy
date: 0001-01-01 00:00:00+00:00
more_info:
Felix Wilhelm of Google Project Zero discovered that HAProxy, a TCP/HTTP reverse proxy, did not properly handle HTTP/2 headers. This would allow an attacker to write arbitrary bytes around a certain location on the heap, resulting in denial-of-service or potential arbitrary code execution.


cve_id: CVE-2020-11501 gnutls28
date: 0001-01-01 00:00:00+00:00
more_info:
A flaw was reported in the DTLS protocol implementation in GnuTLS, a library implementing the TLS and SSL protocols. The DTLS client would not contribute any randomness to the DTLS negotiation, breaking the security guarantees of the DTLS protocol.


cve_id: CVE-2020-11724 nginx
date: 0001-01-01 00:00:00+00:00
more_info:
It was reported that the Lua module for Nginx, a high-performance web and reverse proxy server, is prone to a HTTP request smuggling vulnerability.


cve_id: CVE-2020-11728 awl
date: 0001-01-01 00:00:00+00:00
more_info:
Andrew Bartlett discovered that awl, DAViCal Andrew's Web Libraries, did not properly handle session management: this would allow a malicious user to impersonate other sessions or users.


cve_id: CVE-2020-11996 tomcat9
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in the Tomcat servlet and JSP engine, which could result in code execution or denial of service.


cve_id: CVE-2020-12066 teeworlds
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that insufficient sanitising of received network packets in the game server of Teeworlds, an online multi-player platform 2D shooter, could result in denial of service.


cve_id: CVE-2020-12108 mailman
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in mailman, a web-based mailing list manager, which could result in arbitrary content injection via the options and private archive login pages, and CSRF attacks or privilege escalation via the user options page.


cve_id: CVE-2020-12137 mailman
date: 0001-01-01 00:00:00+00:00
more_info:
Hanno Boeck discovered that it was possible to create a cross site scripting attack on the webarchives of the Mailman mailing list manager, by sending a special type of attachement.


cve_id: CVE-2020-12243 openldap
date: 0001-01-01 00:00:00+00:00
more_info:
A vulnerability was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. LDAP search filters with nested boolean expressions can result in denial of service (slapd daemon crash).


cve_id: CVE-2020-12351 linux
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the Linux kernel that may lead to the execution of arbitrary code, privilege escalation, denial of service or information leaks.


cve_id: CVE-2020-12387 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or information disclosure.


cve_id: CVE-2020-12387 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could result in spoofing the displayed sender email address, denial of service or potentially the execution of arbitrary code.


cve_id: CVE-2020-12398 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could result in the setup of a non-encrypted IMAP connection, denial of service or potentially the execution of arbitrary code.


cve_id: CVE-2020-12399 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or a timing attack on cryptographic keys.


cve_id: CVE-2020-12417 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could result in denial of service or potentially the execution of arbitrary code.


cve_id: CVE-2020-12625 roundcube
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not correctly process and sanitize requests. This would allow a remote attacker to perform either a Cross-Site Request Forgery (CSRF) forcing an authenticated user to be logged out, or a Cross-Side Scripting (XSS) leading to execution of arbitrary code.


cve_id: CVE-2020-12662 unbound
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabiliites have been discovered in Unbound, a recursive-only caching DNS server; a traffic amplification attack against third party authoritative name servers (NXNSAttack) and insufficient sanitisation of replies from upstream servers could result in denial of service via an infinite loop.


cve_id: CVE-2020-12695 minidlna
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that missing input validation in minidlna, a lightweight DLNA/UPnP-AV server could result in the execution of arbitrary code. In addition minidlna was susceptible to the <q>CallStranger</q> UPnP vulnerability.


cve_id: CVE-2020-12762 json-c
date: 0001-01-01 00:00:00+00:00
more_info:
Tobias Stoeckmann discovered an integer overflow in the json-c JSON library, which could result in denial of service or potentially the execution of arbitrary code if large malformed JSON files are processed.


cve_id: CVE-2020-12783 exim4
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that exim4, a mail transport agent, suffers from a authentication bypass vulnerability in the spa authentication driver. The spa authentication driver is not enabled by default.


cve_id: CVE-2020-13254 python-django
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that Django, a high-level Python web development framework, did not properly sanitize input. This would allow a remote attacker to perform SQL injection attacks, Cross-Site Scripting (XSS) attacks, or leak sensitive information.


cve_id: CVE-2020-13401 docker.io
date: 0001-01-01 00:00:00+00:00
more_info:
Etienne Champetier discovered that Docker, a Linux container runtime, created network bridges which by default accept IPv6 router advertisements. This could allow an attacker with the CAP_NET_RAW capability in a container to spoof router advertisements, resulting in information disclosure or denial of service.


cve_id: CVE-2020-13428 vlc
date: 0001-01-01 00:00:00+00:00
more_info:
A vulnerability was discovered in the VLC media player, which could result in the execution of arbitrary code or denial of service if a malformed video file is opened.


cve_id: CVE-2020-13777 gnutls28
date: 0001-01-01 00:00:00+00:00
more_info:
A flaw was reported in the TLS session ticket key construction in GnuTLS, a library implementing the TLS and SSL protocols. The flaw caused the TLS server to not securely construct a session ticket encryption key considering the application supplied secret, allowing a man-in-the-middle attacker to bypass authentication in TLS 1.3 and recover previous conversations in TLS 1.2.


cve_id: CVE-2020-13943 tomcat9
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in the Tomcat servlet and JSP engine, which could result in information disclosure.


cve_id: CVE-2020-13956 httpcomponents-client
date: 0001-01-01 00:00:00+00:00
more_info:
Priyank Nigam discovered that HttpComponents Client, a Java HTTP agent implementation, could misinterpret malformed authority component in a request URI and pick the wrong target host for request execution.


cve_id: CVE-2020-13964 roundcube
date: 0001-01-01 00:00:00+00:00
more_info:
Matei Badanoiu and LoRexxar@knownsec discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not correctly process and sanitize requests. This would allow a remote attacker to perform a Cross-Side Scripting (XSS) attack leading to the execution of arbitrary code.


cve_id: CVE-2020-14001 ruby-kramdown
date: 0001-01-01 00:00:00+00:00
more_info:
A flaw was discovered in ruby-kramdown, a fast, pure ruby, Markdown parser and converter, which could result in unintended read access to files or unintended embedded Ruby code execution when the &#123;::options /&#125; extension is used together with the <q>template</q> option.


cve_id: CVE-2020-14093 mutt
date: 0001-01-01 00:00:00+00:00
more_info:
Damian Poddebniak and Fabian Ising discovered two security issues in the STARTTLS handling of the Mutt mail client, which could enable MITM attacks.


cve_id: CVE-2020-14147 redis
date: 0001-01-01 00:00:00+00:00
more_info:
An integer overflow flaw leading to a stack-based buffer overflow was discovered in redis, a persistent key-value database. A remote attacker can use this flaw to cause a denial of service (application crash).


cve_id: CVE-2020-14345 xorg-server
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the X.Org X server. Missing input sanitising in X server extensions may result in local privilege escalation if the X server is configured to run with root privileges. In addition an ASLR bypass was fixed.


cve_id: CVE-2020-14355 spice
date: 0001-01-01 00:00:00+00:00
more_info:
Frediano Ziglio discovered multiple buffer overflow vulnerabilities in the QUIC image decoding process of spice, a SPICE protocol client and server library, which could result in denial of service, or possibly, execution of arbitrary code.


cve_id: CVE-2020-14360 xorg-server
date: 0001-01-01 00:00:00+00:00
more_info:
Jan-Niklas Sohn discovered that the XKB extension of the Xorg X server performed incomplete input validation, which could result in privilege escalation.


cve_id: CVE-2020-14556 openjdk-11
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the OpenJDK Java runtime, resulting in denial of service, bypass of access/sandbox restrictions or information disclosure.


cve_id: CVE-2020-14779 openjdk-11
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which could result in denial of service, information disclosure, bypass of access/sandbox restrictions or the acceptance of untrusted certificates.


cve_id: CVE-2020-14928 evolution-data-server
date: 0001-01-01 00:00:00+00:00
more_info:
Damian Poddebniak and Fabian Ising discovered a response injection vulnerability in Evolution data server, which could enable MITM attacks.


cve_id: CVE-2020-15005 mediawiki
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in MediaWiki, a website engine for collaborative work: SpecialUserRights could leak whether a user existed or not, multiple code paths lacked HTML sanitisation allowing for cross-site scripting and TOTP validation applied insufficient rate limiting against brute force attempts.


cve_id: CVE-2020-15157 docker.io
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in Docker, a Linux container runtime, which could result in denial of service, an information leak or privilege escalation.


cve_id: CVE-2020-15166 zeromq3
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that ZeroMQ, a lightweight messaging kernel library does not properly handle connecting peers before a handshake is completed. A remote, unauthenticated client connecting to an application using the libzmq library, running with a socket listening with CURVE encryption/authentication enabled can take advantage of this flaw to cause a denial of service affecting authenticated and encrypted clients.


cve_id: CVE-2020-15169 rails
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in the Rails web framework which could result in cross-site scripting, information leaks, code execution, cross-site request forgery or bypass of upload limits.


cve_id: CVE-2020-15238 blueman
date: 0001-01-01 00:00:00+00:00
more_info:
Vaisha Bernard discovered that Blueman, a graphical bluetooth manager performed insufficient validation on a D-Bus interface, which could result in denial of service or privilege escalation.


cve_id: CVE-2020-15389 openjpeg2
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in openjpeg2, the open-source JPEG 2000 codec, which could result in denial of service or the execution of arbitrary code when opening a malformed image.


cve_id: CVE-2020-15562 roundcube
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not properly sanitize incoming mail messages. This would allow a remote attacker to perform a Cross-Side Scripting (XSS) attack.


cve_id: CVE-2020-15586 golang-1.11
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in the implementation of the Go programming language, which could result in denial of service and the P-224 curve implementation could generate incorrect outputs.


cve_id: CVE-2020-15598 modsecurity
date: 0001-01-01 00:00:00+00:00
more_info:
Ervin Hegedues discovered that ModSecurity v3 enabled global regular expression matching which could result in denial of service. For additional information please refer to <a href="https://coreruleset.org/20200914/cve-2020-15598/">\ https://coreruleset.org/20200914/cve-2020-15598/</a>


cve_id: CVE-2020-15652 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or an information leak.


cve_id: CVE-2020-15664 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or unintended or malicious extensions being installed.


cve_id: CVE-2020-15664 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird which could result in the execution of arbitrary code or the unintended installation of extensions.


cve_id: CVE-2020-15673 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting or spoofing the origin of a download.


cve_id: CVE-2020-15685 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service or an information leak.


cve_id: CVE-2020-15810 squid
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Squid, a fully featured web proxy cache, which could result in request splitting, request smuggling (leading to cache poisoning) and denial of service when processing crafted cache digest responses messages.


cve_id: CVE-2020-15861 net-snmp
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in net-snmp, a suite of Simple Network Management Protocol applications, which could lead to privilege escalation.


cve_id: CVE-2020-15959 chromium
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in the Chromium web browser, which could result in the execution of arbitrary code, denial of service or information disclosure.


cve_id: CVE-2020-15995 chromium
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in the Chromium web browser, which could result in the execution of arbitrary code, denial of service or information disclosure.


cve_id: CVE-2020-15999 freetype
date: 0001-01-01 00:00:00+00:00
more_info:
Sergei Glazunov discovered a heap-based buffer overflow vulnerability in the handling of embedded PNG bitmaps in FreeType. Opening malformed fonts may result in denial of service or the execution of arbitrary code.


cve_id: CVE-2020-16012 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure, phishing, cross-site scripting or a DNS rebinding attack.


cve_id: CVE-2020-16042 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or CSS sanitiser bypass.


cve_id: CVE-2020-16042 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service or information leak.


cve_id: CVE-2020-16044 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
A security issue was found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code.


cve_id: CVE-2020-16116 ark
date: 0001-01-01 00:00:00+00:00
more_info:
Dominik Penner discovered that the Ark archive manager did not sanitise extraction paths, which could result in maliciously crafted archives writing outside the extraction directory.


cve_id: CVE-2020-16145 roundcube
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, is prone to cross-site scripting vulnerabilities in handling invalid svg and math tag content.


cve_id: CVE-2020-16287 ghostscript
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in Ghostscript, the GPL PostScript/PDF interpreter which could result in denial of service and potentially the execution of arbitrary code if malformed document files are processed.


cve_id: CVE-2020-16846 salt
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in salt, a powerful remote execution manager. The flaws could result in authentication bypass and invocation of Salt SSH, creation of certificates with weak file permissions via the TLS execution module or shell injections with the Salt API using the SSH client.


cve_id: CVE-2020-1720 postgresql-11
date: 0001-01-01 00:00:00+00:00
more_info:
Tom Lane discovered that <q>ALTER ... DEPENDS ON EXTENSION</q> sub commands in the PostgreSQL database did not perform authorisation checks.


cve_id: CVE-2020-17353 lilypond
date: 0001-01-01 00:00:00+00:00
more_info:
Faidon Liambotis discovered that Lilypond, a program for typesetting sheet music, did not restrict the inclusion of Postscript and SVG commands when operating in safe mode, which could result in the execution of arbitrary code when rendering a typesheet file with embedded Postscript code.


cve_id: CVE-2020-17367 firejail
date: 0001-01-01 00:00:00+00:00
more_info:
Tim Starling discovered two vulnerabilities in firejail, a sandbox program to restrict the running environment of untrusted applications.


cve_id: CVE-2020-17525 subversion
date: 0001-01-01 00:00:00+00:00
more_info:
Thomas Akesson discovered a remotely triggerable vulnerability in the mod_authz_svn module in Subversion, a version control system. When using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option an unauthenticated remote client can take advantage of this flaw to cause a denial of service by sending a request for a non-existing repository URL.


cve_id: CVE-2020-1763 libreswan
date: 0001-01-01 00:00:00+00:00
more_info:
Stephan Zeisberg discovered that the libreswan IPsec implementation could be forced into a crash/restart via a malformed IKEv1 Informational Exchange packet, resulting in denial of service.


cve_id: CVE-2020-18032 graphviz
date: 0001-01-01 00:00:00+00:00
more_info:
A buffer overflow was discovered in Graphviz, which could potentially result in the execution of arbitrary code when processing a malformed file.


cve_id: CVE-2020-19143 tiff
date: 0001-01-01 00:00:00+00:00
more_info:
A flaw was discovered in tiff, a Tag Image File Format library, which may result in denial of service or the execution of arbitrary code if malformed image files are processed.


cve_id: CVE-2020-1930 spamassassin
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in spamassassin, a Perl-based spam filter using text analysis. Malicious rule or configuration files, possibly downloaded from an updates server, could execute arbitrary commands under multiple scenarios.


cve_id: CVE-2020-1946 spamassassin
date: 0001-01-01 00:00:00+00:00
more_info:
Damian Lukowski discovered a flaw in spamassassin, a Perl-based spam filter using text analysis. Malicious rule configuration files, possibly downloaded from an updates server, could execute arbitrary commands under multiple scenarios.


cve_id: CVE-2020-1967 openssl
date: 0001-01-01 00:00:00+00:00
more_info:
Bernd Edlinger discovered that malformed data passed to the SSL_check_chain() function during or after a TLS 1.3 handshake could cause a NULL dereference, resulting in denial of service.


cve_id: CVE-2020-1971 openssl
date: 0001-01-01 00:00:00+00:00
more_info:
David Benjamin discovered a flaw in the GENERAL_NAME_cmp() function which could cause a NULL dereference, resulting in denial of service.


cve_id: CVE-2020-21913 icu
date: 0001-01-01 00:00:00+00:00
more_info:
Rongxin Wu discovered a use-after-free vulnerability in the International Components for Unicode (ICU) library which could result in denial of service or potentially the execution of arbitrary code.


cve_id: CVE-2020-24368 icingaweb2
date: 0001-01-01 00:00:00+00:00
more_info:
A directory traversal vulnerability was discovered in Icinga Web 2, a web interface for Icinga, which could result in the disclosure of files readable by the process.


cve_id: CVE-2020-24379 yaws
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in yaws, a high performance HTTP 1.1 webserver written in Erlang.


cve_id: CVE-2020-24489 intel-microcode
date: 0001-01-01 00:00:00+00:00
more_info:
This update ships updated CPU microcode for some types of Intel CPUs and provides mitigations for security vulnerabilities which could result in privilege escalation in combination with VT-d and various side channel attacks.


cve_id: CVE-2020-24654 ark
date: 0001-01-01 00:00:00+00:00
more_info:
Fabian Vogt reported that the Ark archive manager did not sanitise extraction paths, which could result in maliciously crafted archives with symlinks writing outside the extraction directory.


cve_id: CVE-2020-25032 python-flask-cors
date: 0001-01-01 00:00:00+00:00
more_info:
A directory traversal vulnerability was discovered in python-flask-cors, a Flask extension for handling Cross Origin Resource Sharing (CORS), allowing to access private resources.


cve_id: CVE-2020-25097 squid
date: 0001-01-01 00:00:00+00:00
more_info:
Jianjun Chen discovered that the Squid proxy caching server was susceptible to HTTP request smuggling.


cve_id: CVE-2020-25219 libproxy
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in libproxy, an automatic proxy configuration management library, which could result in denial of service, or possibly, execution of arbitrary code.


cve_id: CVE-2020-25626 djangorestframework
date: 0001-01-01 00:00:00+00:00
more_info:
Two cross-site scripting vulnerabilities were discovered in the Django Rest Framework, a toolkit to build web APIs.


cve_id: CVE-2020-25638 libhibernate3-java
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that libhibernate3-java, a powerful, high performance object/relational persistence and query service, is prone to an SQL injection vulnerability allowing an attacker to access unauthorized information or possibly conduct further attacks.


cve_id: CVE-2020-25654 pacemaker
date: 0001-01-01 00:00:00+00:00
more_info:
Ken Gaillot discovered a vulnerability in the Pacemaker cluster resource manager: If ACLs were configured for users in the <q>haclient</q> group, the ACL restrictions could be bypassed via unrestricted IPC communication, resulting in cluster-wide arbitrary code execution with root privileges.


cve_id: CVE-2020-25681 dnsmasq
date: 0001-01-01 00:00:00+00:00
more_info:
Moshe Kol and Shlomi Oberman of JSOF discovered several vulnerabilities in dnsmasq, a small caching DNS proxy and DHCP/TFTP server. They could result in denial of service, cache poisoning or the execution of arbitrary code.


cve_id: CVE-2020-25692 openldap
date: 0001-01-01 00:00:00+00:00
more_info:
A vulnerability in the handling of normalization with modrdn was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can use this flaw to cause a denial of service (slapd daemon crash) via a specially crafted packet.


cve_id: CVE-2020-25709 openldap
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities in the certificate list syntax verification and in the handling of CSN normalization were discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service (slapd daemon crash) via specially crafted packets.


cve_id: CVE-2020-25717 samba
date: 0001-01-01 00:00:00+00:00
more_info:
Andrew Bartlett discovered that Samba, a SMB/CIFS file, print, and login server for Unix, may map domain users to local users in an undesired way. This could allow a user in an AD domain to potentially become root on domain members.


cve_id: DSA-4767-1 mediawiki
date: 2020-09-25 00:00:00+00:00
more_info:
Multiple security issues were discovered in MediaWiki, a website engine for collaborative work: SpecialUserRights could leak whether a user existed or not, multiple code paths lacked HTML sanitisation allowing for cross-site scripting and TOTP validation applied insufficient rate limiting against brute force attempts.


cve_id: CVE-2020-2583 openjdk-11
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the OpenJDK Java runtime, resulting in denial of service, incorrect implementation of Kerberos GSSAPI and TGS requests or incorrect TLS handshakes.


cve_id: CVE-2020-26217 libxstream-java
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that the default blacklist of XStream, a Java library to serialise objects to XML and back again, was vulnerable to the execution of arbitrary shell commands by manipulating the processed input stream.


cve_id: CVE-2020-26258 libxstream-java
date: 0001-01-01 00:00:00+00:00
more_info:
Liaogui Zhong discovered two security issues in XStream, a Java library to serialise objects to XML and back again, which could result in the deletion of files or server-side request forgery when unmarshalling.


cve_id: CVE-2020-26262 coturn
date: 0001-01-01 00:00:00+00:00
more_info:
A flaw was discovered in coturn, a TURN and STUN server for VoIP. By default coturn does not allow peers on the loopback addresses (127.x.x.x and ::1). A remote attacker can bypass the protection via a specially crafted request using a peer address of <q>0.0.0.0</q> and trick coturn in relaying to the loopback interface. If listening on IPv6 the loopback interface can also be reached by using either [::1] or [::] as the address.


cve_id: CVE-2020-26298 ruby-redcarpet
date: 0001-01-01 00:00:00+00:00
more_info:
Johan Smits discovered that ruby-redcarpet, a markdown parser, did not properly validate its input. This would allow an attacker to mount a cross-site scripting attack.


cve_id: CVE-2020-26519 mupdf
date: 0001-01-01 00:00:00+00:00
more_info:
A heap-based buffer overflow flaw was discovered in MuPDF, a lightweight PDF viewer, which may result in denial of service or the execution of arbitrary code if malformed documents are opened.


cve_id: CVE-2020-26664 vlc
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities were discovered in the VLC media player, which could result in the execution of arbitrary code or denial of service if a malformed media file is opened.


cve_id: CVE-2020-26950 firefox-esr
date: 0001-01-01 00:00:00+00:00
more_info:
A use-after-free was found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code.


cve_id: CVE-2020-26950 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
A use-after-free was found in Thunderbird, which could potentially result in the execution of arbitrary code.


cve_id: CVE-2020-26970 thunderbird
date: 0001-01-01 00:00:00+00:00
more_info:
Chiaki Ishikawa discovered a stack overflow in SMTP server status handling which could potentially result in the execution of arbitrary code.


cve_id: CVE-2020-27350 apt
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could cause out-of-bounds reads or infinite loops, resulting in denial of service when processing malformed deb files.


cve_id: CVE-2020-27351 python-apt
date: 0001-01-01 00:00:00+00:00
more_info:
Various memory and file descriptor leaks were discovered in the Python interface to the APT package management runtime library, which could result in denial of service.


cve_id: CVE-2020-2754 openjdk-11
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been discovered in the OpenJDK Java runtime, resulting in denial of service, insecure TLS handshakes, bypass of sandbox restrictions or HTTP response splitting attacks.


cve_id: CVE-2020-27670 xen
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, privilege escalation or information leaks.


cve_id: CVE-2020-27783 lxml
date: 0001-01-01 00:00:00+00:00
more_info:
Yaniv Nizry discovered that the clean module of lxml, Python bindings for libxml2 and libxslt could be bypassed.


cve_id: CVE-2020-28007 exim4
date: 0001-01-01 00:00:00+00:00
more_info:
The Qualys Research Labs reported several vulnerabilities in Exim, a mail transport agent, which could result in local privilege escalation and remote code execution.


cve_id: CVE-2020-28032 wordpress
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files.


cve_id: CVE-2020-28049 sddm
date: 0001-01-01 00:00:00+00:00
more_info:
Fabian Vogt discovered a flaw in sddm, a modern display manager for X11. A local attacker can take advantage of a race condition when creating the Xauthority file to escalate privileges.


cve_id: CVE-2020-28196 krb5
date: 0001-01-01 00:00:00+00:00
more_info:
Demi Obeneour discovered that unbounded recursion in the ASN1 parser of libkrb5 could result in denial of service.


cve_id: CVE-2020-28243 salt
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security vulnerabilities have been discovered in Salt, a powerful remote execution manager, that allow for local privilege escalation on a minion, server side template injection attacks, insufficient checks for eauth credentials, shell and command injections or incorrect validation of SSL certificates.


cve_id: CVE-2020-28948 php-pear
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities were discovered in the PEAR Archive_Tar package for handling tar files in PHP, potentially allowing a remote attacker to execute arbitrary code or overwrite files.


cve_id: CVE-2020-28984 spip
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that SPIP, a website engine for publishing, did not correctly validate its input. This would allow authenticated users to execute arbitrary code.


cve_id: CVE-2020-29050 sphinxsearch
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that sphinxsearch, a fast standalone full-text SQL search engine, could allow arbitrary files to be read by abusing a configuration option.


cve_id: CVE-2020-29074 x11vnc
date: 0001-01-01 00:00:00+00:00
more_info:
Guenal Davalan reported a flaw in x11vnc, a VNC server to allow remote access to an existing X session. x11vnc creates shared memory segments with 0777 mode. A local attacker can take advantage of this flaw for information disclosure, denial of service or interfering with the VNC session of another user on the host.


cve_id: CVE-2020-29361 p11-kit
date: 0001-01-01 00:00:00+00:00
more_info:
David Cook reported several memory safety issues affecting the RPC protocol in p11-kit, a library providing a way to load and enumerate PKCS#11 modules.


cve_id: CVE-2020-35452 apache2
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities have been found in the Apache HTTP server, which could result in denial of service. In addition the implementation of the MergeSlashes option could result in unexpected behaviour.


cve_id: CVE-2020-35475 mediawiki
date: 0001-01-01 00:00:00+00:00
more_info:
Multiple security issues were discovered in MediaWiki, a website engine for collaborative work, which could result in cross-site scripting or the disclosure of hidden users.


cve_id: CVE-2020-35498 openvswitch
date: 0001-01-01 00:00:00+00:00
more_info:
Joakim Hindersson discovered that Open vSwitch, a software-based Ethernet virtual switch, allowed a malicious user to cause a denial-of-service by sending a specially crafted packet.


cve_id: CVE-2020-35523 tiff
date: 0001-01-01 00:00:00+00:00
more_info:
Two vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed.


cve_id: CVE-2020-35605 kitty
date: 0001-01-01 00:00:00+00:00
more_info:
Stephane Chauveau discovered that the graphics protocol implementation in Kitty, a GPU-based terminal emulator, did not sanitise a filename when returning an error message, which could result in the execution of arbitrary shell commands when displaying a file with cat.


cve_id: CVE-2020-35730 roundcube
date: 0001-01-01 00:00:00+00:00
more_info:
Alex Birnberg discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, is prone to a cross-site scripting vulnerability in handling HTML or Plain text messages with malicious content.


cve_id: CVE-2020-36193 php-pear
date: 0001-01-01 00:00:00+00:00
more_info:
It was discovered that the PEAR Archive_Tar package for handling tar files in PHP is prone to a directory traversal flaw due to inadequate checking of symbolic links.


cve_id: CVE-2020-36221 openldap
date: 0001-01-01 00:00:00+00:00
more_info:
Several vulnerabilities were discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service (slapd daemon crash, infinite loops) via specially crafted packets.


cve_id: CVE-2020-3810 apt
date: 0001-01-01 00:00:00+00:00
more_info:
Shuaibing Lu discovered that missing input validation in the ar/tar implementations of APT, the high level package manager, could result in denial of service when processing specially crafted deb files.


cve_id: CVE-2020-4044 xrdp
date: 0001-01-01 00:00:00+00:00
more_info:
Ashley Newson discovered that the XRDP sessions manager was susceptible to denial of service. A local attacker can further take advantage of this flaw to impersonate the XRDP sessions manager and capture any user credentials that are submitted to XRDP, approve or reject arbitrary login credentials or to hijack existing sessions for xorgxrdp sessions.


